// Copyright (c) 2008-2009 Nokia Corporation and/or its subsidiary(-ies).
// All rights reserved.
// This component and the accompanying materials are made available
// under the terms of the License "Eclipse Public License v1.0"
// which accompanies this distribution, and is available
// at the URL "http://www.eclipse.org/legal/epl-v10.html".
//
// Initial Contributors:
// Nokia Corporation - initial contribution.
//
// Contributors:
//
// Description:
// f32test\loader\security\t_fuzzldr.cpp
// 
//

#define __E32TEST_EXTENSION__
#include <e32test.h>
#include <e32svr.h>
#include <e32uid.h>
#include <f32file.h>
#include <f32image.h>
#include "t_hash.h"

// Fuzzing parameters

const TInt KFuzzImages = 5;
const TInt KRandomFieldIterations = 8;
const TTimeIntervalMicroSeconds32 KDllTimeout = 10 * 1000000;

#define FUZZFIELD(OBJ, NAME) { (const TText*)(L ## #OBJ L"." L ## #NAME), sizeof(((OBJ*)8)->NAME), _FOFF(OBJ, NAME) }
#define DUMBFIELD(NAME, SIZE, OFFSET) { (const TText*)L ## NAME, SIZE, OFFSET }
#define FUZZEND { NULL, 0, 0 }

struct SFuzzField
	{
	const TText* name;
	TInt size;
	TInt offset;
	};

const SFuzzField HeaderFields[] =
	{
	FUZZFIELD(E32ImageHeaderV, iUid1),
	FUZZFIELD(E32ImageHeaderV, iUid2),
	FUZZFIELD(E32ImageHeaderV, iUid3),
	FUZZFIELD(E32ImageHeaderV, iUidChecksum),
	FUZZFIELD(E32ImageHeaderV, iSignature),
	FUZZFIELD(E32ImageHeaderV, iHeaderCrc),
	FUZZFIELD(E32ImageHeaderV, iModuleVersion),
	FUZZFIELD(E32ImageHeaderV, iCompressionType),
	FUZZFIELD(E32ImageHeaderV, iToolsVersion.iMajor),
	FUZZFIELD(E32ImageHeaderV, iToolsVersion.iMinor),
	FUZZFIELD(E32ImageHeaderV, iToolsVersion.iBuild),
	FUZZFIELD(E32ImageHeaderV, iTimeLo),
	FUZZFIELD(E32ImageHeaderV, iTimeHi),
	FUZZFIELD(E32ImageHeaderV, iFlags),
	FUZZFIELD(E32ImageHeaderV, iCodeSize),
	FUZZFIELD(E32ImageHeaderV, iDataSize),
	FUZZFIELD(E32ImageHeaderV, iHeapSizeMin),
	FUZZFIELD(E32ImageHeaderV, iHeapSizeMax),
	FUZZFIELD(E32ImageHeaderV, iStackSize),
	FUZZFIELD(E32ImageHeaderV, iBssSize),
	FUZZFIELD(E32ImageHeaderV, iEntryPoint),
	FUZZFIELD(E32ImageHeaderV, iCodeBase),
	FUZZFIELD(E32ImageHeaderV, iDataBase),
	FUZZFIELD(E32ImageHeaderV, iDllRefTableCount),
	FUZZFIELD(E32ImageHeaderV, iExportDirOffset),
	FUZZFIELD(E32ImageHeaderV, iExportDirCount),
	FUZZFIELD(E32ImageHeaderV, iTextSize),
	FUZZFIELD(E32ImageHeaderV, iCodeOffset),
	FUZZFIELD(E32ImageHeaderV, iDataOffset),
	FUZZFIELD(E32ImageHeaderV, iImportOffset),
	FUZZFIELD(E32ImageHeaderV, iCodeRelocOffset),
	FUZZFIELD(E32ImageHeaderV, iDataRelocOffset),
	FUZZFIELD(E32ImageHeaderV, iProcessPriority),
	FUZZFIELD(E32ImageHeaderV, iCpuIdentifier),
	FUZZFIELD(E32ImageHeaderV, iUncompressedSize),
	FUZZFIELD(E32ImageHeaderV, iS.iSecureId),
	FUZZFIELD(E32ImageHeaderV, iS.iVendorId),
	FUZZFIELD(E32ImageHeaderV, iS.iCaps.iCaps[0]),
	FUZZFIELD(E32ImageHeaderV, iS.iCaps.iCaps[1]),
	FUZZFIELD(E32ImageHeaderV, iExceptionDescriptor),
	FUZZFIELD(E32ImageHeaderV, iSpare2),
	FUZZFIELD(E32ImageHeaderV, iExportDescSize),
	FUZZFIELD(E32ImageHeaderV, iExportDescType),
	FUZZFIELD(E32ImageHeaderV, iExportDesc[0]),
	FUZZEND
	};

const SFuzzField ImportSectionFields[] =
	{
	FUZZFIELD(E32ImportSection, iSize),
	FUZZEND
	};

const SFuzzField ImportBlockFields[] =
	{
	FUZZFIELD(E32ImportBlock, iOffsetOfDllName), // we should fuzz the string also
	FUZZFIELD(E32ImportBlock, iNumberOfImports),
	FUZZEND
	};

const SFuzzField ImportEntryFields[] =
	{
	DUMBFIELD("import", 4, 0),
	FUZZEND
	};

const SFuzzField RelocSectionFields[] =
	{
	FUZZFIELD(E32RelocSection, iSize),
	FUZZFIELD(E32RelocSection, iNumberOfRelocs),
	FUZZEND
	};

const SFuzzField RelocBlockFields[] =
	{
	FUZZFIELD(E32RelocBlock, iPageOffset),
	FUZZFIELD(E32RelocBlock, iBlockSize),
	FUZZEND
	};

const SFuzzField RelocEntryFields[] =
	{
	DUMBFIELD("reloc", 2, 0),
	FUZZEND
	};

const SFuzzField ExportEntryFields[] =
	{
	DUMBFIELD("export", 4, 0),
	FUZZEND
	};

const SFuzzField CompressedDataFields[] =
	{
	DUMBFIELD("data1", 4, 0),
	DUMBFIELD("data2", 4, 4),
	DUMBFIELD("data3", 4, 16),
	DUMBFIELD("data4", 4, 64),
	DUMBFIELD("data5", 4, 256),
	DUMBFIELD("data6", 4, 1024),
	DUMBFIELD("data7", 4, 4096),
	FUZZEND
	};

// Values to try for different sizes, signed here but can be interpreted as either
// each will also try the smaller sizes' values
const TInt8 Values8[] = { KMinTInt8, -100, -10, -2, -1, 0, 1, 2, 10, 100, KMaxTInt8 };
const TInt Values8Count = sizeof(Values8)/sizeof(TInt8);
const TInt16 Values16[] = { KMinTInt16, -10000, -256, -255, 128, 255, 256, 10000, KMaxTInt16 };
const TInt Values16Count = sizeof(Values16)/sizeof(TInt16);
const TInt32 Values32[] = { KMinTInt32, -1000000000, -65536, -65535, 32768, 65535, 65536, 268435455, 268435456, 1000000000, KMaxTInt32 };
const TInt Values32Count = sizeof(Values32)/sizeof(TInt32);
const TInt ValuesCount[] = { 0, Values8Count, Values8Count+Values16Count, 0, Values8Count+Values16Count+Values32Count };
const TInt Offsets[] = { 1, 2, 4, 16, -1, -2, -4, -16 };
const TInt OffsetsCount = sizeof(Offsets)/sizeof(TInt);

// Regular boring definitions and stuff

RTest test(_L("T_FUZZLDR"));
RFs TheFs;
CFileMan* FileMan;

_LIT(KOrigDir, "Z:\\sys\\bin\\");
_LIT(KSysBin, ":\\sys\\bin\\");
_LIT(KSysHash, ":\\sys\\hash\\");
_LIT(KImageName, "fuzzv");
_LIT(KExeExt, ".exe");
_LIT(KDllExt, ".dll");
_LIT(KMyself, "t_fuzzldr");
_LIT(KSlaveArg, "-l ");

TFileName Provided;
TFileName Original;
TFileName Current;
TFileName Hash;
TFileName HashDir;
TBool LoadDll;
RFile File;
RTimer Timer;
TUint8* Target;
E32ImageHeaderV* Header;
E32ImageHeaderV* CleanHeader;
CSHA1* Hasher;

TInt FileSize;
TInt OutFileSize;
TUint8* CleanFileData;
TPtr8 CleanFileDes(CleanFileData, 0);
TUint8* FileData;
TPtr8 FileDes(FileData, 0);
TUint8* EndOfFile;
TChar Drive = '?', InternalDrive = '?', RemovableDrive = '?';

TBool Verbose;
TBool Forever = EFalse;
TUint32 Seed = 0;
typedef void (*TFieldFuzzer)(const SFuzzField*, TInt);

enum SetMode {
	ESetLiteral,
	ESetOffset,
	ESetRandom,
	ESetXor,
};

enum ValueMode {
	EValLiteral,
	EValOffset,
	EValRandom,
	EValXor,
	EValList,
	EValOffsetList,
};


TUint32 Rand()
	{
	Seed *= 69069;
	Seed += 5;
	return Seed;
	}


TUint32 Rand(TUint32 aLimit)
	{
	TUint64 temp = (TUint64)Rand() * (TUint64)aLimit;
	return (TUint32)(temp>>32);
	}


void PrepareName(TInt aNum, TBool aDll)
	{
	Original = KOrigDir;
	Original += KImageName;
	Original.AppendNum(aNum);
	Original += aDll ? KDllExt : KExeExt;
	Current.Zero();
	Current.Append(Drive);
	Current += KSysBin;
	Current += KImageName;
	Current.AppendNum(aNum);
	Current += aDll ? KDllExt : KExeExt;
	Hash = HashDir;
	Hash += KImageName;
	Hash.AppendNum(aNum);
	Hash += aDll ? KDllExt : KExeExt;
	}


void PrepareProvidedName()
	{
	Original = KOrigDir;
	Original += Provided;
	Current.Zero();
	Current.Append(Drive);
	Current += KSysBin;
	Current += Provided;
	Hash = HashDir;
	Hash += Provided;
	}


void MakeCleanCopy()
	{
	Mem::Copy(FileData, CleanFileData, FileSize);
	}


void LoadCleanFile()
	{
	test_KErrNone(File.Open(TheFs, Original, EFileRead));
	test_KErrNone(File.Size(FileSize));
	OutFileSize = FileSize;
	CleanFileData = new TUint8[FileSize];
	test_NotNull(CleanFileData);
	FileData = new TUint8[FileSize];
	EndOfFile = FileData + FileSize;
	test_NotNull(FileData);
	CleanFileDes.Set(CleanFileData, 0, FileSize);
	test_KErrNone(File.Read(CleanFileDes));
	File.Close();
	Header = (E32ImageHeaderV*)FileData;
	CleanHeader = (E32ImageHeaderV*)CleanFileData;
	FileDes.Set(FileData, FileSize, FileSize);
	MakeCleanCopy();
	test(CleanHeader->iUid1==(TUint32)KExecutableImageUidValue || CleanHeader->iUid1==(TUint32)KDynamicLibraryUidValue);
	LoadDll = CleanHeader->iUid1==(TUint32)KDynamicLibraryUidValue;
	}


void DoneFile()
	{
	delete[] FileData;
	delete[] CleanFileData;
	}


void RecalcChecksums()
	{
	if (Header->iUidChecksum == CleanHeader->iUidChecksum)
		{
		TUidType uids = *(const TUidType*)Header;
		TCheckedUid chkuid(uids);
		const TUint32* pChkUid = (const TUint32*)&chkuid;
		Header->iUidChecksum = pChkUid[3];
		}
	if (Header->iHeaderCrc == CleanHeader->iHeaderCrc)
		{
		Header->iHeaderCrc = KImageCrcInitialiser;
		TUint32 crc = 0;
		Mem::Crc32(crc, Header, sizeof(E32ImageHeaderV));
		Header->iHeaderCrc = crc;
		}
	}


void Load()
	{
	RecalcChecksums();
	test_KErrNone(File.Replace(TheFs, Current, EFileWrite));
	test_KErrNone(File.Write(FileDes, OutFileSize));
	test_KErrNone(File.Flush());
	File.Close();
	if (Drive == RemovableDrive)
		{
		TPtrC8 data(FileData, OutFileSize);
		Hasher->Reset();
		Hasher->Update(data);
		TBuf8<SHA1_HASH> hashVal = Hasher->Final();
		test_KErrNone(File.Replace(TheFs, Hash, EFileWrite));
		test_KErrNone(File.Write(hashVal));
		test_KErrNone(File.Flush());
		File.Close();
		}
	RProcess p;
	TInt r;
	if (LoadDll)
		{
		TFileName args;
		args.Copy(KSlaveArg);
		args.Append(Current);
		test_KErrNone(p.Create(KMyself, args));
		TRequestStatus logon, rendez, timeout;
		p.Logon(logon);
		p.Rendezvous(rendez);
		p.Resume();
		User::WaitForRequest(rendez);
		test(rendez==KErrNone);
		Timer.After(timeout, KDllTimeout);
		User::WaitForRequest(logon, timeout);
		if (logon == KRequestPending)
			{
			p.Kill(0);
			User::WaitForRequest(logon);
			}
		else
			{
			Timer.Cancel();
			User::WaitForRequest(timeout);
			}
		p.Close();
		// we don't check the return code as passing it back makes the log output
		// super spammy with KPANIC on - it prints for every nonzero return code.
		if (Verbose) test.Printf(_L("\n"));
		}
	else
		{
		r = p.Create(Current, KNullDesC);
		if (r==KErrNone)
			p.Kill(0);
		if (Verbose) test.Printf(_L("=> %d\n"), r);
		}
	p.Close();
	}


template <typename T> void SetFieldTo(const SFuzzField* aField, T aSetTo, SetMode aMode)
	{
	T* field = (T*)(Target + aField->offset);
	if ((TUint8*)field >= EndOfFile)
		{
		if (Verbose) test.Printf(_L("skipping, eof "));
		return;
		}
	if (aMode == ESetOffset)
		aSetTo += *field;
	else if (aMode == ESetRandom)
		aSetTo = (T)Rand();
	else if (aMode == ESetXor)
		aSetTo ^= *field;
	*field = aSetTo;
	if (Verbose) test.Printf(_L("%d "), aSetTo);
	}


void SetField(const SFuzzField* aField, TInt aValue, ValueMode aMode)
	{
	if (aMode < EValList)
		{
		switch(aField->size)
			{
		case 1:
			SetFieldTo<TInt8>(aField, aValue, (SetMode)aMode);
			break;
		case 2:
			SetFieldTo<TInt16>(aField, aValue, (SetMode)aMode);
			break;
		case 4:
			SetFieldTo<TInt32>(aField, aValue, (SetMode)aMode);
			break;
			}
		}
	else if (aMode == EValList)
		{
		switch(aField->size)
			{
		case 1:
			SetFieldTo<TInt8>(aField, Values8[aValue], ESetLiteral);
			break;
		case 2:
			if (aValue < ValuesCount[1])
				SetFieldTo<TInt16>(aField, Values8[aValue], ESetLiteral);
			else
				SetFieldTo<TInt16>(aField, Values16[aValue-ValuesCount[1]], ESetLiteral);
			break;
		case 4:
			if (aValue < ValuesCount[1])
				SetFieldTo<TInt32>(aField, Values8[aValue], ESetLiteral);
			else if (aValue < ValuesCount[2])
				SetFieldTo<TInt32>(aField, Values16[aValue-ValuesCount[1]], ESetLiteral);
			else
				SetFieldTo<TInt32>(aField, Values32[aValue-ValuesCount[2]], ESetLiteral);
			break;
			}
		}
	else if (aMode == EValOffsetList)
		{
		switch(aField->size)
			{
		case 1:
			SetFieldTo<TInt8>(aField, Offsets[aValue], ESetOffset);
			break;
		case 2:
			SetFieldTo<TInt16>(aField, Offsets[aValue], ESetOffset);
			break;
		case 4:
			SetFieldTo<TInt32>(aField, Offsets[aValue], ESetOffset);
			break;
			}
		}
	}


void FuzzFieldsDeterministically(const SFuzzField* aFields, TInt aOffset)
	{
	Target = FileData + aOffset;

	TInt f = -1;
   	while (aFields[++f].name)
		{
		test.Printf(_L("FIELD: %s ...\n"), aFields[f].name);
		TInt v;
		if (Verbose) test.Next(_L("Using preset values"));
		for (v = 0; v < ValuesCount[aFields[f].size]; ++v)
			{
			MakeCleanCopy();
			SetField(&aFields[f], v, EValList);
			Load();
			}
		if (Verbose) test.Next(_L("Using preset offsets"));
		for (v = 0; v < OffsetsCount; ++v)
			{
			MakeCleanCopy();
			SetField(&aFields[f], v, EValOffsetList);
			Load();
			}
		if (Verbose) test.Next(_L("Flipping single bits"));
		for (v = 0; v < aFields[f].size*8; ++v)
			{
			MakeCleanCopy();
			SetField(&aFields[f], 1<<v, EValXor);
			Load();
			}
		if (Verbose) test.Next(_L("Inverting"));
		MakeCleanCopy();
		SetField(&aFields[f], 0xffffffffu, EValXor);
		Load();

		// things that are offsets all go below, pointless on
		// narrow fields
		if (aFields[f].size == 4)
			{
			if (Verbose) test.Next(_L("Using filesize relative values"));
			for (v = FileSize-4; v <= FileSize+4; ++v)
				{
				MakeCleanCopy();
				SetField(&aFields[f], v, EValLiteral);
				Load();
				}
			if (Verbose) test.Next(_L("Using code-end relative values"));
			TInt codeend = CleanHeader->iCodeSize + CleanHeader->iCodeOffset;
			for (v = codeend-4; v <= codeend+4; ++v)
				{
				MakeCleanCopy();
				SetField(&aFields[f], v, EValLiteral);
				Load();
				}
			}
		}
	}


void FuzzFieldsRandomly(const SFuzzField* aFields, TInt aOffset)
	{
	Target = FileData + aOffset;

	TInt f = 0;
   	while (aFields[f].name)
		{
		test.Printf(_L("FIELD: %s ... (random)\n"), aFields[f].name);
		TInt v;
		for (v = 0; v < KRandomFieldIterations; ++v)
			{
			MakeCleanCopy();
			SetField(&aFields[f], 0, EValRandom);
			Load();
			}
		f++;
		}
	}


void FuzzBlockRandomly(TInt aOffset, TInt aSize)
	{
	SFuzzField field;
	field.size = 1;
	Target = FileData + aOffset;
	
	test.Printf(_L("FIELD: random words in data\n"));
	TInt v;
	for (v = 0; v < KRandomFieldIterations * 4; ++v)
		{
		MakeCleanCopy();
		field.offset = Rand(aSize);
		if (Verbose) test.Printf(_L("@ %d, "), field.offset);
		SetField(&field, 0, EValRandom);
		Load();
		}
	}


void FuzzFile(TBool aRandom)
	{
	TTime before, after;
	before.UniversalTime();
	LoadCleanFile();
	
	TFieldFuzzer FuzzFields = aRandom ? FuzzFieldsRandomly : FuzzFieldsDeterministically;

	// E32ImageHeader
	FuzzFields(HeaderFields, 0);

	if (CleanHeader->iCompressionType == KFormatNotCompressed)
		{
		// import table
		TInt offset = CleanHeader->iImportOffset;
		if (offset != 0)
			{
			FuzzFields(ImportSectionFields, offset);
			offset += sizeof(E32ImportSection);
			FuzzFields(ImportBlockFields, offset);
			offset += sizeof(E32ImportBlock);
			FuzzFields(ImportEntryFields, offset);
			}

		// code relocations
		offset = CleanHeader->iCodeRelocOffset;
		if (offset != 0)
			{
			FuzzFields(RelocSectionFields, offset);
			offset += sizeof(E32RelocSection);
			FuzzFields(RelocBlockFields, offset);
			offset += sizeof(E32RelocBlock);
			FuzzFields(RelocEntryFields, offset);
			}

		// data relocations
		offset = CleanHeader->iDataRelocOffset;
		if (offset != 0)
			{
			FuzzFields(RelocSectionFields, offset);
			offset += sizeof(E32RelocSection);
			FuzzFields(RelocBlockFields, offset);
			offset += sizeof(E32RelocBlock);
			FuzzFields(RelocEntryFields, offset);
			}

		// export table
		offset = CleanHeader->iExportDirOffset;
		if (offset != 0)
			{
			FuzzFields(ExportEntryFields, offset);
			}
		}
	else
		{
		if (aRandom)
			{
			// random bits of the compressed data
			FuzzBlockRandomly(CleanHeader->iCodeOffset, FileSize - CleanHeader->iCodeOffset);
			}
		else
			{
			// arbitrary bits of the compressed data
			FuzzFields(CompressedDataFields, CleanHeader->iCodeOffset);
			}
		}

	DoneFile();
	after.UniversalTime();
	TTimeIntervalSeconds interval;
	after.SecondsFrom(before, interval);
	test.Printf(_L("Took %d seconds\n"), interval.Int());
	}


void FuzzTruncateTo(TInt size)
	{
	OutFileSize = size - 4;
	if (Verbose) test.Printf(_L("%d "), OutFileSize);
	Load();
	OutFileSize = size - 1;
	if (Verbose) test.Printf(_L("%d "), OutFileSize);
	Load();
	if (size == FileSize)
		return;
	OutFileSize = size;
	if (Verbose) test.Printf(_L("%d "), OutFileSize);
	Load();
	OutFileSize = size + 1;
	if (Verbose) test.Printf(_L("%d "), OutFileSize);
	Load();
	OutFileSize = size + 4;
	if (Verbose) test.Printf(_L("%d "), OutFileSize);
	Load();
	}


void FuzzTruncate()
	{
	TTime before, after;
	before.UniversalTime();
	LoadCleanFile();

	FuzzTruncateTo(CleanHeader->iCodeOffset);
	if (CleanHeader->iCompressionType == KFormatNotCompressed)
		FuzzTruncateTo(CleanHeader->iCodeOffset+CleanHeader->iCodeSize);
	FuzzTruncateTo(FileSize);

	DoneFile();
	after.UniversalTime();
	TTimeIntervalSeconds interval;
	after.SecondsFrom(before, interval);
	test.Printf(_L("Took %d seconds\n"), interval.Int());
	}


void FuzzAllTestImages()
	{
	TInt i;
	Drive = InternalDrive;
	test.Next(_L("Fuzzing deterministically"));
	for (i=1; i<=KFuzzImages; ++i)
		{
		test.Next(_L("Next binary..."));
		test.Printf(_L("Fuzzing exe %d\n"), i);
		PrepareName(i, EFalse);
		FuzzFile(EFalse);
		if(i==5)
			continue; // DLL 5 doesn't exist because toolchain doesn't like DLLs with no exports
		test.Next(_L("Next binary..."));
		test.Printf(_L("Fuzzing dll %d\n"), i);
		PrepareName(i, ETrue);
		FuzzFile(EFalse);
		}
	Drive = RemovableDrive;
	test.Next(_L("Fuzzing deterministically on removable media"));
	for (i=1; i<=KFuzzImages; ++i)
		{
		test.Next(_L("Next binary..."));
		test.Printf(_L("Fuzzing exe %d\n"), i);
		PrepareName(i, EFalse);
		FuzzFile(EFalse);
		if(i==5)
			continue; // DLL 5 doesn't exist because toolchain doesn't like DLLs with no exports
		test.Next(_L("Next binary..."));
		test.Printf(_L("Fuzzing dll %d\n"), i);
		PrepareName(i, ETrue);
		FuzzFile(EFalse);
		}
	Drive = InternalDrive;
	test.Next(_L("Fuzzing by truncation"));
	for (i=1; i<=KFuzzImages; ++i)
		{
		test.Next(_L("Next binary..."));
		test.Printf(_L("Fuzzing exe %d\n"), i);
		PrepareName(i, EFalse);
		FuzzTruncate();
		if(i==5)
			continue; // DLL 5 doesn't exist because toolchain doesn't like DLLs with no exports
		test.Next(_L("Next binary..."));
		test.Printf(_L("Fuzzing dll %d\n"), i);
		PrepareName(i, ETrue);
		FuzzTruncate();
		}	
	Drive = RemovableDrive;
	test.Next(_L("Fuzzing by truncation on removable media"));
	for (i=1; i<=KFuzzImages; ++i)
		{
		test.Next(_L("Next binary..."));
		test.Printf(_L("Fuzzing exe %d\n"), i);
		PrepareName(i, EFalse);
		FuzzTruncate();
		if(i==5)
			continue; // DLL 5 doesn't exist because toolchain doesn't like DLLs with no exports
		test.Next(_L("Next binary..."));
		test.Printf(_L("Fuzzing dll %d\n"), i);
		PrepareName(i, ETrue);
		FuzzTruncate();
		}	
	test.Next(_L("Fuzzing randomly"));
	do
		{
		for (i=1; i<=KFuzzImages; ++i)
			{
			Drive = InternalDrive;
			test.Next(_L("Next binary..."));
			test.Printf(_L("Fuzzing exe %d\n"), i);
			PrepareName(i, EFalse);
			FuzzFile(ETrue);
			if(i==5)
				continue; // DLL 5 doesn't exist because toolchain doesn't like DLLs with no exports
			test.Next(_L("Next binary..."));
			test.Printf(_L("Fuzzing dll %d\n"), i);
			PrepareName(i, ETrue);
			FuzzFile(ETrue);
			Drive = RemovableDrive;
			test.Next(_L("Next binary..."));
			test.Printf(_L("Fuzzing exe %d on removable media\n"), i);
			PrepareName(i, EFalse);
			FuzzFile(ETrue);
			if(i==5)
				continue; // DLL 5 doesn't exist because toolchain doesn't like DLLs with no exports
			test.Next(_L("Next binary..."));
			test.Printf(_L("Fuzzing dll %d on removable media\n"), i);
			PrepareName(i, ETrue);
			FuzzFile(ETrue);
			}
		}
	while (Forever);
	}


void FuzzProvidedImage()
	{
	test.Printf(_L("Fuzzing file %S\n"), &Provided);
	PrepareProvidedName();
	Drive = InternalDrive;
	test.Next(_L("Fuzzing deterministically"));
	FuzzFile(EFalse);
	Drive = RemovableDrive;
	test.Next(_L("Fuzzing deterministically on removable media"));
	FuzzFile(EFalse);
	test.Next(_L("Fuzzing by truncation"));
	FuzzTruncate();
	Drive = RemovableDrive;
	test.Next(_L("Fuzzing by truncation on removable media"));
	FuzzTruncate();
	test.Next(_L("Fuzzing randomly"));
	do
		{
		Drive = InternalDrive;
		test.Next(_L("Internal drive"));
		FuzzFile(ETrue);
		Drive = RemovableDrive;
		test.Next(_L("Removable drive"));
		FuzzFile(ETrue);
		}
	while (Forever);
	}


GLDEF_C TInt E32Main()
	{
	// default to verbose unless the fasttest trace flag is on
	Verbose = (UserSvr::DebugMask(2)&0x00000002) == 0;

	TFileName cmd;
	User::CommandLine(cmd);
	TLex lex(cmd);
	FOREVER
		{
		lex.SkipSpace();
		if (lex.Eos())
			break;
		TChar next = lex.Peek();
		if (next == '-' || next == '/')
			{
			// option
			lex.Inc();
			switch(lex.Get())
				{
			case 'v':
				Verbose = ETrue;
				break;
			case 'q':
				Verbose = EFalse;
				break;
			case 'l':
				{
				// being used as a slave to load a DLL
				TPtrC libname(lex.NextToken());
				RLibrary l;
				RProcess::Rendezvous(KErrNone);
				l.Load(libname);
				return KErrNone;
				}
			case 's':
				// random seed
				lex.SkipSpace();
				test_KErrNone(lex.Val(Seed, EHex));
				test.Printf(_L("Using supplied random seed %08x\n"), Seed);
				break;
			case 'f':
				// run forever
				Forever = ETrue;
				break;
				}
			}
		else
			{
			// filename, at least i assume it is :)
			Provided.Copy(lex.NextToken());
			}
		}

	test.Title();
	test.Next(_L("Setup"));
	__UHEAP_MARK;
	CTrapCleanup* cleanup;
	cleanup=CTrapCleanup::New();

	if (Seed == 0)
		{
		TTime time;
		time.UniversalTime();
		Seed = (TUint32)time.Int64();
		test.Printf(_L("Random seed is %08x\n"), Seed);
		}

	test_KErrNone(TheFs.Connect());
	test_TRAP(FileMan=CFileMan::NewL(TheFs));
	test_KErrNone(Timer.CreateLocal());
	test_TRAP(Hasher=CSHA1::NewL());
	HashDir.Append(TheFs.GetSystemDriveChar());
	HashDir.Append(KSysHash);
	TInt r = TheFs.MkDirAll(HashDir);
	test(r == KErrNone || r == KErrAlreadyExists);	

	// Find some interesting drives
	for (TInt driveno = EDriveA; driveno <= EDriveZ; ++driveno)
		{
		TDriveInfo di;
		test_KErrNone(TheFs.Drive(di, driveno));
		if (di.iType == EMediaNotPresent)
			continue;
		TChar drivechar;
		test_KErrNone(TheFs.DriveToChar(driveno, drivechar));
		if ((di.iDriveAtt & KDriveAttInternal) && InternalDrive == '?')
			InternalDrive = drivechar;
		else if ((di.iDriveAtt & KDriveAttRemovable) && RemovableDrive == '?')
			RemovableDrive = drivechar;
		else
			continue;

		TFileName fn;
		fn.Append(drivechar);
		fn.Append(KSysBin);
		TheFs.MkDirAll(fn);
		test(r == KErrNone || r == KErrAlreadyExists);	
		}
	test.Printf(_L("Using %c as internal drive, %c as removable\n"), (TUint)InternalDrive, (TUint)RemovableDrive);

	// Turn off evil lazy dll unloading
	RLoader l;
	test_KErrNone(l.Connect());
	test_KErrNone(l.CancelLazyDllUnload());
	l.Close();

	test.Start(_L("Fuzzing loader"));
	if (Provided.Length() == 0)
		FuzzAllTestImages();
	else
		FuzzProvidedImage();
	test.End();

	delete Hasher;
	Timer.Close();
	delete FileMan;
	TheFs.Close();
	test.Close();
	delete cleanup;
	__UHEAP_MARKEND;
	return KErrNone;
	}