analyze_crash.sh

#!/bin/bash

# SSV Crash Analysis Script
# Allows re-running specific crashes to debug fuzzing issues

set -e

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
PURPLE='\033[0;35m'
CYAN='\033[0;36m'
NC='\033[0m' # No Color

# Function to print colored output
print_color() {
    local color=$1
    local message=$2
    echo -e "${color}${message}${NC}"
}

# Function to list available targets with crashes
list_targets_with_crashes() {
    print_color $BLUE "=== Targets with Crash Data ==="
    echo
    
    local found_crashes=0
    local counter=1
    
    if [[ -d "afl_workdir" ]]; then
        for target_dir in afl_workdir/*/; do
            if [[ -d "$target_dir" ]]; then
                local target_name=$(basename "$target_dir")
                local output_dir="${target_dir}output"
                
                # Count crashes from all fuzzer instances (default, master, slave1, etc.)
                local total_crashes=0
                if [[ -d "$output_dir" ]]; then
                    for fuzzer_dir in "$output_dir"/*/; do
                        if [[ -d "$fuzzer_dir" ]]; then
                            local crash_dir="${fuzzer_dir}crashes"
                            if [[ -d "$crash_dir" ]]; then
                                local crash_count=$(find "$crash_dir" -name "id:*" -type f 2>/dev/null | wc -l)
                                total_crashes=$((total_crashes + crash_count))
                            fi
                        fi
                    done
                fi
                
                if [[ $total_crashes -gt 0 ]]; then
                    printf "%2d) %-40s (%d crashes)\n" $counter "$target_name" $total_crashes
                    ((counter++))
                    found_crashes=1
                fi
            fi
        done
    fi
    
    if [[ $found_crashes -eq 0 ]]; then
        print_color $YELLOW "No targets with crashes found."
        print_color $BLUE "Run some fuzzing first with: ./run_fuzzer.sh"
        return 1
    fi
    
    echo
    return 0
}

# Function to get target by number
get_target_by_number() {
    local choice=$1
    local counter=1
    
    if [[ -d "afl_workdir" ]]; then
        for target_dir in afl_workdir/*/; do
            if [[ -d "$target_dir" ]]; then
                local target_name=$(basename "$target_dir")
                local output_dir="${target_dir}output"
                
                # Check if target has any crashes from all fuzzer instances
                local total_crashes=0
                if [[ -d "$output_dir" ]]; then
                    for fuzzer_dir in "$output_dir"/*/; do
                        if [[ -d "$fuzzer_dir" ]]; then
                            local crash_dir="${fuzzer_dir}crashes"
                            if [[ -d "$crash_dir" ]]; then
                                local crash_count=$(find "$crash_dir" -name "id:*" -type f 2>/dev/null | wc -l)
                                total_crashes=$((total_crashes + crash_count))
                            fi
                        fi
                    done
                fi
                
                if [[ $total_crashes -gt 0 ]]; then
                    if [[ $counter -eq $choice ]]; then
                        echo "$target_name"
                        return 0
                    fi
                    ((counter++))
                fi
            fi
        done
    fi
    
    return 1
}

# Function to list crashes for a specific target
list_crashes() {
    local target=$1
    local output_dir="afl_workdir/${target}/output"
    
    if [[ ! -d "$output_dir" ]]; then
        print_color $RED "No output directory found for target: $target"
        return 1
    fi
    
    print_color $GREEN "=== Crashes for $target ==="
    echo
    
    # Collect all crashes from all fuzzer instances
    local all_crashes=()
    local fuzzer_sources=()
    
    for fuzzer_dir in "$output_dir"/*/; do
        if [[ -d "$fuzzer_dir" ]]; then
            local fuzzer_name=$(basename "$fuzzer_dir")
            local crash_dir="${fuzzer_dir}crashes"
            
            if [[ -d "$crash_dir" ]]; then
                local fuzzer_crashes=($(find "$crash_dir" -name "id:*" -type f | sort))
                for crash_file in "${fuzzer_crashes[@]}"; do
                    all_crashes+=("$crash_file")
                    fuzzer_sources+=("$fuzzer_name")
                done
            fi
        fi
    done
    
    if [[ ${#all_crashes[@]} -eq 0 ]]; then
        print_color $YELLOW "No crashes found for $target"
        return 1
    fi
    
    # Display crashes with fuzzer source information
    local counter=1
    for i in "${!all_crashes[@]}"; do
        local crash_file="${all_crashes[$i]}"
        local fuzzer_source="${fuzzer_sources[$i]}"
        local filename=$(basename "$crash_file")
        local filesize=$(stat -c%s "$crash_file" 2>/dev/null || echo "unknown")
        printf "%2d) %-40s [%s] (%s bytes)\n" $counter "$filename" "$fuzzer_source" "$filesize"
        ((counter++))
    done
    
    echo
    print_color $CYAN "Total crashes: ${#all_crashes[@]}"
    print_color $BLUE "Crashes found in fuzzer instances: $(printf '%s ' "${fuzzer_sources[@]}" | tr ' ' '\n' | sort -u | tr '\n' ' ')"
    return 0
}

# Function to analyze a specific crash
analyze_crash() {
    local target=$1
    local crash_number=$2
    local output_dir="afl_workdir/${target}/output"
    
    # Collect all crashes from all fuzzer instances (same logic as list_crashes)
    local all_crashes=()
    for fuzzer_dir in "$output_dir"/*/; do
        if [[ -d "$fuzzer_dir" ]]; then
            local crash_dir="${fuzzer_dir}crashes"
            if [[ -d "$crash_dir" ]]; then
                local fuzzer_crashes=($(find "$crash_dir" -name "id:*" -type f | sort))
                for crash_file in "${fuzzer_crashes[@]}"; do
                    all_crashes+=("$crash_file")
                done
            fi
        fi
    done
    
    if [[ $crash_number -lt 1 || $crash_number -gt ${#all_crashes[@]} ]]; then
        print_color $RED "Invalid crash number. Please select 1-${#all_crashes[@]}"
        return 1
    fi
    
    local crash_file="${all_crashes[$((crash_number-1))]}"
    local filename=$(basename "$crash_file")
    
    print_color $PURPLE "=== Analyzing Crash: $filename ==="
    echo
    
    # Display crash file info
    print_color $BLUE "📄 Crash File Information:"
    echo "   File: $crash_file"
    echo "   Size: $(stat -c%s "$crash_file") bytes"
    echo "   Modified: $(stat -c%y "$crash_file")"
    echo
    
    # Display hex dump of crash input
    print_color $BLUE "🔍 Crash Input (hex dump - first 256 bytes):"
    hexdump -C "$crash_file" | head -16
    echo
    
    # Display raw bytes if small enough
    local filesize=$(stat -c%s "$crash_file")
    if [[ $filesize -le 1024 ]]; then
        print_color $BLUE "📝 Raw Input (if printable):"
        if file "$crash_file" | grep -q "text"; then
            cat "$crash_file"
            echo
        else
            print_color $YELLOW "   (Binary data - see hex dump above)"
        fi
        echo
    fi
    
    # Check if binary exists
    local binary_path="target/debug/${target}"
    if [[ ! -f "$binary_path" ]]; then
        print_color $YELLOW "⚠️  Binary not found: $binary_path"
        print_color $BLUE "Building target first..."
        
        if ! cargo afl build --bin "$target"; then
            print_color $RED "✗ Failed to build target"
            return 1
        fi
        
        print_color $GREEN "✓ Target built successfully"
    fi
    
    echo
    print_color $PURPLE "🚀 Reproducing Crash..."
    print_color $YELLOW "Running: $binary_path < $crash_file"
    echo "--- CRASH OUTPUT ---"
    
    # Run the binary with crash input and capture output
    if timeout 10s "$binary_path" < "$crash_file" 2>&1; then
        print_color $YELLOW "⚠️  Program completed without crashing (timeout or fixed?)"
    else
        local exit_code=$?
        if [[ $exit_code -eq 124 ]]; then
            print_color $RED "⚠️  Program timed out after 10 seconds"
        else
            print_color $RED "💥 Program crashed with exit code: $exit_code"
        fi
    fi
    
    echo "--- END CRASH OUTPUT ---"
    echo
}

# Function to run crash with debugger
debug_crash() {
    local target=$1
    local crash_number=$2
    local output_dir="afl_workdir/${target}/output"
    
    # Collect all crashes from all fuzzer instances (same logic as analyze_crash)
    local all_crashes=()
    for fuzzer_dir in "$output_dir"/*/; do
        if [[ -d "$fuzzer_dir" ]]; then
            local crash_dir="${fuzzer_dir}crashes"
            if [[ -d "$crash_dir" ]]; then
                local fuzzer_crashes=($(find "$crash_dir" -name "id:*" -type f | sort))
                for crash_file in "${fuzzer_crashes[@]}"; do
                    all_crashes+=("$crash_file")
                done
            fi
        fi
    done
    
    local crash_file="${all_crashes[$((crash_number-1))]}"
    local binary_path="target/debug/${target}"
    
    print_color $PURPLE "🐛 Running crash in GDB debugger..."
    print_color $YELLOW "Commands you can use in GDB:"
    echo "   run < $crash_file    # Run the program with crash input"
    echo "   bt                   # Show backtrace after crash"
    echo "   info registers       # Show register state"
    echo "   quit                 # Exit debugger"
    echo
    
    # Check if gdb is available
    if ! command -v gdb &> /dev/null; then
        print_color $RED "GDB not found. Install with: sudo apt install gdb"
        return 1
    fi
    
    gdb "$binary_path"
}

# Function to save crash for manual analysis
save_crash_for_analysis() {
    local target=$1
    local crash_number=$2
    local output_dir="afl_workdir/${target}/output"
    
    # Collect all crashes from all fuzzer instances (same logic as analyze_crash)
    local all_crashes=()
    local fuzzer_sources=()
    for fuzzer_dir in "$output_dir"/*/; do
        if [[ -d "$fuzzer_dir" ]]; then
            local fuzzer_name=$(basename "$fuzzer_dir")
            local crash_dir="${fuzzer_dir}crashes"
            if [[ -d "$crash_dir" ]]; then
                local fuzzer_crashes=($(find "$crash_dir" -name "id:*" -type f | sort))
                for crash_file in "${fuzzer_crashes[@]}"; do
                    all_crashes+=("$crash_file")
                    fuzzer_sources+=("$fuzzer_name")
                done
            fi
        fi
    done
    
    local crash_file="${all_crashes[$((crash_number-1))]}"
    local fuzzer_source="${fuzzer_sources[$((crash_number-1))]}"
    local filename=$(basename "$crash_file")
    
    # Create analysis directory
    local analysis_dir="crash_analysis/${target}"
    mkdir -p "$analysis_dir"
    
    local saved_file="${analysis_dir}/${filename}"
    cp "$crash_file" "$saved_file"
    
    # Create analysis report
    local report_file="${analysis_dir}/${filename}.analysis"
    
    cat > "$report_file" << EOF
Crash Analysis Report
====================
Target: $target
Crash File: $filename
Fuzzer Source: $fuzzer_source (multi-core instance)
Original Location: $crash_file
Analysis Date: $(date)
File Size: $(stat -c%s "$crash_file") bytes

Hex Dump:
$(hexdump -C "$crash_file" | head -32)

Binary Info:
$(file "$crash_file")

To reproduce:
  ./target/debug/$target < $saved_file

To debug:
  gdb ./target/debug/$target
  (gdb) run < $saved_file

Note: This crash was found during multi-core fuzzing session.
EOF
    
    print_color $GREEN "✓ Crash saved for analysis:"
    print_color $BLUE "   Input file: $saved_file"
    print_color $BLUE "   Report: $report_file"
}

# Main menu function
show_crash_menu() {
    local target=$1
    
    while true; do
        print_color $BLUE "=== Crash Analysis for $target ==="
        echo "1) List all crashes"
        echo "2) Analyze specific crash"
        echo "3) Debug crash with GDB"
        echo "4) Save crash for manual analysis"
        echo "5) Back to target selection"
        echo
        read -p "Choose action (1-5): " action
        
        case $action in
            1)
                list_crashes "$target"
                echo
                read -p "Press Enter to continue..."
                ;;
            2)
                if list_crashes "$target"; then
                    echo
                    read -p "Select crash number to analyze: " crash_num
                    if [[ "$crash_num" =~ ^[0-9]+$ ]]; then
                        analyze_crash "$target" "$crash_num"
                    else
                        print_color $RED "Invalid number"
                    fi
                fi
                echo
                read -p "Press Enter to continue..."
                ;;
            3)
                if list_crashes "$target"; then
                    echo
                    read -p "Select crash number to debug: " crash_num
                    if [[ "$crash_num" =~ ^[0-9]+$ ]]; then
                        debug_crash "$target" "$crash_num"
                    else
                        print_color $RED "Invalid number"
                    fi
                fi
                ;;
            4)
                if list_crashes "$target"; then
                    echo
                    read -p "Select crash number to save: " crash_num
                    if [[ "$crash_num" =~ ^[0-9]+$ ]]; then
                        save_crash_for_analysis "$target" "$crash_num"
                    else
                        print_color $RED "Invalid number"
                    fi
                fi
                echo
                read -p "Press Enter to continue..."
                ;;
            5)
                break
                ;;
            *)
                print_color $RED "Invalid action. Please select 1-5."
                ;;
        esac
    done
}

# Main script logic
main() {
    print_color $CYAN "🔍 SSV Crash Analysis Tool"
    echo
    
    # Check if we're in the right directory
    if [[ ! -f "Cargo.toml" || ! -d "fuzz" ]]; then
        print_color $RED "Error: This script must be run from the ssv-fuzz project root"
        exit 1
    fi
    
    while true; do
        if ! list_targets_with_crashes; then
            exit 0
        fi
        
        read -p "Select target number (or 'q' to quit): " choice
        
        if [[ "$choice" == "q" || "$choice" == "Q" ]]; then
            print_color $GREEN "Goodbye!"
            exit 0
        fi
        
        if [[ "$choice" =~ ^[0-9]+$ ]]; then
            target=$(get_target_by_number "$choice")
            if [[ $? -eq 0 ]]; then
                show_crash_menu "$target"
            else
                print_color $RED "Invalid target number"
                echo
                read -p "Press Enter to continue..."
            fi
        else
            print_color $RED "Invalid input. Enter a number or 'q' to quit."
            echo
            read -p "Press Enter to continue..."
        fi
    done
}

# Run main function
main "$@"