| #!/bin/bash |
| |
| |
| |
| |
| |
| |
| |
| |
|
|
| set -e |
|
|
| ROOT="$(cd "$(dirname "$0")/.." && pwd)" |
| DUMP_DIR="$ROOT/data/dumps_glibc" |
| mkdir -p "$DUMP_DIR" |
|
|
| |
| declare -A UBUNTU_GLIBC |
| UBUNTU_GLIBC[xenial]="2.23" |
| UBUNTU_GLIBC[bionic]="2.27" |
| UBUNTU_GLIBC[focal]="2.31" |
| UBUNTU_GLIBC[jammy]="2.35" |
|
|
| |
| build_image() { |
| local ubuntu_ver=$1 |
| local tag="heap-trm-${ubuntu_ver}" |
|
|
| echo "=== Building ${tag} ===" |
| docker build -t "$tag" -f - "$ROOT" << DOCKERFILE |
| FROM ubuntu:${ubuntu_ver} |
| ENV DEBIAN_FRONTEND=noninteractive |
| RUN apt-get update && apt-get install -y gcc make && rm -rf /var/lib/apt/lists/* |
| WORKDIR /work |
| COPY harness/heapgrid_harness.c harness/Makefile harness/ |
| COPY how2heap/ how2heap/ |
| RUN make -C harness/ |
| DOCKERFILE |
| echo " Built: ${tag}" |
| } |
|
|
| |
| run_technique() { |
| local ubuntu_ver=$1 |
| local glibc_ver=$2 |
| local technique=$3 |
| local tag="heap-trm-${ubuntu_ver}" |
| local how2heap_dir="glibc_${glibc_ver}" |
|
|
| |
| if [ ! -f "$ROOT/how2heap/${how2heap_dir}/${technique}.c" ]; then |
| return 1 |
| fi |
|
|
| local dump_file="${technique}_glibc${glibc_ver//.}.jsonl" |
|
|
| docker run --rm -v "$DUMP_DIR:/dumps" "$tag" bash -c " |
| cd /work |
| gcc -o /tmp/${technique} how2heap/${how2heap_dir}/${technique}.c \ |
| -std=c99 -g -O0 -Wno-all -lpthread 2>/dev/null || exit 1 |
| HEAPGRID_OUT=/dumps/${dump_file} \ |
| LD_PRELOAD=/work/harness/heapgrid_harness.so \ |
| timeout 5 /tmp/${technique} >/dev/null 2>&1 || true |
| " 2>/dev/null |
|
|
| if [ -s "$DUMP_DIR/$dump_file" ]; then |
| local states=$(wc -l < "$DUMP_DIR/$dump_file") |
| echo " [OK] ${technique} (glibc ${glibc_ver}): ${states} states" |
| return 0 |
| else |
| return 1 |
| fi |
| } |
|
|
| |
| TECHNIQUES=( |
| house_of_botcake house_of_einherjar house_of_force house_of_gods |
| house_of_io house_of_lore house_of_mind_fastbin house_of_orange |
| house_of_roman house_of_spirit house_of_storm house_of_tangerine |
| house_of_water |
| fastbin_dup fastbin_dup_consolidate fastbin_dup_into_stack |
| fastbin_reverse_into_tcache tcache_poisoning tcache_house_of_spirit |
| unsafe_unlink overlapping_chunks poison_null_byte large_bin_attack |
| ) |
|
|
| echo "============================================" |
| echo " HeapTRM Cross-glibc Testing" |
| echo "============================================" |
|
|
| |
| for ubuntu_ver in xenial bionic focal jammy; do |
| build_image "$ubuntu_ver" |
| done |
|
|
| |
| echo "" |
| echo "=== Running techniques ===" |
| for ubuntu_ver in xenial bionic focal jammy; do |
| glibc_ver="${UBUNTU_GLIBC[$ubuntu_ver]}" |
| echo "" |
| echo "--- Ubuntu ${ubuntu_ver} (glibc ${glibc_ver}) ---" |
|
|
| ok=0 |
| fail=0 |
| for tech in "${TECHNIQUES[@]}"; do |
| if run_technique "$ubuntu_ver" "$glibc_ver" "$tech"; then |
| ((ok++)) |
| else |
| ((fail++)) |
| fi |
| done |
| echo " Total: ${ok} ok, ${fail} failed/missing" |
| done |
|
|
| echo "" |
| echo "=== Done ===" |
| echo "Dumps in: $DUMP_DIR" |
| echo "Total dump files: $(ls $DUMP_DIR/*.jsonl 2>/dev/null | wc -l)" |
| echo "Total states: $(cat $DUMP_DIR/*.jsonl 2>/dev/null | wc -l)" |
|
|