trevon/fold
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
fold/tests/fixtures/binary
History
Exact
trvon fd4a68dfff
 test: add coverage for project graph, pcode encoder, and detector behaviors 
Unit + integration coverage for the session's work: incremental project
graph/index, pcode encoder, unreachable/dead-branch, equiv/cross-TU,
div-by-zero/sign-conversion/int-truncation, use-after-free, quality-precision,
scan-router profile, source TU runner, detector plan, and the eval fixtures.
2026-08-16 16:46:07 -06:00
..
cwe test: add coverage for project graph, pcode encoder, and detector behaviors 2026-08-16 16:46:07 -06:00
bof.c many good updates for binary and SAST / DAST scanning 2026-06-02 12:39:03 -04:00
bof_arm64 many good updates for binary and SAST / DAST scanning 2026-06-02 12:39:03 -04:00
bof_x64 many good updates for binary and SAST / DAST scanning 2026-06-02 12:39:03 -04:00
build-linux.sh test: add coverage for project graph, pcode encoder, and detector behaviors 2026-08-16 16:46:07 -06:00
README.md many good updates for binary and SAST / DAST scanning 2026-06-02 12:39:03 -04:00

README.md

Binary test fixtures

Prebuilt ELF binaries for fold's binary P-Code / ROP pipeline integration tests (tests/integration/test_binary_rop.cpp). fold scans these statically (radare2 + SLEIGH) — they are never executed — so the committed artifacts run on any host regardless of OS/arch.

File Arch Notes
bof.c source A strcpy-into-fixed-buffer stack overflow + win.
bof_x64 x86-64 Static (musl), stripped. Carries a real gadget set.
bof_arm64 AArch64 Static (musl), stripped.

Regenerating (one-time, via zig cc — trivial cross-compile from any host)

cd tests/fixtures/binary
zig cc -target x86_64-linux-musl  -O0 -fno-stack-protector -static -s -o bof_x64   bof.c
zig cc -target aarch64-linux-musl -O0 -fno-stack-protector -static -s -o bof_arm64 bof.c

-O0 + -fno-stack-protector keep the vulnerable shape; -static gives the image a real gadget inventory (so the Capstone overlapping sweep has clean pop reg; ret-class gadgets to find); -s strips to keep the blobs small (~450 KB). Any Linux cross toolchain (or the docker/ env) works in place of zig cc.

Why discovery-only in CI

test_binary_rop.cpp exercises gadget discovery (discoverRopGadgets), which is fast (section dump + Capstone sweep, no aaa/Z3). The full whole-binary BOF → ROP-chain scan (scanBinaryWithPcode) takes minutes and is trigger- sensitive, so it stays a manual validation step (build/release/pcode_scan <bin>), not an automated test.