pwn 0.5.739 → 0.5.741

data/lib/pwn/ffi/capstone.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+require 'ffi'
+
+PubFFI = ::FFI unless defined?(PubFFI) # rubocop:disable Style/RedundantConstantBase
+
+module PWN
+  module FFI
+    # Thin libcapstone disassembler.
+    module Capstone
+      extend PubFFI::Library
+
+      CS_ARCH_ARM = 0
+      CS_ARCH_ARM64 = 1
+      CS_ARCH_X86 = 3
+      CS_MODE_LITTLE_ENDIAN = 0
+      CS_MODE_32 = 4
+      CS_MODE_64 = 8
+
+      # Capstone cs_insn layout used by cs_disasm.
+      class Insn < PubFFI::Struct
+        layout :id, :uint,
+               :address, :uint64,
+               :size, :ushort,
+               :bytes, [:uchar, 24],
+               :mnemonic, [:char, 32],
+               :op_str, [:char, 160],
+               :detail, :pointer
+      end
+
+      @load_error = nil
+      begin
+        ffi_lib %w[capstone libcapstone.so.5 libcapstone.so.4 libcapstone.so]
+      rescue LoadError => e
+        @load_error = e
+      end
+
+      class << self
+        attr_reader :load_error
+      end
+
+      unless @load_error
+        attach_function :cs_open, %i[int int pointer], :int
+        attach_function :cs_disasm, %i[size_t pointer size_t uint64 size_t pointer], :size_t
+        attach_function :cs_free, %i[pointer size_t], :void
+        attach_function :cs_close, [:pointer], :int
+      end
+
+      public_class_method def self.available?(opts = {})
+        opts[:mod]
+        load_error.nil?
+      end
+
+      public_class_method def self.disassemble(opts = {})
+        raise 'ERROR: libcapstone not available' unless available?(mod: self)
+
+        raw = opts[:bytes] || opts[:opcodes]
+        raise 'ERROR: bytes is required' if raw.to_s.empty?
+
+        bytes = raw.to_s.b
+        arch, mode = arch_mode(arch: opts[:arch], endian: opts[:endian])
+        handle = PubFFI::MemoryPointer.new(:size_t)
+        raise 'ERROR: cs_open failed' unless cs_open(arch, mode, handle).zero?
+
+        buf = PubFFI::MemoryPointer.from_string(bytes)
+        insn_ptr = PubFFI::MemoryPointer.new(:pointer)
+        count = cs_disasm(handle.read_ulong, buf, bytes.bytesize, (opts[:address] || 0).to_i, 0, insn_ptr)
+        insns = []
+        base = insn_ptr.read_pointer
+        count.times do |i|
+          insn = Insn.new(base + (i * Insn.size))
+          insns << { address: insn[:address], mnemonic: insn[:mnemonic].to_s, op_str: insn[:op_str].to_s, size: insn[:size] }
+        end
+        cs_free(base, count) unless base.null?
+        cs_close(handle)
+        { engine: 'capstone', insns: insns, count: count }
+      end
+
+      private_class_method def self.arch_mode(opts = {})
+        arch = opts[:arch].to_s.downcase
+        case arch
+        when 'i386', 'i686', 'x86'
+          [CS_ARCH_X86, CS_MODE_32]
+        when 'aarch64', 'arm64'
+          [CS_ARCH_ARM64, CS_MODE_LITTLE_ENDIAN]
+        when /arm/
+          [CS_ARCH_ARM, CS_MODE_LITTLE_ENDIAN]
+        else
+          [CS_ARCH_X86, CS_MODE_64]
+        end
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # True when libcapstone is loadable.
+          #{self}.available?(
+            mod: 'optional - ignored; present so (opts = {}) reads opts['
+          )
+
+          # Disassemble bytes with Capstone.
+          #{self}.disassemble(
+            bytes: 'required - raw machine-code bytes',
+            opcodes: 'optional - alias for bytes',
+            arch: 'optional - x86_64|x86|arm|aarch64',
+            endian: 'optional - :little or :big byte order',
+            address: 'optional - start address'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/ffi/keystone.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require 'ffi'
+
+PubFFI = ::FFI unless defined?(PubFFI) # rubocop:disable Style/RedundantConstantBase
+
+module PWN
+  module FFI
+    # Thin libkeystone assembler.
+    module Keystone
+      extend PubFFI::Library
+
+      KS_ARCH_ARM = 1
+      KS_ARCH_ARM64 = 2
+      KS_ARCH_X86 = 4
+      KS_MODE_LITTLE_ENDIAN = 0
+      KS_MODE_32 = 4
+      KS_MODE_64 = 8
+
+      @load_error = nil
+      begin
+        ffi_lib %w[keystone libkeystone.so.0 libkeystone.so]
+      rescue LoadError => e
+        @load_error = e
+      end
+
+      class << self
+        attr_reader :load_error
+      end
+
+      unless @load_error
+        attach_function :ks_open, %i[int int pointer], :int
+        attach_function :ks_asm, %i[pointer string uint64 pointer pointer pointer], :int
+        attach_function :ks_free, [:pointer], :void
+        attach_function :ks_close, [:pointer], :int
+      end
+
+      public_class_method def self.available?(opts = {})
+        opts[:mod]
+        load_error.nil?
+      end
+
+      public_class_method def self.assemble(opts = {})
+        raise 'ERROR: libkeystone not available' unless available?(mod: self)
+
+        asm = opts[:asm].to_s
+        raise 'ERROR: asm is required' if asm.empty?
+
+        arch, mode = arch_mode(arch: opts[:arch], endian: opts[:endian])
+        ks_ptr = PubFFI::MemoryPointer.new(:pointer)
+        raise 'ERROR: ks_open failed' unless ks_open(arch, mode, ks_ptr).zero?
+
+        ks = ks_ptr.read_pointer
+        enc = PubFFI::MemoryPointer.new(:pointer)
+        size = PubFFI::MemoryPointer.new(:ulong)
+        count = PubFFI::MemoryPointer.new(:ulong)
+        rc = ks_asm(ks, asm, (opts[:address] || 0).to_i, enc, size, count)
+        raise 'ERROR: ks_asm failed' unless rc.zero?
+
+        n = size.read_ulong
+        bytes = enc.read_pointer.read_string(n)
+        ks_free(enc.read_pointer)
+        ks_close(ks)
+        { engine: 'keystone', bytes: bytes, hex: bytes.unpack1('H*'), count: count.read_ulong }
+      end
+
+      private_class_method def self.arch_mode(opts = {})
+        arch = opts[:arch].to_s.downcase
+        case arch
+        when 'i386', 'i686', 'x86'
+          [KS_ARCH_X86, KS_MODE_32]
+        when 'aarch64', 'arm64'
+          [KS_ARCH_ARM64, KS_MODE_LITTLE_ENDIAN]
+        when /arm/
+          [KS_ARCH_ARM, KS_MODE_LITTLE_ENDIAN]
+        else
+          [KS_ARCH_X86, KS_MODE_64]
+        end
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # True when libkeystone is loadable.
+          #{self}.available?(
+            mod: 'optional - ignored; present so (opts = {}) reads opts['
+          )
+
+          # Assemble instructions with Keystone.
+          #{self}.assemble(
+            asm: 'required - assembly source (one instruction per line)',
+            arch: 'optional - x86_64|x86|arm|aarch64',
+            endian: 'optional - :little or :big byte order',
+            address: 'optional - start address'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/ffi.rb

@@ -21,9 +21,11 @@ module PWN
   # `.available?` returns false so callers can fall back to pure Ruby.
   module FFI
     autoload :AdalmPluto, 'pwn/ffi/adalm_pluto'
+    autoload :Capstone, 'pwn/ffi/capstone'
     autoload :DSPNative, 'pwn/ffi/dsp_native'
     autoload :FFTW,     'pwn/ffi/fftw'
     autoload :HackRF,   'pwn/ffi/hack_rf'
+    autoload :Keystone, 'pwn/ffi/keystone'
     autoload :Liquid,   'pwn/ffi/liquid'
     autoload :RTLSdr,   'pwn/ffi/rtl_sdr'
     autoload :SoapySDR, 'pwn/ffi/soapy_sdr'

data/lib/pwn/migrate.rb

@@ -49,7 +49,7 @@ module PWN
     # Bump this whenever the shape of any file under ~/.pwn changes in a
     # way that requires a one-time transform.  Add the transform as an
     # entry in MIGRATIONS keyed by the NEW schema number.
-    SCHEMA_VERSION = 3
+    SCHEMA_VERSION = 4
 
     OK   = "\e[32mok\e[0m"
     BAD  = "\e[31mFAIL\e[0m"
@@ -241,6 +241,10 @@ module PWN
 
         File.write(path, YAML.dump(raw))
         io.puts "    · agents.yml added default model to #{patched} personas"
+      },
+      4 => lambda { |_root, io|
+        io.puts '    · pwn.yaml ai_sandbox, ai_router, model_routes task classes'
+        PWN::Migrate.backfill_vault(io: io)
       }
     }.freeze
 

data/lib/pwn/plugins/aflplusplus.rb

@@ -3,10 +3,14 @@
 require 'open3'
 require 'digest'
 require 'json'
+require 'fileutils'
+require 'shellwords'
+require 'rbconfig'
+require 'base64'
 
 module PWN
   module Plugins
-    # AFL++ campaign wrapper.
+    # AFL++ / libFuzzer campaign wrapper with corpus, dictionary, and RE triage handoff.
     module AFLplusplus
       public_class_method def self.required_bins
         %w[afl-fuzz]
@@ -41,22 +45,107 @@ module PWN
         end
       end
 
+      public_class_method def self.dictionary_from_binary(opts = {})
+        path = (opts[:path] || opts[:target] || opts[:bin]).to_s
+        raise ArgumentError, 'path is required' if path.empty?
+
+        triage = PWN::Plugins::BinaryParser.triage(path: path, session_id: opts[:session_id] || 'fuzz-dict')
+        strings = triage[:interesting_strings] || {}
+        tokens = []
+        tokens.concat(Array(strings[:urls]))
+        tokens.concat(Array(strings[:paths]))
+        tokens.concat(Array(strings[:format_strings]))
+        tokens.concat(Array(strings[:keys]))
+        tokens.concat(Array(triage[:imports]).map(&:to_s).grep(/\A[A-Za-z_]{3,}/).first(20))
+        tokens = tokens.map(&:to_s).uniq.reject(&:empty?).first(200)
+        quoted = tokens.map { |token| format('"%s"', token.gsub('\\', '\\\\').gsub('"', '\\"')) }
+        { path: path, tokens: tokens, dict: quoted.join("\n") }
+      end
+
+      public_class_method def self.prepare_corpus(opts = {})
+        in_dir = (opts[:in_dir] || opts[:corpus]).to_s
+        raise ArgumentError, 'in_dir is required' if in_dir.empty?
+
+        FileUtils.mkdir_p(in_dir)
+        File.binwrite(File.join(in_dir, 'seed'), "A\n") unless Dir.children(in_dir).any? { |name| File.file?(File.join(in_dir, name)) }
+        Array(opts[:seeds]).each_with_index do |seed, idx|
+          FileUtils.cp(seed, File.join(in_dir, "seed-#{idx}")) if File.file?(seed.to_s)
+        end
+        in_dir
+      end
+
+      public_class_method def self.campaign_command(opts = {})
+        payload = {
+          engine: opts[:engine] || 'aflplusplus',
+          in_dir: opts[:in_dir],
+          out_dir: opts[:out_dir],
+          target: opts[:target],
+          max_runtime: opts[:max_runtime],
+          cwd: opts[:cwd],
+          env: opts[:env],
+          handoff: opts.fetch(:handoff, true)
+        }
+        b64 = Base64.strict_encode64(JSON.generate(payload))
+        Shellwords.join(
+          [
+            RbConfig.ruby,
+            '-rpwn',
+            '-rjson',
+            '-rbase64',
+            '-e',
+            'PWN::Plugins::AFLplusplus.campaign(JSON.parse(Base64.decode64(ARGV[0]), symbolize_names: true))',
+            b64
+          ]
+        )
+      end
+
+      public_class_method def self.campaign(opts = {})
+        opts = opts.transform_keys(&:to_sym)
+        in_dir = prepare_corpus(opts)
+        out_dir = (opts[:out_dir] || opts[:output]).to_s
+        raise ArgumentError, 'out_dir is required' if out_dir.empty?
+
+        FileUtils.mkdir_p(out_dir)
+        bin = binary_from_target(target: opts[:target])
+        dict_info = File.file?(bin.to_s) ? dictionary_from_binary(path: bin) : { dict: '', tokens: [] }
+        dict_path = File.join(out_dir, 'tokens.dict')
+        File.write(dict_path, dict_info[:dict].to_s)
+        unless opts[:skip_fuzz]
+          argv = fuzzer_argv(opts.merge(in_dir: in_dir, dict: dict_path, binary: bin, out_dir: out_dir))
+          run_fuzzer(argv: argv, max_runtime: opts[:max_runtime], env: opts[:env], cwd: opts[:cwd])
+        end
+        crash_triage(out_dir: out_dir, target: bin || opts[:target], handoff: opts.fetch(:handoff, true))
+      end
+
       public_class_method def self.crash_triage(opts = {})
         out_dir = (opts[:out_dir] || opts[:output]).to_s
         raise 'ERROR: out_dir is required' if out_dir.empty?
 
-        crashes = Dir[File.join(out_dir, '**/crashes/id:*')]
-        hashes = crashes.map { |p| [p, Digest::SHA256.file(p).hexdigest] }
-        rows = hashes.map do |path, sha|
-          art = File.join(out_dir, "crash-#{sha[0, 12]}.json")
-          File.write(art, JSON.generate(path: path, sha256: sha))
-          { path: path, sha256: sha, artifact: art }
+        files = crash_files(out_dir: out_dir)
+        target = binary_from_target(target: opts[:target])
+        groups = Hash.new { |hash, key| hash[key] = { files: [] } }
+        files.each do |path|
+          stdin = File.binread(path)
+          crash = replay_crash(target: target, stdin: stdin)
+          key = backtrace_hash(crash: crash)
+          groups[key][:files] << path
+          groups[key][:crash] ||= crash
+          groups[key][:stdin] ||= stdin
         end
+        triaged = []
+        if opts[:handoff] != false
+          groups.each do |key, group|
+            triaged << handoff_re003(target: target, crash: group[:crash], stdin: group[:stdin], files: group[:files], backtrace_hash: key)
+          end
+        end
+        hashes = files.map { |path| [path, Digest::SHA256.file(path).hexdigest] }
         {
-          crashes: crashes,
-          unique: hashes.map(&:last).uniq,
-          asan: crashes.any? { |p| File.binread(p).include?('AddressSanitizer') },
-          artifacts: rows
+          crashes: files,
+          unique: groups.keys,
+          triaged: triaged,
+          pipeline: 'pwn-re-003',
+          asan: files.any? { |path| File.binread(path).include?('AddressSanitizer') },
+          artifacts: hashes.map { |path, sha| { path: path, sha256: sha } }
         }
       end
 
@@ -96,10 +185,54 @@ module PWN
             output: 'optional - alias for out_dir'
           )
 
-          # Dedup AFL++ crash files by sha256 and note AddressSanitizer hits.
+          # Build an AFL/libFuzzer dictionary from interesting strings in a binary.
+          #{self}.dictionary_from_binary(
+            path: 'required - filesystem path of the fuzz target ELF',
+            target: 'optional - alias for path',
+            bin: 'optional - alias for path',
+            session_id: 'optional - artifact session id for BinaryParser.triage'
+          )
+
+          # Ensure a corpus directory exists and contains at least one seed.
+          #{self}.prepare_corpus(
+            in_dir: 'required - corpus directory (defaults to opts[:corpus])',
+            corpus: 'optional - alias for in_dir',
+            seeds: 'optional - extra seed file paths to copy into the corpus'
+          )
+
+          # Build a durable Jobs command that runs campaign then RE triage.
+          #{self}.campaign_command(
+            engine: 'optional - aflplusplus or libfuzzer (defaults to aflplusplus)',
+            in_dir: 'required - corpus directory',
+            out_dir: 'required - fuzzer output directory',
+            target: 'required - fuzz target command or binary path',
+            max_runtime: 'optional - seconds the supervisor may run',
+            cwd: 'optional - working directory',
+            env: 'optional - string environment map',
+            handoff: 'optional - false skips PWN-RE-003 crash handoff (defaults to true)'
+          )
+
+          # Prepare corpus/dict, run AFL++ or libFuzzer, then triage unique crashes.
+          #{self}.campaign(
+            engine: 'optional - aflplusplus or libfuzzer (defaults to aflplusplus)',
+            in_dir: 'required - corpus directory',
+            out_dir: 'required - fuzzer output directory',
+            output: 'optional - alias for out_dir',
+            target: 'required - fuzz target command or binary path',
+            max_runtime: 'optional - seconds forwarded to the fuzzer',
+            cwd: 'optional - working directory',
+            env: 'optional - string environment map',
+            skip_fuzz: 'optional - true harvests existing crashes without launching a fuzzer',
+            handoff: 'optional - false skips PWN-RE-003 crash handoff (defaults to true)',
+            seeds: 'optional - extra seed file paths to copy into the corpus'
+          )
+
+          # Dedup crashes by backtrace hash and hand unique ones to PWN-RE-003 triage.
           #{self}.crash_triage(
             out_dir: 'required - AFL output directory containing crashes/',
-            output: 'optional - alias for out_dir'
+            output: 'optional - alias for out_dir',
+            target: 'optional - fuzz target binary used to replay crashes',
+            handoff: 'optional - false skips GDBMI/BinaryParser/ExploitDev handoff (defaults to true)'
           )
 
           # Minimize a crash input with afl-tmin when present.
@@ -114,6 +247,98 @@ module PWN
         "
         constants.sort
       end
+
+      private_class_method def self.binary_from_target(opts = {})
+        parts = begin
+          Shellwords.split(opts[:target].to_s)
+        rescue ArgumentError
+          [opts[:target].to_s]
+        end
+        parts.find { |part| part != '@@' && !part.start_with?('-') } || parts.first
+      end
+
+      private_class_method def self.fuzzer_argv(opts = {})
+        engine = (opts[:engine] || 'aflplusplus').to_s
+        if engine.downcase.include?('libfuzzer')
+          argv = [opts[:binary] || binary_from_target(target: opts[:target])]
+          argv << "-max_total_time=#{opts[:max_runtime].to_i}" if opts[:max_runtime].to_i.positive?
+          argv << "-dict=#{opts[:dict]}" if opts[:dict].to_s != '' && File.file?(opts[:dict].to_s)
+          argv << "-artifact_prefix=#{File.join(opts[:out_dir].to_s, 'crash-')}"
+          argv << opts[:in_dir].to_s
+        else
+          argv = ['afl-fuzz', '-i', opts[:in_dir].to_s, '-o', opts[:out_dir].to_s]
+          argv += ['-x', opts[:dict].to_s] if opts[:dict].to_s != '' && File.file?(opts[:dict].to_s)
+          argv += ['--', *Shellwords.split(opts[:target].to_s)]
+        end
+        argv
+      end
+
+      private_class_method def self.run_fuzzer(opts = {})
+        env = { 'AFL_NO_UI' => '1', 'AFL_SKIP_CPUFREQ' => '1', 'AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES' => '1' }
+        env.merge!(opts[:env].transform_keys(&:to_s)) if opts[:env].is_a?(Hash)
+        kw = {}
+        kw[:chdir] = opts[:cwd] if opts[:cwd].to_s != ''
+        system(env, *opts[:argv], **kw)
+      end
+
+      private_class_method def self.crash_files(opts = {})
+        out_dir = opts[:out_dir]
+        files = Dir[File.join(out_dir, '**/crashes/id:*')]
+        files += Dir[File.join(out_dir, 'crash-*')]
+        files += Dir[File.join(out_dir, '**/crash-*')]
+        files.select { |path| File.file?(path) && File.basename(path) != 'README.txt' }.uniq
+      end
+
+      private_class_method def self.replay_crash(opts = {})
+        target = opts[:target].to_s
+        stdin = opts[:stdin].to_s
+        return dummy_crash(stdin: stdin) if target.empty?
+
+        PWN::Plugins::GDBMI.run_to_crash(binary: target, stdin: stdin)
+      rescue StandardError
+        stdout, stderr, status = Open3.capture3(target, stdin_data: stdin)
+        sig = status.termsig ? Signal.signame(status.termsig) : nil
+        {
+          signal: sig ? "SIG#{sig}" : 'UNKNOWN',
+          pc: nil,
+          fault_addr: nil,
+          backtrace: stderr.lines.grep(/#\d+/).map(&:strip),
+          stdout: stdout,
+          stderr: stderr
+        }
+      end
+
+      private_class_method def self.dummy_crash(opts = {})
+        { signal: 'SIGSEGV', pc: Digest::SHA256.hexdigest(opts[:stdin].to_s)[0, 8], fault_addr: nil, backtrace: [] }
+      end
+
+      private_class_method def self.backtrace_hash(opts = {})
+        crash = opts[:crash] || {}
+        Digest::SHA256.hexdigest([crash[:signal], crash[:pc], crash[:fault_addr], Array(crash[:backtrace]).inspect].join('|'))[0, 16]
+      end
+
+      private_class_method def self.handoff_re003(opts = {})
+        target = opts[:target].to_s
+        crash = opts[:crash] || {}
+        binary_triage = begin
+          PWN::Plugins::BinaryParser.triage(path: target, session_id: 'pwn-re-003') if File.file?(target)
+        rescue StandardError
+          nil
+        end
+        exploitdev = begin
+          PWN::Plugins::ExploitDev.from_crash(crash: crash, payload: opts[:stdin]) if crash.is_a?(Hash)
+        rescue StandardError
+          nil
+        end
+        {
+          backtrace_hash: opts[:backtrace_hash],
+          crash: crash,
+          binary_triage: binary_triage,
+          exploitdev: exploitdev,
+          files: opts[:files],
+          pipeline: 'pwn-re-003'
+        }
+      end
     end
   end
 end