etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
usbip.dict (2829B)
      1 # USB/IP AFL++ dictionary
      2 # Protocol tokens as binary keywords for smarter mutations.
      3 #
      4 # Usage: afl-fuzz -x dictionaries/usbip.dict ...
      5 
      6 # Protocol version
      7 version_0x0111="\x01\x11"
      8 
      9 # Operation codes (big-endian, 2 bytes)
     10 op_req_devlist="\x80\x05"
     11 op_rep_devlist="\x00\x05"
     12 op_req_import="\x80\x03"
     13 op_rep_import="\x00\x03"
     14 
     15 # op_common header prefix: version + OP_REQ_DEVLIST
     16 op_hdr_devlist="\x01\x11\x80\x05"
     17 op_hdr_import="\x01\x11\x80\x03"
     18 
     19 # Status codes (4 bytes, big-endian)
     20 status_ok="\x00\x00\x00\x00"
     21 status_error="\x00\x00\x00\x01"
     22 
     23 # URB command types (4 bytes, big-endian)
     24 cmd_submit="\x00\x00\x00\x01"
     25 cmd_unlink="\x00\x00\x00\x02"
     26 ret_submit="\x00\x00\x00\x03"
     27 ret_unlink="\x00\x00\x00\x04"
     28 
     29 # Common busid strings
     30 busid_1_1="1-1"
     31 busid_2_1="2-1"
     32 busid_1_2="1-2"
     33 
     34 # Interesting 32-bit values (length / count fields)
     35 u32_zero="\x00\x00\x00\x00"
     36 u32_one="\x00\x00\x00\x01"
     37 u32_max="\xff\xff\xff\xff"
     38 u32_intmin="\x80\x00\x00\x00"
     39 u32_intmax="\x7f\xff\xff\xff"
     40 u32_65536="\x00\x01\x00\x00"
     41 u32_256="\x00\x00\x01\x00"
     42 
     43 # USB speed values (used in usbip_usb_device.speed)
     44 speed_low="\x00\x00\x00\x01"
     45 speed_full="\x00\x00\x00\x02"
     46 speed_high="\x00\x00\x00\x03"
     47 speed_super="\x00\x00\x00\x05"
     48 
     49 # Transfer flags (URB submit)
     50 urb_short_not_ok="\x00\x00\x00\x01"
     51 urb_iso_asap="\x00\x00\x00\x02"
     52 urb_no_transfer_dma="\x00\x00\x00\x04"
     53 urb_zero_packet="\x00\x00\x00\x40"
     54 
     55 # USB setup packet templates (8 bytes)
     56 setup_get_descriptor="\x80\x06\x00\x01\x00\x00\xff\x00"
     57 setup_set_address="\x00\x05\x01\x00\x00\x00\x00\x00"
     58 setup_set_config="\x00\x09\x01\x00\x00\x00\x00\x00"
     59 setup_clear_feature="\x02\x01\x00\x00\x00\x00\x00\x00"
     60 setup_all_ff="\xff\xff\xff\xff\xff\xff\xff\xff"
     61 
     62 # Sysfs path prefix (used in usbip_usb_device.path)
     63 sysfs_path="/sys/devices/pci0000:00/"
     64 sysfs_usb_prefix="/sys/bus/usb/devices/"
     65 
     66 # USB setup packet bRequest values (single byte — control transfer discriminators)
     67 usb_req_get_status="\x00"
     68 usb_req_clear_feature="\x01"
     69 usb_req_set_feature="\x03"
     70 usb_req_set_address="\x05"
     71 usb_req_get_descriptor="\x06"
     72 usb_req_set_descriptor="\x07"
     73 usb_req_get_config="\x08"
     74 usb_req_set_config="\x09"
     75 usb_req_get_interface="\x0a"
     76 usb_req_set_interface="\x0b"
     77 
     78 # USB descriptor types (wValue high byte in GET_DESCRIPTOR)
     79 usb_dt_device="\x01"
     80 usb_dt_config="\x02"
     81 usb_dt_string="\x03"
     82 usb_dt_interface="\x04"
     83 usb_dt_endpoint="\x05"
     84 usb_dt_qualifier="\x06"
     85 
     86 # ISO overflow trigger values: number_of_packets that cause n*16 to wrap (4-byte BE)
     87 # 0x08000001: n*16 = 0x80000010 → overflows int32 → negative size → kmalloc underalloc
     88 # 0x10000001: n*16 = 0x100000010 → truncated uint32 = 0x10 → 16-byte alloc, n*16 bytes used
     89 # 0x40000000: n*16 = 0x400000000 → wraps u32 to 0 → kmalloc(0)
     90 iso_np_overflow_08="\x08\x00\x00\x01"
     91 iso_np_overflow_10="\x10\x00\x00\x01"
     92 iso_np_overflow_40="\x40\x00\x00\x00"