1.6 KiB
Binary test fixtures
Prebuilt ELF binaries for fold's binary P-Code / ROP pipeline integration tests
(tests/integration/test_binary_rop.cpp). fold scans these statically
(radare2 + SLEIGH) — they are never executed — so the committed artifacts run on
any host regardless of OS/arch.
| File | Arch | Notes |
|---|---|---|
bof.c |
source | A strcpy-into-fixed-buffer stack overflow + win. |
bof_x64 |
x86-64 | Static (musl), stripped. Carries a real gadget set. |
bof_arm64 |
AArch64 | Static (musl), stripped. |
Regenerating (one-time, via zig cc — trivial cross-compile from any host)
cd tests/fixtures/binary
zig cc -target x86_64-linux-musl -O0 -fno-stack-protector -static -s -o bof_x64 bof.c
zig cc -target aarch64-linux-musl -O0 -fno-stack-protector -static -s -o bof_arm64 bof.c
-O0 + -fno-stack-protector keep the vulnerable shape; -static gives the
image a real gadget inventory (so the Capstone overlapping sweep has clean
pop reg; ret-class gadgets to find); -s strips to keep the blobs small
(~450 KB). Any Linux cross toolchain (or the docker/ env) works in place of
zig cc.
Why discovery-only in CI
test_binary_rop.cpp exercises gadget discovery (discoverRopGadgets), which
is fast (section dump + Capstone sweep, no aaa/Z3). The full whole-binary
BOF → ROP-chain scan (scanBinaryWithPcode) takes minutes and is trigger-
sensitive, so it stays a manual validation step (build/release/pcode_scan <bin>),
not an automated test.