211 lines
6.5 KiB
Markdown
211 lines
6.5 KiB
Markdown
|
# Fuzzers for libmtp
|
||
|
|
|
||
|
|
## Table of contents
|
||
|
|
+ [mtp_fuzzer](#MtpServer)
|
||
|
|
+ [mtp_host_property_fuzzer](#MtpHostProperty)
|
||
|
|
+ [mtp_device_property_fuzzer](#MtpDeviceProperty)
|
||
|
|
+ [mtp_handle_fuzzer](#MtpHandle)
|
||
|
|
+ [mtp_packet_fuzzer](#MtpPacket)
|
||
|
|
+ [mtp_device_fuzzer](#MtpDevice)
|
||
|
|
+ [mtp_request_packet_fuzzer](#MtpRequestPacket)
|
||
|
|
+ [mtp_event_packet_fuzzer](#MtpEventPacket)
|
||
|
|
+ [mtp_response_packet_fuzzer](#MtpResponsePacket)
|
||
|
|
+ [mtp_data_packet_fuzzer](#MtpDataPacket)
|
||
|
|
|
||
|
|
# <a name="MtpServer"></a> Fuzzer for MtpServer
|
||
|
|
|
||
|
|
MtpServer supports the following parameters:
|
||
|
|
1. PacketData (parameter name: "packetData")
|
||
|
|
|
||
|
|
| Parameter| Valid Values |Configured Value|
|
||
|
|
|-------------|----------|----- |
|
||
|
|
|`packetData`| `String` |Value obtained from FuzzedDataProvider|
|
||
|
|
|
||
|
|
#### Steps to run
|
||
|
|
1. Build the fuzzer
|
||
|
|
```
|
||
|
|
$ mm -j$(nproc) mtp_fuzzer
|
||
|
|
```
|
||
|
|
2. Run on device
|
||
|
|
```
|
||
|
|
$ adb sync data
|
||
|
|
$ adb shell /data/fuzz/arm64/mtp_fuzzer/mtp_fuzzer corpus/ -dict=mtp_fuzzer.dict
|
||
|
|
```
|
||
|
|
|
||
|
|
# <a name="MtpHostProperty"></a> Fuzzer for MtpHostProperty
|
||
|
|
|
||
|
|
MtpHostProperty supports the following parameters:
|
||
|
|
1. Feasible Type (parameter name: "kFeasibleTypes")
|
||
|
|
2. UrbPacket Division Mode (parameter name: "kUrbPacketDivisionModes")
|
||
|
|
|
||
|
|
| Parameter| Valid Values |Configured Value|
|
||
|
|
|-------------|----------|----- |
|
||
|
|
| `kFeasibleType`| 1. `MTP_TYPE_UNDEFINED`, 2. `MTP_TYPE_INT8`, 3.`MTP_TYPE_UINT8`, 4.`MTP_TYPE_INT16`, 5.`MTP_TYPE_UINT16`, 6.`MTP_TYPE_INT32`, 7.`MTP_TYPE_UINT32`, 8.`MTP_TYPE_INT64`, 9.`MTP_TYPE_UINT64`, 10.`MTP_TYPE_INT128`, 11.`MTP_TYPE_UINT128`, 12.`MTP_TYPE_AINT8`, 13.`MTP_TYPE_AUINT8`, 14.`MTP_TYPE_AINT16`, 15.`MTP_TYPE_AUINT16`, 16.`MTP_TYPE_AINT32`, 17.`MTP_TYPE_AUINT32`, 18.`MTP_TYPE_AINT64`, 19.`MTP_TYPE_AUINT64`, 20.`MTP_TYPE_AINT128`, 21.`MTP_TYPE_AUINT128`, 22.`MTP_TYPE_STR`,| Value obtained from FuzzedDataProvider|
|
||
|
|
|`kUrbPacketDivisionMode`| 1. `FIRST_PACKET_ONLY_HEADER`, 2. `FIRST_PACKET_HAS_PAYLOAD`, |Value obtained from FuzzedDataProvider|
|
||
|
|
|
||
|
|
#### Steps to run
|
||
|
|
1. Build the fuzzer
|
||
|
|
```
|
||
|
|
$ mm -j$(nproc) mtp_host_property_fuzzer
|
||
|
|
```
|
||
|
|
2. Run on device
|
||
|
|
```
|
||
|
|
$ adb sync data
|
||
|
|
$ adb shell /data/fuzz/arm64/mtp_host_property_fuzzer/mtp_host_property_fuzzer
|
||
|
|
```
|
||
|
|
|
||
|
|
# <a name="MtpDeviceProperty"></a> Fuzzer for MtpDeviceProperty
|
||
|
|
|
||
|
|
MtpDeviceProperty supports the following parameters:
|
||
|
|
1. Feasible Type (parameter name: "kFeasibleType")
|
||
|
|
|
||
|
|
| Parameter| Valid Values |Configured Value|
|
||
|
|
|-------------|----------|----- |
|
||
|
|
| `kFeasibleType`| 1. `MTP_TYPE_UNDEFINED`, 2. `MTP_TYPE_INT8`, 3.`MTP_TYPE_UINT8`, 4.`MTP_TYPE_INT16`, 5.`MTP_TYPE_UINT16`, 6.`MTP_TYPE_INT32`, 7.`MTP_TYPE_UINT32`, 8.`MTP_TYPE_INT64`, 9.`MTP_TYPE_UINT64`, 10.`MTP_TYPE_INT128`, 11.`MTP_TYPE_UINT128`, 12.`MTP_TYPE_AINT8`, 13.`MTP_TYPE_AUINT8`, 14.`MTP_TYPE_AINT16`, 15.`MTP_TYPE_AUINT16`, 16.`MTP_TYPE_AINT32`, 17.`MTP_TYPE_AUINT32`, 18.`MTP_TYPE_AINT64`, 19.`MTP_TYPE_AUINT64`, 20.`MTP_TYPE_AINT128`, 21.`MTP_TYPE_AUINT128`, 22.`MTP_TYPE_STR`,| Value obtained from FuzzedDataProvider|
|
||
|
|
|
||
|
|
#### Steps to run
|
||
|
|
1. Build the fuzzer
|
||
|
|
```
|
||
|
|
$ mm -j$(nproc) mtp_device_property_fuzzer
|
||
|
|
```
|
||
|
|
2. Run on device
|
||
|
|
```
|
||
|
|
$ adb sync data
|
||
|
|
$ adb shell /data/fuzz/arm64/mtp_device_property_fuzzer/mtp_device_property_fuzzer
|
||
|
|
```
|
||
|
|
|
||
|
|
# <a name="MtpHandle"></a>Fuzzer for MtpHandle
|
||
|
|
|
||
|
|
#### Steps to run
|
||
|
|
1. Build the fuzzer
|
||
|
|
```
|
||
|
|
$ mm -j$(nproc) mtp_handle_fuzzer
|
||
|
|
```
|
||
|
|
2. Run on device
|
||
|
|
```
|
||
|
|
$ adb sync data
|
||
|
|
$ adb shell /data/fuzz/arm64/mtp_handle_fuzzer/mtp_handle_fuzzer
|
||
|
|
```
|
||
|
|
|
||
|
|
# <a name="MtpPacket"></a> Fuzzer for MtpPacket
|
||
|
|
|
||
|
|
MtpPacket supports the following parameters:
|
||
|
|
1. bufferSize (parameter name: "size")
|
||
|
|
|
||
|
|
| Parameter| Valid Values |Configured Value|
|
||
|
|
|-------------|----------|----- |
|
||
|
|
|`bufferSize`| Integer `1` to `1000`, |Value obtained from FuzzedDataProvider|
|
||
|
|
|
||
|
|
#### Steps to run
|
||
|
|
1. Build the fuzzer
|
||
|
|
```
|
||
|
|
$ mm -j$(nproc) mtp_packet_fuzzer
|
||
|
|
```
|
||
|
|
2. Run on device
|
||
|
|
```
|
||
|
|
$ adb sync data
|
||
|
|
$ adb shell /data/fuzz/arm64/mtp_packet_fuzzer/mtp_packet_fuzzer
|
||
|
|
```
|
||
|
|
|
||
|
|
# <a name="MtpDevice"></a> Fuzzer for MtpDevice
|
||
|
|
|
||
|
|
MtpDevice supports the following parameters:
|
||
|
|
1. Device Name (parameter name: "deviceName")
|
||
|
|
|
||
|
|
| Parameter| Valid Values |Configured Value|
|
||
|
|
|-------------|----------|----- |
|
||
|
|
|`deviceName`| `String` |Value obtained from FuzzedDataProvider|
|
||
|
|
|
||
|
|
#### Steps to run
|
||
|
|
1. Build the fuzzer
|
||
|
|
```
|
||
|
|
$ mm -j$(nproc) mtp_device_fuzzer
|
||
|
|
```
|
||
|
|
2. Run on device
|
||
|
|
```
|
||
|
|
$ adb sync data
|
||
|
|
$ adb shell /data/fuzz/arm64/mtp_device_fuzzer/mtp_device_fuzzer
|
||
|
|
```
|
||
|
|
|
||
|
|
# <a name="MtpRequestPacket"></a> Fuzzer for MtpRequestPacket
|
||
|
|
|
||
|
|
MtpRequestPacket supports the following parameters:
|
||
|
|
1. Data (parameter name: "data")
|
||
|
|
|
||
|
|
| Parameter| Valid Values |Configured Value|
|
||
|
|
|-------------|----------|----- |
|
||
|
|
|`data`| Vector of positive Integer |Value obtained from FuzzedDataProvider|
|
||
|
|
|
||
|
|
#### Steps to run
|
||
|
|
1. Build the fuzzer
|
||
|
|
```
|
||
|
|
$ mm -j$(nproc) mtp_request_packet_fuzzer
|
||
|
|
```
|
||
|
|
2. Run on device
|
||
|
|
```
|
||
|
|
$ adb sync data
|
||
|
|
$ adb shell /data/fuzz/arm64/mtp_request_packet_fuzzer/mtp_request_packet_fuzzer
|
||
|
|
```
|
||
|
|
|
||
|
|
# <a name="MtpEventPacket"></a> Fuzzer for MtpEventPacket
|
||
|
|
|
||
|
|
MtpEventPacket supports the following parameters:
|
||
|
|
1. Size (parameter name: "size")
|
||
|
|
|
||
|
|
| Parameter| Valid Values |Configured Value|
|
||
|
|
|-------------|----------|----- |
|
||
|
|
|`size`| Integer `1` to `1000`, |Value obtained from FuzzedDataProvider|
|
||
|
|
|
||
|
|
#### Steps to run
|
||
|
|
1. Build the fuzzer
|
||
|
|
```
|
||
|
|
$ mm -j$(nproc) mtp_event_packet_fuzzer
|
||
|
|
```
|
||
|
|
2. Run on device
|
||
|
|
```
|
||
|
|
$ adb sync data
|
||
|
|
$ adb shell /data/fuzz/arm64/mtp_event_packet_fuzzer/mtp_event_packet_fuzzer
|
||
|
|
```
|
||
|
|
|
||
|
|
# <a name="MtpResponsePacket"></a> Fuzzer for MtpResponsePacket
|
||
|
|
|
||
|
|
MtpResponsePacket supports the following parameters:
|
||
|
|
1. Size (parameter name: "size")
|
||
|
|
|
||
|
|
| Parameter| Valid Values |Configured Value|
|
||
|
|
|-------------|----------|----- |
|
||
|
|
|`size`| Integer `1` to `1000`, |Value obtained from FuzzedDataProvider|
|
||
|
|
|
||
|
|
#### Steps to run
|
||
|
|
1. Build the fuzzer
|
||
|
|
```
|
||
|
|
$ mm -j$(nproc) mtp_response_packet_fuzzer
|
||
|
|
```
|
||
|
|
2. Run on device
|
||
|
|
```
|
||
|
|
$ adb sync data
|
||
|
|
$ adb shell /data/fuzz/arm64/mtp_response_packet_fuzzer/mtp_response_packet_fuzzer
|
||
|
|
```
|
||
|
|
|
||
|
|
# <a name="MtpDataPacket"></a> Fuzzer for MtpDataPacket
|
||
|
|
|
||
|
|
MtpDataPacket supports the following parameters:
|
||
|
|
1. UrbPacket Division Mode (parameter name: "kUrbPacketDivisionModes")
|
||
|
|
2. Size (parameter name: "size")
|
||
|
|
|
||
|
|
| Parameter| Valid Values |Configured Value|
|
||
|
|
|-------------|----------|----- |
|
||
|
|
|`kUrbPacketDivisionMode`| 1. `FIRST_PACKET_ONLY_HEADER`, 2. `FIRST_PACKET_HAS_PAYLOAD`, |Value obtained from FuzzedDataProvider|
|
||
|
|
|`size`| Integer `1` to `1000`, |Value obtained from FuzzedDataProvider|
|
||
|
|
|
||
|
|
#### Steps to run
|
||
|
|
1. Build the fuzzer
|
||
|
|
```
|
||
|
|
$ mm -j$(nproc) mtp_data_packet_fuzzer
|
||
|
|
```
|
||
|
|
2. Run on device
|
||
|
|
```
|
||
|
|
$ adb sync data
|
||
|
|
$ adb shell /data/fuzz/arm64/mtp_data_packet_fuzzer/mtp_data_packet_fuzzer
|
||
|
|
```
|