34 lines
1.6 KiB
Markdown
34 lines
1.6 KiB
Markdown
# Binary test fixtures
|
|
|
|
Prebuilt ELF binaries for fold's binary P-Code / ROP pipeline integration tests
|
|
(`tests/integration/test_binary_rop.cpp`). fold scans these **statically**
|
|
(radare2 + SLEIGH) — they are never executed — so the committed artifacts run on
|
|
any host regardless of OS/arch.
|
|
|
|
| File | Arch | Notes |
|
|
|-------------|----------|----------------------------------------------------|
|
|
| `bof.c` | source | A `strcpy`-into-fixed-buffer stack overflow + `win`. |
|
|
| `bof_x64` | x86-64 | Static (musl), stripped. Carries a real gadget set. |
|
|
| `bof_arm64` | AArch64 | Static (musl), stripped. |
|
|
|
|
## Regenerating (one-time, via `zig cc` — trivial cross-compile from any host)
|
|
|
|
```sh
|
|
cd tests/fixtures/binary
|
|
zig cc -target x86_64-linux-musl -O0 -fno-stack-protector -static -s -o bof_x64 bof.c
|
|
zig cc -target aarch64-linux-musl -O0 -fno-stack-protector -static -s -o bof_arm64 bof.c
|
|
```
|
|
|
|
`-O0` + `-fno-stack-protector` keep the vulnerable shape; `-static` gives the
|
|
image a real gadget inventory (so the Capstone overlapping sweep has clean
|
|
`pop reg; ret`-class gadgets to find); `-s` strips to keep the blobs small
|
|
(~450 KB). Any Linux cross toolchain (or the `docker/` env) works in place of
|
|
`zig cc`.
|
|
|
|
## Why discovery-only in CI
|
|
|
|
`test_binary_rop.cpp` exercises **gadget discovery** (`discoverRopGadgets`), which
|
|
is fast (section dump + Capstone sweep, no `aaa`/Z3). The full whole-binary
|
|
BOF → ROP-chain scan (`scanBinaryWithPcode`) takes minutes and is trigger-
|
|
sensitive, so it stays a manual validation step (`build/release/pcode_scan <bin>`),
|
|
not an automated test.
|