Static & Dynamic Security Analysis

#!/usr/bin/env python3
# Binary security audit: hardening flags + entropy analysis
import subprocess, json, math

def check_hardening(elf_path: str) -> dict:
    # Run checksec against compiled ELF; fail on missing protections
    proc = subprocess.run(
        ["checksec", "--file", elf_path, "--json"],
        capture_output=True, text=True
    )
    cs = json.loads(proc.stdout)
    checks = {
        "stack_canary": cs.get("STACK_CANARY","no") == "yes",
        "nx_bit":       cs.get("NX","no") == "yes",
        "relro":        cs.get("RELRO","no") in ["full","partial"],
        "pie":          cs.get("PIE","no") == "yes",
    }
    missing = [k for k,v in checks.items() if not v]
    return {"checks": checks, "missing": missing,
            "pass": len(missing) == 0}

def detect_hardcoded_keys(fw_bytes: bytes, entropy_threshold: float = 7.5) -> list:
    # Scan for high-entropy regions that may contain hardcoded key material
    hits = []
    for offset in range(0, len(fw_bytes)-32, 16):
        chunk = fw_bytes[offset:offset+32]
        freq = [chunk.count(b)/32 for b in set(chunk)]
        e = -sum(p*math.log2(p) for p in freq if p > 0)
        if e > entropy_threshold:
            hits.append({"offset": hex(offset), "entropy": round(e,2),
                         "sample": chunk[:8].hex()})
    return hits[:10]  # return top 10

# Usage in CI:
# hardening = check_hardening("build/eps_ecu.elf")
# if not hardening["pass"]: sys.exit(1)  # block release
# keys = detect_hardcoded_keys(open("build/eps_ecu.bin","rb").read())
# if keys: print(f"WARNING: {len(keys)} high-entropy regions -- verify not hardcoded keys")

#!/usr/bin/env python3
# Host-based fuzzing harness with AddressSanitizer
# Compile ECU C code for x86 host: gcc -fsanitize=address,undefined -g -O1 uds_parser.c -o parser_asan

import subprocess, os, tempfile

ASAN_OPTIONS = "halt_on_error=1:detect_leaks=1"

def run_asan(binary: str, input_bytes: bytes) -> dict:
    with tempfile.NamedTemporaryFile(delete=False, suffix=".bin") as f:
        f.write(input_bytes); inp = f.name
    env = {**os.environ, "ASAN_OPTIONS": ASAN_OPTIONS}
    r = subprocess.run([binary, inp], capture_output=True, text=True,
                       env=env, timeout=10)
    asan_err = "AddressSanitizer" in r.stderr
    ubsan_err = "runtime error" in r.stderr
    return {
        "clean":  not asan_err and not ubsan_err and r.returncode == 0,
        "asan":   asan_err,
        "ubsan":  ubsan_err,
        "output": r.stderr[:300] if (asan_err or ubsan_err) else None,
    }

# Boundary-value corpus for UDS SecurityAccess fuzzing
corpus = [
    bytes([0x27,0x01]) + bytes(4),              # normal seed request
    bytes([0x27,0x02]) + bytes([0xff]*32),       # max-length key
    bytes([0x27,0x02]) + bytes(65535),           # oversized → should be rejected cleanly
    bytes(8),                                    # all zeros
    bytes([0xff]*8),                             # all ones
]

for inp in corpus:
    print(f"  Input ({len(inp)}B): {inp[:8].hex()}")
    # result = run_asan("./parser_asan", inp)
    # print(f"  Clean: {result['clean']}")