Create sample for in-place fuzzing

2019-06-17 14:37:24 -07:00 · 2019-06-17 14:37:24 -07:00 · db1d739e3d
--- a/SampleFuzzingJobs/InPlaceFuzzing/InPlaceFuzzingSample.nuspec
+++ b/SampleFuzzingJobs/InPlaceFuzzing/InPlaceFuzzingSample.nuspec
@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
+    <metadata>
+        <id>InPlaceFuzzingSample</id>
+        <version>1.0.0</version>
+        <authors>Microsoft</authors>
+        <requireLicenseAcceptance>false</requireLicenseAcceptance>
+        <description>Package in place fuzzing sample and seeds</description>
+        <copyright>Microsoft 2019</copyright>
+    </metadata>
+    <files>
+        <file src="Seeds\seed1.re1" target="Seeds\seed1.re1" />
+        <file src="Seeds\seed1.re2" target="Seeds\seed1.re2" />
+        <file src="Seeds\seed1.top" target="Seeds\seed1.top" />
+        <file src="Seeds\seed2.re1" target="Seeds\seed2.re1" />
+        <file src="Seeds\seed2.re2" target="Seeds\seed2.re2" />
+        <file src="Seeds\seed2.top" target="Seeds\seed2.top" />
+        <file src="inplacefuzzing\x64\debug\inplacefuzzing.exe" target="inplacefuzzing.exe" />
+    </files>
+</package>
--- a/SampleFuzzingJobs/InPlaceFuzzing/Seeds/seed1.re1
+++ b/SampleFuzzingJobs/InPlaceFuzzing/Seeds/seed1.re1
@ -0,0 +1,3 @@
+A_CONSTANT
+Test Search String
+0
--- a/SampleFuzzingJobs/InPlaceFuzzing/Seeds/seed1.re2
+++ b/SampleFuzzingJobs/InPlaceFuzzing/Seeds/seed1.re2
@ -0,0 +1,4 @@
+zzzzzzzzzzzzzzzzz
+POLO
+1
+seed1.re1
--- a/SampleFuzzingJobs/InPlaceFuzzing/Seeds/seed1.top
+++ b/SampleFuzzingJobs/InPlaceFuzzing/Seeds/seed1.top
@ -0,0 +1,5 @@
+POLO
+POLO
+2
+seed1.re1
+seed1.re2 
--- a/SampleFuzzingJobs/InPlaceFuzzing/Seeds/seed2.re1
+++ b/SampleFuzzingJobs/InPlaceFuzzing/Seeds/seed2.re1
@ -0,0 +1,3 @@
+A_CONSTANT
+Test Search String
+0
--- a/SampleFuzzingJobs/InPlaceFuzzing/Seeds/seed2.re2
+++ b/SampleFuzzingJobs/InPlaceFuzzing/Seeds/seed2.re2
@ -0,0 +1,4 @@
+zzzzzzzzzzzzzzzzz
+ZZZZZ
+1
+seed2.re1
--- a/SampleFuzzingJobs/InPlaceFuzzing/Seeds/seed2.top
+++ b/SampleFuzzingJobs/InPlaceFuzzing/Seeds/seed2.top
@ -0,0 +1,5 @@
+DUMMY_CONSTANT
+ZZZZZ
+2
+seed2.re1
+seed2.re2 
--- a/SampleFuzzingJobs/InPlaceFuzzing/inplacefuzzing/inplacefuzzing.sln
+++ b/SampleFuzzingJobs/InPlaceFuzzing/inplacefuzzing/inplacefuzzing.sln
@ -0,0 +1,31 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.29006.145
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "inplacefuzzing", "inplacefuzzing\inplacefuzzing.vcxproj", "{4D585EDB-64E0-4E08-AF5A-A7A0F3243F95}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{4D585EDB-64E0-4E08-AF5A-A7A0F3243F95}.Debug|x64.ActiveCfg = Debug|x64
+		{4D585EDB-64E0-4E08-AF5A-A7A0F3243F95}.Debug|x64.Build.0 = Debug|x64
+		{4D585EDB-64E0-4E08-AF5A-A7A0F3243F95}.Debug|x86.ActiveCfg = Debug|Win32
+		{4D585EDB-64E0-4E08-AF5A-A7A0F3243F95}.Debug|x86.Build.0 = Debug|Win32
+		{4D585EDB-64E0-4E08-AF5A-A7A0F3243F95}.Release|x64.ActiveCfg = Release|x64
+		{4D585EDB-64E0-4E08-AF5A-A7A0F3243F95}.Release|x64.Build.0 = Release|x64
+		{4D585EDB-64E0-4E08-AF5A-A7A0F3243F95}.Release|x86.ActiveCfg = Release|Win32
+		{4D585EDB-64E0-4E08-AF5A-A7A0F3243F95}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {7A510148-D3C1-41D9-8963-019310BD5B6D}
+	EndGlobalSection
+EndGlobal
--- a/SampleFuzzingJobs/InPlaceFuzzing/inplacefuzzing/inplacefuzzing/inplacefuzzing.cpp
+++ b/SampleFuzzingJobs/InPlaceFuzzing/inplacefuzzing/inplacefuzzing/inplacefuzzing.cpp
@ -0,0 +1,147 @@
+// Copyright (c) Microsoft Corporation.
+// Sample test driver demonstrating in-place fuzzing
+// feature of Microsoft Security Risk Detection service.
+// In-place fuzzing feature allows seeds refer to other files
+// with different file extensions.
+
+#include <iostream>
+#include <stdio.h>
+#include <string.h>
+
+// File header definition
+struct Header {
+    char* constant;
+    char* searchString;
+    int numberOfReferenceFiles;
+};
+
+// File format definition
+struct FileFormat {
+    Header header;
+    char** files;
+};
+
+char* loadFile(char* filePath) {
+    if (filePath == NULL) {
+        return NULL;
+    }
+    FILE* pSeed = fopen(filePath, "rb");
+    if (pSeed == NULL) {
+        return NULL;
+    }
+
+    fseek(pSeed, 0, SEEK_END);
+    size_t size = ftell(pSeed);
+    rewind(pSeed);
+
+    char* buffer = (char*)malloc(sizeof(char) * (size + 1UL));
+    if (buffer == NULL) {
+        free(buffer);
+        return NULL;
+    }
+    memset(buffer, NULL, sizeof(char) * (size + 1UL));
+    size_t bytesRead = fread(buffer, sizeof(char), size, pSeed);
+    fclose(pSeed);
+
+    if (0 == bytesRead) {
+        free(buffer);
+        return NULL;
+    }
+    return buffer;
+}
+
+// Load file from the specified path
+// Do not check for any errors
+FileFormat parseFile(char* filePath) {
+    char* buffer = loadFile(filePath);
+    Header header = { NULL, NULL, -1 };
+
+    char* pch = strtok(buffer, "\n");
+    while (pch != NULL)
+    {
+        size_t len = strlen(pch);
+
+        if (header.constant == NULL) {
+            header.constant = _strdup(pch);
+        }
+        else if (header.searchString == NULL) {
+            header.searchString = _strdup(pch);
+        }
+        else {
+            header.numberOfReferenceFiles = atoi(pch);
+            break;
+        }
+        pch = strtok(NULL, "\n");
+    }
+
+    FileFormat fileFormat = { header, (char**)malloc(sizeof(char*) * header.numberOfReferenceFiles) };
+
+    if (header.numberOfReferenceFiles <= 0) {
+        free(fileFormat.files);
+        fileFormat.files = NULL;
+        return fileFormat;
+    }
+
+    for (int i = 0; i < header.numberOfReferenceFiles; i++) {
+        pch = strtok(NULL, "\n");
+        fileFormat.files[i] = _strdup(pch);
+    }
+    free(buffer);
+    return fileFormat;
+}
+
+int searchForStringInBuffer(char* buffer, char* searchString) {
+    if (buffer == NULL || searchString == NULL) {
+        return 0;
+    }
+
+    int occurences = 0;
+    char* found = strstr(buffer, searchString);
+    size_t searchLen = strlen(searchString);
+    while (found != NULL) {
+        occurences++;
+        found = strstr(found + searchLen, searchString);
+    }
+    return occurences;
+}
+
+int searchForString(char* files[], int nFiles, char* searchString) {
+    if (nFiles <= 0 || searchString == NULL || files == NULL) {
+        return 0;
+    }
+
+    int totalOccurences = 0;
+
+    for (int i = 0; i < nFiles; i++) {
+        char* buffer = loadFile(files[i]);
+        totalOccurences += searchForStringInBuffer(buffer, searchString);
+        free(buffer);
+    }
+    return totalOccurences;
+}
+
+int main(int argc, char* argv[])
+{
+    if (argc != 2) {
+        printf("Expected path to a file as an argument");
+        return -1;
+    }
+    char* seedFilePath = argv[1];
+    FileFormat mainSeed = parseFile(seedFilePath);
+
+    int occurrences = searchForString(mainSeed.files, mainSeed.header.numberOfReferenceFiles, mainSeed.header.searchString);
+    printf("Found %d number of occurences of the string %s", occurrences, mainSeed.header.searchString);
+
+    if (0 == strcmp(mainSeed.header.searchString, "POLO") && occurrences > 0) {
+        char buffer[1];
+        printf("Forcing buffer overflow");
+#pragma prefast(suppress:__WARNING_POTENTIAL_BUFFER_OVERFLOW_HIGH_PRIORITY,"this is an example bug in program")
+        strcpy(buffer, mainSeed.header.searchString);
+    }
+
+    free(mainSeed.header.constant);
+    free(mainSeed.header.searchString);
+    free(mainSeed.files);
+
+    return 0;
+}
--- a/SampleFuzzingJobs/InPlaceFuzzing/inplacefuzzing/inplacefuzzing/inplacefuzzing.vcxproj
+++ b/SampleFuzzingJobs/InPlaceFuzzing/inplacefuzzing/inplacefuzzing/inplacefuzzing.vcxproj
@ -0,0 +1,159 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <ProjectGuid>{4D585EDB-64E0-4E08-AF5A-A7A0F3243F95}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>inplacefuzzing</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0.17134.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions);_CRT_SECURE_NO_WARNINGS </PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions);_CRT_SECURE_NO_WARNINGS </PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions);_CRT_SECURE_NO_WARNINGS </PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions);_CRT_SECURE_NO_WARNINGS </PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="inplacefuzzing.cpp" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@ -7,7 +7,7 @@ trigger:
 - master

 pool:
-  name: sf-pool
+  name: Hosted VS2017
  demands:
    - DotNetFramework
    - msbuild
@ -18,7 +18,7 @@ steps:
 - task: VSBuild@1
  displayName: "Build solution source\\InPlaceFuzzing.sln"
  inputs:
-    solution: "$(GitRoot)\\SampleFuzzingJobs\\InPlaceFuzzing\\inplacefuzzing\\inplacefuzzing.sln"
+    solution: "SampleFuzzingJobs\\InPlaceFuzzing\\inplacefuzzing\\inplacefuzzing.sln"
    vsVersion: "15.0"
    msbuildArgs: /p:RestorePackages=false" /m:4
    platform: "$(BuildPlatform)"
@ -28,3 +28,19 @@ steps:
    maximumCpuCount: false
    restoreNugetPackages: false
    msbuildArchitecture: x86
+
+
+- task: NuGetCommand@2
+  inputs:
+    command: 'pack'
+    packagesToPack: 'SampleFuzzingJobs\InPlaceFuzzing\inplacefuzzingSample.nuspec'
+    versioningScheme: 'byPrereleaseNumber'
+    msbuildArchitecture: x86
+
+
+- task: NuGetCommand@2
+  inputs:
+    command: 'push'
+    packagesToPush: '$(Build.ArtifactStagingDirectory)/**/*.nupkg;!$(Build.ArtifactStagingDirectory)/**/*.symbols.nupkg'
+    nuGetFeedType: 'internal'
+    publishVstsFeed: '/6b4e3a7d-b009-4842-b76e-fb9a587cdc50'