etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
README.md (3359B)
      1 # usbipd fuzzer
      2 
      3 AFL++ fuzzing environment for the USB/IP daemon (`usbipd`) and protocol stack.
      4 
      5 Two complementary modes run in parallel:
      6 - **In-process** (fast, ~50k exec/s) — AFL++ calls usbip parsing functions directly with `recv()` intercepted via `--wrap`
      7 - **QEMU network** (deep) — AFL++ sends mutated packets to a live `usbipd` inside a minimal VM; catches kernel-level bugs in the USB/IP module
      8 
      9 ## Quick start
     10 
     11 ```bash
     12 bash setup.sh          # install deps, build AFL++, compile kernel, create initramfs (~20 min)
     13 bash build_fuzzers.sh  # compile harnesses (~30 sec)
     14 bash run-fuzzers.sh    # launch tmux session with both fuzzer instances
     15 ```
     16 
     17 Check status / stop:
     18 ```bash
     19 bash run-fuzzers.sh --status   # afl-whatsup summary
     20 bash cleanup.sh                # kill everything
     21 bash cleanup.sh --keep-corpus  # kill procs + rm builds, keep output/
     22 ```
     23 
     24 Crash backup (run as cron or loop):
     25 ```bash
     26 bash backup-crashes.sh         # archives new unique crashes to ./backups/
     27 # crontab: */15 * * * * /path/to/usbip/backup-crashes.sh
     28 ```
     29 
     30 ## Files
     31 
     32 | File | Purpose |
     33 |------|---------|
     34 | `setup.sh` | Full bootstrap: deps, AFL++, Linux 6.12, busybox, initramfs |
     35 | `build_fuzzers.sh` | Compile harnesses (fast re-build without re-running setup) |
     36 | `run-fuzzers.sh` | Tmux session: AFL++ master + QEMU worker |
     37 | `backup-crashes.sh` | Timestamped, deduplicated crash archival |
     38 | `cleanup.sh` | Kill processes, remove artifacts |
     39 | `fuzz_protocol.c` | op_common header routing harness |
     40 | `fuzz_devlist.c` | Device-list reply parsing (ndev overflow class) |
     41 | `fuzz_import.c` | Device import + busid string edge cases |
     42 | `fuzz_urb.c` | URB header parsing (CVE-2016-3955 class) |
     43 | `mock_syscalls.c` | `__wrap_recv` / `__wrap_send` — feeds AFL input into usbip source |
     44 | `net_send.c` | TCP client that sends AFL input to usbipd in the QEMU VM |
     45 | `fuzz-include/usbip_fuzz.h` | Fuzz buffer, logging stubs, protocol constants |
     46 | `gen_corpus.py` | Generates 87 structured seeds across 7 categories |
     47 | `dictionaries/usbip.dict` | AFL++ dictionary (op codes, URB flags, busid strings) |
     48 | `qemu/init` | Initramfs `/init`: mounts, loads USB/IP modules, watchdog loops usbipd |
     49 | `qemu/kernel.config` | Minimal kernel config (USB/IP + e1000 + serial, no distro cruft) |
     50 
     51 ## Architecture
     52 
     53 ```
     54 AFL++ master ──────────────────► fuzz_protocol (in-process)
     55                                   recv() → g_fuzz_buf (--wrap)
     56                                   ASAN crash → AFL++ detects instantly
     57 
     58 AFL++ worker ──► net_send ──TCP──► usbipd (QEMU VM, port 13240→3240)
     59                                   ECONNRESET → exit(1) → AFL++ marks crash
     60          shared output/ dir
     61          (corpus cross-pollination)
     62 ```
     63 
     64 The QEMU VM boots from `bzImage` + `initramfs.cpio.gz` in under 2 seconds. `usbipd` is restarted immediately on crash by the `/init` watchdog, keeping round-trip latency low.
     65 
     66 ## Notable targets
     67 
     68 - `usbip_net_recv_op_common()` — parses the 8-byte op_common header on every connection
     69 - `usbip_net_recv_op_devlist_reply()` — `ndev` integer overflow / large allocation
     70 - `usbip_net_recv_op_import_reply()` — busid string handling (path traversal, no-NUL)
     71 - URB `transfer_buffer_length` validation — CVE-2016-3955 class (heap overflow via unchecked length field in `USBIP_RET_SUBMIT`)