CGC Challenges

There are a couple other repos for the CGC binaries, notably the venerable cb-multios from Trail of Bits (which this is based on).

They all have weird build system hacks going on that make it pretty hard to tune your build. This one doesn't!

The CGC challenge set is intended to facilitate testing fuzzers, symbolic execution engines, and other binary analysis tools on a robust and realistic test set. It is recommended by Klees et. al and most other Fuzzing evaluation papers, alongside the LAVA-M dataset from Gavitt et. al.

This repository will build all CGC binaries and generate the "polls" for them, which are essentially input seeds. It also provides a one-shot test for each binary, as many binaries are broken (for example cgc_malloc from Kaprica does not run correctly and the fix is to replace its body with a call to malloc but this is not done yet for all binaries).

Table of Contents

• CGC Challenges
  • Table of Contents
  • Build Instructions
    • Install Dependencies
    • Compile Challenges
    • Install Challenges
    • Test Challenges
  • Customizing Build
    • Change Output Directory
    • Custom Flags
    • Turn off poll building
    • Automatic Python2 Module Installs
    • Enabling and Disabling Challenges
      • Disable Challenges
      • Enable Challenges
      • Enable Broken Challenges
  • Challenge Status

Build Instructions

Install Dependencies

$ sudo apt-get install meson ninja-build build-essential python2

Compile Challenges

$ meson builddir
$ meson compile -C builddir

Install Challenges

By default, challenges will be "installed" to ./output/.

$ meson install -C builddir

Test Challenges

You can test the challenges with their generated polls with:

$ meson test -C builddir

Customizing Build

Change Output Directory

You can specify a custom install directory with:

meson "-Dinstall_path=/path/to/install/dir" builddir

Custom Flags

• Custom CFLAGS example: meson -Dc_args='-fno-inline'
• Custom LDFLAGS example: meson -Dc_link_args='-fuse-ld=mold

There are a lot of included build options that you can find here probably, you will want:

• To enable/disable PIE: -Db_pie=true or -Db_pie=false
• NOTE: on some compilers for some reason, b_pie does not affect PIE executable building. in this case, you can use -Dforce_nopie=true to force no-pie building. This is tracked as issue 10885.

Turn off poll building

Poll building can be disabled entirely with meson -Dno_polls=true

Automatic Python2 Module Installs

Four Python2 modules are required to build this project's polls (which are basically just input seeds):

• pycryptodome
• pyyaml
• matplotlib

These will NOT be installed automatically by default, but if you are missing these modules or missing Python2 pip, the build system can install them for you and set up Python2. Just pass -Dinstall_pip_modules.

Enabling and Disabling Challenges

By default all working challenges are enabled and will be built. The build is reasonably fast, but you may for some reason want to disable challenges.

Disable Challenges

You can specify a list of challenges to disable with:

meson "-Ddisable=['TFTTP', 'virtual_pet']" builddir

All challenges are enabled by default, so adding a challenge to the list of disabled challenges will toggle it off. The list of disabled challenges defaults to the list of broken challenges, but if this option is passed the passed list will not override the list of broken challenges unless "-Denable_broken" is also passed.

Enable Challenges

You can specify a list of challenges to enable with:

meson "-Denable=['TFTTP', 'virtual_pet']" builddir

Only challenges that are explicitly enabled will be built if this option is provided.

Enable Broken Challenges

You can enable broken challenges (for testing purposes if you are trying to fix one, in which case, thanks!) with:

meson "-Denable_broken" builddir

Challenge Status

Not all challenges are working yet. Generally, multi-binary challenges are not set up, and some of the challenges have issues with improper header files. Some of these are easy fixes and will be fixed soon by me (or you can PR a fix 🥰). Some are harder.

Working: 186

Not working: 53

Legend:

✅: The challenge compiles!

❌: The challenge does not compile :(

#	Challenge	Codename	Building	Polls Generated	Doesn't Segfault
0	0maker	NRFIN_00014	❌	❌	❌
1	3D_Image_Toolkit	CROMU_00001	✅	❌	❌
2	AIS-Lite	CROMU_00004	✅	✅	✅
3	ASCII_Content_Server	CROMU_00006	✅	✅	✅
4	ASL6parse	CROMU_00008	✅	✅	❌
5	A_Game_of_Chance	CROMU_00003	❌	❌	❌
6	Accel	CROMU_00002	❌	❌	❌
7	Audio_Visualizer	CROMU_00009	✅	✅	❌
8	Azurad	CROMU_00010	✅	❌	❌
9	BIRC	CROMU_00015	❌	❌	❌
10	Barcoder	CROMU_00011	✅	✅	✅
11	BitBlaster	CROMU_00016	✅	✅	✅
12	Bloomy_Sunday	CROMU_00017	✅	✅	✅
13	Blubber	Unknown	❌	❌	❌
14	Board_Game	CROMU_00018	✅	✅	✅
15	BudgIT	CROMU_00019	✅	✅	✅
16	CGC_Board	CROMU_00024	❌	❌	❌
17	CGC_File_System	CROMU_00025	✅	❌	❌
18	CGC_Hangman_Game	CROMU_00026	✅	✅	❌
19	CGC_Image_Parser	CROMU_00027	❌	❌	❌
20	CGC_Planet_Markup_Language_Parser	CROMU_00028	✅	❌	❌
21	CGC_Symbol_Viewer_CSV	CROMU_00029	✅	✅	✅
22	CGC_Video_Format_Parser_and_Viewer	CROMU_00030	✅	❌	❌
23	CLOUDCOMPUTE	CROMU_00035	❌	❌	❌
24	CML	Unknown	❌	❌	❌
25	CNMP	CROMU_00036	✅	✅	✅
26	COLLIDEOSCOPE	CROMU_00037	✅	✅	✅
27	CTTP	CROMU_00041	✅	✅	✅
28	CableGrind	CROMU_00020	✅	✅	✅
29	CableGrindLlama	CROMU_00021	✅	✅	✅
30	Carbonate	Unknown	❌	❌	❌
31	Casino_Games	CROMU_00022	✅	✅	✅
32	Cereal_Mixup__A_Cereal_Vending_Machine_Controller	CROMU_00023	✅	✅	❌
33	Character_Statistics	CROMU_00031	✅	✅	✅
34	Charter	Unknown	❌	❌	❌
35	Checkmate	CROMU_00032	✅	✅	✅
36	Childs_Game	CROMU_00034	✅	✅	❌
37	Corinth	Unknown	❌	❌	❌
38	Cromulence_All_Service	CROMU_00040	✅	✅	✅
39	DFARS_Sample_Service	CROMU_00043	✅	✅	❌
40	Diary_Parser	CROMU_00044	✅	✅	❌
41	Differ	KPRCA_00002	✅	✅	❌
42	Diophantine_Password_Wallet	KPRCA_00007	✅	✅	✅
43	Dive_Logger	KPRCA_00008	✅	✅	✅
44	Divelogger2	KPRCA_00009	✅	✅	✅
45	Document_Rendering_Engine	KPRCA_00010	✅	✅	✅
46	Dungeon_Master	KPRCA_00011	❌	❌	❌
47	ECM_TCM_Simulator	KPRCA_00012	✅	✅	✅
48	Eddy	KPRCA_00013	✅	✅	✅
49	Email_System_2	KPRCA_00016	✅	✅	✅
50	Enslavednode_chat	KPRCA_00017	❌	❌	❌
51	Estadio	KPRCA_00018	✅	❌	❌
52	EternalPass	KPRCA_00019	❌	❌	❌
53	FASTLANE	KPRCA_00023	❌	❌	❌
54	FISHYXML	KPRCA_00027	✅	✅	❌
55	FSK_BBS	KPRCA_00031	✅	✅	✅
56	FSK_Messaging_Service	KPRCA_00032	✅	✅	✅
57	FUN	KPRCA_00033	❌	❌	❌
58	FablesReport	KPRCA_00020	✅	✅	✅
59	FaceMag	Unknown	❌	❌	❌
60	Facilities_Access_Control_System	KPRCA_00021	✅	✅	✅
61	FailAV	KPRCA_00022	✅	✅	❌
62	FileSys	KPRCA_00024	✅	✅	❌
63	Filesystem_Command_Shell	KPRCA_00025	✅	✅	❌
64	Finicky_File_Folder	KPRCA_00026	✅	✅	❌
65	Flash_File_System	KPRCA_00028	✅	✅	✅
66	Flight_Routes	KPRCA_00029	✅	✅	✅
67	Fortress	KPRCA_00030	✅	✅	❌
68	GPS_Tracker	KPRCA_00036	✅	✅	✅
69	GREYMATTER	KPRCA_00039	✅	✅	✅
70	Game_Night	KPRCA_00034	✅	✅	✅
71	Glue	KPRCA_00035	✅	✅	❌
72	GreatView	KPRCA_00037	✅	✅	✅
73	Gridder	KPRCA_00040	✅	✅	✅
74	Griswold	KPRCA_00041	❌	❌	❌
75	Grit	KPRCA_00042	✅	✅	✅
76	H20FlowInc	KPRCA_00043	✅	✅	✅
77	HIGHCOO	KPRCA_00048	✅	✅	✅
78	HackMan	KPRCA_00044	✅	✅	✅
79	Headscratch	KPRCA_00046	✅	✅	✅
80	HeartThrob	KPRCA_00047	✅	✅	✅
81	HighFrequencyTradingAlgo	KPRCA_00049	✅	✅	✅
82	Hug_Game	KPRCA_00050	✅	✅	✅
83	INSULATR	KPRCA_00053	✅	✅	✅
84	Image_Compressor	KPRCA_00052	✅	❌	❌
85	KKVS	NRFIN_00004	❌	❌	❌
86	KTY_Pretty_Printer	NRFIN_00005	✅	✅	❌
87	Kaprica_Go	KPRCA_00054	✅	❌	❌
88	Kaprica_Script_Interpreter	NRFIN_00001	❌	❌	❌
89	LAN_Simulator	NRFIN_00006	❌	❌	❌
90	LMS	NRFIN_00009	✅	✅	✅
91	LazyCalc	NRFIN_00008	✅	✅	❌
92	Lazybox	NRFIN_00007	❌	❌	❌
93	Loud_Square_Instant_Messaging_Protocol_LSIMP	NRFIN_00011	✅	✅	✅
94	LulzChat	NRFIN_00012	❌	❌	❌
95	Material_Temperature_Simulation	NRFIN_00015	✅	❌	❌
96	Mathematical_Solver	NRFIN_00016	✅	✅	✅
97	Matrix_Math_Calculator	NRFIN_00018	✅	✅	❌
98	Message_Service	NRFIN_00019	✅	❌	❌
99	Messaging	NRFIN_00020	❌	❌	❌
100	Mixology	Unknown	❌	❌	❌
101	Modern_Family_Tree	NRFIN_00023	✅	✅	✅
102	Monster_Game	NRFIN_00024	✅	✅	✅
103	Mount_Filemore	NRFIN_00025	✅	✅	❌
104	Movie_Rental_Service	NRFIN_00026	✅	✅	❌
105	Movie_Rental_Service_Redux	NRFIN_00027	✅	✅	❌
106	Multi_Arena_Pursuit_Simulator	NRFIN_00029	✅	✅	✅
107	Multi_User_Calendar	NRFIN_00035	✅	✅	❌
108	Multicast_Chat_Server	NRFIN_00030	❌	❌	❌
109	Multipass	NRFIN_00032	❌	❌	❌
110	Multipass2	NRFIN_00033	❌	❌	❌
111	Multipass3	NRFIN_00034	❌	❌	❌
112	Music_Store_Client	NRFIN_00036	✅	✅	✅
113	NarfAgainShell	NRFIN_00037	✅	✅	❌
114	NarfRPN	NRFIN_00038	✅	✅	✅
115	Network_File_System	NRFIN_00040	✅	❌	❌
116	Network_File_System_v3	NRFIN_00041	✅	✅	✅
117	Network_Queuing_Simulator	NRFIN_00042	✅	❌	❌
118	Neural_House	YAN01_00007	✅	✅	✅
119	NoHiC	YAN01_00009	❌	❌	❌
120	No_Paper._Not_Ever._NOPE	YAN01_00010	✅	✅	✅
121	OTPSim	Unknown	✅	✅	❌
122	OUTLAW	Unknown	❌	❌	❌
123	On_Sale	Unknown	❌	❌	❌
124	One_Amp	YAN01_00011	✅	✅	❌
125	One_Vote	YAN01_00012	✅	✅	✅
126	Order_Up	Unknown	❌	❌	❌
127	Overflow_Parking	Unknown	✅	✅	✅
128	PCM_Message_decoder	Unknown	✅	✅	✅
129	PKK_Steganography	Unknown	✅	✅	❌
130	PRU	Unknown	✅	✅	✅
131	PTaaS	Unknown	✅	❌	❌
132	Pac_for_Edges	Unknown	✅	✅	❌
133	Packet_Analyzer	Unknown	✅	✅	✅
134	Packet_Receiver	Unknown	✅	✅	✅
135	Palindrome	Unknown	✅	✅	✅
136	Palindrome2	Unknown	✅	✅	✅
137	Parking_Permit_Management_System_PPMS	Unknown	✅	✅	✅
138	Particle_Simulator	Unknown	✅	❌	❌
139	Pattern_Finder	Unknown	✅	✅	❌
140	Personal_Fitness_Manager	Unknown	✅	✅	✅
141	Pipelined	Unknown	❌	❌	❌
142	Printer	Unknown	✅	✅	❌
143	QUIETSQUARE	Unknown	✅	✅	❌
144	QuadtreeConways	Unknown	✅	✅	❌
145	Query_Calculator	Unknown	❌	❌	❌
146	RAM_based_filesystem	Unknown	❌	❌	❌
147	REDPILL	Unknown	❌	❌	❌
148	REMATCH_1--Hat_Trick--Morris_Worm	Unknown	❌	❌	❌
149	REMATCH_2--Mail_Server--Crackaddr	Unknown	✅	❌	❌
150	REMATCH_3--Address_Resolution_Service--SQL_Slammer	Unknown	✅	✅	❌
151	REMATCH_4--CGCRPC_Server--MS08-067	Unknown	❌	❌	❌
152	REMATCH_5--File_Explorer--LNK_Bug	Unknown	✅	✅	❌
153	REMATCH_6--Secure_Server--Heartbleed	Unknown	✅	✅	❌
154	RRPN	Unknown	✅	❌	❌
155	Recipe_Database	Unknown	✅	✅	✅
156	Recipe_and_Pantry_Manager	Unknown	✅	❌	❌
157	Rejistar	Unknown	❌	❌	❌
158	Resort_Modeller	Unknown	✅	✅	✅
159	SAuth	Unknown	✅	✅	❌
160	SCUBA_Dive_Logging	Unknown	✅	✅	✅
161	SFTSCBSISS	Unknown	✅	✅	✅
162	SIGSEGV	Unknown	✅	✅	✅
163	SLUR_reference_implementation	Unknown	✅	✅	❌
164	SOLFEDGE	Unknown	✅	✅	✅
165	SPIFFS	Unknown	✅	✅	❌
166	Sad_Face_Template_Engine_SFTE	Unknown	✅	✅	❌
167	Sample_Shipgame	Unknown	✅	✅	✅
168	Scrum_Database	Unknown	✅	✅	❌
169	Secure_Compression	Unknown	✅	✅	❌
170	Sensr	Unknown	✅	✅	❌
171	Shipgame	Unknown	❌	❌	❌
172	Shortest_Path_Tree_Calculator	Unknown	✅	✅	✅
173	ShoutCTF	Unknown	✅	✅	❌
174	Simple_Stack_Machine	Unknown	✅	✅	✅
175	Single-Sign-On	Unknown	❌	❌	❌
176	Snail_Mail	Unknown	✅	✅	✅
177	Sorter	Unknown	✅	✅	❌
178	Space_Attackers	Unknown	✅	✅	❌
179	Square_Rabbit	Unknown	✅	✅	❌
180	Stock_Exchange_Simulator	Unknown	❌	❌	❌
181	Street_map_service	Unknown	✅	✅	✅
182	String_Info_Calculator	Unknown	✅	✅	✅
183	String_Storage_and_Retrieval	Unknown	✅	✅	❌
184	TAINTEDLOVE	Unknown	✅	✅	✅
185	TFTTP	Unknown	❌	❌	❌
186	TIACA	Unknown	✅	✅	✅
187	TVS	Unknown	✅	✅	❌
188	Tennis_Ball_Motion_Calculator	Unknown	✅	✅	✅
189	Terrible_Ticket_Tracker	Unknown	✅	✅	❌
190	TextSearch	Unknown	❌	❌	❌
191	The_Longest_Road	Unknown	❌	❌	❌
192	Thermal_Controller_v2	Unknown	✅	✅	✅
193	Thermal_Controller_v3	Unknown	✅	✅	✅
194	Tick-A-Tack	Unknown	✅	✅	✅
195	UTF-late	Unknown	✅	✅	✅
196	User_Manager	Unknown	✅	✅	✅
197	ValveChecks	Unknown	✅	✅	✅
198	Vector_Graphics_2	Unknown	✅	✅	✅
199	Vector_Graphics_Format	Unknown	✅	✅	✅
200	Venture_Calculator	Unknown	✅	✅	❌
201	Virtual_Machine	Unknown	✅	✅	✅
202	Water_Treatment_Facility_Simulator	Unknown	❌	❌	❌
203	WhackJack	Unknown	✅	✅	✅
204	WordCompletion	Unknown	✅	❌	❌
205	XStore	Unknown	✅	✅	❌
206	anagram_game	CROMU_00005	✅	✅	❌
207	basic_emulator	CROMU_00012	✅	✅	✅
208	basic_messaging	CROMU_00014	✅	❌	❌
209	chess_mimic	CROMU_00033	✅	✅	✅
210	commerce_webscale	CROMU_00038	❌	❌	❌
211	cotton_swab_arithmetic	CROMU_00039	✅	✅	✅
212	cyber_blogger	CROMU_00042	✅	✅	✅
213	electronictrading	KPRCA_00014	✅	✅	❌
214	greeter	KPRCA_00038	✅	✅	✅
215	hawaii_sets	KPRCA_00045	✅	❌	❌
216	humaninterface	KPRCA_00051	✅	✅	❌
217	matrices_for_sale	NRFIN_00017	✅	✅	✅
218	middleout	NRFIN_00021	❌	❌	❌
219	middleware_handshake	NRFIN_00022	✅	✅	❌
220	netstorage	NRFIN_00039	❌	❌	❌
221	online_job_application	Unknown	✅	✅	❌
222	online_job_application2	Unknown	✅	✅	❌
223	payroll	Unknown	✅	❌	❌
224	pizza_ordering_system	Unknown	✅	✅	❌
225	reallystream	Unknown	❌	❌	❌
226	root64_and_parcour	Unknown	✅	✅	✅
227	router_simulator	Unknown	✅	✅	❌
228	simpleOCR	Unknown	✅	✅	✅
229	simple_integer_calculator	Unknown	✅	✅	✅
230	simplenote	Unknown	✅	✅	❌
231	stack_vm	Unknown	✅	✅	✅
232	stream_vm	Unknown	✅	✅	✅
233	stream_vm2	Unknown	✅	✅	❌
234	tribute	Unknown	❌	❌	❌
235	university_enrollment	Unknown	❌	❌	❌
236	vFilter	Unknown	✅	✅	❌
237	virtual_pet	Unknown	❌	❌	❌
238	yolodex	Unknown	✅	✅	✅