Alternative interfaces

[jtpereyda]

See Issue #92 Feature Proposal: Alternative Interfaces .

Goal:

• Allow non-socket interfaces (requires abstracting out connection/transmission code so that another object can be swapped in).
• Add serial interface.
• Allow basic logging for serial rx/tx data.

Changes:

• Session class:
  • Refactored out connection and send/recv functionality. This now happens through Target.open(), Target.send(), Target.recv(), Target.close().
  • Added fuzz_data_logger constructor param (see below).
• Target class:
  • Added open, send, recv, close methods.
  • Added host, port, proto, bind, timeout to constructor parameters.
• Connection classes:
  • ITargetConnection is the generic interface for connections.
  • SocketConnection is where the existing sockets code went.
  • SerialConnection is self-explanatory.
• SerialTarget class: Inherits from Target and uses a SerialConnection. Simple class.
• IFuzzLogger and FuzzLogger define the interface and one implementation for logging sent and received fuzz data.
  • A future implementation could use the pcap format, eliminating the need for a separate network monitor.
  • This is used in the Session class, which calls open_test_case to signal a new mutation, and in the Target class to record sent and received data.

Example:

Here is a complete usage example for throwing data at a serial device. Files will be stored in ./exploration-local-caps/.

#!/usr/bin/env python
from sulley import *
from sulley import sessions
from sulley import serial_target
from sulley import fuzz_logger
import logging

# This file demonstrates how to do basic serial fuzzing with Sulley.

# Fuzz data logger:
logger = fuzz_logger.FuzzLogger(path="exploration-local-caps")

# Serial Target:
target = serial_target.SerialTarget(port=1, baudrate=19200, message_separator_time=.3)

# Session
sess = sessions.Session(session_filename="exploration.session", sleep_time=0.25, log_level=logging.INFO,
                        fuzz_data_logger=logger)
sess.add_target(target)

# Fuzz plan
s_initialize("explore")
s_string("???")
sess.connect(s_get("explore"))

print "Geronimo!"
sess.fuzz()

There is no error detection yet, but it's an important start.

[jtpereyda]

raise is a left behind debugging change

[jtpereyda]

Testing:
Besides running a test with the serial interface, I verified that the socket interface still works on my Linux box.