// Copyright (c) 2008-2009 Nokia Corporation and/or its subsidiary(-ies).

// All rights reserved.

// This component and the accompanying materials are made available

// under the terms of the License "Eclipse Public License v1.0"

// which accompanies this distribution, and is available

// at the URL "http://www.eclipse.org/legal/epl-v10.html".

//

// Initial Contributors:

// Nokia Corporation - initial contribution.

//

// Contributors:

//

// Description:

// f32test\loader\security\t_fuzzldr.cpp

// 

//

#define __E32TEST_EXTENSION__

#include <e32test.h>

#include <e32uid.h>

#include <f32file.h>

#include <f32image.h>

#include "t_hash.h"

// Fuzzing parameters

const TInt KFuzzImages = 5;

const TInt KRandomFieldIterations = 8;

const TTimeIntervalMicroSeconds32 KDllTimeout = 10 * 1000000;

#define FUZZFIELD(OBJ, NAME) { (const TText*)(L ## #OBJ L"." L ## #NAME), sizeof(((OBJ*)8)->NAME), _FOFF(OBJ, NAME) }

#define DUMBFIELD(NAME, SIZE, OFFSET) { (const TText*)L ## NAME, SIZE, OFFSET }

#define FUZZEND { NULL, 0, 0 }

struct SFuzzField

	{

	const TText* name;

	TInt size;

	TInt offset;

	};

const SFuzzField HeaderFields[] =

	{

	FUZZFIELD(E32ImageHeaderV, iUid1),

	FUZZFIELD(E32ImageHeaderV, iUid2),

	FUZZFIELD(E32ImageHeaderV, iUid3),

	FUZZFIELD(E32ImageHeaderV, iUidChecksum),

	FUZZFIELD(E32ImageHeaderV, iSignature),

	FUZZFIELD(E32ImageHeaderV, iHeaderCrc),

	FUZZFIELD(E32ImageHeaderV, iModuleVersion),

	FUZZFIELD(E32ImageHeaderV, iCompressionType),

	FUZZFIELD(E32ImageHeaderV, iToolsVersion.iMajor),

	FUZZFIELD(E32ImageHeaderV, iToolsVersion.iMinor),

	FUZZFIELD(E32ImageHeaderV, iToolsVersion.iBuild),

	FUZZFIELD(E32ImageHeaderV, iTimeLo),

	FUZZFIELD(E32ImageHeaderV, iTimeHi),

	FUZZFIELD(E32ImageHeaderV, iFlags),

	FUZZFIELD(E32ImageHeaderV, iCodeSize),

	FUZZFIELD(E32ImageHeaderV, iDataSize),

	FUZZFIELD(E32ImageHeaderV, iHeapSizeMin),

	FUZZFIELD(E32ImageHeaderV, iHeapSizeMax),

	FUZZFIELD(E32ImageHeaderV, iStackSize),

	FUZZFIELD(E32ImageHeaderV, iBssSize),

	FUZZFIELD(E32ImageHeaderV, iEntryPoint),

	FUZZFIELD(E32ImageHeaderV, iCodeBase),

	FUZZFIELD(E32ImageHeaderV, iDataBase),

	FUZZFIELD(E32ImageHeaderV, iDllRefTableCount),

	FUZZFIELD(E32ImageHeaderV, iExportDirOffset),

	FUZZFIELD(E32ImageHeaderV, iExportDirCount),

	FUZZFIELD(E32ImageHeaderV, iTextSize),

	FUZZFIELD(E32ImageHeaderV, iCodeOffset),

	FUZZFIELD(E32ImageHeaderV, iDataOffset),

	FUZZFIELD(E32ImageHeaderV, iImportOffset),

	FUZZFIELD(E32ImageHeaderV, iCodeRelocOffset),

	FUZZFIELD(E32ImageHeaderV, iDataRelocOffset),

	FUZZFIELD(E32ImageHeaderV, iProcessPriority),

	FUZZFIELD(E32ImageHeaderV, iCpuIdentifier),

	FUZZFIELD(E32ImageHeaderV, iUncompressedSize),

	FUZZFIELD(E32ImageHeaderV, iS.iSecureId),

	FUZZFIELD(E32ImageHeaderV, iS.iVendorId),

	FUZZFIELD(E32ImageHeaderV, iS.iCaps.iCaps[0]),

	FUZZFIELD(E32ImageHeaderV, iS.iCaps.iCaps[1]),

	FUZZFIELD(E32ImageHeaderV, iExceptionDescriptor),

	FUZZFIELD(E32ImageHeaderV, iSpare2),

	FUZZFIELD(E32ImageHeaderV, iExportDescSize),

	FUZZFIELD(E32ImageHeaderV, iExportDescType),

	FUZZFIELD(E32ImageHeaderV, iExportDesc[0]),

	FUZZEND

	};

const SFuzzField ImportSectionFields[] =

	{

	FUZZFIELD(E32ImportSection, iSize),

	FUZZEND

	};

const SFuzzField ImportBlockFields[] =

	{

	FUZZFIELD(E32ImportBlock, iOffsetOfDllName), // we should fuzz the string also

	FUZZFIELD(E32ImportBlock, iNumberOfImports),

	FUZZEND

	};

const SFuzzField ImportEntryFields[] =

	{

	DUMBFIELD("import", 4, 0),

	FUZZEND

	};

const SFuzzField RelocSectionFields[] =

	{

	FUZZFIELD(E32RelocSection, iSize),

	FUZZFIELD(E32RelocSection, iNumberOfRelocs),

	FUZZEND

	};

const SFuzzField RelocBlockFields[] =

	{

	FUZZFIELD(E32RelocBlock, iPageOffset),

	FUZZFIELD(E32RelocBlock, iBlockSize),

	FUZZEND

	};

const SFuzzField RelocEntryFields[] =

	{

	DUMBFIELD("reloc", 2, 0),

	FUZZEND

	};

const SFuzzField ExportEntryFields[] =

	{

	DUMBFIELD("export", 4, 0),

	FUZZEND

	};

const SFuzzField CompressedDataFields[] =

	{

	DUMBFIELD("data1", 4, 0),

	DUMBFIELD("data2", 4, 4),

	DUMBFIELD("data3", 4, 16),

	DUMBFIELD("data4", 4, 64),

	DUMBFIELD("data5", 4, 256),

	DUMBFIELD("data6", 4, 1024),

	DUMBFIELD("data7", 4, 4096),

	FUZZEND

	};

// Values to try for different sizes, signed here but can be interpreted as either

// each will also try the smaller sizes' values

const TInt8 Values8[] = { KMinTInt8, -100, -10, -2, -1, 0, 1, 2, 10, 100, KMaxTInt8 };

const TInt Values8Count = sizeof(Values8)/sizeof(TInt8);

const TInt16 Values16[] = { KMinTInt16, -10000, -256, -255, 128, 255, 256, 10000, KMaxTInt16 };

const TInt Values16Count = sizeof(Values16)/sizeof(TInt16);

const TInt32 Values32[] = { KMinTInt32, -1000000000, -65536, -65535, 32768, 65535, 65536, 268435455, 268435456, 1000000000, KMaxTInt32 };

const TInt Values32Count = sizeof(Values32)/sizeof(TInt32);

const TInt ValuesCount[] = { 0, Values8Count, Values8Count+Values16Count, 0, Values8Count+Values16Count+Values32Count };

const TInt Offsets[] = { 1, 2, 4, 16, -1, -2, -4, -16 };

const TInt OffsetsCount = sizeof(Offsets)/sizeof(TInt);

// Regular boring definitions and stuff

RTest test(_L("T_FUZZLDR"));

RFs TheFs;

CFileMan* FileMan;

_LIT(KOrigDir, "Z:\\sys\\bin\\");

_LIT(KSysBin, ":\\sys\\bin\\");

_LIT(KSysHash, ":\\sys\\hash\\");

_LIT(KImageName, "fuzzv");

_LIT(KExeExt, ".exe");

_LIT(KDllExt, ".dll");

_LIT(KMyself, "t_fuzzldr");

_LIT(KSlaveArg, "-l ");

TFileName Provided;

TFileName Original;

TFileName Current;

TFileName Hash;

TFileName HashDir;

TBool LoadDll;

RFile File;

RTimer Timer;

TUint8* Target;

E32ImageHeaderV* Header;

E32ImageHeaderV* CleanHeader;

CSHA1* Hasher;

TInt FileSize;

TInt OutFileSize;

TUint8* CleanFileData;

TPtr8 CleanFileDes(CleanFileData, 0);

TUint8* FileData;

TPtr8 FileDes(FileData, 0);

TUint8* EndOfFile;

TChar Drive = '?', InternalDrive = '?', RemovableDrive = '?';

TBool Verbose;

TBool Forever = EFalse;

TUint32 Seed = 0;

typedef void (*TFieldFuzzer)(const SFuzzField*, TInt);

enum SetMode {

	ESetLiteral,

	ESetOffset,

	ESetRandom,

	ESetXor,

};

enum ValueMode {

	EValLiteral,

	EValOffset,

	EValRandom,

	EValXor,

	EValList,

	EValOffsetList,

};

TUint32 Rand()

	{

	Seed *= 69069;

	Seed += 5;

	return Seed;

	}

TUint32 Rand(TUint32 aLimit)

	{

	TUint64 temp = (TUint64)Rand() * (TUint64)aLimit;

	return (TUint32)(temp>>32);

	}

void PrepareName(TInt aNum, TBool aDll)

	{

	Original = KOrigDir;

	Original += KImageName;

	Original.AppendNum(aNum);

	Original += aDll ? KDllExt : KExeExt;

	Current.Zero();

	Current.Append(Drive);

	Current += KSysBin;

	Current += KImageName;

	Current.AppendNum(aNum);

	Current += aDll ? KDllExt : KExeExt;

	Hash = HashDir;

	Hash += KImageName;

	Hash.AppendNum(aNum);

	Hash += aDll ? KDllExt : KExeExt;

	}

void PrepareProvidedName()

	{

	Original = KOrigDir;

	Original += Provided;

	Current.Zero();

	Current.Append(Drive);

	Current += KSysBin;

	Current += Provided;

	Hash = HashDir;

	Hash += Provided;

	}

void MakeCleanCopy()

	{

	Mem::Copy(FileData, CleanFileData, FileSize);

	}

void LoadCleanFile()

	{

	test_KErrNone(File.Open(TheFs, Original, EFileRead));

	test_KErrNone(File.Size(FileSize));

	OutFileSize = FileSize;

	CleanFileData = new TUint8[FileSize];

	test_NotNull(CleanFileData);

	FileData = new TUint8[FileSize];

	EndOfFile = FileData + FileSize;

	test_NotNull(FileData);

	CleanFileDes.Set(CleanFileData, 0, FileSize);

	test_KErrNone(File.Read(CleanFileDes));

	File.Close();

	Header = (E32ImageHeaderV*)FileData;

	CleanHeader = (E32ImageHeaderV*)CleanFileData;

	FileDes.Set(FileData, FileSize, FileSize);

	MakeCleanCopy();

	test(CleanHeader->iUid1==(TUint32)KExecutableImageUidValue || CleanHeader->iUid1==(TUint32)KDynamicLibraryUidValue);

	LoadDll = CleanHeader->iUid1==(TUint32)KDynamicLibraryUidValue;

	}

void DoneFile()

	{

	delete[] FileData;

	delete[] CleanFileData;

	}

void RecalcChecksums()

	{

	if (Header->iUidChecksum == CleanHeader->iUidChecksum)

		{

		TUidType uids = *(const TUidType*)Header;

		TCheckedUid chkuid(uids);

		const TUint32* pChkUid = (const TUint32*)&chkuid;

		Header->iUidChecksum = pChkUid[3];

		}

	if (Header->iHeaderCrc == CleanHeader->iHeaderCrc)

		{

		Header->iHeaderCrc = KImageCrcInitialiser;

		TUint32 crc = 0;

		Mem::Crc32(crc, Header, sizeof(E32ImageHeaderV));

		Header->iHeaderCrc = crc;

		}

	}

void Load()

	{

	RecalcChecksums();

	test_KErrNone(File.Replace(TheFs, Current, EFileWrite));

	test_KErrNone(File.Write(FileDes, OutFileSize));

	test_KErrNone(File.Flush());

	File.Close();

	if (Drive == RemovableDrive)

		{

		TPtrC8 data(FileData, OutFileSize);

		Hasher->Reset();

		Hasher->Update(data);

		TBuf8<SHA1_HASH> hashVal = Hasher->Final();

		test_KErrNone(File.Replace(TheFs, Hash, EFileWrite));

		test_KErrNone(File.Write(hashVal));

		test_KErrNone(File.Flush());

		File.Close();

		}

	RProcess p;

	TInt r;

	if (LoadDll)

		{

		TFileName args;

		args.Copy(KSlaveArg);

		args.Append(Current);

		test_KErrNone(p.Create(KMyself, args));

		TRequestStatus logon, rendez, timeout;

		p.Logon(logon);

		p.Rendezvous(rendez);

		p.Resume();

		User::WaitForRequest(rendez);

		test(rendez==KErrNone);

		Timer.After(timeout, KDllTimeout);

		User::WaitForRequest(logon, timeout);

		if (logon == KRequestPending)

			{

			p.Kill(0);

			User::WaitForRequest(logon);

			}

		else

			{

			Timer.Cancel();

			User::WaitForRequest(timeout);

			}

		p.Close();

		// we don't check the return code as passing it back makes the log output

		// super spammy with KPANIC on - it prints for every nonzero return code.

		if (Verbose) test.Printf(_L("\n"));

		}

	else

		{

		r = p.Create(Current, KNullDesC);

		if (r==KErrNone)

			p.Kill(0);

		if (Verbose) test.Printf(_L("=> %d\n"), r);

		}

	p.Close();

	}

template <typename T> void SetFieldTo(const SFuzzField* aField, T aSetTo, SetMode aMode)

	{

	T* field = (T*)(Target + aField->offset);

	if ((TUint8*)field >= EndOfFile)

		{

		if (Verbose) test.Printf(_L("skipping, eof "));

		return;

		}

	if (aMode == ESetOffset)

		aSetTo += *field;

	else if (aMode == ESetRandom)

		aSetTo = (T)Rand();

	else if (aMode == ESetXor)

		aSetTo ^= *field;

	*field = aSetTo;

	if (Verbose) test.Printf(_L("%d "), aSetTo);

	}

void SetField(const SFuzzField* aField, TInt aValue, ValueMode aMode)

	{

	if (aMode < EValList)

		{

		switch(aField->size)

			{

		case 1:

			SetFieldTo<TInt8>(aField, aValue, (SetMode)aMode);

			break;

		case 2:

			SetFieldTo<TInt16>(aField, aValue, (SetMode)aMode);

			break;

		case 4:

			SetFieldTo<TInt32>(aField, aValue, (SetMode)aMode);

			break;

			}

		}

	else if (aMode == EValList)

		{

		switch(aField->size)

			{

		case 1:

			SetFieldTo<TInt8>(aField, Values8[aValue], ESetLiteral);

			break;

		case 2:

			if (aValue < ValuesCount[1])

				SetFieldTo<TInt16>(aField, Values8[aValue], ESetLiteral);

			else

				SetFieldTo<TInt16>(aField, Values16[aValue-ValuesCount[1]], ESetLiteral);

			break;

		case 4:

			if (aValue < ValuesCount[1])

				SetFieldTo<TInt32>(aField, Values8[aValue], ESetLiteral);

			else if (aValue < ValuesCount[2])

				SetFieldTo<TInt32>(aField, Values16[aValue-ValuesCount[1]], ESetLiteral);

			else

				SetFieldTo<TInt32>(aField, Values32[aValue-ValuesCount[2]], ESetLiteral);

			break;

			}

		}

	else if (aMode == EValOffsetList)

		{

		switch(aField->size)

			{

		case 1:

			SetFieldTo<TInt8>(aField, Offsets[aValue], ESetOffset);

			break;

		case 2:

			SetFieldTo<TInt16>(aField, Offsets[aValue], ESetOffset);

			break;

		case 4:

			SetFieldTo<TInt32>(aField, Offsets[aValue], ESetOffset);

			break;

			}

		}

	}

void FuzzFieldsDeterministically(const SFuzzField* aFields, TInt aOffset)

	{

	Target = FileData + aOffset;

	TInt f = -1;

   	while (aFields[++f].name)

		{

		test.Printf(_L("FIELD: %s ...\n"), aFields[f].name);

		TInt v;

		if (Verbose) test.Next(_L("Using preset values"));

		for (v = 0; v < ValuesCount[aFields[f].size]; ++v)

			{

			MakeCleanCopy();

			SetField(&aFields[f], v, EValList);

			Load();

			}

		if (Verbose) test.Next(_L("Using preset offsets"));

		for (v = 0; v < OffsetsCount; ++v)

			{

			MakeCleanCopy();

			SetField(&aFields[f], v, EValOffsetList);

			Load();

			}

		if (Verbose) test.Next(_L("Flipping single bits"));

		for (v = 0; v < aFields[f].size*8; ++v)

			{

			MakeCleanCopy();

			SetField(&aFields[f], 1<<v, EValXor);

			Load();

			}

		if (Verbose) test.Next(_L("Inverting"));

		MakeCleanCopy();

		SetField(&aFields[f], 0xffffffffu, EValXor);

		Load();

		// things that are offsets all go below, pointless on

		// narrow fields

		if (aFields[f].size == 4)

			{

			if (Verbose) test.Next(_L("Using filesize relative values"));

			for (v = FileSize-4; v <= FileSize+4; ++v)

				{

				MakeCleanCopy();

				SetField(&aFields[f], v, EValLiteral);

				Load();

				}

			if (Verbose) test.Next(_L("Using code-end relative values"));

			TInt codeend = CleanHeader->iCodeSize + CleanHeader->iCodeOffset;

			for (v = codeend-4; v <= codeend+4; ++v)

				{

				MakeCleanCopy();

				SetField(&aFields[f], v, EValLiteral);

				Load();

				}

			}

		}

	}

void FuzzFieldsRandomly(const SFuzzField* aFields, TInt aOffset)

	{

	Target = FileData + aOffset;

	TInt f = 0;

   	while (aFields[f].name)

		{

		test.Printf(_L("FIELD: %s ... (random)\n"), aFields[f].name);

		TInt v;

		for (v = 0; v < KRandomFieldIterations; ++v)

			{

			MakeCleanCopy();