testcases.h File Reference

header for test cases More...

Go to the source code of this file.

Functions
BOOLEAN	TestCommandParser ()
	Test command parser.
BOOLEAN	TestPeParser ()
	Runs all PE parser unit tests and reports pass/fail results.
BOOLEAN	TestCodeViewRsdsParser ()
	Runs a series of test cases to validate the behavior of the RSDS parser helper functions.
BOOLEAN	TestSemanticScripts ()
	Test semantic scripts.

Detailed Description

header for test cases

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.11

Date

2024-08-11

Copyright

This project is released under the GNU Public License v3.

Function Documentation

TestCodeViewRsdsParser()

BOOLEAN TestCodeViewRsdsParser

(

)

Runs a series of test cases to validate the behavior of the RSDS parser helper functions.

Returns

BOOLEAN TRUE if all test cases passed, FALSE if any test case failed

{
    BYTE  Buffer[RsdsFixtureSize] = {0};
    INT32 TestNum                 = 0;
 
    RsdsBuildMinimalPe(Buffer, FALSE);
    RsdsWriteValidDebugEntry(Buffer, RsdsGuid64, 7, "symbols\\valid64.pdb");
    TestNum++;
    if (RsdsExpectSuccess(Buffer, "valid64.pdb", RsdsGuid64, 7))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] valid PE32+ RSDS entry was not parsed\n");
        return FALSE;
    }
 
    RsdsBuildMinimalPe(Buffer, FALSE);
    RsdsWriteValidDebugEntry(Buffer, RsdsGuid64, 7, "symbols\\unadvertised.pdb");
    RsdsSetNumberOfRvaAndSizes(Buffer, IMAGE_DIRECTORY_ENTRY_DEBUG);
    TestNum++;
    if (RsdsExpectFailure(Buffer))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] raw parser accepted an unadvertised debug directory\n");
        return FALSE;
    }
 
    RsdsBuildMinimalPe(Buffer, TRUE);
    RsdsWriteValidDebugEntry(Buffer, RsdsGuid32, 9, "symbols/valid32.pdb");
    TestNum++;
    if (RsdsExpectSuccess(Buffer, "valid32.pdb", RsdsGuid32, 9))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] valid PE32 RSDS entry was not parsed\n");
        return FALSE;
    }
 
    RsdsBuildMinimalPe(Buffer, FALSE);
    RsdsWriteValidDebugEntry(Buffer, RsdsGuid64, 7, "symbols\\valid64.pdb");
    RsdsSetDebugDirectory(Buffer, 0x3000, sizeof(IMAGE_DEBUG_DIRECTORY));
    TestNum++;
    if (RsdsExpectFailure(Buffer))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] unmapped debug directory parsed successfully\n");
        return FALSE;
    }
 
    RsdsBuildMinimalPe(Buffer, FALSE);
    RsdsWriteValidDebugEntry(Buffer, RsdsGuid64, 7, "symbols\\invalid.pdb");
    CopyMemory(Buffer + RsdsPayloadRaw, "ABCD", sizeof(DWORD));
    TestNum++;
    if (RsdsExpectFailure(Buffer))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] unsupported CodeView signature parsed successfully\n");
        return FALSE;
    }
 
    RsdsBuildMinimalPe(Buffer, FALSE);
    RsdsWritePayload(Buffer, RsdsPayloadRaw, RsdsGuid64, 7, "symbols\\missing-nul.pdb", FALSE);
    RsdsWriteDebugEntry(Buffer,
                        RsdsDebugDirectoryRaw,
                        IMAGE_DEBUG_TYPE_CODEVIEW,
                        RsdsPayloadRva,
                        RsdsPayloadRaw,
                        RsdsPayloadSize("symbols\\missing-nul.pdb", FALSE));
    TestNum++;
    if (RsdsExpectFailure(Buffer))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] RSDS path without NUL terminator parsed successfully\n");
        return FALSE;
    }
 
    RsdsBuildMinimalPe(Buffer, FALSE);
    RsdsSetDebugDirectory(Buffer, RsdsDebugDirectoryRva, sizeof(IMAGE_DEBUG_DIRECTORY) * 2);
    RsdsWriteDebugEntry(Buffer, RsdsDebugDirectoryRaw, IMAGE_DEBUG_TYPE_CODEVIEW, RsdsPayloadRva, RsdsPayloadRaw, sizeof(DWORD));
    CopyMemory(Buffer + RsdsPayloadRaw, "NB10", sizeof(DWORD));
    RsdsWritePayload(Buffer, 0x390, RsdsGuidMulti, 11, "alt/second-valid.pdb", TRUE);
    RsdsWriteDebugEntry(Buffer,
                        RsdsDebugDirectoryRaw + sizeof(IMAGE_DEBUG_DIRECTORY),
                        IMAGE_DEBUG_TYPE_CODEVIEW,
                        0x1190,
                        0x390,
                        RsdsPayloadSize("alt/second-valid.pdb", TRUE));
    TestNum++;
    if (RsdsExpectSuccess(Buffer, "second-valid.pdb", RsdsGuidMulti, 11))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] parser did not skip invalid first entry and parse second RSDS entry\n");
        return FALSE;
    }
 
    RsdsBuildLoadedPe(Buffer, FALSE);
    RsdsWriteValidLoadedDebugEntry(Buffer, RsdsGuid64, 0x21, "loaded\\loaded64.pdb");
    TestNum++;
    if (RsdsExpectLoadedSuccess(Buffer, "loaded64.pdb", RsdsGuid64, 0x21))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] loaded PE32+ RSDS entry was not parsed\n");
        return FALSE;
    }
 
    RsdsBuildLoadedPe(Buffer, FALSE);
    RsdsWriteValidLoadedDebugEntry(Buffer, RsdsGuid64, 0x21, "loaded\\unadvertised.pdb");
    RsdsSetNumberOfRvaAndSizes(Buffer, IMAGE_DIRECTORY_ENTRY_DEBUG);
    TestNum++;
    if (RsdsExpectLoadedFailure(Buffer))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] loaded parser accepted an unadvertised debug directory\n");
        return FALSE;
    }
 
    RsdsBuildLoadedPe(Buffer, TRUE);
    RsdsWriteValidLoadedDebugEntry(Buffer, RsdsGuid32, 0x22, "loaded/loaded32.pdb");
    TestNum++;
    if (RsdsExpectLoadedSuccess(Buffer, "loaded32.pdb", RsdsGuid32, 0x22))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] loaded PE32 RSDS entry was not parsed\n");
        return FALSE;
    }
 
    RsdsBuildLoadedPe(Buffer, FALSE);
    RsdsWriteValidLoadedDebugEntry(Buffer, RsdsGuid64, 0x23, "loaded\\bogus-raw-ignored.pdb");
    TestNum++;
    if (RsdsExpectLoadedSuccess(Buffer, "bogus-raw-ignored.pdb", RsdsGuid64, 0x23))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] loaded parser used bogus PointerToRawData instead of loaded RVA\n");
        return FALSE;
    }
 
    std::vector<BYTE> HighLoadedBuffer(RsdsHighLoadedSize);
    RsdsBuildLoadedPe(HighLoadedBuffer.data(), FALSE);
    RsdsSetSizeOfImage(HighLoadedBuffer.data(), (DWORD)HighLoadedBuffer.size());
    RsdsSetDebugDirectory(HighLoadedBuffer.data(), RsdsHighLoadedDebugRva, sizeof(IMAGE_DEBUG_DIRECTORY));
    RsdsWritePayload(HighLoadedBuffer.data(), RsdsHighLoadedPayloadRva, RsdsGuid64, 0x28, "loaded\\high-rva.pdb", TRUE);
    RsdsWriteDebugEntry(HighLoadedBuffer.data(),
                        RsdsHighLoadedDebugRva,
                        IMAGE_DEBUG_TYPE_CODEVIEW,
                        RsdsHighLoadedPayloadRva,
                        RsdsBogusRawPointer,
                        RsdsPayloadSize("loaded\\high-rva.pdb", TRUE));
    CHAR  HighLoadedPdbFileName[MAX_PATH] = {0};
    GUID  HighLoadedGuid                  = {0};
    DWORD HighLoadedAge                   = 0;
    TestNum++;
    if (SymExtractCodeViewRsdsInfoFromLoadedPeImage(HighLoadedBuffer.data(),
                                                    HighLoadedBuffer.size(),
                                                    HighLoadedPdbFileName,
                                                    sizeof(HighLoadedPdbFileName),
                                                    &HighLoadedGuid,
                                                    &HighLoadedAge) &&
        strcmp(HighLoadedPdbFileName, "high-rva.pdb") == 0 && RsdsGuidEquals(HighLoadedGuid, RsdsGuid64) &&
        HighLoadedAge == 0x28)
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] loaded parser did not parse high-RVA RSDS data\n");
        return FALSE;
    }
 
    RsdsBuildLoadedPe(Buffer, FALSE);
    RsdsWriteValidLoadedDebugEntry(Buffer, RsdsGuid64, 0x24, "loaded\\invalid-dir.pdb");
    RsdsSetDebugDirectory(Buffer, RsdsFixtureSize - sizeof(IMAGE_DEBUG_DIRECTORY) / 2, sizeof(IMAGE_DEBUG_DIRECTORY));
    TestNum++;
    if (RsdsExpectLoadedFailure(Buffer))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] loaded parser accepted malformed debug directory bounds\n");
        return FALSE;
    }
 
    RsdsBuildLoadedPe(Buffer, FALSE);
    RsdsWriteValidLoadedDebugEntry(Buffer, RsdsGuid64, 0x25, "loaded\\unsupported.pdb");
    CopyMemory(Buffer + RsdsLoadedPayloadRva, "ABCD", sizeof(DWORD));
    TestNum++;
    if (RsdsExpectLoadedFailure(Buffer))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] loaded parser accepted unsupported CodeView signature\n");
        return FALSE;
    }
 
    RsdsBuildLoadedPe(Buffer, FALSE);
    RsdsWritePayload(Buffer, RsdsLoadedPayloadRva, RsdsGuid64, 0x26, "loaded\\missing-nul.pdb", FALSE);
    RsdsWriteDebugEntry(Buffer,
                        RsdsLoadedDebugRva,
                        IMAGE_DEBUG_TYPE_CODEVIEW,
                        RsdsLoadedPayloadRva,
                        RsdsBogusRawPointer,
                        RsdsPayloadSize("loaded\\missing-nul.pdb", FALSE));
    TestNum++;
    if (RsdsExpectLoadedFailure(Buffer))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] loaded parser accepted RSDS path without NUL terminator\n");
        return FALSE;
    }
 
    RsdsBuildLoadedPe(Buffer, FALSE);
    RsdsSetDebugDirectory(Buffer, RsdsLoadedDebugRva, sizeof(IMAGE_DEBUG_DIRECTORY) * 2);
    RsdsWriteDebugEntry(Buffer, RsdsLoadedDebugRva, IMAGE_DEBUG_TYPE_CODEVIEW, RsdsLoadedPayloadRva, RsdsBogusRawPointer, sizeof(DWORD));
    CopyMemory(Buffer + RsdsLoadedPayloadRva, "NB10", sizeof(DWORD));
    RsdsWritePayload(Buffer, 0x330, RsdsGuidMulti, 0x27, "loaded/second-loaded.pdb", TRUE);
    RsdsWriteDebugEntry(Buffer,
                        RsdsLoadedDebugRva + sizeof(IMAGE_DEBUG_DIRECTORY),
                        IMAGE_DEBUG_TYPE_CODEVIEW,
                        0x330,
                        RsdsBogusRawPointer,
                        RsdsPayloadSize("loaded/second-loaded.pdb", TRUE));
    TestNum++;
    if (RsdsExpectLoadedSuccess(Buffer, "second-loaded.pdb", RsdsGuidMulti, 0x27))
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] loaded parser did not skip invalid first entry and parse second RSDS entry\n");
        return FALSE;
    }
 
    CHAR       SymbolServerRelativePath[MAX_PATH]                = {0};
    CHAR       GuidAndAgeDetails[MAX_PATH]                       = {0};
    CHAR       SmallGuidAndAgeDetails[MAXIMUM_GUID_AND_AGE_SIZE] = {0};
    const GUID Guid                                              = {0x01234567, 0x89ab, 0xcdef, {0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10}};
    TestNum++;
    if (SymFormatPdbIdentity("valid32.pdb",
                             &Guid,
                             0x1a,
                             SymbolServerRelativePath,
                             sizeof(SymbolServerRelativePath),
                             GuidAndAgeDetails,
                             sizeof(GuidAndAgeDetails)) &&
        strcmp(GuidAndAgeDetails, "0123456789abcdeffedcba98765432101a") == 0 &&
        strcmp(SymbolServerRelativePath, "valid32.pdb/0123456789abcdeffedcba98765432101a/valid32.pdb") == 0)
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] PDB identity formatting did not match symbol server path and GUID+age expectations\n");
        return FALSE;
    }
 
    TestNum++;
    if (SymFormatPdbIdentity("valid32.pdb",
                             &Guid,
                             0x1a,
                             NULL,
                             0,
                             SmallGuidAndAgeDetails,
                             sizeof(SmallGuidAndAgeDetails)) &&
        strcmp(SmallGuidAndAgeDetails, "0123456789abcdeffedcba98765432101a") == 0)
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] GUID+age identity did not fit the SDK-sized buffer\n");
        return FALSE;
    }
 
    RsdsBuildMinimalPe(Buffer, FALSE);
    RsdsWriteValidDebugEntry(Buffer, RsdsGuid64, 0x1c, "preferred\\preferred.pdb");
    RSDS_FAKE_FALLBACK_CONTEXT FallbackContext         = {0, TRUE};
    CHAR                       PreferredPath[MAX_PATH] = {0};
    TestNum++;
    if (SymFormatPdbIdentityFromPeImageOrFallback(Buffer,
                                                  RsdsFixtureSize,
                                                  PreferredPath,
                                                  sizeof(PreferredPath),
                                                  NULL,
                                                  0,
                                                  NULL,
                                                  0,
                                                  RsdsFakeFallback,
                                                  &FallbackContext) &&
        strcmp(PreferredPath, "preferred.pdb/67452301ab89efcd1032547698badcfe1c/preferred.pdb") == 0 &&
        FallbackContext.CallCount == 0)
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] PE RSDS identity was not preferred over fallback identity\n");
        return FALSE;
    }
 
    FallbackContext.CallCount = 0;
    CHAR ZeroSizeOutput       = 'x';
    TestNum++;
    if (!SymFormatPdbIdentityFromPeImageOrFallback(Buffer,
                                                   RsdsFixtureSize,
                                                   &ZeroSizeOutput,
                                                   0,
                                                   NULL,
                                                   0,
                                                   NULL,
                                                   0,
                                                   RsdsFakeFallback,
                                                   &FallbackContext) &&
        ZeroSizeOutput == 'x' && FallbackContext.CallCount == 0)
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] zero-sized output buffer was written or reported success\n");
        return FALSE;
    }
 
    FallbackContext.CallCount = 0;
    TestNum++;
    if (!SymFormatPdbIdentityFromPeImageOrFallback(Buffer,
                                                   RsdsFixtureSize,
                                                   NULL,
                                                   0,
                                                   NULL,
                                                   0,
                                                   NULL,
                                                   0,
                                                   RsdsFakeFallback,
                                                   &FallbackContext) &&
        FallbackContext.CallCount == 0)
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] identity formatting without requested output reported success or used fallback\n");
        return FALSE;
    }
 
    FallbackContext.CallCount    = 0;
    CHAR SmallPdbPath[4]         = {'x'};
    CHAR SmallFailureGuidAge[64] = {'x'};
    TestNum++;
    if (!SymFormatPdbIdentityFromPeImageOrFallback(Buffer,
                                                   RsdsFixtureSize,
                                                   NULL,
                                                   0,
                                                   SmallPdbPath,
                                                   sizeof(SmallPdbPath),
                                                   SmallFailureGuidAge,
                                                   sizeof(SmallFailureGuidAge),
                                                   RsdsFakeFallback,
                                                   &FallbackContext) &&
        SmallPdbPath[0] == '\0' && SmallFailureGuidAge[0] == '\0' && FallbackContext.CallCount == 0)
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] output formatting failure leaked partial identity data\n");
        return FALSE;
    }
 
    ZeroMemory(Buffer, sizeof(Buffer));
    FallbackContext.CallCount      = 0;
    FallbackContext.Succeed        = TRUE;
    CHAR FallbackPdb[MAX_PATH]     = {0};
    CHAR FallbackGuidAge[MAX_PATH] = {0};
    TestNum++;
    if (SymFormatPdbIdentityFromPeImageOrFallback(Buffer,
                                                  RsdsFixtureSize,
                                                  NULL,
                                                  0,
                                                  FallbackPdb,
                                                  sizeof(FallbackPdb),
                                                  FallbackGuidAge,
                                                  sizeof(FallbackGuidAge),
                                                  RsdsFakeFallback,
                                                  &FallbackContext) &&
        strcmp(FallbackPdb, "fallback.pdb") == 0 &&
        strcmp(FallbackGuidAge, "aabbccddeeff112233445566778899aa2b") == 0 &&
        FallbackContext.CallCount == 1)
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] malformed PE bytes did not use fallback identity\n");
        return FALSE;
    }
 
    FallbackContext.CallCount    = 0;
    FallbackContext.Succeed      = FALSE;
    CHAR FailedPath[MAX_PATH]    = {'x'};
    CHAR FailedPdb[MAX_PATH]     = {'x'};
    CHAR FailedGuidAge[MAX_PATH] = {'x'};
    TestNum++;
    if (!SymFormatPdbIdentityFromPeImageOrFallback(Buffer,
                                                   RsdsFixtureSize,
                                                   FailedPath,
                                                   sizeof(FailedPath),
                                                   FailedPdb,
                                                   sizeof(FailedPdb),
                                                   FailedGuidAge,
                                                   sizeof(FailedGuidAge),
                                                   RsdsFakeFallback,
                                                   &FallbackContext) &&
        FailedPath[0] == '\0' && FailedPdb[0] == '\0' && FailedGuidAge[0] == '\0' && FallbackContext.CallCount == 1)
    {
        printf("[+] Test number %d Passed\n", TestNum);
    }
    else
    {
        printf("[-] Test number %d Failed\n", TestNum);
        printf("[x] fallback failure reported success or left success-looking output\n");
        return FALSE;
    }
 
    return TRUE;
}

TestCommandParser()

BOOLEAN TestCommandParser

(

)

Test command parser.

Returns

BOOLEAN

{
    BOOLEAN OverallResult       = TRUE;
    INT32   TestNum             = 0;
    CHAR    FilePath[MAX_PATH]  = {0};
    UINT32  FailedTokenNum      = 0;
    UINT32  FailedTokenPosition = 0;
 
    //
    // Parse the test cases from the file
    // Setup the path for the filename
    //
    if (!hyperdbg_u_setup_path_for_filename(COMMAND_PARSER_TEST_CASES_FILE, FilePath, MAX_PATH, TRUE))
    {
        //
        // Error could not find the test case files
        //
        cout << "[-] Could not find the test case files" << endl;
        return FALSE;
    }
 
    //
    // Parse the test cases from the file
    //
    auto TestCases = ParseTestCases(FilePath);
 
    //
    // Perform testing test cases with parsed file
    //
    cout << "Perform testing test cases with parsed file:" << endl;
 
    //
    // Output the parsed test cases
    //
    for (const auto & TestCase : TestCases)
    {
        TestNum++;
 
        //
        // Create CHAR**
        //
        CHAR_PTR_PTR TestCaseArray = CreateTestCaseArray(TestCase.second);
 
        //
        // Check token with actual parser
        //
        if (hyperdbg_u_test_command_parser((CHAR *)TestCase.first.c_str(),
                                           (UINT32)TestCase.second.size(),
                                           TestCaseArray,
                                           &FailedTokenNum,
                                           &FailedTokenPosition))
        {
            cout << "[+] Test number " << TestNum << " Passed " << endl;
        }
        else
        {
            //
            // Set overall result to FALSE since one of the test cases failed
            //
            OverallResult = FALSE;
 
            //
            // Show parsed command and tokens
            //
            cout << "\n============================================================" << endl;
            cout << "\n*********************          " << endl;
            cout << "*** Error details ***          " << endl;
            cout << "*********************          " << endl;
            cout << "\nParsed tokens from HyperDbg main command parser:\n"
                 << endl;
 
            //
            // Show tokens
            //
            hyperdbg_u_test_command_parser_show_tokens((CHAR *)TestCase.first.c_str());
 
            cout << "\n============================================================" << endl;
 
            cout << "\nThe parsed command and tokens (From file):" << endl;
            ShowParsedCommandAndTokens(TestCase, FailedTokenNum, FailedTokenPosition);
 
            cout << "\n[-] Test number " << TestNum << " Failed " << endl;
            cout << "============================================================\n"
                 << endl;
 
            break;
        }
 
        //
        // Clean up memory
        //
        FreeTestCaseArray(TestCaseArray, TestCase.second.size());
    }
 
    return OverallResult;
}

TestPeParser()

BOOLEAN TestPeParser

(

)

Runs all PE parser unit tests and reports pass/fail results.

Each numbered test case exercises a distinct behaviour of the PE image reader:

1. A valid PE32+ image initialises successfully and reports 64-bit.
2. A valid PE32 image initialises successfully and reports 32-bit.
3. A corrupt DOS magic causes initialisation to fail.
4. An optional header that is one byte too small causes initialisation to fail.
5. An e_lfanew value that points past the buffer causes initialisation to fail.
6. A valid section RVA maps to the correct raw file offset.
7. Header-range RVA resolution is enforced at SizeOfHeaders boundaries.
8. An 8-byte section name is always returned null-terminated.
9. An RVA whose raw mapping extends outside the file is rejected.

Returns

BOOLEAN TRUE if all tests pass, FALSE if any test fails

{
    BOOLEAN OverallResult         = TRUE;
    INT32   TestNum               = 0;
    BYTE    Buffer[PeFixtureSize] = {0};
 
    BuildMinimalPe64(Buffer);
    TestNum++;
    {
        PE_IMAGE_READER Reader = {0};
 
        if (PeImageReaderInitialize(Buffer, sizeof(Buffer), &Reader) && !PeImageReaderIs32Bit(&Reader))
        {
            printf("[+] Test number %d Passed\n", TestNum);
        }
        else
        {
            printf("[-] Test number %d Failed\n", TestNum);
            printf("[x] valid PE64 did not initialize as PE32+\n");
            return FALSE;
        }
    }
 
    BuildMinimalPe32(Buffer);
    TestNum++;
    {
        PE_IMAGE_READER Reader = {0};
 
        if (PeImageReaderInitialize(Buffer, sizeof(Buffer), &Reader) && PeImageReaderIs32Bit(&Reader))
        {
            printf("[+] Test number %d Passed\n", TestNum);
        }
        else
        {
            printf("[-] Test number %d Failed\n", TestNum);
            printf("[x] valid PE32 did not initialize as PE32\n");
            return FALSE;
        }
    }
 
    BuildMinimalPe64(Buffer);
    WriteWord(Buffer, 0, 0);
    TestNum++;
    {
        PE_IMAGE_READER Reader = {0};
 
        if (!PeImageReaderInitialize(Buffer, sizeof(Buffer), &Reader))
        {
            printf("[+] Test number %d Passed\n", TestNum);
        }
        else
        {
            printf("[-] Test number %d Failed\n", TestNum);
            printf("[x] invalid DOS magic initialized successfully\n");
            return FALSE;
        }
    }
 
    BuildMinimalPe64(Buffer);
    WriteWord(Buffer,
              PeHeaderOffset + sizeof(DWORD) + offsetof(IMAGE_FILE_HEADER, SizeOfOptionalHeader),
              sizeof(IMAGE_OPTIONAL_HEADER64) - 1);
    TestNum++;
    {
        PE_IMAGE_READER Reader = {0};
 
        if (!PeImageReaderInitialize(Buffer, sizeof(Buffer), &Reader))
        {
            printf("[+] Test number %d Passed\n", TestNum);
        }
        else
        {
            printf("[-] Test number %d Failed\n", TestNum);
            printf("[x] truncated optional header initialized successfully\n");
            return FALSE;
        }
    }
 
    BuildMinimalPe64(Buffer);
    WriteDword(Buffer, offsetof(IMAGE_DOS_HEADER, e_lfanew), PeFixtureSize);
    TestNum++;
    {
        PE_IMAGE_READER Reader = {0};
 
        if (!PeImageReaderInitialize(Buffer, sizeof(Buffer), &Reader))
        {
            printf("[+] Test number %d Passed\n", TestNum);
        }
        else
        {
            printf("[-] Test number %d Failed\n", TestNum);
            printf("[x] invalid e_lfanew initialized successfully\n");
            return FALSE;
        }
    }
 
    BuildMinimalPe64(Buffer);
    SetPe64OptionalHeaderSizeOfHeaders(Buffer, 0x1c0);
    ConfigureTextSection(Buffer, sizeof(IMAGE_OPTIONAL_HEADER64), 0x1000, 0x50, 0x1c0, 0x40);
    TestNum++;
    {
        PE_IMAGE_READER Reader     = {0};
        SIZE_T          FileOffset = 0;
 
        if (PeImageReaderInitialize(Buffer, sizeof(Buffer), &Reader) &&
            PeImageReaderRvaToFileOffset(&Reader, 0x1010, 4, &FileOffset) && FileOffset == 0x1d0)
        {
            printf("[+] Test number %d Passed\n", TestNum);
        }
        else
        {
            printf("[-] Test number %d Failed\n", TestNum);
            printf("[x] valid section RVA did not map to raw file offset\n");
            return FALSE;
        }
    }
 
    BuildMinimalPe64(Buffer);
    SetPe64OptionalHeaderSizeOfHeaders(Buffer, 0x1c0);
    TestNum++;
    {
        PE_IMAGE_READER Reader     = {0};
        SIZE_T          FileOffset = 0;
 
        if (PeImageReaderInitialize(Buffer, sizeof(Buffer), &Reader) &&
            PeImageReaderRvaToFileOffset(&Reader, 0x20, 4, &FileOffset) && FileOffset == 0x20 &&
            !PeImageReaderRvaToFileOffset(&Reader, 0x1be, 4, &FileOffset))
        {
            printf("[+] Test number %d Passed\n", TestNum);
        }
        else
        {
            printf("[-] Test number %d Failed\n", TestNum);
            printf("[x] header RVA bounds were not enforced\n");
            return FALSE;
        }
    }
 
    TestNum++;
    {
        IMAGE_SECTION_HEADER SectionHeader = {0};
        CHAR                 Name[9];
 
        FillMemory(Name, sizeof(Name), 'X');
        CopyMemory(SectionHeader.Name, "ABCDEFGH", IMAGE_SIZEOF_SHORT_NAME);
        if (PeImageReaderGetSectionName(&SectionHeader, Name, sizeof(Name)) &&
            strcmp(Name, "ABCDEFGH") == 0 && Name[IMAGE_SIZEOF_SHORT_NAME] == '\0')
        {
            printf("[+] Test number %d Passed\n", TestNum);
        }
        else
        {
            printf("[-] Test number %d Failed\n", TestNum);
            printf("[x] 8-byte section name was not null-terminated\n");
            return FALSE;
        }
    }
 
    BuildMinimalPe64(Buffer);
    SetPe64OptionalHeaderSizeOfHeaders(Buffer, 0x1c0);
    ConfigureTextSection(Buffer, sizeof(IMAGE_OPTIONAL_HEADER64), 0x1000, 0x40, 0x300, 0x20);
    TestNum++;
    {
        PE_IMAGE_READER Reader     = {0};
        SIZE_T          FileOffset = 0;
 
        if (PeImageReaderInitialize(Buffer, sizeof(Buffer), &Reader) &&
            !PeImageReaderRvaToFileOffset(&Reader, 0x1000, 1, &FileOffset))
        {
            printf("[+] Test number %d Passed\n", TestNum);
        }
        else
        {
            printf("[-] Test number %d Failed\n", TestNum);
            printf("[x] RVA mapping accepted raw pointer outside file\n");
            OverallResult = FALSE;
        }
    }
 
    return OverallResult;
}

TestSemanticScripts()

BOOLEAN TestSemanticScripts

(

)

Test semantic scripts.

Returns

BOOLEAN

{
    INT32 TestNum           = 0;
    CHAR  dirPath[MAX_PATH] = {0};
 
    //
    // Parse the semantic script test cases from the file
    // Setup the path for the filenames
    //
    if (!hyperdbg_u_setup_path_for_filename(SCRIPT_SEMANTIC_TEST_CASE_DIRECTORY, dirPath, MAX_PATH, FALSE))
    {
        //
        // Error could not find the test case files
        //
        cout << "[-] Could not find the test case files" << endl;
        return FALSE;
    }
 
    //
    // Connect to the debugger
    //
    if (!hyperdbg_u_connect_remote_debugger_using_named_pipe(TEST_DEFAULT_NAMED_PIPE, TRUE))
    {
        cout << "[-] Could not connect to the debugger" << endl;
        return FALSE;
    }
 
    //
    // Run test cases
    //
    ReadDirectoryAndTestSemanticTestCases(dirPath);
 
    //
    // Close the connection
    //
    hyperdbg_u_debug_close_remote_debugger();
 
    return TRUE;
}