| #!/usr/bin/env python3 |
| # |
| # Copyright (C) 2016 The Android Open Source Project |
| # |
| # Licensed under the Apache License, Version 2.0 (the "License"); |
| # you may not use this file except in compliance with the License. |
| # You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, software |
| # distributed under the License is distributed on an "AS IS" BASIS, |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| # See the License for the specific language governing permissions and |
| # limitations under the License. |
| |
| import argparse |
| import os |
| import shutil |
| import sys |
| |
| from glob import glob |
| from subprocess import call |
| from tempfile import mkdtemp |
| |
| sys.path.append(os.path.dirname(os.path.dirname( |
| os.path.realpath(__file__)))) |
| |
| from common.common import FatalError |
| from common.common import GetEnvVariableOrError |
| from common.common import RetCode |
| from common.common import RunCommand |
| |
| |
| # |
| # Tester class. |
| # |
| |
| |
| class DexFuzzTester(object): |
| """Tester that feeds JFuzz programs into DexFuzz testing.""" |
| |
| def __init__(self, num_tests, num_inputs, device, dexer, debug_info): |
| """Constructor for the tester. |
| |
| Args: |
| num_tests: int, number of tests to run |
| num_inputs: int, number of JFuzz programs to generate |
| device: string, target device serial number (or None) |
| dexer: string, defines dexer |
| debug_info: boolean, if True include debugging info |
| """ |
| self._num_tests = num_tests |
| self._num_inputs = num_inputs |
| self._device = device |
| self._save_dir = None |
| self._results_dir = None |
| self._dexfuzz_dir = None |
| self._inputs_dir = None |
| self._dexfuzz_env = None |
| self._dexer = dexer |
| self._debug_info = debug_info |
| |
| def __enter__(self): |
| """On entry, enters new temp directory after saving current directory. |
| |
| Raises: |
| FatalError: error when temp directory cannot be constructed |
| """ |
| self._save_dir = os.getcwd() |
| self._results_dir = mkdtemp(dir='/tmp/') |
| self._dexfuzz_dir = mkdtemp(dir=self._results_dir) |
| self._inputs_dir = mkdtemp(dir=self._dexfuzz_dir) |
| if self._results_dir is None or self._dexfuzz_dir is None or \ |
| self._inputs_dir is None: |
| raise FatalError('Cannot obtain temp directory') |
| self._dexfuzz_env = os.environ.copy() |
| self._dexfuzz_env['ANDROID_DATA'] = self._dexfuzz_dir |
| top = GetEnvVariableOrError('ANDROID_BUILD_TOP') |
| self._dexfuzz_env['PATH'] = (top + '/art/tools/bisection_search:' + |
| self._dexfuzz_env['PATH']) |
| android_root = GetEnvVariableOrError('ANDROID_HOST_OUT') |
| self._dexfuzz_env['ANDROID_ROOT'] = android_root |
| self._dexfuzz_env['LD_LIBRARY_PATH'] = android_root + '/lib' |
| os.chdir(self._dexfuzz_dir) |
| os.mkdir('divergent_programs') |
| os.mkdir('bisection_outputs') |
| return self |
| |
| def __exit__(self, etype, evalue, etraceback): |
| """On exit, re-enters previously saved current directory and cleans up.""" |
| os.chdir(self._save_dir) |
| # TODO: detect divergences or shutil.rmtree(self._results_dir) |
| |
| def Run(self): |
| """Feeds JFuzz programs into DexFuzz testing.""" |
| print() |
| print('**\n**** J/DexFuzz Testing\n**') |
| print() |
| print('#Tests :', self._num_tests) |
| print('Device :', self._device) |
| print('Directory :', self._results_dir) |
| print() |
| self.GenerateJFuzzPrograms() |
| self.RunDexFuzz() |
| |
| def CompileOnHost(self): |
| """Compiles Test.java into classes.dex using either javac/dx or d8. |
| |
| Raises: |
| FatalError: error when compilation fails |
| """ |
| if self._dexer == 'dx' or self._dexer == 'd8': |
| dbg = '-g' if self._debug_info else '-g:none' |
| if RunCommand(['javac', '--release=8', dbg, 'Test.java'], |
| out=None, err='jerr.txt', timeout=30) != RetCode.SUCCESS: |
| print('Unexpected error while running javac') |
| raise FatalError('Unexpected error while running javac') |
| cfiles = glob('*.class') |
| dx = 'dx' if self._dexer == 'dx' else 'd8-compat-dx' |
| if RunCommand([dx, '--dex', '--output=classes.dex'] + cfiles, |
| out=None, err='dxerr.txt', timeout=30) != RetCode.SUCCESS: |
| print('Unexpected error while running dx') |
| raise FatalError('Unexpected error while running dx') |
| # Cleanup on success (nothing to see). |
| for cfile in cfiles: |
| os.unlink(cfile) |
| os.unlink('jerr.txt') |
| os.unlink('dxerr.txt') |
| else: |
| raise FatalError('Unknown dexer: ' + self._dexer) |
| |
| def GenerateJFuzzPrograms(self): |
| """Generates JFuzz programs. |
| |
| Raises: |
| FatalError: error when generation fails |
| """ |
| os.chdir(self._inputs_dir) |
| for i in range(1, self._num_inputs + 1): |
| if RunCommand(['jfuzz'], out='Test.java', err=None) != RetCode.SUCCESS: |
| print('Unexpected error while running JFuzz') |
| raise FatalError('Unexpected error while running JFuzz') |
| self.CompileOnHost() |
| shutil.move('Test.java', '../Test' + str(i) + '.java') |
| shutil.move('classes.dex', 'classes' + str(i) + '.dex') |
| |
| def RunDexFuzz(self): |
| """Starts the DexFuzz testing.""" |
| os.chdir(self._dexfuzz_dir) |
| dexfuzz_args = ['--inputs=' + self._inputs_dir, |
| '--execute', |
| '--execute-class=Test', |
| '--repeat=' + str(self._num_tests), |
| '--quiet', |
| '--dump-output', |
| '--dump-verify', |
| '--interpreter', |
| '--optimizing', |
| '--bisection-search'] |
| if self._device is not None: |
| dexfuzz_args += ['--device=' + self._device, '--allarm'] |
| else: |
| dexfuzz_args += ['--host'] # Assume host otherwise. |
| cmd = ['dexfuzz'] + dexfuzz_args |
| print('**** Running ****\n\n', cmd, '\n') |
| call(cmd, env=self._dexfuzz_env) |
| print('\n**** Results (report.log) ****\n') |
| call(['tail', '-n 24', 'report.log']) |
| |
| |
| def main(): |
| # Handle arguments. |
| parser = argparse.ArgumentParser() |
| parser.add_argument('--num_tests', default=1000, type=int, |
| help='number of tests to run (default: 1000)') |
| parser.add_argument('--num_inputs', default=10, type=int, |
| help='number of JFuzz program to generate (default: 10)') |
| parser.add_argument('--device', help='target device serial number') |
| parser.add_argument('--dexer', default='dx', type=str, |
| help='defines dexer as dx or d8 (default: dx)') |
| parser.add_argument('--debug_info', default=False, action='store_true', |
| help='include debugging info') |
| args = parser.parse_args() |
| # Run the DexFuzz tester. |
| with DexFuzzTester(args.num_tests, |
| args.num_inputs, |
| args.device, |
| args.dexer, args.debug_info) as fuzzer: |
| fuzzer.Run() |
| |
| if __name__ == '__main__': |
| main() |
