There are a couple other repos for the CGC binaries, notably the venerable cb-multios from Trail of Bits (which this is based on).
They all have weird build system hacks going on that make it pretty hard to tune your build. This one doesn't!
The CGC challenge set is intended to facilitate testing fuzzers, symbolic execution engines, and other binary analysis tools on a robust and realistic test set. It is recommended by Klees et. al and most other Fuzzing evaluation papers, alongside the LAVA-M dataset from Gavitt et. al.
This repository will build all CGC binaries and generate the "polls" for them, which
are essentially input seeds. It also provides a one-shot test for each binary, as many
binaries are broken (for example cgc_malloc
from Kaprica does not run correctly and
the fix is to replace its body with a call to malloc
but this is not done yet for all
binaries).
$ sudo apt-get install meson ninja-build build-essential python2
$ meson builddir
$ meson compile -C builddir
By default, challenges will be "installed" to ./output/
.
$ meson install -C builddir
You can test the challenges with their generated polls with:
$ meson test -C builddir
You can specify a custom install directory with:
meson "-Dinstall_path=/path/to/install/dir" builddir
- Custom
CFLAGS
example:meson -Dc_args='-fno-inline'
- Custom
LDFLAGS
example:meson -Dc_link_args='-fuse-ld=mold
There are a lot of included build options that you can find here probably, you will want:
- To enable/disable PIE:
-Db_pie=true
or-Db_pie=false
- NOTE: on some compilers for some reason,
b_pie
does not affect PIE executable building. in this case, you can use-Dforce_nopie=true
to force no-pie building. This is tracked as issue 10885.
Poll building can be disabled entirely with meson -Dno_polls=true
Four Python2 modules are required to build this project's polls (which are basically just input seeds):
pycryptodome
pyyaml
matplotlib
These will NOT be installed automatically by default, but if you are missing these
modules or missing Python2 pip, the build system can install them for you and set
up Python2. Just pass -Dinstall_pip_modules
.
By default all working challenges are enabled and will be built. The build is reasonably fast, but you may for some reason want to disable challenges.
You can specify a list of challenges to disable with:
meson "-Ddisable=['TFTTP', 'virtual_pet']" builddir
All challenges are enabled by default, so adding a challenge to the list of disabled
challenges will toggle it off. The list of disabled challenges defaults to the list of
broken challenges, but if this option is passed the passed list will not override the
list of broken challenges unless "-Denable_broken"
is also passed.
You can specify a list of challenges to enable with:
meson "-Denable=['TFTTP', 'virtual_pet']" builddir
Only challenges that are explicitly enabled will be built if this option is provided.
You can enable broken challenges (for testing purposes if you are trying to fix one, in which case, thanks!) with:
meson "-Denable_broken" builddir
Not all challenges are working yet. Generally, multi-binary challenges are not set up, and some of the challenges have issues with improper header files. Some of these are easy fixes and will be fixed soon by me (or you can PR a fix 🥰). Some are harder.
Working: 186
Not working: 53
Legend:
✅: The challenge compiles!
❌: The challenge does not compile :(
# | Challenge | Codename | Building | Polls Generated | Doesn't Segfault |
---|---|---|---|---|---|
0 | 0maker | NRFIN_00014 | ❌ | ❌ | ❌ |
1 | 3D_Image_Toolkit | CROMU_00001 | ✅ | ❌ | ❌ |
2 | AIS-Lite | CROMU_00004 | ✅ | ✅ | ✅ |
3 | ASCII_Content_Server | CROMU_00006 | ✅ | ✅ | ✅ |
4 | ASL6parse | CROMU_00008 | ✅ | ✅ | ❌ |
5 | A_Game_of_Chance | CROMU_00003 | ❌ | ❌ | ❌ |
6 | Accel | CROMU_00002 | ❌ | ❌ | ❌ |
7 | Audio_Visualizer | CROMU_00009 | ✅ | ✅ | ❌ |
8 | Azurad | CROMU_00010 | ✅ | ❌ | ❌ |
9 | BIRC | CROMU_00015 | ❌ | ❌ | ❌ |
10 | Barcoder | CROMU_00011 | ✅ | ✅ | ✅ |
11 | BitBlaster | CROMU_00016 | ✅ | ✅ | ✅ |
12 | Bloomy_Sunday | CROMU_00017 | ✅ | ✅ | ✅ |
13 | Blubber | Unknown | ❌ | ❌ | ❌ |
14 | Board_Game | CROMU_00018 | ✅ | ✅ | ✅ |
15 | BudgIT | CROMU_00019 | ✅ | ✅ | ✅ |
16 | CGC_Board | CROMU_00024 | ❌ | ❌ | ❌ |
17 | CGC_File_System | CROMU_00025 | ✅ | ❌ | ❌ |
18 | CGC_Hangman_Game | CROMU_00026 | ✅ | ✅ | ❌ |
19 | CGC_Image_Parser | CROMU_00027 | ❌ | ❌ | ❌ |
20 | CGC_Planet_Markup_Language_Parser | CROMU_00028 | ✅ | ❌ | ❌ |
21 | CGC_Symbol_Viewer_CSV | CROMU_00029 | ✅ | ✅ | ✅ |
22 | CGC_Video_Format_Parser_and_Viewer | CROMU_00030 | ✅ | ❌ | ❌ |
23 | CLOUDCOMPUTE | CROMU_00035 | ❌ | ❌ | ❌ |
24 | CML | Unknown | ❌ | ❌ | ❌ |
25 | CNMP | CROMU_00036 | ✅ | ✅ | ✅ |
26 | COLLIDEOSCOPE | CROMU_00037 | ✅ | ✅ | ✅ |
27 | CTTP | CROMU_00041 | ✅ | ✅ | ✅ |
28 | CableGrind | CROMU_00020 | ✅ | ✅ | ✅ |
29 | CableGrindLlama | CROMU_00021 | ✅ | ✅ | ✅ |
30 | Carbonate | Unknown | ❌ | ❌ | ❌ |
31 | Casino_Games | CROMU_00022 | ✅ | ✅ | ✅ |
32 | Cereal_Mixup__A_Cereal_Vending_Machine_Controller | CROMU_00023 | ✅ | ✅ | ❌ |
33 | Character_Statistics | CROMU_00031 | ✅ | ✅ | ✅ |
34 | Charter | Unknown | ❌ | ❌ | ❌ |
35 | Checkmate | CROMU_00032 | ✅ | ✅ | ✅ |
36 | Childs_Game | CROMU_00034 | ✅ | ✅ | ❌ |
37 | Corinth | Unknown | ❌ | ❌ | ❌ |
38 | Cromulence_All_Service | CROMU_00040 | ✅ | ✅ | ✅ |
39 | DFARS_Sample_Service | CROMU_00043 | ✅ | ✅ | ❌ |
40 | Diary_Parser | CROMU_00044 | ✅ | ✅ | ❌ |
41 | Differ | KPRCA_00002 | ✅ | ✅ | ❌ |
42 | Diophantine_Password_Wallet | KPRCA_00007 | ✅ | ✅ | ✅ |
43 | Dive_Logger | KPRCA_00008 | ✅ | ✅ | ✅ |
44 | Divelogger2 | KPRCA_00009 | ✅ | ✅ | ✅ |
45 | Document_Rendering_Engine | KPRCA_00010 | ✅ | ✅ | ✅ |
46 | Dungeon_Master | KPRCA_00011 | ❌ | ❌ | ❌ |
47 | ECM_TCM_Simulator | KPRCA_00012 | ✅ | ✅ | ✅ |
48 | Eddy | KPRCA_00013 | ✅ | ✅ | ✅ |
49 | Email_System_2 | KPRCA_00016 | ✅ | ✅ | ✅ |
50 | Enslavednode_chat | KPRCA_00017 | ❌ | ❌ | ❌ |
51 | Estadio | KPRCA_00018 | ✅ | ❌ | ❌ |
52 | EternalPass | KPRCA_00019 | ❌ | ❌ | ❌ |
53 | FASTLANE | KPRCA_00023 | ❌ | ❌ | ❌ |
54 | FISHYXML | KPRCA_00027 | ✅ | ✅ | ❌ |
55 | FSK_BBS | KPRCA_00031 | ✅ | ✅ | ✅ |
56 | FSK_Messaging_Service | KPRCA_00032 | ✅ | ✅ | ✅ |
57 | FUN | KPRCA_00033 | ❌ | ❌ | ❌ |
58 | FablesReport | KPRCA_00020 | ✅ | ✅ | ✅ |
59 | FaceMag | Unknown | ❌ | ❌ | ❌ |
60 | Facilities_Access_Control_System | KPRCA_00021 | ✅ | ✅ | ✅ |
61 | FailAV | KPRCA_00022 | ✅ | ✅ | ❌ |
62 | FileSys | KPRCA_00024 | ✅ | ✅ | ❌ |
63 | Filesystem_Command_Shell | KPRCA_00025 | ✅ | ✅ | ❌ |
64 | Finicky_File_Folder | KPRCA_00026 | ✅ | ✅ | ❌ |
65 | Flash_File_System | KPRCA_00028 | ✅ | ✅ | ✅ |
66 | Flight_Routes | KPRCA_00029 | ✅ | ✅ | ✅ |
67 | Fortress | KPRCA_00030 | ✅ | ✅ | ❌ |
68 | GPS_Tracker | KPRCA_00036 | ✅ | ✅ | ✅ |
69 | GREYMATTER | KPRCA_00039 | ✅ | ✅ | ✅ |
70 | Game_Night | KPRCA_00034 | ✅ | ✅ | ✅ |
71 | Glue | KPRCA_00035 | ✅ | ✅ | ❌ |
72 | GreatView | KPRCA_00037 | ✅ | ✅ | ✅ |
73 | Gridder | KPRCA_00040 | ✅ | ✅ | ✅ |
74 | Griswold | KPRCA_00041 | ❌ | ❌ | ❌ |
75 | Grit | KPRCA_00042 | ✅ | ✅ | ✅ |
76 | H20FlowInc | KPRCA_00043 | ✅ | ✅ | ✅ |
77 | HIGHCOO | KPRCA_00048 | ✅ | ✅ | ✅ |
78 | HackMan | KPRCA_00044 | ✅ | ✅ | ✅ |
79 | Headscratch | KPRCA_00046 | ✅ | ✅ | ✅ |
80 | HeartThrob | KPRCA_00047 | ✅ | ✅ | ✅ |
81 | HighFrequencyTradingAlgo | KPRCA_00049 | ✅ | ✅ | ✅ |
82 | Hug_Game | KPRCA_00050 | ✅ | ✅ | ✅ |
83 | INSULATR | KPRCA_00053 | ✅ | ✅ | ✅ |
84 | Image_Compressor | KPRCA_00052 | ✅ | ❌ | ❌ |
85 | KKVS | NRFIN_00004 | ❌ | ❌ | ❌ |
86 | KTY_Pretty_Printer | NRFIN_00005 | ✅ | ✅ | ❌ |
87 | Kaprica_Go | KPRCA_00054 | ✅ | ❌ | ❌ |
88 | Kaprica_Script_Interpreter | NRFIN_00001 | ❌ | ❌ | ❌ |
89 | LAN_Simulator | NRFIN_00006 | ❌ | ❌ | ❌ |
90 | LMS | NRFIN_00009 | ✅ | ✅ | ✅ |
91 | LazyCalc | NRFIN_00008 | ✅ | ✅ | ❌ |
92 | Lazybox | NRFIN_00007 | ❌ | ❌ | ❌ |
93 | Loud_Square_Instant_Messaging_Protocol_LSIMP | NRFIN_00011 | ✅ | ✅ | ✅ |
94 | LulzChat | NRFIN_00012 | ❌ | ❌ | ❌ |
95 | Material_Temperature_Simulation | NRFIN_00015 | ✅ | ❌ | ❌ |
96 | Mathematical_Solver | NRFIN_00016 | ✅ | ✅ | ✅ |
97 | Matrix_Math_Calculator | NRFIN_00018 | ✅ | ✅ | ❌ |
98 | Message_Service | NRFIN_00019 | ✅ | ❌ | ❌ |
99 | Messaging | NRFIN_00020 | ❌ | ❌ | ❌ |
100 | Mixology | Unknown | ❌ | ❌ | ❌ |
101 | Modern_Family_Tree | NRFIN_00023 | ✅ | ✅ | ✅ |
102 | Monster_Game | NRFIN_00024 | ✅ | ✅ | ✅ |
103 | Mount_Filemore | NRFIN_00025 | ✅ | ✅ | ❌ |
104 | Movie_Rental_Service | NRFIN_00026 | ✅ | ✅ | ❌ |
105 | Movie_Rental_Service_Redux | NRFIN_00027 | ✅ | ✅ | ❌ |
106 | Multi_Arena_Pursuit_Simulator | NRFIN_00029 | ✅ | ✅ | ✅ |
107 | Multi_User_Calendar | NRFIN_00035 | ✅ | ✅ | ❌ |
108 | Multicast_Chat_Server | NRFIN_00030 | ❌ | ❌ | ❌ |
109 | Multipass | NRFIN_00032 | ❌ | ❌ | ❌ |
110 | Multipass2 | NRFIN_00033 | ❌ | ❌ | ❌ |
111 | Multipass3 | NRFIN_00034 | ❌ | ❌ | ❌ |
112 | Music_Store_Client | NRFIN_00036 | ✅ | ✅ | ✅ |
113 | NarfAgainShell | NRFIN_00037 | ✅ | ✅ | ❌ |
114 | NarfRPN | NRFIN_00038 | ✅ | ✅ | ✅ |
115 | Network_File_System | NRFIN_00040 | ✅ | ❌ | ❌ |
116 | Network_File_System_v3 | NRFIN_00041 | ✅ | ✅ | ✅ |
117 | Network_Queuing_Simulator | NRFIN_00042 | ✅ | ❌ | ❌ |
118 | Neural_House | YAN01_00007 | ✅ | ✅ | ✅ |
119 | NoHiC | YAN01_00009 | ❌ | ❌ | ❌ |
120 | No_Paper._Not_Ever._NOPE | YAN01_00010 | ✅ | ✅ | ✅ |
121 | OTPSim | Unknown | ✅ | ✅ | ❌ |
122 | OUTLAW | Unknown | ❌ | ❌ | ❌ |
123 | On_Sale | Unknown | ❌ | ❌ | ❌ |
124 | One_Amp | YAN01_00011 | ✅ | ✅ | ❌ |
125 | One_Vote | YAN01_00012 | ✅ | ✅ | ✅ |
126 | Order_Up | Unknown | ❌ | ❌ | ❌ |
127 | Overflow_Parking | Unknown | ✅ | ✅ | ✅ |
128 | PCM_Message_decoder | Unknown | ✅ | ✅ | ✅ |
129 | PKK_Steganography | Unknown | ✅ | ✅ | ❌ |
130 | PRU | Unknown | ✅ | ✅ | ✅ |
131 | PTaaS | Unknown | ✅ | ❌ | ❌ |
132 | Pac_for_Edges | Unknown | ✅ | ✅ | ❌ |
133 | Packet_Analyzer | Unknown | ✅ | ✅ | ✅ |
134 | Packet_Receiver | Unknown | ✅ | ✅ | ✅ |
135 | Palindrome | Unknown | ✅ | ✅ | ✅ |
136 | Palindrome2 | Unknown | ✅ | ✅ | ✅ |
137 | Parking_Permit_Management_System_PPMS | Unknown | ✅ | ✅ | ✅ |
138 | Particle_Simulator | Unknown | ✅ | ❌ | ❌ |
139 | Pattern_Finder | Unknown | ✅ | ✅ | ❌ |
140 | Personal_Fitness_Manager | Unknown | ✅ | ✅ | ✅ |
141 | Pipelined | Unknown | ❌ | ❌ | ❌ |
142 | Printer | Unknown | ✅ | ✅ | ❌ |
143 | QUIETSQUARE | Unknown | ✅ | ✅ | ❌ |
144 | QuadtreeConways | Unknown | ✅ | ✅ | ❌ |
145 | Query_Calculator | Unknown | ❌ | ❌ | ❌ |
146 | RAM_based_filesystem | Unknown | ❌ | ❌ | ❌ |
147 | REDPILL | Unknown | ❌ | ❌ | ❌ |
148 | REMATCH_1--Hat_Trick--Morris_Worm | Unknown | ❌ | ❌ | ❌ |
149 | REMATCH_2--Mail_Server--Crackaddr | Unknown | ✅ | ❌ | ❌ |
150 | REMATCH_3--Address_Resolution_Service--SQL_Slammer | Unknown | ✅ | ✅ | ❌ |
151 | REMATCH_4--CGCRPC_Server--MS08-067 | Unknown | ❌ | ❌ | ❌ |
152 | REMATCH_5--File_Explorer--LNK_Bug | Unknown | ✅ | ✅ | ❌ |
153 | REMATCH_6--Secure_Server--Heartbleed | Unknown | ✅ | ✅ | ❌ |
154 | RRPN | Unknown | ✅ | ❌ | ❌ |
155 | Recipe_Database | Unknown | ✅ | ✅ | ✅ |
156 | Recipe_and_Pantry_Manager | Unknown | ✅ | ❌ | ❌ |
157 | Rejistar | Unknown | ❌ | ❌ | ❌ |
158 | Resort_Modeller | Unknown | ✅ | ✅ | ✅ |
159 | SAuth | Unknown | ✅ | ✅ | ❌ |
160 | SCUBA_Dive_Logging | Unknown | ✅ | ✅ | ✅ |
161 | SFTSCBSISS | Unknown | ✅ | ✅ | ✅ |
162 | SIGSEGV | Unknown | ✅ | ✅ | ✅ |
163 | SLUR_reference_implementation | Unknown | ✅ | ✅ | ❌ |
164 | SOLFEDGE | Unknown | ✅ | ✅ | ✅ |
165 | SPIFFS | Unknown | ✅ | ✅ | ❌ |
166 | Sad_Face_Template_Engine_SFTE | Unknown | ✅ | ✅ | ❌ |
167 | Sample_Shipgame | Unknown | ✅ | ✅ | ✅ |
168 | Scrum_Database | Unknown | ✅ | ✅ | ❌ |
169 | Secure_Compression | Unknown | ✅ | ✅ | ❌ |
170 | Sensr | Unknown | ✅ | ✅ | ❌ |
171 | Shipgame | Unknown | ❌ | ❌ | ❌ |
172 | Shortest_Path_Tree_Calculator | Unknown | ✅ | ✅ | ✅ |
173 | ShoutCTF | Unknown | ✅ | ✅ | ❌ |
174 | Simple_Stack_Machine | Unknown | ✅ | ✅ | ✅ |
175 | Single-Sign-On | Unknown | ❌ | ❌ | ❌ |
176 | Snail_Mail | Unknown | ✅ | ✅ | ✅ |
177 | Sorter | Unknown | ✅ | ✅ | ❌ |
178 | Space_Attackers | Unknown | ✅ | ✅ | ❌ |
179 | Square_Rabbit | Unknown | ✅ | ✅ | ❌ |
180 | Stock_Exchange_Simulator | Unknown | ❌ | ❌ | ❌ |
181 | Street_map_service | Unknown | ✅ | ✅ | ✅ |
182 | String_Info_Calculator | Unknown | ✅ | ✅ | ✅ |
183 | String_Storage_and_Retrieval | Unknown | ✅ | ✅ | ❌ |
184 | TAINTEDLOVE | Unknown | ✅ | ✅ | ✅ |
185 | TFTTP | Unknown | ❌ | ❌ | ❌ |
186 | TIACA | Unknown | ✅ | ✅ | ✅ |
187 | TVS | Unknown | ✅ | ✅ | ❌ |
188 | Tennis_Ball_Motion_Calculator | Unknown | ✅ | ✅ | ✅ |
189 | Terrible_Ticket_Tracker | Unknown | ✅ | ✅ | ❌ |
190 | TextSearch | Unknown | ❌ | ❌ | ❌ |
191 | The_Longest_Road | Unknown | ❌ | ❌ | ❌ |
192 | Thermal_Controller_v2 | Unknown | ✅ | ✅ | ✅ |
193 | Thermal_Controller_v3 | Unknown | ✅ | ✅ | ✅ |
194 | Tick-A-Tack | Unknown | ✅ | ✅ | ✅ |
195 | UTF-late | Unknown | ✅ | ✅ | ✅ |
196 | User_Manager | Unknown | ✅ | ✅ | ✅ |
197 | ValveChecks | Unknown | ✅ | ✅ | ✅ |
198 | Vector_Graphics_2 | Unknown | ✅ | ✅ | ✅ |
199 | Vector_Graphics_Format | Unknown | ✅ | ✅ | ✅ |
200 | Venture_Calculator | Unknown | ✅ | ✅ | ❌ |
201 | Virtual_Machine | Unknown | ✅ | ✅ | ✅ |
202 | Water_Treatment_Facility_Simulator | Unknown | ❌ | ❌ | ❌ |
203 | WhackJack | Unknown | ✅ | ✅ | ✅ |
204 | WordCompletion | Unknown | ✅ | ❌ | ❌ |
205 | XStore | Unknown | ✅ | ✅ | ❌ |
206 | anagram_game | CROMU_00005 | ✅ | ✅ | ❌ |
207 | basic_emulator | CROMU_00012 | ✅ | ✅ | ✅ |
208 | basic_messaging | CROMU_00014 | ✅ | ❌ | ❌ |
209 | chess_mimic | CROMU_00033 | ✅ | ✅ | ✅ |
210 | commerce_webscale | CROMU_00038 | ❌ | ❌ | ❌ |
211 | cotton_swab_arithmetic | CROMU_00039 | ✅ | ✅ | ✅ |
212 | cyber_blogger | CROMU_00042 | ✅ | ✅ | ✅ |
213 | electronictrading | KPRCA_00014 | ✅ | ✅ | ❌ |
214 | greeter | KPRCA_00038 | ✅ | ✅ | ✅ |
215 | hawaii_sets | KPRCA_00045 | ✅ | ❌ | ❌ |
216 | humaninterface | KPRCA_00051 | ✅ | ✅ | ❌ |
217 | matrices_for_sale | NRFIN_00017 | ✅ | ✅ | ✅ |
218 | middleout | NRFIN_00021 | ❌ | ❌ | ❌ |
219 | middleware_handshake | NRFIN_00022 | ✅ | ✅ | ❌ |
220 | netstorage | NRFIN_00039 | ❌ | ❌ | ❌ |
221 | online_job_application | Unknown | ✅ | ✅ | ❌ |
222 | online_job_application2 | Unknown | ✅ | ✅ | ❌ |
223 | payroll | Unknown | ✅ | ❌ | ❌ |
224 | pizza_ordering_system | Unknown | ✅ | ✅ | ❌ |
225 | reallystream | Unknown | ❌ | ❌ | ❌ |
226 | root64_and_parcour | Unknown | ✅ | ✅ | ✅ |
227 | router_simulator | Unknown | ✅ | ✅ | ❌ |
228 | simpleOCR | Unknown | ✅ | ✅ | ✅ |
229 | simple_integer_calculator | Unknown | ✅ | ✅ | ✅ |
230 | simplenote | Unknown | ✅ | ✅ | ❌ |
231 | stack_vm | Unknown | ✅ | ✅ | ✅ |
232 | stream_vm | Unknown | ✅ | ✅ | ✅ |
233 | stream_vm2 | Unknown | ✅ | ✅ | ❌ |
234 | tribute | Unknown | ❌ | ❌ | ❌ |
235 | university_enrollment | Unknown | ❌ | ❌ | ❌ |
236 | vFilter | Unknown | ✅ | ✅ | ❌ |
237 | virtual_pet | Unknown | ❌ | ❌ | ❌ |
238 | yolodex | Unknown | ✅ | ✅ | ✅ |