// Copyright (c) 2008-2009 Nokia Corporation and/or its subsidiary(-ies).

 // All rights reserved.

 // This component and the accompanying materials are made available

 // under the terms of the License "Eclipse Public License v1.0"

 // which accompanies this distribution, and is available

 // at the URL "http://www.eclipse.org/legal/epl-v10.html".

 //

 // Initial Contributors:

 // Nokia Corporation - initial contribution.

 //

 // Contributors:

 //

 // Description:

 // f32test\loader\security\t_fuzzldr.cpp

 // 

 //

 #define __E32TEST_EXTENSION__

 #include <e32test.h>

 #include <e32svr.h>

 #include <e32uid.h>

 #include <f32file.h>

 #include <f32image.h>

 #include "t_hash.h"

 // Fuzzing parameters

 const TInt KFuzzImages = 5;

 const TInt KRandomFieldIterations = 8;

 const TTimeIntervalMicroSeconds32 KDllTimeout = 10 * 1000000;

 #define FUZZFIELD(OBJ, NAME) { (const TText*)(L ## #OBJ L"." L ## #NAME), sizeof(((OBJ*)8)->NAME), _FOFF(OBJ, NAME) }

 #define DUMBFIELD(NAME, SIZE, OFFSET) { (const TText*)L ## NAME, SIZE, OFFSET }

 #define FUZZEND { NULL, 0, 0 }

 struct SFuzzField

 	{

 	const TText* name;

 	TInt size;

 	TInt offset;

 	};

 const SFuzzField HeaderFields[] =

 	{

 	FUZZFIELD(E32ImageHeaderV, iUid1),

 	FUZZFIELD(E32ImageHeaderV, iUid2),

 	FUZZFIELD(E32ImageHeaderV, iUid3),

 	FUZZFIELD(E32ImageHeaderV, iUidChecksum),

 	FUZZFIELD(E32ImageHeaderV, iSignature),

 	FUZZFIELD(E32ImageHeaderV, iHeaderCrc),

 	FUZZFIELD(E32ImageHeaderV, iModuleVersion),

 	FUZZFIELD(E32ImageHeaderV, iCompressionType),

 	FUZZFIELD(E32ImageHeaderV, iToolsVersion.iMajor),

 	FUZZFIELD(E32ImageHeaderV, iToolsVersion.iMinor),

 	FUZZFIELD(E32ImageHeaderV, iToolsVersion.iBuild),

 	FUZZFIELD(E32ImageHeaderV, iTimeLo),

 	FUZZFIELD(E32ImageHeaderV, iTimeHi),

 	FUZZFIELD(E32ImageHeaderV, iFlags),

 	FUZZFIELD(E32ImageHeaderV, iCodeSize),

 	FUZZFIELD(E32ImageHeaderV, iDataSize),

 	FUZZFIELD(E32ImageHeaderV, iHeapSizeMin),

 	FUZZFIELD(E32ImageHeaderV, iHeapSizeMax),

 	FUZZFIELD(E32ImageHeaderV, iStackSize),

 	FUZZFIELD(E32ImageHeaderV, iBssSize),

 	FUZZFIELD(E32ImageHeaderV, iEntryPoint),

 	FUZZFIELD(E32ImageHeaderV, iCodeBase),

 	FUZZFIELD(E32ImageHeaderV, iDataBase),

 	FUZZFIELD(E32ImageHeaderV, iDllRefTableCount),

 	FUZZFIELD(E32ImageHeaderV, iExportDirOffset),

 	FUZZFIELD(E32ImageHeaderV, iExportDirCount),

 	FUZZFIELD(E32ImageHeaderV, iTextSize),

 	FUZZFIELD(E32ImageHeaderV, iCodeOffset),

 	FUZZFIELD(E32ImageHeaderV, iDataOffset),

 	FUZZFIELD(E32ImageHeaderV, iImportOffset),

 	FUZZFIELD(E32ImageHeaderV, iCodeRelocOffset),

 	FUZZFIELD(E32ImageHeaderV, iDataRelocOffset),

 	FUZZFIELD(E32ImageHeaderV, iProcessPriority),

 	FUZZFIELD(E32ImageHeaderV, iCpuIdentifier),

 	FUZZFIELD(E32ImageHeaderV, iUncompressedSize),

 	FUZZFIELD(E32ImageHeaderV, iS.iSecureId),

 	FUZZFIELD(E32ImageHeaderV, iS.iVendorId),

 	FUZZFIELD(E32ImageHeaderV, iS.iCaps.iCaps[0]),

 	FUZZFIELD(E32ImageHeaderV, iS.iCaps.iCaps[1]),

 	FUZZFIELD(E32ImageHeaderV, iExceptionDescriptor),

 	FUZZFIELD(E32ImageHeaderV, iSpare2),

 	FUZZFIELD(E32ImageHeaderV, iExportDescSize),

 	FUZZFIELD(E32ImageHeaderV, iExportDescType),

 	FUZZFIELD(E32ImageHeaderV, iExportDesc[0]),

 	FUZZEND

 	};

 const SFuzzField ImportSectionFields[] =

 	{

 	FUZZFIELD(E32ImportSection, iSize),

 	FUZZEND

 	};

 const SFuzzField ImportBlockFields[] =

 	{

 	FUZZFIELD(E32ImportBlock, iOffsetOfDllName), // we should fuzz the string also

 	FUZZFIELD(E32ImportBlock, iNumberOfImports),

 	FUZZEND

 	};

 const SFuzzField ImportEntryFields[] =

 	{

 	DUMBFIELD("import", 4, 0),

 	FUZZEND

 	};

 const SFuzzField RelocSectionFields[] =

 	{

 	FUZZFIELD(E32RelocSection, iSize),

 	FUZZFIELD(E32RelocSection, iNumberOfRelocs),

 	FUZZEND

 	};

 const SFuzzField RelocBlockFields[] =

 	{

 	FUZZFIELD(E32RelocBlock, iPageOffset),

 	FUZZFIELD(E32RelocBlock, iBlockSize),

 	FUZZEND

 	};

 const SFuzzField RelocEntryFields[] =

 	{

 	DUMBFIELD("reloc", 2, 0),

 	FUZZEND

 	};

 const SFuzzField ExportEntryFields[] =

 	{

 	DUMBFIELD("export", 4, 0),

 	FUZZEND

 	};

 const SFuzzField CompressedDataFields[] =

 	{

 	DUMBFIELD("data1", 4, 0),

 	DUMBFIELD("data2", 4, 4),

 	DUMBFIELD("data3", 4, 16),

 	DUMBFIELD("data4", 4, 64),

 	DUMBFIELD("data5", 4, 256),

 	DUMBFIELD("data6", 4, 1024),

 	DUMBFIELD("data7", 4, 4096),

 	FUZZEND

 	};

 // Values to try for different sizes, signed here but can be interpreted as either

 // each will also try the smaller sizes' values

 const TInt8 Values8[] = { KMinTInt8, -100, -10, -2, -1, 0, 1, 2, 10, 100, KMaxTInt8 };

 const TInt Values8Count = sizeof(Values8)/sizeof(TInt8);

 const TInt16 Values16[] = { KMinTInt16, -10000, -256, -255, 128, 255, 256, 10000, KMaxTInt16 };

 const TInt Values16Count = sizeof(Values16)/sizeof(TInt16);

 const TInt32 Values32[] = { KMinTInt32, -1000000000, -65536, -65535, 32768, 65535, 65536, 268435455, 268435456, 1000000000, KMaxTInt32 };

 const TInt Values32Count = sizeof(Values32)/sizeof(TInt32);

 const TInt ValuesCount[] = { 0, Values8Count, Values8Count+Values16Count, 0, Values8Count+Values16Count+Values32Count };

 const TInt Offsets[] = { 1, 2, 4, 16, -1, -2, -4, -16 };

 const TInt OffsetsCount = sizeof(Offsets)/sizeof(TInt);

 // Regular boring definitions and stuff

 RTest test(_L("T_FUZZLDR"));

 RFs TheFs;

 CFileMan* FileMan;

 _LIT(KOrigDir, "Z:\\sys\\bin\\");

 _LIT(KSysBin, ":\\sys\\bin\\");

 _LIT(KSysHash, ":\\sys\\hash\\");

 _LIT(KImageName, "fuzzv");

 _LIT(KExeExt, ".exe");

 _LIT(KDllExt, ".dll");

 _LIT(KMyself, "t_fuzzldr");

 _LIT(KSlaveArg, "-l ");

 TFileName Provided;

 TFileName Original;

 TFileName Current;

 TFileName Hash;

 TFileName HashDir;

 TBool LoadDll;

 RFile File;

 RTimer Timer;

 TUint8* Target;

 E32ImageHeaderV* Header;

 E32ImageHeaderV* CleanHeader;

 CSHA1* Hasher;

 TInt FileSize;

 TInt OutFileSize;

 TUint8* CleanFileData;

 TPtr8 CleanFileDes(CleanFileData, 0);

 TUint8* FileData;

 TPtr8 FileDes(FileData, 0);

 TUint8* EndOfFile;

 TChar Drive = '?', InternalDrive = '?', RemovableDrive = '?';

 TBool Verbose;

 TBool Forever = EFalse;

 TUint32 Seed = 0;

 typedef void (*TFieldFuzzer)(const SFuzzField*, TInt);

 enum SetMode {

 	ESetLiteral,

 	ESetOffset,

 	ESetRandom,

 	ESetXor,

 };

 enum ValueMode {

 	EValLiteral,

 	EValOffset,

 	EValRandom,

 	EValXor,

 	EValList,

 	EValOffsetList,

 };

 TUint32 Rand()

 	{

 	Seed *= 69069;

 	Seed += 5;

 	return Seed;

 	}

 TUint32 Rand(TUint32 aLimit)

 	{

 	TUint64 temp = (TUint64)Rand() * (TUint64)aLimit;

 	return (TUint32)(temp>>32);

 	}

 void PrepareName(TInt aNum, TBool aDll)

 	{

 	Original = KOrigDir;

 	Original += KImageName;

 	Original.AppendNum(aNum);

 	Original += aDll ? KDllExt : KExeExt;

 	Current.Zero();

 	Current.Append(Drive);

 	Current += KSysBin;

 	Current += KImageName;

 	Current.AppendNum(aNum);

 	Current += aDll ? KDllExt : KExeExt;

 	Hash = HashDir;

 	Hash += KImageName;

 	Hash.AppendNum(aNum);

 	Hash += aDll ? KDllExt : KExeExt;

 	}

 void PrepareProvidedName()

 	{

 	Original = KOrigDir;

 	Original += Provided;

 	Current.Zero();

 	Current.Append(Drive);

 	Current += KSysBin;

 	Current += Provided;

 	Hash = HashDir;

 	Hash += Provided;

 	}

 void MakeCleanCopy()

 	{

 	Mem::Copy(FileData, CleanFileData, FileSize);

 	}

 void LoadCleanFile()

 	{

 	test_KErrNone(File.Open(TheFs, Original, EFileRead));

 	test_KErrNone(File.Size(FileSize));

 	OutFileSize = FileSize;

 	CleanFileData = new TUint8[FileSize];

 	test_NotNull(CleanFileData);

 	FileData = new TUint8[FileSize];

 	EndOfFile = FileData + FileSize;

 	test_NotNull(FileData);

 	CleanFileDes.Set(CleanFileData, 0, FileSize);

 	test_KErrNone(File.Read(CleanFileDes));

 	File.Close();

 	Header = (E32ImageHeaderV*)FileData;

 	CleanHeader = (E32ImageHeaderV*)CleanFileData;

 	FileDes.Set(FileData, FileSize, FileSize);

 	MakeCleanCopy();

 	test(CleanHeader->iUid1==(TUint32)KExecutableImageUidValue || CleanHeader->iUid1==(TUint32)KDynamicLibraryUidValue);

 	LoadDll = CleanHeader->iUid1==(TUint32)KDynamicLibraryUidValue;

 	}

 void DoneFile()

 	{

 	delete[] FileData;

 	delete[] CleanFileData;

 	}

 void RecalcChecksums()

 	{

 	if (Header->iUidChecksum == CleanHeader->iUidChecksum)

 		{

 		TUidType uids = *(const TUidType*)Header;

 		TCheckedUid chkuid(uids);

 		const TUint32* pChkUid = (const TUint32*)&chkuid;

 		Header->iUidChecksum = pChkUid[3];

 		}

 	if (Header->iHeaderCrc == CleanHeader->iHeaderCrc)

 		{

 		Header->iHeaderCrc = KImageCrcInitialiser;

 		TUint32 crc = 0;

 		Mem::Crc32(crc, Header, sizeof(E32ImageHeaderV));

 		Header->iHeaderCrc = crc;

 		}

 	}

 void Load()

 	{

 	RecalcChecksums();

 	test_KErrNone(File.Replace(TheFs, Current, EFileWrite));

 	test_KErrNone(File.Write(FileDes, OutFileSize));

 	test_KErrNone(File.Flush());

 	File.Close();

 	if (Drive == RemovableDrive)

 		{

 		TPtrC8 data(FileData, OutFileSize);

 		Hasher->Reset();

 		Hasher->Update(data);

 		TBuf8<SHA1_HASH> hashVal = Hasher->Final();

 		test_KErrNone(File.Replace(TheFs, Hash, EFileWrite));

 		test_KErrNone(File.Write(hashVal));

 		test_KErrNone(File.Flush());

 		File.Close();

 		}

 	RProcess p;

 	TInt r;

 	if (LoadDll)

 		{

 		TFileName args;

 		args.Copy(KSlaveArg);

 		args.Append(Current);

 		test_KErrNone(p.Create(KMyself, args));

 		TRequestStatus logon, rendez, timeout;

 		p.Logon(logon);

 		p.Rendezvous(rendez);

 		p.Resume();

 		User::WaitForRequest(rendez);

 		test(rendez==KErrNone);

 		Timer.After(timeout, KDllTimeout);

 		User::WaitForRequest(logon, timeout);

 		if (logon == KRequestPending)

 			{

 			p.Kill(0);

 			User::WaitForRequest(logon);

 			}

 		else

 			{

 			Timer.Cancel();

 			User::WaitForRequest(timeout);

 			}

 		p.Close();

 		// we don't check the return code as passing it back makes the log output

 		// super spammy with KPANIC on - it prints for every nonzero return code.

 		if (Verbose) test.Printf(_L("\n"));

 		}

 	else

 		{

 		r = p.Create(Current, KNullDesC);

 		if (r==KErrNone)

 			p.Kill(0);

 		if (Verbose) test.Printf(_L("=> %d\n"), r);

 		}

 	p.Close();

 	}

 template <typename T> void SetFieldTo(const SFuzzField* aField, T aSetTo, SetMode aMode)

 	{

 	T* field = (T*)(Target + aField->offset);

 	if ((TUint8*)field >= EndOfFile)

 		{

 		if (Verbose) test.Printf(_L("skipping, eof "));

 		return;

 		}

 	if (aMode == ESetOffset)

 		aSetTo += *field;

 	else if (aMode == ESetRandom)

 		aSetTo = (T)Rand();

 	else if (aMode == ESetXor)

 		aSetTo ^= *field;

 	*field = aSetTo;

 	if (Verbose) test.Printf(_L("%d "), aSetTo);

 	}

 void SetField(const SFuzzField* aField, TInt aValue, ValueMode aMode)

 	{

 	if (aMode < EValList)

 		{

 		switch(aField->size)

 			{

 		case 1:

 			SetFieldTo<TInt8>(aField, aValue, (SetMode)aMode);

 			break;

 		case 2:

 			SetFieldTo<TInt16>(aField, aValue, (SetMode)aMode);

 			break;

 		case 4:

 			SetFieldTo<TInt32>(aField, aValue, (SetMode)aMode);

 			break;

 			}

 		}

 	else if (aMode == EValList)

 		{

 		switch(aField->size)

 			{

 		case 1:

 			SetFieldTo<TInt8>(aField, Values8[aValue], ESetLiteral);

 			break;

 		case 2:

 			if (aValue < ValuesCount[1])

 				SetFieldTo<TInt16>(aField, Values8[aValue], ESetLiteral);

 			else

 				SetFieldTo<TInt16>(aField, Values16[aValue-ValuesCount[1]], ESetLiteral);

 			break;

 		case 4:

 			if (aValue < ValuesCount[1])

 				SetFieldTo<TInt32>(aField, Values8[aValue], ESetLiteral);

 			else if (aValue < ValuesCount[2])

 				SetFieldTo<TInt32>(aField, Values16[aValue-ValuesCount[1]], ESetLiteral);

 			else

 				SetFieldTo<TInt32>(aField, Values32[aValue-ValuesCount[2]], ESetLiteral);

 			break;

 			}

 		}

 	else if (aMode == EValOffsetList)

 		{

 		switch(aField->size)

 			{

 		case 1:

 			SetFieldTo<TInt8>(aField, Offsets[aValue], ESetOffset);

 			break;

 		case 2:

 			SetFieldTo<TInt16>(aField, Offsets[aValue], ESetOffset);

 			break;

 		case 4:

 			SetFieldTo<TInt32>(aField, Offsets[aValue], ESetOffset);

 			break;

 			}

 		}

 	}

 void FuzzFieldsDeterministically(const SFuzzField* aFields, TInt aOffset)

 	{

 	Target = FileData + aOffset;

 	TInt f = -1;

    	while (aFields[++f].name)

 		{

 		test.Printf(_L("FIELD: %s ...\n"), aFields[f].name);

 		TInt v;

 		if (Verbose) test.Next(_L("Using preset values"));

 		for (v = 0; v < ValuesCount[aFields[f].size]; ++v)

 			{

 			MakeCleanCopy();

 			SetField(&aFields[f], v, EValList);

 			Load();

 			}

 		if (Verbose) test.Next(_L("Using preset offsets"));

 		for (v = 0; v < OffsetsCount; ++v)

 			{

 			MakeCleanCopy();

 			SetField(&aFields[f], v, EValOffsetList);

 			Load();

 			}

 		if (Verbose) test.Next(_L("Flipping single bits"));

 		for (v = 0; v < aFields[f].size*8; ++v)

 			{

 			MakeCleanCopy();

 			SetField(&aFields[f], 1<<v, EValXor);

 			Load();

 			}

 		if (Verbose) test.Next(_L("Inverting"));

 		MakeCleanCopy();

 		SetField(&aFields[f], 0xffffffffu, EValXor);

 		Load();

 		// things that are offsets all go below, pointless on

 		// narrow fields

 		if (aFields[f].size == 4)

 			{

 			if (Verbose) test.Next(_L("Using filesize relative values"));

 			for (v = FileSize-4; v <= FileSize+4; ++v)

 				{

 				MakeCleanCopy();

 				SetField(&aFields[f], v, EValLiteral);

 				Load();

 				}

 			if (Verbose) test.Next(_L("Using code-end relative values"));

 			TInt codeend = CleanHeader->iCodeSize + CleanHeader->iCodeOffset;

 			for (v = codeend-4; v <= codeend+4; ++v)

 				{

 				MakeCleanCopy();

 				SetField(&aFields[f], v, EValLiteral);

 				Load();

 				}

 			}

 		}

 	}

 void FuzzFieldsRandomly(const SFuzzField* aFields, TInt aOffset)

 	{

 	Target = FileData + aOffset;

 	TInt f = 0;

    	while (aFields[f].name)

 		{

 		test.Printf(_L("FIELD: %s ... (random)\n"), aFields[f].name);

 		TInt v;

 		for (v = 0; v < KRandomFieldIterations; ++v)

 			{

 			MakeCleanCopy();

 			SetField(&aFields[f], 0, EValRandom);

 			Load();

 			}

 		f++;

 		}

 	}

 void FuzzBlockRandomly(TInt aOffset, TInt aSize)

 	{

 	SFuzzField field;

 	field.size = 1;

 	Target = FileData + aOffset;

 	test.Printf(_L("FIELD: random words in data\n"));

 	TInt v;

 	for (v = 0; v < KRandomFieldIterations * 4; ++v)

 		{

 		MakeCleanCopy();

 		field.offset = Rand(aSize);

 		if (Verbose) test.Printf(_L("@ %d, "), field.offset);

 		SetField(&field, 0, EValRandom);

 		Load();

 		}

 	}

 void FuzzFile(TBool aRandom)

 	{

 	TTime before, after;

 	before.UniversalTime();

 	LoadCleanFile();

 	TFieldFuzzer FuzzFields = aRandom ? FuzzFieldsRandomly : FuzzFieldsDeterministically;

 	// E32ImageHeader

 	FuzzFields(HeaderFields, 0);

 	if (CleanHeader->iCompressionType == KFormatNotCompressed)

 		{

 		// import table

 		TInt offset = CleanHeader->iImportOffset;

 		if (offset != 0)

 			{

 			FuzzFields(ImportSectionFields, offset);

 			offset += sizeof(E32ImportSection);

 			FuzzFields(ImportBlockFields, offset);

 			offset += sizeof(E32ImportBlock);

 			FuzzFields(ImportEntryFields, offset);

 			}

 		// code relocations

 		offset = CleanHeader->iCodeRelocOffset;

 		if (offset != 0)

 			{

 			FuzzFields(RelocSectionFields, offset);

 			offset += sizeof(E32RelocSection);

 			FuzzFields(RelocBlockFields, offset);

 			offset += sizeof(E32RelocBlock);

 			FuzzFields(RelocEntryFields, offset);

 			}

 		// data relocations

 		offset = CleanHeader->iDataRelocOffset;

 		if (offset != 0)

 			{

 			FuzzFields(RelocSectionFields, offset);

 			offset += sizeof(E32RelocSection);

 			FuzzFields(RelocBlockFields, offset);

 			offset += sizeof(E32RelocBlock);

 			FuzzFields(RelocEntryFields, offset);

 			}

 		// export table

 		offset = CleanHeader->iExportDirOffset;

 		if (offset != 0)

 			{

 			FuzzFields(ExportEntryFields, offset);

 			}

 		}

 	else

 		{

 		if (aRandom)

 			{

 			// random bits of the compressed data

 			FuzzBlockRandomly(CleanHeader->iCodeOffset, FileSize - CleanHeader->iCodeOffset);

 			}

 		else

 			{

 			// arbitrary bits of the compressed data

 			FuzzFields(CompressedDataFields, CleanHeader->iCodeOffset);

 			}

 		}

 	DoneFile();

 	after.UniversalTime();

 	TTimeIntervalSeconds interval;

 	after.SecondsFrom(before, interval);

 	test.Printf(_L("Took %d seconds\n"), interval.Int());

 	}

 void FuzzTruncateTo(TInt size)

 	{

 	OutFileSize = size - 4;

 	if (Verbose) test.Printf(_L("%d "), OutFileSize);

 	Load();

 	OutFileSize = size - 1;

 	if (Verbose) test.Printf(_L("%d "), OutFileSize);

 	Load();

 	if (size == FileSize)

 		return;

 	OutFileSize = size;

 	if (Verbose) test.Printf(_L("%d "), OutFileSize);

 	Load();

 	OutFileSize = size + 1;

 	if (Verbose) test.Printf(_L("%d "), OutFileSize);

 	Load();

 	OutFileSize = size + 4;

 	if (Verbose) test.Printf(_L("%d "), OutFileSize);

 	Load();

 	}

 void FuzzTruncate()

 	{

 	TTime before, after;

 	before.UniversalTime();

 	LoadCleanFile();

 	FuzzTruncateTo(CleanHeader->iCodeOffset);

 	if (CleanHeader->iCompressionType == KFormatNotCompressed)

 		FuzzTruncateTo(CleanHeader->iCodeOffset+CleanHeader->iCodeSize);

 	FuzzTruncateTo(FileSize);

 	DoneFile();

 	after.UniversalTime();

 	TTimeIntervalSeconds interval;

 	after.SecondsFrom(before, interval);

 	test.Printf(_L("Took %d seconds\n"), interval.Int());

 	}

 void FuzzAllTestImages()

 	{

 	TInt i;

 	Drive = InternalDrive;

 	test.Next(_L("Fuzzing deterministically"));

 	for (i=1; i<=KFuzzImages; ++i)

 		{

 		test.Next(_L("Next binary..."));

 		test.Printf(_L("Fuzzing exe %d\n"), i);

 		PrepareName(i, EFalse);

 		FuzzFile(EFalse);

 		if(i==5)

 			continue; // DLL 5 doesn't exist because toolchain doesn't like DLLs with no exports

 		test.Next(_L("Next binary..."));

 		test.Printf(_L("Fuzzing dll %d\n"), i);

 		PrepareName(i, ETrue);

 		FuzzFile(EFalse);

 		}

 	Drive = RemovableDrive;

 	test.Next(_L("Fuzzing deterministically on removable media"));

 	for (i=1; i<=KFuzzImages; ++i)

 		{

 		test.Next(_L("Next binary..."));

 		test.Printf(_L("Fuzzing exe %d\n"), i);

 		PrepareName(i, EFalse);

 		FuzzFile(EFalse);

 		if(i==5)

 			continue; // DLL 5 doesn't exist because toolchain doesn't like DLLs with no exports

 		test.Next(_L("Next binary..."));

 		test.Printf(_L("Fuzzing dll %d\n"), i);

 		PrepareName(i, ETrue);

 		FuzzFile(EFalse);

 		}

 	Drive = InternalDrive;

 	test.Next(_L("Fuzzing by truncation"));

 	for (i=1; i<=KFuzzImages; ++i)

 		{

 		test.Next(_L("Next binary..."));

 		test.Printf(_L("Fuzzing exe %d\n"), i);

 		PrepareName(i, EFalse);

 		FuzzTruncate();

 		if(i==5)

 			continue; // DLL 5 doesn't exist because toolchain doesn't like DLLs with no exports

 		test.Next(_L("Next binary..."));

 		test.Printf(_L("Fuzzing dll %d\n"), i);

 		PrepareName(i, ETrue);

 		FuzzTruncate();

 		}	

 	Drive = RemovableDrive;

 	test.Next(_L("Fuzzing by truncation on removable media"));

 	for (i=1; i<=KFuzzImages; ++i)

 		{

 		test.Next(_L("Next binary..."));

 		test.Printf(_L("Fuzzing exe %d\n"), i);

 		PrepareName(i, EFalse);

 		FuzzTruncate();

 		if(i==5)

 			continue; // DLL 5 doesn't exist because toolchain doesn't like DLLs with no exports

 		test.Next(_L("Next binary..."));

 		test.Printf(_L("Fuzzing dll %d\n"), i);

 		PrepareName(i, ETrue);

 		FuzzTruncate();

 		}	

 	test.Next(_L("Fuzzing randomly"));

 	do

 		{

 		for (i=1; i<=KFuzzImages; ++i)

 			{

 			Drive = InternalDrive;

 			test.Next(_L("Next binary..."));

 			test.Printf(_L("Fuzzing exe %d\n"), i);

 			PrepareName(i, EFalse);

 			FuzzFile(ETrue);

 			if(i==5)

 				continue; // DLL 5 doesn't exist because toolchain doesn't like DLLs with no exports

 			test.Next(_L("Next binary..."));

 			test.Printf(_L("Fuzzing dll %d\n"), i);

 			PrepareName(i, ETrue);

 			FuzzFile(ETrue);

 			Drive = RemovableDrive;

 			test.Next(_L("Next binary..."));

 			test.Printf(_L("Fuzzing exe %d on removable media\n"), i);

 			PrepareName(i, EFalse);

 			FuzzFile(ETrue);

 			if(i==5)

 				continue; // DLL 5 doesn't exist because toolchain doesn't like DLLs with no exports

 			test.Next(_L("Next binary..."));

 			test.Printf(_L("Fuzzing dll %d on removable media\n"), i);

 			PrepareName(i, ETrue);

 			FuzzFile(ETrue);

 			}

 		}

 	while (Forever);

 	}

 void FuzzProvidedImage()

 	{

 	test.Printf(_L("Fuzzing file %S\n"), &Provided);

 	PrepareProvidedName();

 	Drive = InternalDrive;

 	test.Next(_L("Fuzzing deterministically"));

 	FuzzFile(EFalse);

 	Drive = RemovableDrive;

 	test.Next(_L("Fuzzing deterministically on removable media"));

 	FuzzFile(EFalse);

 	test.Next(_L("Fuzzing by truncation"));

 	FuzzTruncate();

 	Drive = RemovableDrive;

 	test.Next(_L("Fuzzing by truncation on removable media"));

 	FuzzTruncate();

 	test.Next(_L("Fuzzing randomly"));

 	do

 		{

 		Drive = InternalDrive;

 		test.Next(_L("Internal drive"));

 		FuzzFile(ETrue);

 		Drive = RemovableDrive;

 		test.Next(_L("Removable drive"));

 		FuzzFile(ETrue);

 		}

 	while (Forever);

 	}

 GLDEF_C TInt E32Main()

 	{

 	// default to verbose unless the fasttest trace flag is on

 	Verbose = (UserSvr::DebugMask(2)&0x00000002) == 0;

 	TFileName cmd;

 	User::CommandLine(cmd);

 	TLex lex(cmd);

 	FOREVER

 		{

 		lex.SkipSpace();

 		if (lex.Eos())

 			break;

 		TChar next = lex.Peek();

 		if (next == '-' || next == '/')

 			{

 			// option

 			lex.Inc();

 			switch(lex.Get())

 				{

 			case 'v':

 				Verbose = ETrue;

 				break;

 			case 'q':

 				Verbose = EFalse;

 				break;

 			case 'l':

 				{

 				// being used as a slave to load a DLL

 				TPtrC libname(lex.NextToken());

 				RLibrary l;

 				RProcess::Rendezvous(KErrNone);

 				l.Load(libname);

 				return KErrNone;

 				}

 			case 's':

 				// random seed

 				lex.SkipSpace();

 				test_KErrNone(lex.Val(Seed, EHex));

 				test.Printf(_L("Using supplied random seed %08x\n"), Seed);

 				break;

 			case 'f':

 				// run forever

 				Forever = ETrue;

 				break;

 				}

 			}

 		else

 			{

 			// filename, at least i assume it is :)

 			Provided.Copy(lex.NextToken());

 			}

 		}

 	test.Title();

 	test.Next(_L("Setup"));

 	__UHEAP_MARK;

 	CTrapCleanup* cleanup;

 	cleanup=CTrapCleanup::New();

 	if (Seed == 0)

 		{

 		TTime time;

 		time.UniversalTime();

 		Seed = (TUint32)time.Int64();

 		test.Printf(_L("Random seed is %08x\n"), Seed);

 		}

 	test_KErrNone(TheFs.Connect());

 	test_TRAP(FileMan=CFileMan::NewL(TheFs));

 	test_KErrNone(Timer.CreateLocal());

 	test_TRAP(Hasher=CSHA1::NewL());

 	HashDir.Append(TheFs.GetSystemDriveChar());

 	HashDir.Append(KSysHash);

 	TInt r = TheFs.MkDirAll(HashDir);

 	test(r == KErrNone || r == KErrAlreadyExists);	

 	// Find some interesting drives

 	for (TInt driveno = EDriveA; driveno <= EDriveZ; ++driveno)

 		{

 		TDriveInfo di;

 		test_KErrNone(TheFs.Drive(di, driveno));

 		if (di.iType == EMediaNotPresent)

 			continue;

 		TChar drivechar;

 		test_KErrNone(TheFs.DriveToChar(driveno, drivechar));

 		if ((di.iDriveAtt & KDriveAttInternal) && InternalDrive == '?')

 			InternalDrive = drivechar;

 		else if ((di.iDriveAtt & KDriveAttRemovable) && RemovableDrive == '?')

 			RemovableDrive = drivechar;

 		else

 			continue;

 		TFileName fn;

 		fn.Append(drivechar);

 		fn.Append(KSysBin);

 		TheFs.MkDirAll(fn);

 		test(r == KErrNone || r == KErrAlreadyExists);	

 		}

 	test.Printf(_L("Using %c as internal drive, %c as removable\n"), (TUint)InternalDrive, (TUint)RemovableDrive);

 	// Turn off evil lazy dll unloading

 	RLoader l;

 	test_KErrNone(l.Connect());

 	test_KErrNone(l.CancelLazyDllUnload());

 	l.Close();

 	test.Start(_L("Fuzzing loader"));

 	if (Provided.Length() == 0)

 		FuzzAllTestImages();

 	else

 		FuzzProvidedImage();

 	test.End();

 	delete Hasher;

 	Timer.Close();

 	delete FileMan;

 	TheFs.Close();

 	test.Close();

 	delete cleanup;

 	__UHEAP_MARKEND;

 	return KErrNone;

 	}