how to adjust content of a primitive according to another?

[Lerr1uqs]

Assume that a field within protocol header is length(size) which is associated with the content(data) appending to the header's tail(i.e. length = len(data)).
I want the length field do not mutate randomly but adjust it self according to the length of data which is generated by s_random primative and its length is variable.
What should I do?

[cq674350529]

Hi, maybe you can refer to this example: https://github.com/jtpereyda/boofuzz/blob/master/examples/http_with_body.py. Specifically, use s_size() to define the length field, and s_block() to define the content part.

[Lerr1uqs]

write a demo like following:

#!/usr/bin/env python3
# Designed for use with boofuzz v0.2.0

# More advanced request definitions can be found in the request_definitions directory.

from boofuzz import *
import pdb

def main():
    session = Session(
        target=Target(connection=TCPSocketConnection("127.0.0.1", 8888)),
    )

    s_initialize(name="Request")
    with s_block("Request-Line"):
        s_size("Body-Content", output_format="ascii", name="Content-Length-Value")

    # pdb.set_trace()
    with s_block("Body-Content"):
        s_string("AAAAAAAAAA", name="Body-Content-Value", fuzzable = False)


    session.connect(s_get("Request"))

    session.fuzz()

if __name__ == "__main__":
    main()

and it's transmission message:(I use fuzzable=False for simply this question）

[2023-03-10 13:53:13,945]     Transmitted 20 bytes: 34 32 39 34 39 36 37 32 39 32 41 41 41 41 41 41 41 41 41 41 b'4294967292AAAAAAAAAA'
[2023-03-10 13:53:13,945]   Test Step: Contact target monitors
[2023-03-10 13:53:13,945]   Test Step: Cleaning up connections from callbacks
[2023-03-10 13:53:13,945]       Check OK: No crash detected.
[2023-03-10 13:53:13,945]     Info: Closing target connection...
[2023-03-10 13:53:13,945]     Info: Connection closed.
[2023-03-10 13:53:13,946] Test Case: 138: Request:[Request.Request-Line.Content-Length-Value:137]
[2023-03-10 13:53:13,946]     Info: Type: Size
[2023-03-10 13:53:13,946]     Info: Opening target connection (127.0.0.1:8888)...
[2023-03-10 13:53:13,946]     Info: Connection opened.
[2023-03-10 13:53:13,946]   Test Step: Monitor CallbackMonitor#140507666431712[pre=[],post=[],restart=[],post_start_target=[]].pre_send()
[2023-03-10 13:53:13,946]   Test Step: Fuzzing Node 'Request'
[2023-03-10 13:53:13,946]     Info: Sending 20 bytes...
[2023-03-10 13:53:13,946]     Transmitted 20 bytes: 34 32 39 34 39 36 37 32 39 33 41 41 41 41 41 41 41 41 41 41 b'4294967293AAAAAAAAAA'
[2023-03-10 13:53:13,946]   Test Step: Contact target monitors
[2023-03-10 13:53:13,946]   Test Step: Cleaning up connections from callbacks
[2023-03-10 13:53:13,946]       Check OK: No crash detected.
[2023-03-10 13:53:13,946]     Info: Closing target connection...
[2023-03-10 13:53:13,946]     Info: Connection closed.

but 10 41 41 41 41 41 41 41 41 41 41 is my expect ,which 10 represent that length of data "AAAAAAAAAA" is 10.
34 32 39 34 39 36 37 32 39 33 is the transmission times by ASCII representation I think.
This point confusing me a lot.....

[cq674350529]

Thanks for the details. There is an option fuzzable in s_size(), when set to False, this field will not be fuzzed. Its defaule value is True, can you add fuzzable=False and try again?

boofuzz/boofuzz/__init__.py

Lines 489 to 499 in 6340630

	def s_size(
	block_name=None,
	offset=0,
	length=4,
	endian=LITTLE_ENDIAN,
	output_format="binary",
	inclusive=False,
	signed=False,
	math=None,
	fuzzable=True,
	name=None,

In your demo, it will fuzz the field Content-Length-Value (s_size()), as we can see values like 4294967293 in the log.

[Lerr1uqs]

according your suggestion, I modified the demo, activate the fuzzable, convert output_format to binary and limit its length for readability of message.

def main():
    session = Session(
        target=Target(connection=TCPSocketConnection("127.0.0.1", 8888)),
    )

    s_initialize(name="Request")
    with s_block("Request-Line"):
        s_size("Body-Content", output_format="binary", name="Content-Length-Value")

    # pdb.set_trace()
    with s_block("Body-Content"):
        s_string("AAAAAAAAAA", name="Body-Content-Value", max_len= 12)


    session.connect(s_get("Request"))

    session.fuzz()

if __name__ == "__main__":
    main()

It's transmission message is close to my demand, but still have some problem yet...

[2023-03-10 14:38:07,066]     Transmitted 12 bytes: 00 00 00 00 5b 5b 5b 5b 5b 5b 5b 5b b'\x00\x00\x00\x00[[[[[[[['
[2023-03-10 14:38:07,066]   Test Step: Contact target monitors
[2023-03-10 14:38:07,066]   Test Step: Cleaning up connections from callbacks
[2023-03-10 14:38:07,066]       Check OK: No crash detected.
[2023-03-10 14:38:07,066]     Info: Closing target connection...
[2023-03-10 14:38:07,066]     Info: Connection closed.
[2023-03-10 14:38:07,066] Test Case: 629: Request:[Request.Request-Line.Content-Length-Value:0, Request.Body-Content.Body-Content-Value:209]
[2023-03-10 14:38:07,066]     Info: Type: String
[2023-03-10 14:38:07,066]     Info: Opening target connection (127.0.0.1:8888)...
[2023-03-10 14:38:07,066]     Info: Connection opened.
[2023-03-10 14:38:07,066]   Test Step: Monitor CallbackMonitor#139667969949856[pre=[],post=[],restart=[],post_start_target=[]].pre_send()
[2023-03-10 14:38:07,066]   Test Step: Fuzzing Node 'Request'
[2023-03-10 14:38:07,066]     Info: Sending 13 bytes...
[2023-03-10 14:38:07,066]     Transmitted 13 bytes: 00 00 00 00 5b 5b 5b 5b 5b 5b 5b 5b 5b b'\x00\x00\x00\x00[[[[[[[[['

seemings its field of length doesn't change at all.

[Lerr1uqs]

Thanks for the details. There is an option fuzzable in s_size(), when set to False, this field will not be fuzzed. Its defaule value is True, can you add fuzzable=False and try again?

boofuzz/boofuzz/__init__.py

Lines 489 to 499 in 6340630

	def s_size(
	block_name=None,
	offset=0,
	length=4,
	endian=LITTLE_ENDIAN,
	output_format="binary",
	inclusive=False,
	signed=False,
	math=None,
	fuzzable=True,
	name=None,

In your demo, it will fuzz the field Content-Length-Value (s_size()), as we can see values like 4294967293 in the log.

Oh so sorry I misunderstand what you said, I modified s_size()'s fuzzable and it work pretty well now. You can ignore what I last said above cuz it is a mistake. Thank you very much.

[cq674350529]

Glad to hear it works on your side. Sorry for not making it clear about the fuzzable option of s_size() at first, for I though its value was False in default.