menu.ps1

<#
  menu.ps1 - CLFSFuzzer interactive console (v2 front-end).
  Ties together: environment validation, seed/corpus, autonomous parse-fuzz, API-sequence
  fuzz, triage, kill switch, uninstall, live status. Destructive actions route through
  run_all.ps1, which enforces the VM guard. RUN IN THE VM.
#>
$ErrorActionPreference = "SilentlyContinue"
$PROJ    = $PSScriptRoot
$HARNESS = Join-Path $PROJ "harness\clfs_harness.exe"
$SEED    = Join-Path $PROJ "seeds\seed.blf"
$RUNALL  = Join-Path $PROJ "run_all.ps1"

# self-elevate so Verifier/dumps/kill options work
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
        ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Start-Process powershell.exe -Verb RunAs -ArgumentList `
        @("-NoProfile","-ExecutionPolicy","Bypass","-File","`"$PSCommandPath`"")
    return
}

function Banner {
    Clear-Host
    Write-Host @"
   ______ __     ______ _____   ______
  / ____// /    / ____// ___/  / ____/__  __ ____ ____ ___   ____
 / /    / /    / /_    \__ \  / /_   / / / /_  //_  //  _ \ / __/
/ /___ / /___ / __/   ___/ / / __/  / /_/ / / /_ / /_/  __// /
\____//_____//_/     /____/ /_/     \__,_/ /___//___/\___//_/
"@ -ForegroundColor Cyan
    Write-Host "        Common Log File System kernel fuzzer  ::  VM ONLY" -ForegroundColor DarkCyan
    Write-Host "        v1.0.238  (build 210726p)`n" -ForegroundColor DarkGray
}

function Test-IsVM {
    try {
        $cs = Get-CimInstance Win32_ComputerSystem; $b = Get-CimInstance Win32_BIOS
        return ("$($cs.Manufacturer)|$($cs.Model)|$($b.Manufacturer)|$($b.Version)|$($b.SerialNumber)" `
                -match 'VMware|VirtualBox|Virtual Machine|QEMU|KVM|Parallels|Xen|innotek|Bochs|Apple')
    } catch { return $false }
}

function Resolve-Cdb {
    $c = (Get-Command cdb.exe -EA SilentlyContinue).Source
    if ($c) { return $c }
    foreach ($r in @("${env:ProgramFiles(x86)}\Windows Kits\10\Debuggers","$env:ProgramFiles\Windows Kits\10\Debuggers")) {
        foreach ($arch in "arm64","x64","x86") {
            $p = Join-Path $r "$arch\cdb.exe"; if (Test-Path $p) { return $p }
        }
    }
    return $null
}

function Show-Status {
    $vm    = if (Test-IsVM) { "YES" } else { "NO (guard will refuse)" }
    $ver   = if ((verifier /query 2>$null | Out-String) -match 'clfs\.sys') { "ARMED" } else { "off" }
    $task  = if (schtasks /query /TN CLFSFuzzer 2>$null) { "registered" } else { "none" }
    $proc  = if (Get-Process clfs_harness) { "RUNNING" } else { "idle" }
    $py    = if (Get-Command python.exe) { "yes" } else { "NO" }
    $cdb   = if (Resolve-Cdb)            { "yes" } else { "no" }
    $seed  = if (Test-Path $SEED) { "present" } else { "missing" }
    $crash = (Get-ChildItem (Join-Path $PROJ "crashes") -Directory | Where-Object Name -match '^\d').Count
    Write-Host ("  VM: {0}   Verifier/clfs: {1}   Task: {2}   Harness: {3}" -f $vm,$ver,$task,$proc) -ForegroundColor Gray
    Write-Host ("  python: {0}   cdb: {1}   seed: {2}   crash bundles: {3}`n" -f $py,$cdb,$seed,$crash) -ForegroundColor Gray
}

function Pause-Menu { Write-Host "`n[enter] to continue..." -ForegroundColor DarkGray; [void](Read-Host) }

function Invoke-RunAll([string[]]$extra) {
    # run_all.ps1 self-elevates and enforces the VM guard
    Start-Process powershell.exe -Verb RunAs -ArgumentList (@("-NoProfile","-ExecutionPolicy","Bypass","-File","`"$RUNALL`"") + $extra)
}

function Verifier-Armed { return ((verifier /query 2>$null | Out-String) -match 'clfs\.sys') }

function Run-ForegroundFuzz {
    $seedDir = Join-Path $PROJ "seeds"
    if (-not (Get-ChildItem $seedDir -Filter *.blf -EA SilentlyContinue)) {
        Write-Host "No seeds - making one with real records..."; & $HARNESS create $SEED 4 | Out-Null
    }
    $nseed = (Get-ChildItem $seedDir -Filter *.blf).Count
    Remove-Item (Join-Path $PROJ "STOP.flag") -Force -EA SilentlyContinue
    if (-not (Verifier-Armed)) {
        Write-Host "[!] Verifier is NOT armed on clfs.sys - OOB bugs may not bugcheck." -ForegroundColor Yellow
        Write-Host "    Use option 'v' first (arm + reboot) for reliable crash detection.`n" -ForegroundColor Yellow
    }
    Write-Host "LIVE parse-fuzz from $nseed seed(s). Watch 'reached %' and 'topErr'." -ForegroundColor Yellow
    Write-Host "A BSOD = you caught one. Drop a file named STOP.flag in the folder to end.`n" -ForegroundColor DarkGray
    $env:PYTHONWARNINGS = 'ignore'
    $round = 0
    while (-not (Test-Path (Join-Path $PROJ "STOP.flag"))) {
        $round++
        Write-Host "`n=== round $round : 2000 fresh mutants from $nseed seed(s) ===" -ForegroundColor Cyan
        & python.exe -W ignore (Join-Path $PROJ "mutator\blf_mutate.py") `
            --seed $seedDir --out (Join-Path $PROJ "corpus") --count 2000 --fix-checksums --seed-rng $round --verbose
        & $HARNESS fuzzdir (Join-Path $PROJ "corpus") (Join-Path $PROJ "crashes\progress.log")
        Get-ChildItem $env:TEMP -Filter *.container -EA SilentlyContinue | Remove-Item -Force -EA SilentlyContinue
    }
}

while ($true) {
    Banner
    Show-Status
    Write-Host "  A) AUTO-CAMPAIGN  (harvest seeds -> make seed -> live fuzz)  <- start here" -ForegroundColor Green
    Write-Host "  v) Arm Verifier + dumps (needed once; reboot after)         [prep]" -ForegroundColor Green
    Write-Host "  h) Help / explain everything`n" -ForegroundColor Cyan
    Write-Host "  -- manual steps --" -ForegroundColor DarkGray
    Write-Host "  1) Validate env   2) Make seed   s) Harvest real BLFs   3) Gen corpus"
    Write-Host "  f) Foreground fuzz (live)   4) Autonomous campaign   5) API-seq fuzz"
    Write-Host "  6) Triage crash   b) Bucketize   m) Minimize   7) STOP   8) Uninstall"
    Write-Host "  9) Open folders   0) Exit`n"
    switch (Read-Host "select") {
        "a" {
            Banner
            if (-not (Test-IsVM)) { Write-Host "Refusing: not a VM." -ForegroundColor Red; Pause-Menu; break }
            if (-not (Verifier-Armed)) {
                Write-Host "Verifier not armed yet - arming it now (needed for crash detection)." -ForegroundColor Yellow
                & (Join-Path $PROJ "triage\setup_vm.ps1") -Surface legacy
                Write-Host "`nDONE. REBOOT, then run menu -> A again to harvest seeds + start fuzzing." -ForegroundColor Green
                if ((Read-Host "reboot now? (y/N)") -eq 'y') { Restart-Computer -Force }
                Pause-Menu; break
            }
            # Default to the high-reach generated seed (real records + LOCAL containers).
            # Harvested real logs reference locked system containers -> mostly 6614 / low
            # reach, and would dominate the corpus. Keep 's' as an explicit diversity opt-in.
            Remove-Item (Join-Path $PROJ "seeds\sys_*.blf") -Force -EA SilentlyContinue
            Write-Host "== building a generated seed (real records + local containers) ==" -ForegroundColor Cyan
            & $HARNESS create $SEED 6 | Out-Null
            Write-Host "  Tip: option 's' adds real system logs for structural diversity, but they" -ForegroundColor DarkGray
            Write-Host "  reference locked system containers -> mostly topErr 6614, lower reach." -ForegroundColor DarkGray
            Write-Host "`nStarting live fuzz...`n" -ForegroundColor Green
            Start-Sleep 2
            Run-ForegroundFuzz
            Pause-Menu
        }
        "h" {
            Banner
            Write-Host @"
  HOW TO CATCH A CLFS CRASH (the effective path)
  ----------------------------------------------
  1) Snapshot the VM clean (so you can roll back after each BSOD).
  2) 'v' (or 'A') -> arms Driver Verifier on clfs.sys + crash dumps. REBOOT.
     Verifier is what turns a silent out-of-bounds into a real bugcheck.
  3) 'A' AUTO-CAMPAIGN -> harvests real system BLFs as seeds, makes a generated
     seed (with real log records), then fuzzes them all in a live loop.
  4) Watch the live line:  reached %  and  topErr <code> <name>
        reached %  = mutants that got PAST validation into the parser (want it high)
        topErr 6612 LOG_METADATA_CORRUPT   = normal (that mutant was rejected as invalid)
        topErr 6614 LOG_METADATA_INCONSISTENT = primary/shadow desync (fixed in v1.0)
     The '[sample]' block shows the actual fields being mutated (lsnOwnerPage,
     RecordOffsets, pContainer, ...) with old -> new values.
  5) A BSOD = a hit. The VM auto-reboots; run '6' to triage (needs Debugging Tools).
     Then 'b' (dedup) and 'm' (minimize) to turn it into a clean repro.

  STOP: drop a file named STOP.flag in this folder, or use '7'.
  If it won't boot: restore the snapshot (see docs\RECOVERY.md).
  Details: docs\tuning.md (reach%, errors), docs\cve-map.md (what each strategy targets).
"@ -ForegroundColor Gray
            Pause-Menu
        }
        "1" {
            Banner
            Write-Host "VM detected      : $(Test-IsVM)"
            Write-Host "python           : $((Get-Command python.exe).Source)"
            Write-Host "cdb (triage)     : $(if(Resolve-Cdb){Resolve-Cdb}else{'NOT FOUND - install Debugging Tools for Windows'})"
            Write-Host "Verifier clfs.sys: $((verifier /query 2>$null | Out-String) -match 'clfs\.sys')"
            Write-Host "harness built    : $(Test-Path $HARNESS)"
            Pause-Menu
        }
        "2" {
            Banner
            $nc = Read-Host "containers (more = more surface; default 4)"; if (-not $nc) { $nc = 4 }
            & $HARNESS create $SEED $nc
            Pause-Menu
        }
        "s" {
            Banner
            & (Join-Path $PROJ "harvest_seeds.ps1")
            Write-Host "`nThese add structural diversity. Foreground fuzz (f) mutates ALL seeds." -ForegroundColor Gray
            Pause-Menu
        }
        "3" {
            Banner
            $n = Read-Host "how many mutants? (default 2000)"; if (-not $n) { $n = 2000 }
            & python.exe (Join-Path $PROJ "mutator\blf_mutate.py") --seed (Join-Path $PROJ "seeds") `
                --out (Join-Path $PROJ "corpus") --count $n --fix-checksums
            Pause-Menu
        }
        "4" {
            Banner
            Write-Host "This arms Verifier and reboots into an autonomous loop." -ForegroundColor Yellow
            Write-Host "SNAPSHOT THE VM FIRST. Drop STOP.flag to halt." -ForegroundColor Yellow
            if ((Read-Host "type GO to proceed") -eq "GO") { Invoke-RunAll @() }
            Pause-Menu
        }
        "v" {
            Banner
            if (-not (Test-IsVM)) { Write-Host "Refusing: not a VM." -ForegroundColor Red; Pause-Menu; break }
            & (Join-Path $PROJ "triage\setup_vm.ps1") -Surface legacy
            Write-Host "`nVerifier + dumps armed (no autonomous task). REBOOT, then menu -> f." -ForegroundColor Yellow
            if ((Read-Host "reboot now? (y/N)") -eq 'y') { Restart-Computer -Force }
            Pause-Menu
        }
        "f" {
            Banner
            if (-not (Test-IsVM)) { Write-Host "Refusing: not a VM." -ForegroundColor Red; Pause-Menu; break }
            Run-ForegroundFuzz
            Pause-Menu
        }
        "5" {
            Banner
            if (-not (Test-IsVM)) { Write-Host "Refusing: not a VM." -ForegroundColor Red; Pause-Menu; break }
            $it = Read-Host "iterations? (default 100000)"; if (-not $it) { $it = 100000 }
            Write-Host "API-sequence fuzzing (VM only) - a hit = BSOD..." -ForegroundColor Yellow
            & $HARNESS seqfuzz $it (Get-Random)
            Pause-Menu
        }
        "6" { Banner; & (Join-Path $PROJ "triage\collect.ps1"); Pause-Menu }
        "7" {
            Banner
            New-Item -ItemType File -Force (Join-Path $PROJ "STOP.flag") | Out-Null
            Get-Process clfs_harness | Stop-Process -Force
            Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match 'orchestrator\.py|blf_mutate\.py' } |
                ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
            Write-Host "STOP.flag dropped; fuzzer processes killed." -ForegroundColor Green
            Pause-Menu
        }
        "8" { Banner; Invoke-RunAll @("-Uninstall"); Pause-Menu }
        "9" { Start-Process explorer.exe (Join-Path $PROJ "crashes"); Start-Process explorer.exe (Join-Path $PROJ "logs") }
        "b" { Banner; & python.exe (Join-Path $PROJ "triage\bucketize.py"); Pause-Menu }
        "m" {
            Banner
            $c = Read-Host "crashing .blf path"
            if (Test-Path $c) {
                Write-Host "Oracle returns exit 0 if the input still crashes. For a VM/kernel bug"
                Write-Host "this is your wrapper that runs it and detects the BSOD. {input} = candidate."
                $o = Read-Host "oracle command (blank = --self-test demo)"
                $out = Join-Path $PROJ "crashes\minimized.blf"
                if ($o) { & python.exe (Join-Path $PROJ "triage\minimize.py") --crash $c --seed $SEED --oracle $o --out $out }
                else    { & python.exe (Join-Path $PROJ "triage\minimize.py") --crash $c --seed $SEED --self-test --out $out }
            } else { Write-Host "not found: $c" -ForegroundColor Red }
            Pause-Menu
        }
        "0" { return }
        default { }
    }
}