chapters/data: Add checkers for memory-security tasks

Done solving the issue 134 : chapters/data/memory-security/drills/tasks: Add solutions and checkers #134
Added the generate_skels.py infrastructure to generate the skeletons from the solutions
Added checkers for the tasks which needed one
Updated the README.md for every task with useful information on how to generate the skels and run the checker
Added solution
Updated generate_skels.py to add support for a task that requires uncommenting lines in the Makefile.

Resolves #134

Signed-off-by: Vica Teodor Andrei <[email protected]>

chapters/data/memory-security/drills/tasks/aslr/Makefile

@@ -4,7 +4,7 @@ SCRIPT = generate_skels.py
 skels:
 	mkdir -p support/src
 	$(PYTHON) $(SCRIPT) --input ./solution/src --output ./support/src
-	$(PYTHON) $(SCRIPT) --input ./solution/tests --output ./support/src/tests
+	$(PYTHON) $(SCRIPT) --input ./solution/tests --output ./support/tests
 
 clean:
 	rm -rf support/

chapters/data/memory-security/drills/tasks/aslr/README.md

@@ -1,5 +1,9 @@
 # ASLR
 
+Navigate to `chapters/data/memory-security/drills/tasks/aslr` and run `make skels` to generate the `support/` folder.
+Then navigate to `support/src`.
+
+
 Use the `Makefile.aslr` file to compile the `chapters/data/memory-security/drills/tasks/aslr/support/aslr.c` file:
 
 ```console
@@ -26,3 +30,17 @@ Disable PIC by uncommenting the `-fno-PIC` and `LDFLAGS` lines.
 We observe that for randomization to work, we need to instruct the OS to randomize the program sections and the compiler to generate code that is position independent.
 
 If you're having difficulties solving this exercise, go through [this](../../../reading/memory-security.md) reading material.
+
+## Checker
+
+To run the checker, go into the `tests` directory located in `src`, then type `make check`.
+A successful output of the checker should look like this :
+
+```console
+student@os:~/.../drills/tasks/aslr/support/src/tests make check
+test_aslr                        ........................ passed ... 100
+
+========================================================================
+
+Total:                                                           100/100
+```

chapters/data/memory-security/drills/tasks/aslr/generate_skels.py

@@ -16,20 +16,23 @@ def process_file(src, dst, pattern, replace, remove, replace_pairs, end_string=N
         sys.exit(1)
 
     fin = open(src, "r")
+    os.makedirs(os.path.dirname(dst), exist_ok=True)
     fout = open(dst, "w")
+
     remove_lines = 0
     skip_lines = 0
     uncomment_lines = 0
     end_found = True
+    makefile_special_handling = "Makefile" in src
 
-    for l in fin.readlines():
+    for i, l in enumerate(fin.readlines()):
         # Skip generation of file.
         if "SKIP_GENERATE" in l:
             fout.close()
             os.remove(dst)
             return
 
-        if end_string and end_found == False:
+        if end_string and not end_found:
             fout.write(l)
             if end_string in l:
                 end_found = True
@@ -54,6 +57,12 @@ def process_file(src, dst, pattern, replace, remove, replace_pairs, end_string=N
             fout.write(l)
             continue
 
+        if makefile_special_handling and "TODO" in l and "Uncomment" in l:
+            fout.write(l)
+            next_line = fin.readline()
+            fout.write("# " + next_line)
+            continue
+
         m = re.search(pattern, l)
         if m:
             if m.group(2):
@@ -86,7 +95,6 @@ def process_file(src, dst, pattern, replace, remove, replace_pairs, end_string=N
 
     fout.close()
 
-
 def main():
     parser = argparse.ArgumentParser(
         description="Generate skeletons sources from reference solution sources"

chapters/data/memory-security/drills/tasks/aslr/solution/src/.gitignore

@@ -0,0 +1 @@
+/aslr

aslr COPY-ORIGINAL/support/Makefile → chapters/data/memory-security/drills/tasks/aslr/solution/src/Makefile

@@ -8,7 +8,10 @@ SRCS = aslr.c
 OBJS = $(SRCS:.c=.o)
 
 # Flags for compiling and linking
+# TODO: Uncomment the -fno-PIC line
 CFLAGS += -fno-stack-protector -fno-PIC
+
+# TODO: Uncomment the LDFLAGS line
 LDFLAGS += -no-pie
 
 # Output binary

chapters/data/memory-security/drills/tasks/exec-shellcode/support/tests/Makefile → chapters/data/memory-security/drills/tasks/aslr/solution/tests/Makefile

@@ -1,6 +1,6 @@
 SRC_PATH ?= ../src
-FULL_SRC_PATH = "$(realpath $(SRC_PATH))"
-CPPFLAGS = -I. -I$(FULL_SRC_PATH) -I../utils
+FULL_SRC_PATH = $(realpath $(SRC_PATH))
+CPPFLAGS = -I. -I$(realpath $(SRC_PATH)) -I../utils
 CFLAGS = -Wall -Wextra
 # Remove the line below to disable debugging support.
 CFLAGS += -g -O0
@@ -22,7 +22,7 @@ check: $(SHELLCODES)
 	make -C $(FULL_SRC_PATH) clean
 	make clean
 	make -i SRC_PATH=$(FULL_SRC_PATH)
-	./run_all_tests.sh
+	sudo bash ./run_all_tests.sh
 
 lint:
 	-cd .. && checkpatch.pl -f src/*.c

chapters/data/memory-security/drills/tasks/aslr/solution/tests/graded_test.inc.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# SPDX-License-Identifier: BSD-3-Clause
+
+#
+# Print test result. Printed message should fit in 72 characters.
+#
+# Print format is:
+#
+# description ...................... passed ... NNN
+# description ...................... failed ... NNN
+#   32 chars        24 chars           6     3   3
+#
+
+print_test()
+{
+    func="$1"
+    result="$2"
+    points="$3"
+
+    if test "$points" -gt 999; then
+        points=999
+    fi
+
+    printf "%-32s " "${func:0:31}"
+    printf "........................"
+    if test "$result" -eq 0; then
+        printf " passed ... %3d\n" "$points"
+    else
+        printf " failed ...  0\n"
+    fi
+}
+
+run_test()
+{
+    func="$1"
+    points="$2" 
+    # Run in subshell.
+    (eval "$func")
+    print_test "$func" "$?" "$points"
+}

chapters/data/memory-security/drills/tasks/exec-shellcode/support/tests/run_all_tests.sh → chapters/data/memory-security/drills/tasks/aslr/solution/tests/run_all_tests.sh

@@ -1,19 +1,17 @@
-#!/bin/bash
 # SPDX-License-Identifier: BSD-3-Clause
+#!/bin/bash
 
 if test -z "$SRC_PATH"; then
-    SRC_PATH=../src
+    SRC_PATH=../src/
 fi
 
 export SRC_PATH
-
+echo ""
 (
-./test_helloworld.sh
-./test_getpid.sh
-./test_openfile.sh
-./test_brk.sh
+  bash test.sh
 ) | tee results.txt
-
+echo ""
+echo "========================================================================"
 total=$(grep '\( passed \| failed \)' results.txt | rev | cut -d ' ' -f 1 | rev | paste -s -d'+' | bc)
 echo ""
 echo -n "Total:                           "

chapters/data/memory-security/drills/tasks/aslr/solution/tests/test.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+# SPDX-License-Identifier: BSD-3-Clause
+
+source graded_test.inc.sh
+
+binary=../src/aslr
+
+if test -z "$SRC_PATH"; then
+    SRC_PATH=./../src
+fi
+
+test_aslr()
+{
+    start_address=$(nm "$binary" | awk '/_start/ {print $1}' | head -n 1)
+    start_address_decimal=$((0x$start_address))
+    if ((start_address_decimal < 0x400000)); then
+        exit 1
+    fi
+    exit 0
+}
+
+run_test test_aslr 100

chapters/data/memory-security/drills/tasks/bypassing-stack-protector/Makefile

@@ -4,7 +4,7 @@ SCRIPT = generate_skels.py
 skels:
 	mkdir -p support/src
 	$(PYTHON) $(SCRIPT) --input ./solution/src --output ./support/src
-	$(PYTHON) $(SCRIPT) --input ./solution/tests --output ./support/src/tests
+	$(PYTHON) $(SCRIPT) --input ./solution/tests --output ./support/tests
 
 clean:
 	rm -rf support/

chapters/data/memory-security/drills/tasks/bypassing-stack-protector/README.md

@@ -1,9 +1,27 @@
 # Bypassing the Stack Protector
 
+Navigate to `chapters/data/memory-security/drills/tasks/bypassing-stack-protector` and run `make skels` to generate the `support/` folder.
+Then navigate to `support/src`.
+
+
 Inspect the `chapters/data/memory-security/drills/tasks/bypassing-stack-protector/support/stack_protector.c` source file.
 Compile the program and examine the object code.
 Try to identify the canary value.
-Using the `addr` variable, write 2 `scanf` instructions: one that overwrites the canary with the correct value and one that overwrites the return address with the address of function `pawned`.
+Using the `addr` variable, write 2 instructions: one that indexes `addr` to overwrite the canary with the correct value and one that indexes `addr` to overwrite the return address with the address of function `pawned()`.
 In case of a successful exploit a video will be offered as reward.
 
 If you're having difficulties solving this exercise, go through [this](../../../reading/memory-security.md) reading material.
+
+## Checker
+
+To run the checker, go into the `tests` directory located in `src`, then type `make check`.
+A successful output of the checker should look like this :
+
+```console
+student@os:~/.../drills/tasks/aslr/support/src/tests make check
+test_bypassing-stackprotector    ........................ passed ... 100
+
+========================================================================
+
+Total:                                                           100/100
+```

chapters/data/memory-security/drills/tasks/bypassing-stack-protector/generate_skels.py

@@ -16,6 +16,7 @@ def process_file(src, dst, pattern, replace, remove, replace_pairs, end_string=N
         sys.exit(1)
 
     fin = open(src, "r")
+    os.makedirs(os.path.dirname(dst), exist_ok=True)
     fout = open(dst, "w")
     remove_lines = 0
     skip_lines = 0

chapters/data/memory-security/drills/tasks/bypassing-stack-protector/solution/src/.gitignore

@@ -0,0 +1 @@
+/stack_protector

chapters/data/memory-security/drills/tasks/bypassing-stack-protector/solution/stack_protector.c → chapters/data/memory-security/drills/tasks/bypassing-stack-protector/solution/src/stack_protector.c

@@ -19,16 +19,20 @@ void fun1(char *p)
 	}
 
 	printf("overwrite canary:\n");
-	// TODO(Student): Add code that overwrites the canary
+	/* TODO 1: Add code that overwrites the canary. */
+	addr[6] = 0;
 
 	printf("overwrite return address:\n");
-	// TODO(Student): Add code that overwrites the return address with the addess of pawned
+	/* TODO 2: Add code that overwrites the return address with the address of pawned. */
+	addr[7] = &pawned;
 
 	(void) p;
 }
 
 int main(void)
 {
+	setvbuf(stdout, NULL, _IONBF, 0);
+	setvbuf(stderr, NULL, _IONBF, 0);
 	char *p = (char *)0x4343434343434343;
 
 	fun1(p);

chapters/data/memory-security/drills/tasks/bypassing-stack-protector/solution/tests/Makefile

@@ -0,0 +1,34 @@
+SRC_PATH ?= ../src
+FULL_SRC_PATH = $(realpath $(SRC_PATH))
+CPPFLAGS = -I. -I$(realpath $(SRC_PATH)) -I../utils
+CFLAGS = -Wall -Wextra
+# Remove the line below to disable debugging support.
+CFLAGS += -g -O0
+
+SRCS = $(wildcard *.asm)
+SHELLCODES = $(patsubst %.asm,%,$(SRCS))
+
+.PHONY: all src check lint clean
+
+all: $(SHELLCODES) src
+
+$(SHELLCODES): %:%.asm | src
+	nasm -o $@ $<
+
+src:
+	make -C $(FULL_SRC_PATH)
+
+check: $(SHELLCODES)
+	make -C $(FULL_SRC_PATH) clean
+	make clean
+	make -i SRC_PATH=$(FULL_SRC_PATH)
+	sudo bash ./run_all_tests.sh
+
+lint:
+	-cd .. && checkpatch.pl -f src/*.c
+	-cd .. && checkpatch.pl -f tests/*.sh
+	-cd .. && cpplint --recursive src/
+	-cd .. && shellcheck tests/*.sh
+
+clean:
+	-rm -f *~