balrog

~ ELF file analysis tool to be used after firmware extraction
git clone https://github.com/djnnvx/balrog.git
scorecard.rs (1524B)
      1 use std::process::Command;
      2 
      3 fn run(bin: &str, class: &str) -> String {
      4     let exe = env!("CARGO_BIN_EXE_balrog");
      5     let out = Command::new(exe)
      6         .args([
      7             "scan",
      8             bin,
      9             "--class",
     10             class,
     11             "--min=0",
     12             "--per-bin=99",
     13             "-n",
     14             "10",
     15         ])
     16         .output()
     17         .expect("balrog runs");
     18     String::from_utf8_lossy(&out.stdout).into_owned()
     19 }
     20 
     21 fn expect(var: &str, class: &str, proofs: &[&str]) {
     22     let Ok(path) = std::env::var(var) else {
     23         eprintln!("skip {var}: not set");
     24         return;
     25     };
     26     let out = run(&path, class);
     27     for p in proofs {
     28         assert!(out.contains(p), "{var}: missing evidence {p:?} in:\n{out}");
     29     }
     30 }
     31 
     32 #[test]
     33 fn proftpd_efmlog_stack_overflow() {
     34     expect(
     35         "BALROG_PROFTPD",
     36         "mem",
     37         &[
     38             "sprintf",
     39             "\"%s(%s)\"",
     40             "destination is a stack buffer",
     41             "unbounded write",
     42         ],
     43     );
     44 }
     45 
     46 #[test]
     47 fn easydisc_udp_command_injection() {
     48     expect(
     49         "BALROG_EASYDISC",
     50         "exec",
     51         &[
     52             "system",
     53             "dev_sta set -m esw_networkId_merge",
     54             "same function as a network/env input",
     55         ],
     56     );
     57 }
     58 
     59 #[test]
     60 fn porter_unauthenticated_root_socket() {
     61     expect(
     62         "BALROG_PORTER",
     63         "ipc",
     64         &[
     65             "bind",
     66             "/tmp/porter.sock",
     67             "no SO_PEERCRED",
     68             "qid_sys_execute_update_script",
     69         ],
     70     );
     71 }