CGC Challenge Binaries

This repository holds challenge binaries (CBs) and tools from DARPA's Cyber Grand Challenge (CGC). Specifically, this is a fork of the CGC samples repository on GitHub, into which the following CGC tools have been incorporated: libcgc, cgc2elf, service-launcher, poll-generator, cb-testing.

Portions of Trail of Bits' libcgc implmentation have also been incorporated, along with GrammaTech modifications to provide compatibility across ISAs (we have successfully built CBs for x86-32, x86-64, and ARMv7).

Layout

The repository is laid out as follows:

Path	Contents
`bin/`	Utility scripts useful for building and running tests
`cqe-challenges/`	CBs from the CGC qualifying event
`debian/`	Debian packaging folder (unchanged from DARPA)
`examples/`	CB samples and CFE challenges
`lib/`	libcgc implementation
`Makefile`	DECREE build and test (unchanged from DARPA)
`templates/`	Templates for writing CBs (unchanged from DARPA)
`tools/`	Collected CGC tools developed by DARPA.

Setup

The test tools require that some Python packages be installed:

    sudo pip install pycrypto pyyaml matplotlib defusedxml

And you must build the service launcher (used by cb-test to feed inputs into CBs):

    cd tools/service-launcher
    make

Building and Testing Challenge Binaries

Set PATH and PYTHONPATH environment variables to point to scripts needed to build and run pollers:
```
  . sourceme.sh
```
In a challenge directory, run build.sh <output name> <compiler and flags>. For example, to build a 64-bit binary using gcc with optimization on a 64-bit machine:
```
  cd cqe-challenges/CROMU_00003
  build.sh CROMU_00003 gcc -O3
```
Each CB is accompanied by a README.md file that describes the program, how to interact with it, vulnerabilities embedded in the CB, and potential difficulties in analyzing it.
CGC challenge binaries can be tested for correctness with input/output pairs called "pollers". Pre-built pollers are archived at /u4/TARBALLS/rewriting/cgc-cbs_poller_inputs.tar.xz. Unpack these from the root of the repo to extract xml.tgz archives in each challenge's poller/for-testing and/or poller/for-release directory(ies):
```
  cd cgc-cbs
  tar xf /u4/TARBALLS/rewriting/cgc-cbs_poller_inputs.tar.xz --strip-components=1
  cd cqe-challenges/CROMU_00003/poller/for-release
  tar xf xml.tgz
```
You can also generate these poller inputs by using the generate-polls tool. Each challenge is accompanied by a state machine and state graph that the tool uses to generate poller inputs. Often there are two sets of these specifications, in poller/for-testing and poller/for-release. The differences aren't clear and we tend to use the for-release inputs.
```
  cd poller/for-release
  generate-polls machine.py state-graph.yaml .
```
Use the cb-test tool to feed test input into the challenge binary and check its output. One can use the --xml option to specify one or more xml files or the --xml_dir option to point to an entire directory of pollers (i.e., point to a for-release or for-testing directory). See documentation in tools/cb-testing for more details. Examples follow:
```
  # from inside cgc-cbs/cqe-challenges/CROMU_00003:
  # directory of pollers
  cb-test --directory . --cb CROMU_00003 --xml_dir poller/for-release

  # single poller
  cb-test --directory . --cb CROMU_00003 --xml poller/for-release/GEN_00000_00489.xml
```

Imported subtrees

The following subdirectories of this repository were added using git subtree and may be updated using the following commands.

tools/cb-testing

  git subtree pull --prefix=tools/cb-testing https://github.com/CyberGrandChallenge/cb-testing.git master

tools/cgc2elf

  git subtree pull --prefix=tools/cgc2elf https://github.com/CyberGrandChallenge/cgc2elf.git master

tools/poll-generator

  git subtree pull --prefix=tools/poll-generator https://github.com/CyberGrandChallenge/poll-generator.git master

tools/service-launcher

  git subtree pull --prefix=tools/service-launcher https://github.com/CyberGrandChallenge/service-launcher.git master

lib/libcgc

  git subtree pull --prefix=lib/libcgc https://github.com/CyberGrandChallenge/libcgc.git master

GrammaTech / cgc-cbs

CGC Challenge Binaries

Layout

Setup

Building and Testing Challenge Binaries

Imported subtrees

About

Languages