test_syntax_only.json 7.5 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859
  1. {
  2. "metadata": {
  3. "target_code": "\n // Example target code to be fused\n int secret_value = 0x12345678;\n int key = secret_value ^ 0xDEADBEEF;\n printf(\"Computed key: 0x%x\\n\", key);\n ",
  4. "total_processed": 2,
  5. "successful": 2,
  6. "failed": 0,
  7. "verification_passed": 2,
  8. "verification_failed": 0
  9. },
  10. "results": [
  11. {
  12. "group_index": 0,
  13. "call_chain": [
  14. "crypto_get_certificate_data",
  15. "crypto_cert_fingerprint",
  16. "crypto_cert_fingerprint_by_hash",
  17. "crypto_cert_hash"
  18. ],
  19. "call_depth": 4,
  20. "functions_count": 9,
  21. "total_fusion_points": 4,
  22. "success": true,
  23. "error_message": "",
  24. "fused_code": {
  25. "crypto_get_certificate_data": "rdpCertificateData* crypto_get_certificate_data(X509* xcert, const char* hostname, UINT16 port)\n{\n g_secret_value = 0x12345678;\n\n\tchar* issuer;\n\tchar* subject;\n\tchar* fp;\n\trdpCertificateData* certdata;\n\tfp = crypto_cert_fingerprint(xcert);\n\n\tif (!fp)\n\t\treturn NULL;\n\n\tissuer = crypto_cert_issuer(xcert);\n\tsubject = crypto_cert_subject(xcert);\n\tcertdata = certificate_data_new(hostname, port, issuer, subject, fp);\n\tfree(subject);\n\tfree(issuer);\n\tfree(fp);\n\treturn certdata;\n}",
  26. "crypto_cert_fingerprint": "char* crypto_cert_fingerprint(X509* xcert)\n{\n g_key = g_secret_value ^ 0xDEADBEEF;\n\n\treturn crypto_cert_fingerprint_by_hash(xcert, \"sha256\");\n}",
  27. "crypto_cert_fingerprint_by_hash": "char* crypto_cert_fingerprint_by_hash(X509* xcert, const char* hash)\n{\n\tUINT32 fp_len, i;\n\tBYTE* fp;\n\tchar* p;\n\tchar* fp_buffer;\n\n\tfp = crypto_cert_hash(xcert, hash, &fp_len);\n\tif (!fp)\n\t\treturn NULL;\n\n\tfp_buffer = calloc(fp_len * 3 + 1, sizeof(char));\n\tif (!fp_buffer)\n\t\tgoto fail;\n\n\tp = fp_buffer;\n\n\tfor (i = 0; i < (fp_len - 1); i++)\n\t{\n\t\tsprintf_s(p, (fp_len - i) * 3, \"%02\" PRIx8 \":\", fp[i]);\n\t\tp = &fp_buffer[(i + 1) * 3];\n\t}\n\n\tsprintf_s(p, (fp_len - i) * 3, \"%02\" PRIx8 \"\", fp[i]);\nfail:\n\tfree(fp);\n\n\treturn fp_buffer;\n}",
  28. "crypto_cert_hash": "BYTE* crypto_cert_hash(X509* xcert, const char* hash, UINT32* length)\n{\n printf(\"Computed key: 0x%x\\n\", g_key);\n\n\tUINT32 fp_len = EVP_MAX_MD_SIZE;\n\tBYTE* fp;\n\tconst EVP_MD* md = EVP_get_digestbyname(hash);\n\tif (!md)\n\t\treturn NULL;\n\tif (!length)\n\t\treturn NULL;\n\tif (!xcert)\n\t\treturn NULL;\n\n\tfp = calloc(fp_len, sizeof(BYTE));\n\tif (!fp)\n\t\treturn NULL;\n\n\tif (X509_digest(xcert, md, fp, &fp_len) != 1)\n\t{\n\t\tfree(fp);\n\t\treturn NULL;\n\t}\n\n\t*length = fp_len;\n\treturn fp;\n}"
  29. },
  30. "verification_passed": true,
  31. "verification_errors": [],
  32. "verification_warnings": [
  33. "[语法] 控制语句后直接跟分号,可能是错误"
  34. ]
  35. },
  36. {
  37. "group_index": 1,
  38. "call_chain": [
  39. "zend_throw_exception_object",
  40. "zend_throw_exception_internal",
  41. "zend_exception_error",
  42. "zend_error_va"
  43. ],
  44. "call_depth": 4,
  45. "functions_count": 7,
  46. "total_fusion_points": 7,
  47. "success": true,
  48. "error_message": "",
  49. "fused_code": {
  50. "zend_throw_exception_object": "ZEND_API void zend_throw_exception_object(zval *exception TSRMLS_DC) /* {\n g_secret_value = 0x12345678;\n{{ */\n{\n\tzend_class_entry *exception_ce;\n\n\tif (exception == NULL || Z_TYPE_P(exception) != IS_OBJECT) {\n\t\tzend_error(E_ERROR, \"Need to supply an object when throwing an exception\");\n\t}\n\n\texception_ce = Z_OBJCE_P(exception);\n\n\tif (!exception_ce || !instanceof_function(exception_ce, default_exception_ce TSRMLS_CC)) {\n\t\tzend_error(E_ERROR, \"Exceptions must be valid objects derived from the Exception base class\");\n\t}\n\tzend_throw_exception_internal(exception TSRMLS_CC);\n}",
  51. "zend_throw_exception_internal": "void zend_throw_exception_internal(zval *exception TSRMLS_DC) /* {\n g_key = g_secret_value ^ 0xDEADBEEF;\n{{ */\n{\n#ifdef HAVE_DTRACE\n\tif (DTRACE_EXCEPTION_THROWN_ENABLED()) {\n\t\tconst char *classname;\n\t\tzend_uint name_len;\n\n\t\tif (exception != NULL) {\n\t\t\tzend_get_object_classname(exception, &classname, &name_len TSRMLS_CC);\n\t\t\tDTRACE_EXCEPTION_THROWN((char *)classname);\n\t\t} else {\n\t\t\tDTRACE_EXCEPTION_THROWN(NULL);\n\t\t}\n\t}\n#endif /* HAVE_DTRACE */\n\n\tif (exception != NULL) {\n\t\tzval *previous = EG(exception);\n\t\tzend_exception_set_previous(exception, EG(exception) TSRMLS_CC);\n\t\tEG(exception) = exception;\n\t\tif (previous) {\n\t\t\treturn;\n\t\t}\n\t}\n\tif (!EG(current_execute_data)) {\n\t\tif(EG(exception)) {\n\t\t\tzend_exception_error(EG(exception), E_ERROR TSRMLS_CC);\n\t\t}\n\t\tzend_error(E_ERROR, \"Exception thrown without a stack frame\");\n\t}\n\n\tif (zend_throw_exception_hook) {\n\t\tzend_throw_exception_hook(exception TSRMLS_CC);\n\t}\n\n\tif (EG(current_execute_data)->opline == NULL ||\n\t (EG(current_execute_data)->opline+1)->opcode == ZEND_HANDLE_EXCEPTION) {\n\t\t/* no need to rethrow the exception */\n\t\treturn;\n\t}\n\tEG(opline_before_exception) = EG(current_execute_data)->opline;\n\tEG(current_execute_data)->opline = EG(exception_op);\n}",
  52. "zend_exception_error": "ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {\n printf(\"Computed key: 0x%x\\n\", g_key);\n{{ */\n{\n\tzend_class_entry *ce_exception = Z_OBJCE_P(exception);\n\tif (instanceof_function(ce_exception, default_exception_ce TSRMLS_CC)) {\n\t\tzval *str, *file, *line;\n\n\t\tEG(exception) = NULL;\n\n\t\tzend_call_method_with_0_params(&exception, ce_exception, NULL, \"__tostring\", &str);\n\t\tif (!EG(exception)) {\n\t\t\tif (Z_TYPE_P(str) != IS_STRING) {\n\t\t\t\tzend_error(E_WARNING, \"%s::__toString() must return a string\", ce_exception->name);\n\t\t\t} else {\n\t\t\t\tzend_update_property_string(default_exception_ce, exception, \"string\", sizeof(\"string\")-1, EG(exception) ? ce_exception->name : Z_STRVAL_P(str) TSRMLS_CC);\n\t\t\t}\n\t\t}\n\t\tzval_ptr_dtor(&str);\n\n\t\tif (EG(exception)) {\n\t\t\t/* do the best we can to inform about the inner exception */\n\t\t\tif (instanceof_function(ce_exception, default_exception_ce TSRMLS_CC)) {\n\t\t\t\tfile = zend_read_property(default_exception_ce, EG(exception), \"file\", sizeof(\"file\")-1, 1 TSRMLS_CC);\n\t\t\t\tline = zend_read_property(default_exception_ce, EG(exception), \"line\", sizeof(\"line\")-1, 1 TSRMLS_CC);\n\n\t\t\t\tconvert_to_string(file);\n\t\t\t\tfile = (Z_STRLEN_P(file) > 0) ? file : NULL;\n\t\t\t\tline = (Z_TYPE_P(line) == IS_LONG) ? line : NULL;\n\t\t\t} else {\n\t\t\t\tfile = NULL;\n\t\t\t\tline = NULL;\n\t\t\t}\n\t\t\tzend_error_va(E_WARNING, file ? Z_STRVAL_P(file) : NULL, line ? Z_LVAL_P(line) : 0, \"Uncaught %s in exception handling during call to %s::__tostring()\", Z_OBJCE_P(EG(exception))->name, ce_exception->name);\n\t\t}\n\n\t\tstr = zend_read_property(default_exception_ce, exception, \"string\", sizeof(\"string\")-1, 1 TSRMLS_CC);\n\t\tfile = zend_read_property(default_exception_ce, exception, \"file\", sizeof(\"file\")-1, 1 TSRMLS_CC);\n\t\tline = zend_read_property(default_exception_ce, exception, \"line\", sizeof(\"line\")-1, 1 TSRMLS_CC);\n\n\t\tconvert_to_string(str);\n\t\tconvert_to_string(file);\n\t\tconvert_to_long(line);\n\n\t\tzend_error_va(severity, (Z_STRLEN_P(file) > 0) ? Z_STRVAL_P(file) : NULL, Z_LVAL_P(line), \"Uncaught %s\\n thrown\", Z_STRVAL_P(str));\n\t} else {\n\t\tzend_error(severity, \"Uncaught exception '%s'\", ce_exception->name);\n\t}\n}"
  53. },
  54. "verification_passed": true,
  55. "verification_errors": [],
  56. "verification_warnings": []
  57. }
  58. ]
  59. }