mozillasecurity / peach Goto Github PK

Peach is a fuzzing framework which uses a DSL for building fuzzers and an observer based architecture to execute and monitor them.

License: Mozilla Public License 2.0

Python 99.91% JavaScript 0.09% HTML 0.01%

peach's Introduction

MozPeach is a fork of Peach v2.7 by Mozilla Security. With support from our community and partnerships our goal is to continue to deliver Peach as an open source product with Python compatibility and new features.

Our focus is on usability, speed and fewer dependencies. We have also begun work on Python 3 support, replaced deprecated Python dependencies, switched the XML back-end, added a new configuration system, simplified code and much more.

Setup

Prerequisites for Ubuntu

sudo apt-get --yes --quiet install libxml2-dev libxslt1-dev lib32z1-dev

General

pip install virtualenv
pip install virtualenvwrapper

git clone --depth 1 https://github.com/mozillasecurity/peach

cd peach
git clone --depth 1 https://github.com/mozillasecurity/fuzzdata

mkvirtualenv -r requirements.txt peach

workon peach

Fundamentals

Peach uses XML based "pits" as configuration files. There are two types of pits which we will briefly describe here.

Pit: Data Model

A data-model pit is an XML description of a specification and is required to parse any kind of input into an in-memory XML tree. Peach then uses that tree to generate fuzzed output.

Pit: Target

The target pit is used to define how the target process will get fuzzed, how it will be monitored for suspicious behavior and how to deal with results.

It is optional whether you place everything into one pit however not doing so will simplify working with multiple targets, different hosts and reusing pits. Following the data model/target pit practice will allow the reuse of data model pits across projects.

Examples

Run

./peach.py -pit Pits/<component>/<format>/<name>.xml -target Pits/Targets/firefox.xml -run Browser

HINT: You can set related configuration values for both pits from the command-line by using the -macros switch.

Debug

./peach.py -pit Pits/<component>/<format>/<name>.xml -1 -debug | less -R

NOTE: This will show a very verbose output of the parsing process. To see only the results of the parsing process for each element you can add: "| grep Rating | less -R"

Help Menu

% ./peach.py -h
usage: peach.py [-h] [-pit path] [-run name]
                [-analyzer ANALYZER [ANALYZER ...]] [-parser PARSER]
                [-target TARGET] [-macros MACROS [MACROS ...]] [-seed #]
                [-debug] [-new] [-1] [-range # #] [-test] [-count] [-skipto #]
                [-parallel # #] [-agent # #] [-logging #]
                [-check model samples] [-verbose] [-clean] [-version]

Peach Runtime

optional arguments:
  -h, --help            show this help message and exit
  -pit path             pit file
  -run name             run name
  -analyzer ANALYZER [ANALYZER ...]
                        load analyzer.
  -parser PARSER        use specific parser.
  -target TARGET        select a target pit.
  -macros MACROS [MACROS ...]
                        override configuration macros
  -seed #               seed
  -debug                turn on debugging. (default: False)
  -new                  use new relations.
  -1                    run single test case.
  -range # #            run range of test cases.
  -test                 validate pit file.
  -count                count test cases for deterministic strategies.
  -skipto #             skip to a test case number.
  -parallel # #         use parallelism.
  -agent # #            start agent.
  -logging #            verbosity level of logging
  -check model samples  validate a data model against a set of samples.
  -verbose              turn verbosity on. (default: False)
  -clean                remove python object files.
  -version              show program's version number and exit

Resources

Resources which aid in building a pit based on the grammar of a file format:

* http://www.sweetscape.com/010editor/templates/
* http://www.synalysis.net/formats.xml

peach's People

Contributors

Stargazers

Watchers

Forkers

admurray magicyb sigma-random tengfei1010 bigpigg key20 dolfcao pombredanne halo2me defanlt strazzere wyylucky kursh bilalnaqvi gitcollect samdney blursight machiry jijicanyu ant4g0nist cogbee littledj007 nakshatra04 p3r1k0 k0keoyo jameslinus shengulong cor3sm4sh3r bigbuilding yecharles sireof ieswxia youngcraft ykankaya fuzzamos lokinglz olderlong yzx-fish pcanyi entropy1337 windyware ch4p34un0ir threezerobravoteam wzugang segfaultmasters wangmianhelo mmg1 coolboy4me chtq cbhust8025 yuroc0598 kumaran-git modulexcite mozilla-github-standards l9sk superf0sh chnxyzz 0x6b7966 awesome-security m4rm0k seabreg breakteam pventuzelo eastierp 5l1v3r1 ics-sec dhvssigrun yanghua-github asll666 who3411 zgq346712481 bluesky129 latkes bladeleafsage shoeper-forks andyincode 1621740748 rajivraj kei-naga ai4dev arcilli hartl3y94 whereisoops jdusane apython123 realwatch crazycars martinviv c0de3 twitchllu gratitechinc dlangman hust-xy ruikangpeng olderboy scriptk1d wenxuefeng3930

peach's Issues

ASanConsoleMonitor doesn't support blocking executable

Hi,

When ASanConsoleMonitor is used to monitor a blocking process (i.e. foreground process), fuzzing process doesn't start.

This is caused by the instruction:
stdout, stderr = self.process.communicate()
in file process.py

Thank you

Hello. I want to know whether you have something like guidance to help me understand what the labels in pit XML mean?

Hello.
I want to know whether you have something like guidance to help me understand what the labels in pit XML mean?
Actually, I'm confused with the pit file.
Thank you very much.

Additional dependency in Ubuntu 14.04 64-bit

Upon running mkvirtualenv -r requirements.txt peach, as shown in the README, I get the following output (prior output excised):

Installing collected packages: zope.interface, Twisted, lxml, psutil, pyasn1, tlslite
  Running setup.py install for lxml
    Complete output from command /home/jeff/.virtualenvs/peach/bin/python -c "import setuptools, tokenize;__file__='/tmp/pip-build-Lyx0_T/lxml/setup.py';exec(compile(getattr(tokenize, 'open', open)(__file__).read().replace('\r\n', '\n'), __file__, 'exec'))" install --record /tmp/pip-yAEYNq-record/install-record.txt --single-version-externally-managed --compile --install-headers /home/jeff/.virtualenvs/peach/include/site/python2.7/lxml:
    /usr/lib/python2.7/distutils/dist.py:267: UserWarning: Unknown distribution option: 'bugtrack_url'
      warnings.warn(msg)
    Building lxml version 3.3.5.
    Building without Cython.
    ERROR: /bin/sh: 1: xslt-config: not found

    ** make sure the development packages of libxml2 and libxslt are installed **

    Using build configuration of libxslt
    running install
    running build
    running build_py
    copying src/lxml/includes/lxml-version.h -> build/lib.linux-x86_64-2.7/lxml/includes
    running build_ext
    building 'lxml.etree' extension
    x86_64-linux-gnu-gcc -pthread -fno-strict-aliasing -DNDEBUG -g -fwrapv -O2 -Wall -Wstrict-prototypes -fPIC -I/tmp/pip-build-Lyx0_T/lxml/src/lxml/includes -I/usr/include/python2.7 -c src/lxml/lxml.etree.c -o build/temp.linux-x86_64-2.7/src/lxml/lxml.etree.o -w
    In file included from src/lxml/lxml.etree.c:346:0:
    /tmp/pip-build-Lyx0_T/lxml/src/lxml/includes/etree_defs.h:9:31: fatal error: libxml/xmlversion.h: No such file or directory
     #include "libxml/xmlversion.h"
                                   ^
    compilation terminated.
    error: command 'x86_64-linux-gnu-gcc' failed with exit status 1

    ----------------------------------------
Command "/home/jeff/.virtualenvs/peach/bin/python -c "import setuptools, tokenize;__file__='/tmp/pip-build-Lyx0_T/lxml/setup.py';exec(compile(getattr(tokenize, 'open', open)(__file__).read().replace('\r\n', '\n'), __file__, 'exec'))" install --record /tmp/pip-yAEYNq-record/install-record.txt --single-version-externally-managed --compile --install-headers /home/jeff/.virtualenvs/peach/include/site/python2.7/lxml" failed with error code 1 in /tmp/pip-build-Lyx0_T/lxml

Installing libxslt1-dev (sudo apt-get install libxslt1-dev) was necessary for me. If you add a line for apt-get prerequisites, you may want to add python-pip as well.

Required Text - All text under the headings Community Participation Guidelines and How to Report, are required, and should not be altered.
Optional Text - The Project Specific Etiquette heading provides a space to speak more specifically about ways people can work effectively and inclusively together. Some examples of those can be found on the Firefox Debugger project, and Common Voice. (The optional part is commented out in the raw template file, and will not be visible until you modify and uncomment that part.)

If you have any questions about this file, or Code of Conduct policies and procedures, please see Mozilla-GitHub-Standards or email [email protected].

(Message COC001)