soarsmu / transfer

Test Mimicry to Assess the Exploitability of Library Vulnerabilities ISSTA 2022
6 stars 3 forks source link

Need more help on running tool #1

Open NEUZhangy opened 1 year ago

NEUZhangy commented 1 year ago

Hi,

I am trying to run the tool with the example project listed on README.MD. But I encountered some problems:

java  -Xmx10g -jar xxx/evosuite-master-1.1.1-SNAPSHOT.jar -class org.jivesoftware.openfire.auth.JDBCAuthProvider -projectCP src/test/resources/:target/xmppserver-4.7.0-SNAPSHOT.jar:target/xmppserver-4.7.0-SNAPSHOT-tests.jar:libs/log4j-kubernetes-2.13.2.jar:libs/FastInfoset-1.2.16.jar:libs/jdom2-2.0.6.jar:libs/activation-1.1.jar:libs/jetty-annotations-9.4.35.v20201120.jar:libs/ant-1.10.9.jar:libs/jetty-client-9.4.35.v20201120.jar:libs/ant-launcher-1.10.9.jar:libs/jetty-continuation-9.4.35.v20201120.jar:libs/apache-el-8.5.54.jar:libs/jetty-http-9.4.35.v20201120.jar:libs/apache-jsp-8.5.54.jar:libs/jetty-io-9.4.35.v20201120.jar:libs/apache-jsp-9.4.35.v20201120.jar:libs/jetty-jmx-9.4.35.v20201120.jar:libs/asm-9.0.jar:libs/jetty-jndi-9.4.35.v20201120.jar:libs/asm-analysis-9.0.jar:libs/jetty-plus-9.4.35.v20201120.jar:libs/asm-commons-9.0.jar:libs/jetty-schemas-3.1.2.jar:libs/asm-tree-9.0.jar:libs/jetty-security-9.4.35.v20201120.jar:libs/awaitility-3.1.6.jar:libs/jetty-server-9.4.35.v20201120.jar:libs/bcpg-jdk15on-1.68.jar:libs/jetty-servlet-9.4.35.v20201120.jar:libs/bcpkix-jdk15on-1.68.jar:libs/jetty-servlets-9.4.35.v20201120.jar:libs/bcprov-jdk15on-1.68.jar:libs/jetty-util-9.4.35.v20201120.jar:libs/byte-buddy-1.9.10.jar:libs/jetty-util-ajax-9.4.35.v20201120.jar:libs/byte-buddy-agent-1.9.10.jar:libs/jetty-webapp-9.4.35.v20201120.jar:libs/caffeine-2.7.0.jar:libs/jetty-xml-9.4.35.v20201120.jar:libs/checker-qual-3.5.0.jar:libs/jmdns-1.0.jar:libs/common-image-3.5.jar:libs/jsmpp-2.3.7.jar:libs/common-io-3.5.jar:libs/jsr305-3.0.2.jar:libs/common-lang-3.5.jar:libs/jtds-1.3.1.jar:libs/commons-io-2.6.jar:libs/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar:libs/commons-lang3-3.9.jar:libs/log4j-api-2.13.3.jar:libs/commons-logging-1.2.jar:libs/log4j-core-2.13.3.jar:libs/commons-pool2-2.6.2.jar:libs/log4j-slf4j-impl-2.13.3.jar:libs/mina-core-2.1.3.jar:libs/dom4j-2.1.3.jar:libs/mina-filter-compression-2.1.3.jar:libs/dwr-3.0.2-RELEASE.jar:libs/mina-integration-beans-2.1.3.jar:libs/ecj-3.19.0.jar:libs/mina-integration-jmx-2.1.3.jar:libs/embedded-ldap-junit-0.7.jar:libs/mina-integration-ognl-2.1.3.jar:libs/error_prone_annotations-2.3.4.jar:libs/mockito-core-2.27.0.jar:libs/failureaccess-1.0.1.jar:libs/mssql-jdbc-7.2.2.jre8.jar:libs/guava-30.1-jre.jar:libs/mysql-connector-java-8.0.21.jar:libs/hamcrest-all-1.3.jar:libs/objenesis-2.6.jar:libs/hamcrest-core-1.3.jar:libs/ognl-3.2.10.jar:libs/hamcrest-library-1.3.jar:libs/postgresql-42.2.14.jar:libs/hsqldb-2.4.1.jar:libs/protobuf-java-3.11.4.jar:libs/httpclient-4.5.13.jar:libs/rome-1.12.0.jar:libs/httpcore-4.4.13.jar:libs/rome-utils-1.12.0.jar:libs/i18n-4.7.0-SNAPSHOT.jar:libs/shaj-0.5.jar:libs/imageio-bmp-3.5.jar:libs/sitemesh-2.4.2.jar:libs/imageio-core-3.5.jar:libs/slf4j-api-1.7.30.jar:libs/istack-commons-runtime-3.0.8.jar:libs/stax-ex-1.8.1.jar:libs/j2objc-annotations-1.3.jar:libs/taglibs-standard-impl-1.2.5.jar:libs/jakarta.activation-api-1.2.1.jar:libs/taglibs-standard-spec-1.2.5.jar:libs/jakarta.xml.bind-api-2.3.2.jar:libs/tinder-2.0.0.jar:libs/javassist-3.24.1-GA.jar:libs/tools-1.8.0.jar:libs/javax.activation-api-1.2.0.jar:libs/txw2-2.3.2.jar:libs/javax.annotation-api-1.3.2.jar:libs/unboundid-ldapsdk-4.0.4.jar:libs/javax.mail-1.6.2.jar:libs/websocket-api-9.4.35.v20201120.jar:libs/javax.servlet-api-3.1.0.jar:libs/websocket-client-9.4.35.v20201120.jar:libs/jaxb-api-2.3.1.jar:libs/websocket-common-9.4.35.v20201120.jar:libs/jaxb-runtime-2.3.2.jar:libs/websocket-server-9.4.35.v20201120.jar:libs/jaxen-1.2.0.jar:libs/websocket-servlet-9.4.35.v20201120.jar:libs/jcip-annotations-1.0.jar:libs/xpp3-1.1.4c.jar:libs/jcl-over-slf4j-1.7.30.jar:libs/log4j-docker-2.14.0.jar:libs/log4j-spring-boot-2.14.0.jar:libs/commons-codec-1.12.jar -Djunit=OpenBSDBCryptTest.OpenBSDBCryptTest -Dselected_junit=OpenBSDBCryptTest.OpenBSDBCryptTest:org.jivesoftware.openfire.auth.JDBCAuthProviderTest  -Dcarve_object_pool=true -Dmax_loop_iterations=-1 -Dchop_carved_exceptions=false -Dsearch_budget=600   

[MASTER] 13:01:04.821 [main] ERROR EvoSuite - Fatal crash on main EvoSuite process. Class  using seed 1663520464819. Configuration id : null
java.lang.IllegalArgumentException: Classpath element does not exist on disk at: src/test/resources/
    at org.evosuite.classpath.ClassPathHandler.checkIfValidClasspathEntry(ClassPathHandler.java:206)
    at org.evosuite.classpath.ClassPathHandler.getClassPath(ClassPathHandler.java:114)
    at org.evosuite.classpath.ClassPathHandler.changeTargetClassPath(ClassPathHandler.java:101)
    at org.evosuite.CommandLineParameters.handleClassPath(CommandLineParameters.java:234)
    at org.evosuite.EvoSuite.parseCommandLine(EvoSuite.java:248)
    at org.evosuite.EvoSuite.main(EvoSuite.java:115)

And in the README.MD, calleeMethod.evosuite_target. calleeMethod.test are required. May I know what I should put inside these two files?

kanghj commented 1 year ago

Many thanks for your interest!

I have some of the files I used in my experiments on another laptop. I will try to retrieve them soon (sorry I missed this github issue earlier today). The error is related to the missing src/test/resources directory from the directory that the command is called from.

The calleeMethod.evosuite_target, calleeMethod.test and callerMethod.evosuite_target are given in these files: https://github.com/soarsmu/transfer/blob/public2/vulnerabilities/bouncycastle/bouncycastle_openfire.txt. I will try to give these files directly when I retrieve them.

kanghj commented 1 year ago

I'm still working on retrieving some of the files (which can be enormous..).

One thing that I would have done in retrospect was not to download the entire client project. There are many complexities with the classpath (i.e., the -projectCP part) that crops up because of the use of whole client project (and the total size of the project + dependencies can be very large). It may be easier to simply extract the relevant java files from the client project, then run the experiment on it. If so, then I can provide the exact java file and test file.

Will the above be preferable?

kanghj commented 1 year ago

Here's one example of running the tool: https://drive.google.com/drive/folders/1Vl8LXIhu78J10DNjK8nHlvf85n9L-5ap?usp=sharing

If you download and unzip this file, you can run the run.sh script in the source directory. This should create a test.transfer_evosuite_output at the end

NEUZhangy commented 1 year ago

I just request permission for this example. Would you mind kindly approving it?

Kang Hong Jin @.***> 于2022年9月20日周二 09:52写道:

Here's one example of running the tool: https://drive.google.com/drive/folders/1Vl8LXIhu78J10DNjK8nHlvf85n9L-5ap?usp=sharing

If you download and unzip this file, you can run the run.sh script in the source directory. This should create a test.transfer_evosuite_output at the end

— Reply to this email directly, view it on GitHub https://github.com/soarsmu/transfer/issues/1#issuecomment-1252387278, or unsubscribe https://github.com/notifications/unsubscribe-auth/AEGFCPAHSMWLYVUAUZLK2TLV7G6QLANCNFSM6AAAAAAQPQUSDE . You are receiving this because you authored the thread.Message ID: @.***>

kanghj commented 1 year ago

I have changed the permissions for the google drive, such that everyone should be able to access it. I missed this out the first time. Thanks for your patience

NEUZhangy commented 1 year ago

Hi, just got one more question, may I know which evosuite version (commit-id) you are using in this project? I saw 1.1.0-SNAPSHOT in the repo, so just out of curiosity to know which commit-id you based.

kanghj commented 1 year ago

The version number can be ignored (I may have modified it randomly..). I used commit 4101af05ad100217e6594f68011d044b397b93c1 (which should be snapshot from 1.1.1).

jxfzzzt commented 4 months ago

hi, when i clean the "functions_covered.log" file, the tool cann't run properly. how i get the content of "functions_covered.log"?