ronin-support 0.4.1 → 0.5.2

data/lib/ronin/fuzzing/fuzzer.rb

@@ -0,0 +1,110 @@
+#
+# Copyright (c) 2006-2021 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# This file is part of ronin-support.
+#
+# ronin-support is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as published
+# by the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# ronin-support is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with ronin-support.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+require 'ronin/fuzzing/fuzzing'
+require 'ronin/extensions/regexp'
+
+require 'strscan'
+
+module Ronin
+  module Fuzzing
+    #
+    # Fuzzing class that incrementally fuzzes a String, given substitution
+    # rules.
+    #
+    # @api semipublic
+    #
+    # @since 0.5.0
+    #
+    class Fuzzer
+
+      # Patterns and their substitutions
+      attr_reader :rules
+
+      #
+      # Initializes a new Fuzzer.
+      #
+      # @param [Hash{Regexp,String,Symbol => Enumerable,Symbol}] rules
+      #   Patterns and their substitutions.
+      #
+      def initialize(rules)
+        @rules = {}
+        
+        rules.each do |pattern,substitution|
+          pattern = case pattern
+                    when Regexp then pattern
+                    when String then Regexp.new(Regexp.escape(pattern))
+                    when Symbol then Regexp.const_get(pattern.to_s.upcase)
+                    else
+                      raise(TypeError,"cannot convert #{pattern.inspect} to a Regexp")
+                    end
+
+          substitution = case substitution
+                         when Enumerable then substitution
+                         when Symbol     then Fuzzing[substitution]
+                         else
+                           raise(TypeError,"substitutions must be Enumerable or a Symbol")
+                         end
+
+          @rules[pattern] = substitution
+        end
+      end
+
+      #
+      # Incrementally fuzzes the String.
+      #
+      # @yield [fuzz]
+      #   The given block will be passed every fuzzed String.
+      #
+      # @yieldparam [String] fuzz
+      #   A fuzzed String.
+      #
+      # @return [Enumerator]
+      #   If no block is given, an Enumerator will be returned.
+      #
+      def each(string)
+        return enum_for(__method__,string) unless block_given?
+
+        @rules.each do |pattern,substitution|
+          scanner = StringScanner.new(string)
+          indices = []
+
+          while scanner.scan_until(pattern)
+            indices << [scanner.pos - scanner.matched_size, scanner.matched_size]
+          end
+
+          indices.each do |index,length|
+            substitution.each do |substitute|
+              substitute = case substitute
+                           when Proc    then substitute[string[index,length]]
+                           when Integer then substitute.chr
+                           else              substitute.to_s
+                           end
+
+              fuzzed = string.dup
+              fuzzed[index,length] = substitute
+              yield fuzzed
+            end
+          end
+        end
+      end
+
+    end
+  end
+end

data/lib/ronin/fuzzing/fuzzing.rb

@@ -1,20 +1,20 @@
 #
-# Copyright (c) 2006-2012 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2006-2021 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
-# This file is part of Ronin Support.
+# This file is part of ronin-support.
 #
-# Ronin Support is free software: you can redistribute it and/or modify
+# ronin-support is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Lesser General Public License as published
 # by the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
-# Ronin Support is distributed in the hope that it will be useful,
+# ronin-support is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU Lesser General Public License for more details.
 #
 # You should have received a copy of the GNU Lesser General Public License
-# along with Ronin Support.  If not, see <http://www.gnu.org/licenses/>.
+# along with ronin-support.  If not, see <https://www.gnu.org/licenses/>.
 #
 
 require 'set'
@@ -29,10 +29,10 @@ module Ronin
   #
   module Fuzzing
     # Short String lengths
-    SHORT_LENGTHS = SortedSet[1, 100, 500, 1_000, 10_000]
+    SHORT_LENGTHS = Set[1, 100, 500, 1_000, 10_000]
 
     # Long String lengths
-    LONG_LENGTHS = SortedSet[
+    LONG_LENGTHS = Set[
       128, 255, 256, 257, 511, 512, 513, 1023, 1024, 2048, 2049, 4095,
       4096, 4097, 5_000, 10_000, 20_000, 32762, 32763, 32764, 32765, 32766,
       32767, 32768, 32769,
@@ -58,14 +58,21 @@ module Ronin
     # @return [Enumerator]
     #   An Enumerator for the fuzzer method.
     #
+    # @raise [NoMethodError]
+    #   The fuzzing method could not be found.
+    #
     # @api semipublic
     #
     def self.[](name)
-      if (!Object.respond_to?(name) && respond_to?(name))
-        enum_for(name)
+      if (!respond_to?(name) || Module.respond_to?(name))
+        raise(NoMethodError,"no such fuzzing method: #{name}")
       end
+
+      return enum_for(name)
     end
 
+    module_function
+
     #
     # Various bad-strings.
     #
@@ -77,7 +84,7 @@ module Ronin
     #   or null-bytes (see {NULL_BYTES}), of varying length
     #   (see {SHORT_LENGTHS} and {LONG_LENGTHS}).
     #
-    def self.bad_strings(&block)
+    def bad_strings(&block)
       yield ''
 
       chars = [
@@ -118,7 +125,7 @@ module Ronin
     # @yieldparam [String] fmt_string
     #   A format-string containing format operators (see {FORMAT_STRINGS}).
     #
-    def self.format_strings(&block)
+    def format_strings(&block)
       FORMAT_STRINGS.each do |fmt|
         yield fmt
         yield fmt * 100
@@ -136,7 +143,7 @@ module Ronin
     # @yieldparam [String] path
     #   A known bad path.
     #
-    def self.bad_paths(&block)
+    def bad_paths(&block)
       padding = 'A' * 5_000
 
       yield "/.:/#{padding}\x00\x00"
@@ -166,7 +173,7 @@ module Ronin
     # @yieldparam [String] bitfield
     #   A bit-field (8bit - 64bit).
     #
-    def self.bit_fields(&block)
+    def bit_fields(&block)
       ("\x00".."\xff").each do |c|
         yield c
         yield c << c # x2
@@ -184,7 +191,7 @@ module Ronin
     # @yieldparam [String] bitfield
     #   A signed bit-field (8bit - 64bit).
     #
-    def self.signed_bit_fields(&block)
+    def signed_bit_fields(&block)
       ("\x80".."\xff").each do |c|
         yield c
         yield c << c # x2
@@ -202,7 +209,7 @@ module Ronin
     # @yieldparam [String] int
     #   A unsigned 8bit integer.
     #
-    def self.uint8(&block)
+    def uint8(&block)
       ("\x00".."\xff").each(&block)
     end
 
@@ -215,7 +222,7 @@ module Ronin
     # @yieldparam [String] int
     #   A unsigned 16bit integer.
     #
-    def self.uint16
+    def uint16
       uint8 { |c| yield c * 2 }
     end
 
@@ -228,7 +235,7 @@ module Ronin
     # @yieldparam [String] int
     #   A unsigned 32bit integer.
     #
-    def self.uint32
+    def uint32
       uint8 { |c| yield c * 4 }
     end
 
@@ -241,7 +248,7 @@ module Ronin
     # @yieldparam [String] int
     #   A unsigned 64bit integer.
     #
-    def self.uint64
+    def uint64
       uint8 { |c| yield c * 8 }
     end
 
@@ -254,7 +261,7 @@ module Ronin
     # @yieldparam [String] int
     #   A signed 8bit integer.
     #
-    def self.int8(&block)
+    def int8(&block)
       ("\x00".."\x70").each(&block)
     end
 
@@ -267,7 +274,7 @@ module Ronin
     # @yieldparam [String] int
     #   A signed 16bit integer.
     #
-    def self.int16
+    def int16
       int8 { |c| yield c * 2 }
     end
 
@@ -280,7 +287,7 @@ module Ronin
     # @yieldparam [String] int
     #   A signed 32bit integer.
     #
-    def self.int32
+    def int32
       int8 { |c| yield c * 4 }
     end
 
@@ -293,7 +300,7 @@ module Ronin
     # @yieldparam [String] int
     #   A signed 64bit integer.
     #
-    def self.int64
+    def int64
       int8 { |c| yield c * 8 }
     end
 
@@ -306,7 +313,7 @@ module Ronin
     # @yieldparam [String] int
     #   A negative-signed 8bit integer.
     #
-    def self.sint8(&block)
+    def sint8(&block)
       ("\x80".."\xff").each(&block)
     end
 
@@ -319,7 +326,7 @@ module Ronin
     # @yieldparam [String] int
     #   A negative-signed 16bit integer.
     #
-    def self.sint16
+    def sint16
       sint8 { |c| yield c * 2 }
     end
 
@@ -332,7 +339,7 @@ module Ronin
     # @yieldparam [String] int
     #   A negative-signed 32bit integer.
     #
-    def self.sint32
+    def sint32
       sint8 { |c| yield c * 4 }
     end
 
@@ -345,7 +352,7 @@ module Ronin
     # @yieldparam [String] int
     #   A negative-signed 64bit integer.
     #
-    def self.sint64
+    def sint64
       sint8 { |c| yield c * 8 }
     end
 

data/lib/ronin/fuzzing/mutator.rb

@@ -0,0 +1,161 @@
+#
+# Copyright (c) 2006-2021 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# This file is part of ronin-support.
+#
+# ronin-support is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as published
+# by the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# ronin-support is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with ronin-support.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+require 'ronin/fuzzing/fuzzing'
+require 'ronin/extensions/regexp'
+
+require 'combinatorics/list_comprehension'
+require 'combinatorics/power_set'
+require 'combinatorics/generator'
+require 'strscan'
+require 'set'
+
+module Ronin
+  module Fuzzing
+    #
+    # Fuzzer class that permutates over every mutation of a String, given
+    # mutation rules.
+    #
+    # @api semipublic
+    #
+    # @since 0.5.0
+    #
+    class Mutator
+
+      # Mutation rules
+      attr_reader :rules
+
+      #
+      # Initialize the Mutator.
+      #
+      # @param [Hash{Regexp,String,Symbol => Symbol,Enumerable}] rules
+      #   The patterns and substitutions to mutate the String with.
+      #
+      # @raise [TypeError]
+      #   A mutation pattern was not a Regexp, String or Symbol.
+      #   A mutation substitution was not a Symbol or Enumerable.
+      #
+      def initialize(rules)
+        @rules = {}
+        
+        rules.each do |pattern,mutation|
+          pattern = case pattern
+                    when Regexp
+                      pattern
+                    when String
+                      Regexp.new(Regexp.escape(pattern))
+                    when Symbol
+                      Regexp.const_get(pattern.to_s.upcase)
+                    else
+                      raise(TypeError,"cannot convert #{pattern.inspect} to a Regexp")
+                    end
+
+          mutation = case mutation
+                     when Enumerable
+                       mutation
+                     when Symbol
+                       Ronin::Fuzzing[mutation]
+                     else
+                       raise(TypeError,"mutation #{mutation.inspect} must be a Symbol or Enumerable")
+                     end
+
+          @rules[pattern] = mutation
+        end
+      end
+
+      #
+      # Permutes over every possible mutation of the String.
+      #
+      # @param [String] string
+      #   The String to be mutated.
+      #
+      # @yield [mutant]
+      #   The given block will be yielded every possible mutant String.
+      #
+      # @yieldparam [String] mutant
+      #   A mutated String.
+      #
+      # @return [Enumerator]
+      #   If no block is given, an Enumerator will be returned.
+      #
+      def each(string)
+        return enum_for(__method__,string) unless block_given?
+
+        matches = Set[]
+
+        @rules.each do |pattern,mutation|
+          scanner = StringScanner.new(string)
+
+          while scanner.scan_until(pattern)
+            length   = scanner.matched_size
+            index    = scanner.pos - length
+            original = scanner.matched
+
+            mutator = Combinatorics::Generator.new do |g|
+              mutation.each do |mutate|
+                g.yield case mutate
+                        when Proc
+                          mutate.call(original)
+                        when Integer
+                          mutate.chr
+                        else
+                          mutate.to_s
+                        end
+              end
+            end
+
+            matches << [index, length, mutator]
+          end
+        end
+
+        matches.powerset do |submatches|
+          # ignore the empty Set
+          next if submatches.empty?
+
+          # sort the submatches by index
+          submatches = submatches.sort_by { |index,length,mutator| index }
+          sets       = []
+          prev_index = 0
+
+          submatches.each do |index,length,mutator|
+            # add the previous substring to the set of Strings
+            if index > prev_index
+              sets << [string[prev_index,index - prev_index]]
+            end
+
+            # add the mutator to the set of Strings
+            sets << mutator
+
+            prev_index = index + length
+          end
+
+          # add the remaining substring to the set of Strings
+          if prev_index < string.length
+            sets << [string[prev_index..-1]]
+          end
+
+          sets.comprehension { |strings| yield strings.join }
+        end
+
+        return nil
+      end
+
+    end
+  end
+end