How do I get the current test case?

[Sunxingzhezhexingsun]

I've implemented a monitor that inherits from BaseMonitor, and then when a crash is detected, I want to save the test cases that triggered the crash, how do I get the current test cases? I didn't find the answer in the logger documentation.

[cq674350529]

In your monitor can you access the session instance? If yes, you can only record session.mutant_index, which can be used to replay the test case later. Maybe you can have a try?

boofuzz/boofuzz/sessions.py

Lines 1298 to 1319 in 373a5cb

	def fuzz_single_case(self, mutant_index):
	"""Deprecated: Fuzz a test case by mutant_index.
	Deprecation note: The new approach is to set Session's start and end indices to the same value.
	Args:
	mutant_index (int): Positive non-zero integer.
	Returns:
	None
	Raises:
	sex.SulleyRuntimeError: If any error is encountered while executing the test case.
	"""
	warnings.warn(
	"Session.fuzz_single_case is deprecated in favor of Session's index_start and index_end constructor "
	"parameters."
	)
	self.total_mutant_index = 0
	self.total_num_mutations = 1
	self._main_fuzz_loop(self._generate_single_case_by_index(mutant_index))

[Sunxingzhezhexingsun]

@cq674350529 Thank you for your reply! Is the session.mutant_index variable the sequence number of the current test case? Which method should I pass this variable to get the contents of the test case?

[cq674350529]

Previously I guess you'd like to get the contents of the test case that triggered the crash to replay later. If yes, you can only save the session.mutant_index. As the fuzz_single_case() denotes (now it's deprecated), when the fuzzing process is over, keep all other things same, just set the index_start and index_end paramter of Session() to generate a single case you want.

If you really want to log the test case in your monitor, maybe you can call or refer to session.test_case_data(session.mutant_index). Since the web server will show the current test case, there must be a place to record it.

[Sunxingzhezhexingsun]

@cq674350529 Yes, session.test_case_data(session.mutant_index) is exactly what I was looking for, thank you very much!!!

[Sunxingzhezhexingsun]

@cq674350529
When my monitor detects crash, it runs the following code:

fuzz_data_logger.log_info("session.mutant_index: " + str(session.mutant_index))
current_testcase = session.test_case_data(index=session.mutant_index)
fuzz_data_logger.log_info("session.test_case_data(index=session.mutant_index): " + str(current_testcase))

II do get the index of the current testCase, but passing it into session.test_case_data() returns None...

[2021-09-28 11:21:05,350]     Info: session.mutant_index: 14
[2021-09-28 11:21:05,351]     Info: session.test_case_data(index=session.mutant_index): None

[cq674350529]

In normal cases, does the session.test_case_data(session.mutant_index) return meaningful data? How does your monitor work? Can you give a simple demo of your session instance and monitor?

[Sunxingzhezhexingsun]

@cq674350529
my monitor:

class MyMonitor(BaseMonitor):
    def post_send(self, target=None, fuzz_data_logger=None, session=None):
        fuzz_data_logger.log_info('post_send(): detecting target status...')
        alive = True
        target_pids = get_target_pids()

        fuzz_data_logger.log_info("session.mutant_index: " + str(session.mutant_index))
        current_testcase = session.test_case_data(index=session.mutant_index)
        fuzz_data_logger.log_info("session.test_case_data(index=session.mutant_index): " + str(current_testcase))

        if target_pids != init_target_pids:
            fuzz_data_logger.log_fail('Detected target processes changed!!!')

            # need to be imporved...
            alive = False
        else:
            fuzz_data_logger.log_pass('Detected target processes unchanged.')
        return alive

    def restart_target(self, target=None, fuzz_data_logger=None, session=None):
        ...

    def alive(self):
        return check_if_restarted()

my session:

    session = Session(
        target=Target(
            connection=TCPSocketConnection(target_ip, port),
            monitors=[MyMonitor()],
        ),
        fuzz_loggers=my_loggers,
    )

    session.connect(s_get("Regist"))
    session.connect(s_get("Regist"), s_get("Message"))
    session.fuzz()

As the code shown, I print session.test_case_data(session.mutant_index) after each test case , and always return None

[2021-09-28 13:23:27,247]   Test Step: Contact target monitors
[2021-09-28 13:23:27,247]     Info: post_send(): detecting target status...
[2021-09-28 13:23:27,395]     Info: session.mutant_index: 4
[2021-09-28 13:23:27,395]     Info: session.test_case_data(index=session.mutant_index): None
[2021-09-28 13:23:27,395]       Check OK: Detected target processes unchanged.
[2021-09-28 13:23:27,395]   Test Step: Cleaning up connections from callbacks
[2021-09-28 13:23:27,395]       Check OK: No crash detected.
[2021-09-28 13:23:27,395]     Info: Closing target connection...
[2021-09-28 13:23:27,396]     Info: Connection closed

[cq674350529]

Indeed, the session.test_case_data(session.mutant_index) returned None always. I guess it's because the post_send() is called before when putting the current test case info db. So when calling session.test_case_data() with current mutant index, there is no corresponding data in db.

Since you will check if target is crashed when each test case is sent, there is another way to get the current test case: session.last_send, which will return the last sent data.

[Sunxingzhezhexingsun]

@cq674350529
session.last_send works!
But I have no documentation on these important class member variables, and it would be nice if the documentation were more complete

[cq674350529]

Read the source code, and drop an ipython env, then you can access all the underlying attributes. If any doubts, always debug it in an ipython env, as I learnt the framework in this way.