/src/capstonev5/suite/fuzz/fuzz_disasm.c
Line  | Count  | Source  | 
1  |  | // the following must precede stdio (woo, thanks msft)  | 
2  |  | #if defined(_MSC_VER) && _MSC_VER < 1900  | 
3  |  | #define _CRT_SECURE_NO_WARNINGS  | 
4  |  | #endif  | 
5  |  |  | 
6  |  | #include <stdio.h>  | 
7  |  | #include <stdlib.h>  | 
8  |  | #include <inttypes.h>  | 
9  |  |  | 
10  |  | #include <capstone/capstone.h>  | 
11  |  |  | 
12  |  | #include "platform.h"  | 
13  |  |  | 
14  |  | int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);  | 
15  |  |  | 
16  |  |  | 
17  |  | static FILE *outfile = NULL;  | 
18  |  |  | 
19  | 129k  | int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { | 
20  | 129k  |     csh handle;  | 
21  | 129k  |     cs_insn *all_insn;  | 
22  | 129k  |     cs_detail *detail;  | 
23  | 129k  |     cs_err err;  | 
24  | 129k  |     unsigned int i;  | 
25  |  |  | 
26  | 129k  |     if (Size < 1) { | 
27  |  |         // 1 byte for arch choice  | 
28  | 0  |         return 0;  | 
29  | 129k  |     } else if (Size > 0x1000) { | 
30  |  |         //limit input to 4kb  | 
31  | 0  |         Size = 0x1000;  | 
32  | 0  |     }  | 
33  |  |  | 
34  | 129k  |     if (outfile == NULL) { | 
35  |  |         // we compute the output  | 
36  | 2  |         outfile = fopen("/dev/null", "w"); | 
37  | 2  |         if (outfile == NULL) { | 
38  | 0  |             return 0;  | 
39  | 0  |         }  | 
40  | 2  |     }  | 
41  |  |  | 
42  | 129k  |     i = get_platform_entry((uint8_t)Data[0]);  | 
43  |  |  | 
44  | 129k  |     err = cs_open(platforms[i].arch, platforms[i].mode, &handle);  | 
45  | 129k  |     if (err) { | 
46  | 8  |         return 0;  | 
47  | 8  |     }  | 
48  |  |  | 
49  | 129k  |     cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON);  | 
50  | 129k  |     if (Data[0]&0x80) { | 
51  |  |         //hack  | 
52  | 36.7k  |         cs_option(handle, CS_OPT_SYNTAX, CS_OPT_SYNTAX_ATT);  | 
53  | 36.7k  |     }  | 
54  |  |  | 
55  | 129k  |     uint64_t address = 0x1000;  | 
56  | 129k  |     size_t count = cs_disasm(handle, Data+1, Size-1, address, 0, &all_insn);  | 
57  |  |  | 
58  | 129k  |     if (count) { | 
59  | 126k  |         size_t j;  | 
60  | 126k  |         unsigned int n;  | 
61  |  |  | 
62  | 6.37M  |         for (j = 0; j < count; j++) { | 
63  | 6.25M  |             cs_insn *i = &(all_insn[j]);  | 
64  | 6.25M  |             fprintf(outfile, "0x%"PRIx64":\t%s\t\t%s // insn-ID: %u, insn-mnem: %s\n",  | 
65  | 6.25M  |                    i->address, i->mnemonic, i->op_str,  | 
66  | 6.25M  |                    i->id, cs_insn_name(handle, i->id));  | 
67  |  |  | 
68  | 6.25M  |             detail = i->detail;  | 
69  |  |  | 
70  | 6.25M  |             if (detail->regs_read_count > 0) { | 
71  | 1.35M  |                 fprintf(outfile, "\tImplicit registers read: ");  | 
72  | 3.48M  |                 for (n = 0; n < detail->regs_read_count; n++) { | 
73  | 2.12M  |                     fprintf(outfile, "%s ", cs_reg_name(handle, detail->regs_read[n]));  | 
74  | 2.12M  |                 }  | 
75  | 1.35M  |             }  | 
76  |  |  | 
77  | 6.25M  |             if (detail->regs_write_count > 0) { | 
78  | 2.34M  |                 fprintf(outfile, "\tImplicit registers modified: ");  | 
79  | 5.20M  |                 for (n = 0; n < detail->regs_write_count; n++) { | 
80  | 2.85M  |                     fprintf(outfile, "%s ", cs_reg_name(handle, detail->regs_write[n]));  | 
81  | 2.85M  |                 }  | 
82  | 2.34M  |             }  | 
83  |  |  | 
84  | 6.25M  |             if (detail->groups_count > 0) { | 
85  | 3.59M  |                 fprintf(outfile, "\tThis instruction belongs to groups: ");  | 
86  | 8.66M  |                 for (n = 0; n < detail->groups_count; n++) { | 
87  | 5.07M  |                     fprintf(outfile, "%s ", cs_group_name(handle, detail->groups[n]));  | 
88  | 5.07M  |                 }  | 
89  | 3.59M  |             }  | 
90  | 6.25M  |         }  | 
91  |  |  | 
92  | 126k  |         fprintf(outfile, "0x%"PRIx64":\n", all_insn[j-1].address + all_insn[j-1].size);  | 
93  | 126k  |         cs_free(all_insn, count);  | 
94  | 126k  |     }  | 
95  |  |  | 
96  | 129k  |     cs_close(&handle);  | 
97  |  |  | 
98  | 129k  |     return 0;  | 
99  | 129k  | }  |