libFuzzer ，脚本

写了个脚本，根据当前传入参数，自动化生成当前整个项目的编译批处理，

执行批处理后，自动化使用clang编译整个项目，

编译完成后，即是一个包含了目标代码的Fuzz程序，双击等崩溃就好了。

我是把这个脚本集成到了VS中，所以编译完成之后，我甚至可以直接用VS来调试，

有源码的情况下，效果比较好，无源码的情况下，不如用WinDBG呢，

但是不管怎么说，总比手动一点点扯蛋强。

import os
import sys
import os.path

# Clang 路径
CLANG_PATH = ""
# Clang Fuzz 参数
FUZZER_PARAM = "-g -fsanitize=fuzzer -fsanitize=address -fsanitize-coverage=trace-cmp,trace-gep,trace-div"
# 中间目录
MIDDLE_DIR = "x64\middle"
if sys.argv[1] == '32':
    MIDDLE_DIR = "x86\middle"
# 输出目录
OUT_DIR = "x64\out"
if sys.argv[1] == '32':
    OUT_DIR = "x86\out"
# 编译需要的库，这个是写死的，编译Clang 的时候就定下来的，所以这个也是死的
CLANG_LIB_DIR = "E:\LLVM\LLVM\"
if sys.argv[1] == '32':
    CLANG_LIB_DIR32 = "E:\LLVM\LLVM32\"
    CLANG_LIB_DIR = CLANG_LIB_DIR32
CLANG_VERSION = "12.0.1\"
CLANG_LIB_DIR_PATH = CLANG_LIB_DIR + "lib\clang\" + CLANG_VERSION + "lib\windows\"
FUZZER_LIBRARY = [
    CLANG_LIB_DIR_PATH + "clang_rt.fuzzer_no_main-x86_64.lib",
    CLANG_LIB_DIR_PATH + "clang_rt.fuzzer-x86_64.lib",
]

# 要处理的文件
extend = [".c", ".cpp"]


def MakeDir(path_name):
    path, name = os.path.split(path_name)
    if os.path.exists(path):
        pass
    else:
        os.makedirs(path)


def WalkDir(dirname):
    global extend
    dirlist = []
    filelist = []
    try:
        ls = os.listdir(dirname)
    except:
        print("Access Deny.")
    else:
        for fn in ls:
            temp = os.path.join(dirname, fn)
            if os.path.isdir(temp):
                dirlist.append(temp)
                d, f = WalkDir(temp)
                dirlist.extend(d)
                filelist.extend(f)
            else:
                for ext in extend:
                    if temp.endswith(ext):
                        filelist.append(temp)
    return dirlist, filelist


def GetAllSourceList(dirname):
    dirlist, filelist = WalkDir(dirname)
    str_file = ""
    for file in filelist:
        str_file = str_file + """ + file + "" "
    return str_file


def WriteBuild(dirname, cmd):
    print(cmd)
    f = open(dirname + "/" + 'build.bat', 'w+')
    f.write(cmd)
    f.close()


def LoadAllFileInDir(file_dir, ext=None):
    list = []
    for root, dirs, files in os.walk(file_dir):
        for file in files:
            if ext is not None and os.path.splitext(file)[1] in ext:
                list.append(os.path.join(root, file))
            if ext is None:
                list.append(os.path.join(root, file))
            if not ext:
                list.append(os.path.join(root, file))
            if "*" in ext:
                list.append(os.path.join(root, file))
    return list


# 参数：clang 路径，检测路径，输出路径
def Main():
    global CLANG_PATH
    global FUZZER_PARAM
    global MIDDLE_DIR
    global OUT_DIR

    argc = len(sys.argv)
    # 参数 1 必须是 x86或者 x64 位数
    # plant bit  : 32
    print("plant bit  : " + sys.argv[1])

    # 参数 2 clang 路径
    if argc >= 2:
        CLANG_PATH = sys.argv[2]
    # clang path : E:LLVMllvm-12.0.1.srcllvm-12.0.1.srcProjectRelWithDebInfoinclang.exe
    print("clang path : " + CLANG_PATH)
    if CLANG_PATH == "":
        print("Clang Path Error")
        return

    # os.path.abspath('.')
    # os.getcwd()
    # 初值给一个当前文件所在的同级目录
    dirname = os.path.dirname(os.path.abspath(sys.argv[0]))
    # 参数2 当前要扫描的目录
    if argc >= 3:
        dirname = sys.argv[3]
    # dir   path : E:LLVMTestFuzzFuzzProjectEmptyProject
    print("dir   path : " + dirname)

    # 如果存在就删了它
    if os.path.exists(dirname + "/" + 'build.bat'):
        os.remove(dirname + "/" + 'build.bat')

    # str_file = GetAllSourceList(dirname)

    MIDDLE_DIR = dirname + MIDDLE_DIR
    MakeDir(MIDDLE_DIR)

    OUT_DIR = dirname + OUT_DIR
    MakeDir(OUT_DIR)

    files = LoadAllFileInDir(dirname, extend)

    write_file = ""
    object_array = []
    for file in files:
        file_path = file[len(dirname):]
        object_name = MIDDLE_DIR + "\" + file_path + ".o"
        MakeDir(object_name)
        cmd = CLANG_PATH + " " + FUZZER_PARAM + " -c " + file + " -o " + object_name
        write_file = write_file + cmd + "
"
        object_array.append(object_name)

    string_command = CLANG_PATH
    string_command = string_command + " " + FUZZER_PARAM
    global FUZZER_LIBRARY
    for library in FUZZER_LIBRARY:
        string_command = string_command + " -L" + library

    for object in object_array:
        string_command = string_command + " " + object

    MakeDir(OUT_DIR + "\FuzzMain.exe")
    print("Out   File : " + OUT_DIR + "\FuzzMain.exe")
    string_command = string_command + " -o " + OUT_DIR + "\FuzzMain.exe"

    write_file = write_file + string_command + "
"
    WriteBuild(dirname, write_file)


if __name__ == "__main__":
    Main()