42#import <Foundation/Foundation.h>
43#import <UIKit/UIKit.h>
44#import <CoreGraphics/CoreGraphics.h>
47#import <os/signpost.h>
56#include <sys/sysctl.h>
57#import <ImageIO/ImageIO.h>
58#import <UniformTypeIdentifiers/UniformTypeIdentifiers.h>
60#pragma mark - Verbose Logging
64#pragma mark - Constants
90#define MAX_PERMUTATION 12
91#define COMM_PAGE64_BASE_ADDRESS (0x0000000FFFFFC000ULL)
92#define COMM_PAGE_CPU_CAPABILITIES64 (COMM_PAGE64_BASE_ADDRESS + 0x010)
93#define MAX_PERMUTATION 12
95#define COMM_PAGE64_BASE_ADDRESS (0x0000000FFFFFC000ULL)
96#elif defined(__x86_64__)
101#define COMM_PAGE_VERSION (COMM_PAGE64_BASE_ADDRESS + 0x01E)
102#define COMM_PAGE_NCPUS (COMM_PAGE64_BASE_ADDRESS + 0x022)
103#define COMM_PAGE_CACHE_LINESIZE (COMM_PAGE64_BASE_ADDRESS + 0x026)
104#define COMM_PAGE_SCHED_GEN (COMM_PAGE64_BASE_ADDRESS + 0x028)
105#define COMM_PAGE_MEMORY_PRESSURE (COMM_PAGE64_BASE_ADDRESS + 0x02c)
106#define COMM_PAGE_SPIN_COUNT (COMM_PAGE64_BASE_ADDRESS + 0x030)
107#define COMM_PAGE_KDEBUG_ENABLE (COMM_PAGE64_BASE_ADDRESS + 0x044)
108#define COMM_PAGE_ATM_DIAGNOSTIC_CONFIG (COMM_PAGE64_BASE_ADDRESS + 0x048)
109#define COMM_PAGE_BOOTTIME_USEC (COMM_PAGE64_BASE_ADDRESS + 0x0C8)
110#define COMM_PAGE_ACTIVE_CPUS (COMM_PAGE64_BASE_ADDRESS + 0x034)
111#define COMM_PAGE_PHYSICAL_CPUS (COMM_PAGE64_BASE_ADDRESS + 0x035)
112#define COMM_PAGE_LOGICAL_CPUS (COMM_PAGE64_BASE_ADDRESS + 0x036)
113#define COMM_PAGE_MEMORY_SIZE (COMM_PAGE64_BASE_ADDRESS + 0x038)
114#define COMM_PAGE_CPUFAMILY (COMM_PAGE64_BASE_ADDRESS + 0x040)
115#define COMM_PAGE_CPU_CAPABILITIES64 (COMM_PAGE64_BASE_ADDRESS + 0x010)
117#pragma mark - Color Definitions
144#define MAG(string) "\x1b[0;35m" string RESET_COLOR
145#define BLUE(string) "\x1b[34m" string RESET_COLOR
146#define RED(string) "\x1b[31m" string RESET_COLOR
147#define WHT(string) "\x1b[0;37m" string RESET_COLOR
148#define GRN(string) "\x1b[0;32m" string RESET_COLOR
149#define YEL(string) "\x1b[0;33m" string RESET_COLOR
150#define CYN(string) "\x1b[0;36m" string RESET_COLOR
151#define HWHT(string) "\x1b[0;97m" string RESET_COLOR
152#define NORMAL_COLOR(string) "\x1B[0m" string RESET_COLOR
153#define RESET_COLOR "\x1b[0m"
155#pragma mark - Injection Strings Configuration
157#pragma mark - Injection Strings Configuration
177#define INJECT_STRING_1 "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
178#define INJECT_STRING_2 "<script>console.error('XNU Image Fuzzer');</script>"
179#define INJECT_STRING_3 "' OR ''='"
180#define INJECT_STRING_4 "%d %s %d %s"
181#define INJECT_STRING_5 "XNU Image Fuzzer"
182#define INJECT_STRING_6 "123456; DROP TABLE users"
183#define INJECT_STRING_7 "!@#$%^&*()_+="
184#define INJECT_STRING_8 "..//..//..//win"
185#define INJECT_STRING_9 "\0\0\0"
186#define INJECT_STRING_10 "<?xml version=\"1.0\"?><!DOCTYPE replace [<!ENTITY example \"XNUImageFuzzer\"> ]><userInfo><firstName>XNUImageFuzzer<&example;></firstName></userInfo>"
187#define NUMBER_OF_STRINGS 10
203#pragma mark - Debugging Macros
224#define DebugLog(fmt, ...) NSLog((@"%s [Line %d] " fmt), __PRETTY_FUNCTION__, __LINE__, ##__VA_ARGS__)
229#pragma mark - Assertion
243#define AssertWithMessage(condition, message, ...) \
245 if (!(condition)) { \
246 NSLog((@"Assertion failed: %s " message), #condition, ##__VA_ARGS__); \
251#pragma mark - Date and Time Utilities
267 NSDateFormatter *dateFormatter = [[NSDateFormatter alloc] init];
268 [dateFormatter setDateFormat:@"yyyy-MM-dd HH:mm:ss"];
269 NSString *formattedDate = [dateFormatter stringFromDate:[NSDate date]];
270 return formattedDate;
273#pragma mark - Signature
305 fprintf(stderr,
"Error: Failed to allocate memory for signature.\n");
312 fprintf(stderr,
"Error: COMM_PAGE64_BASE_ADDRESS is null.\n");
324#pragma mark - iOS Device Information
345UIDevice *device = [UIDevice currentDevice];
346NSLog(
@"Device Information:");
347NSLog(
@" Name: %@", device.name);
348NSLog(
@" Model: %@", device.model);
349NSLog(
@" System Name: %@", device.systemName);
350NSLog(
@" System Version: %@", device.systemVersion);
351NSLog(
@" Identifier For Vendor: %@", device.identifierForVendor.UUIDString);
353device.batteryMonitoringEnabled = YES;
354NSLog(
@" Battery Level: %f", device.batteryLevel * 100);
355NSString *batteryState;
356switch (device.batteryState) {
357 case UIDeviceBatteryStateUnknown:
358 batteryState =
@"Unknown";
360 case UIDeviceBatteryStateUnplugged:
361 batteryState =
@"Unplugged";
363 case UIDeviceBatteryStateCharging:
364 batteryState =
@"Charging";
366 case UIDeviceBatteryStateFull:
367 batteryState =
@"Full";
370 batteryState =
@"Not Available";
373NSLog(
@" Battery State: %@", batteryState);
374device.batteryMonitoringEnabled = NO;
377#pragma mark - macOS System Information
409 size_t size =
sizeof(str);
412 sysctlbyname(
"kern.osrelease", str, &size, NULL, 0);
413 NSLog(
@"Kernel Version: %s", str);
418 sysctlbyname(
"hw.model", str, &size, NULL, 0);
419 NSLog(
@"Hardware Model: %s", str);
424 sysctlbyname(
"machdep.cpu.brand_string", str, &size, NULL, 0);
425 NSLog(
@"CPU Type: %s", str);
429#pragma mark - CPU Cap Strings
456 "MMX",
"SSE",
"SSE2",
"SSE3",
"Cache32",
"Cache64",
"Cache128",
457 "FastThreadLocalStorage",
"SupplementalSSE3",
"64Bit",
"SSE4_1",
"SSE4_2",
458 "AES",
"InOrderPipeline",
"Slow",
"UP",
"NumCPUs",
"AVX1_0",
"RDRAND",
459 "F16C",
"ENFSTRG",
"FMA",
"AVX2_0",
"BMI1",
"BMI2",
"RTM",
"HLE",
"ADX",
460 "RDSEED",
"MPX",
"SGX"
463#pragma mark - Dump Comm Page
500#define READ_COMM_PAGE_VALUE(type, address) (*((type *)(address)))
505 NSLog(
@"[*] COMM_PAGE_SIGNATURE: %s", sig);
508 NSLog(
@"[*] COMM_PAGE_SIGNATURE: Error reading signature.");
516 NSLog(
@"[*] COMM_PAGE_CPU_CAPABILITIES64:");
518 for (
int i = 0, shift = 0; i < (int)(
sizeof(
cpu_cap_strings) /
sizeof(
char *)); i++) {
524 NSLog(
@"\t%s: %@",
cpu_cap_strings[i], (cpu_caps & (1ULL << shift)) ?
@"true" :
@"false");
527 NSLog(
@"[*] Done dumping comm page.");
530#pragma mark - Print Color Function
556#pragma mark - Function Prototypes
606void logPixelData(
unsigned char *rawData,
size_t width,
size_t height,
const char *message, BOOL verbose);
613#pragma mark - IO Handling
615#pragma mark - saveFuzzedImage
644 if (contextDescription == nil || [contextDescription length] == 0) {
645 NSLog(
@"Context description is invalid.");
650 NSString *fileExtension =
@"png";
653 if ([contextDescription containsString:
@"jpeg"] || [contextDescription containsString:@"jpg"]) {
654 fileExtension =
@"jpg";
655 imageData = UIImageJPEGRepresentation(image, 0.9);
656 NSLog(
@"Saving image as JPEG");
657 }
else if ([contextDescription containsString:
@"gif"]) {
658 fileExtension =
@"gif";
661 NSLog(
@"Successfully created GIF data");
663 NSLog(
@"Failed to create GIF data");
665 }
else if ([contextDescription containsString:
@"premultipliedfirstalpha"]) {
667 imageData = UIImagePNGRepresentation(image);
668 NSLog(
@"Saving image as PNG with premultipliedfirstalpha");
671 imageData = UIImagePNGRepresentation(image);
672 NSLog(
@"Saving image as PNG");
676 NSString *fileName = [NSString stringWithFormat:@"fuzzed_image_%@.%@", contextDescription, fileExtension];
679 NSString *documentsDirectory = [NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES) firstObject];
680 NSString *filePath = [documentsDirectory stringByAppendingPathComponent:fileName];
683 BOOL success = [imageData writeToFile:filePath atomically:YES];
686 NSLog(
@"Fuzzed image for '%@' context saved to %@", contextDescription, filePath);
688 NSLog(
@"Failed to save fuzzed image for '%@' context", contextDescription);
692#pragma mark - GIF UIImage
704 NSLog(
@"UIImageGIFRepresentation: Invalid image input.");
709 NSMutableData *gifData = [NSMutableData data];
712 CGImageDestinationRef destination = CGImageDestinationCreateWithData((CFMutableDataRef)gifData, (__bridge CFStringRef)UTTypeGIF.identifier, 1, NULL);
715 NSLog(
@"UIImageGIFRepresentation: Failed to create image destination for GIF.");
720 NSDictionary *gifProperties = @{
721 (__bridge id)kCGImagePropertyGIFDictionary: @{
722 (__bridge id)kCGImagePropertyGIFLoopCount: @0
727 CGImageDestinationAddImage(destination, image.CGImage, (__bridge CFDictionaryRef)gifProperties);
730 if (!CGImageDestinationFinalize(destination)) {
731 NSLog(
@"UIImageGIFRepresentation: Failed to finalize the GIF image destination.");
732 CFRelease(destination);
736 CFRelease(destination);
741#pragma mark - MonoConversionFunction
760 size_t bytesPerRow = (width + 7) / 8;
761 unsigned char threshold = 127;
763 for (
size_t y = 0; y < height; y++) {
764 for (
size_t x = 0; x < width; x++) {
765 size_t byteIndex = y * bytesPerRow + x / 8;
766 unsigned char pixelValue = rawData[y * width + x];
767 unsigned char bit = (pixelValue > threshold) ? 1 : 0;
769 rawData[byteIndex] &= ~(1 << (7 - (x % 8)));
770 rawData[byteIndex] |= (bit << (7 - (x % 8)));
775#pragma mark - MonoSavingFunction
792 NSData *imageData = UIImagePNGRepresentation(image);
793 NSString *docsDir = [NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES) firstObject];
794 NSString *filePath = [docsDir stringByAppendingPathComponent:[NSString stringWithFormat:@"%@.png", identifier]];
796 if ([imageData writeToFile:filePath atomically:YES]) {
797 NSLog(
@"Saved monochrome image with identifier %@ at %@", identifier, filePath);
799 NSLog(
@"Error saving monochrome image with identifier %@", identifier);
803#pragma mark - Directory Management
819 NSDateFormatter *formatter = [[NSDateFormatter alloc] init];
820 formatter.dateFormat =
@"yyyy-MM-dd_HH-mm-ss-SSS";
823 NSString *dateString = [formatter stringFromDate:[NSDate date]];
824 uint32_t randomComponent = arc4random_uniform(10000);
825 NSString *uniqueDirectoryName = [NSString stringWithFormat:@"%@_%u", dateString, randomComponent];
828 NSString *documentsDirectory = [NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES) firstObject];
831 NSString *uniqueDirPath = [documentsDirectory stringByAppendingPathComponent:uniqueDirectoryName];
834 NSError *error = nil;
835 if (![[NSFileManager defaultManager] createDirectoryAtPath:uniqueDirPath withIntermediateDirectories:YES attributes:nil error:&error]) {
836 NSLog(
@"Error creating directory for saving images: %@", error.localizedDescription);
841 return uniqueDirPath;
844#pragma mark - Pixel Logging
846#pragma mark - Raw Image Data
864 if (!rawData || width == 0 || height == 0) {
865 NSLog(
@"%s - Invalid data or dimensions. Logging aborted.", message);
869 const int numberOfPixelsToLog = 5;
871 NSLog(
@"%s - %s logging %d random pixels:", message,
verboseLogging ?
"Verbose" :
"Basic", numberOfPixelsToLog);
873 for (
int i = 0; i < numberOfPixelsToLog; i++) {
874 unsigned int randomX = arc4random_uniform((
unsigned int)width);
875 unsigned int randomY = arc4random_uniform((
unsigned int)height);
876 size_t pixelIndex = (randomY * width + randomX) * 4;
878 if (pixelIndex + 3 < width * height * 4) {
879 unsigned char r = rawData[pixelIndex];
880 unsigned char g = rawData[pixelIndex + 1];
881 unsigned char b = rawData[pixelIndex + 2];
882 unsigned char a = rawData[pixelIndex + 3];
884 NSLog(
@"%s - Pixel[%u, %u]: R=%u, G=%u, B=%u, A=%u", message, randomX, randomY, r, g, b, a);
888 unsigned char decodedChar = (r & 1) | ((g & 1) << 1) | ((b & 1) << 2);
889 NSLog(
@"%s - Decoded data from Pixel[%u, %u]: %c", message, randomX, randomY, decodedChar);
892 NSLog(
@"%s - Out of bounds pixel access prevented at [%u, %u].", message, randomX, randomY);
897#pragma mark - Random Image Data
909 if (!rawData || width == 0 || height == 0) {
910 NSLog(
@"%s - Invalid data or dimensions. Logging aborted.", message);
914 const int numberOfPixelsToLog = 5;
915 NSLog(
@"%s - Logging %d random pixels:", message, numberOfPixelsToLog);
917 for (
int i = 0; i < numberOfPixelsToLog; i++) {
918 unsigned int randomX = arc4random_uniform((
unsigned int)width);
919 unsigned int randomY = arc4random_uniform((
unsigned int)height);
920 size_t pixelIndex = (randomY * width + randomX) * 4;
922 if (pixelIndex + 3 < width * height * 4) {
923 NSLog(
@"%s - Pixel[%u, %u]: R=%d, G=%d, B=%d, A=%d",
924 message, randomX, randomY,
925 rawData[pixelIndex], rawData[pixelIndex + 1],
926 rawData[pixelIndex + 2], rawData[pixelIndex + 3]);
928 NSLog(
@"%s - Out of bounds pixel access prevented at [%u, %u].", message, randomX, randomY);
933#pragma mark - Fuzzing Functions
935#pragma mark - applyColorShift
943 for (
int i = 0; i < 3; i++) {
944 int shift = (arc4random_uniform(2) == 0) ? -15 : 15;
945 int newValue = data[index + i] + shift;
946 data[index + i] = (
unsigned char)fmax(0, fmin(255, newValue));
950#pragma mark - Pixel Scramble
960 int swapIndex = arc4random_uniform(3);
961 temp = data[index + swapIndex];
962 data[index + swapIndex] = data[index + (swapIndex + 1) % 3];
963 data[index + (swapIndex + 1) % 3] = temp;
966#pragma mark - applyEnhancedFuzzingToBitmapContext
981 if (!rawData || width == 0 || height == 0) {
982 NSLog(
@"No valid raw data or dimensions available for enhanced fuzzing.");
986 size_t stringIndex = 0;
987 size_t injectIndex = 0;
988 size_t totalStringsInjected = 0;
989 const size_t numFuzzMethods = 8;
992 NSLog(
@"Starting enhanced fuzzing on bitmap context");
995 for (
size_t y = 0; y < height; y++) {
996 for (
size_t x = 0; x < width; x++) {
997 size_t pixelIndex = (y * width + x) * 4;
998 int fuzzMethod = arc4random_uniform(numFuzzMethods);
1002 NSLog(
@"Starting injection of string %zu: %s", stringIndex + 1,
injectStrings[stringIndex]);
1006 size_t stringLength = strlen(currentString);
1008 if (injectIndex < stringLength) {
1010 for (
int i = 0; i < 3; i++) {
1012 rawData[pixelIndex + i] &= 0xFE;
1013 rawData[pixelIndex + i] |= (currentString[injectIndex] & 0x01);
1016 rawData[pixelIndex + i] &= 0x7F;
1017 rawData[pixelIndex + i] |= (currentString[injectIndex] & 0x80);
1022 if (injectIndex == stringLength) {
1024 NSLog(
@"Completed injection of string %zu: %s", stringIndex + 1, currentString);
1028 totalStringsInjected++;
1033 switch (fuzzMethod) {
1036 NSLog(
@"Inversion applied at Pixel[%zu, %zu]", x, y);
1038 for (
int i = 0; i < 3; i++) {
1039 rawData[pixelIndex + i] = 255 - rawData[pixelIndex + i];
1044 NSLog(
@"Random noise applied at Pixel[%zu, %zu]", x, y);
1046 for (
int i = 0; i < 4; i++) {
1047 int noise = (arc4random_uniform(101) - 50);
1048 int newValue = rawData[pixelIndex + i] + noise;
1049 rawData[pixelIndex + i] = (
unsigned char)fmax(0, fmin(255, newValue));
1054 NSLog(
@"Random color set at Pixel[%zu, %zu]", x, y);
1057 for (
int i = 0; i < 3; i++) {
1058 rawData[pixelIndex + i] = arc4random_uniform(256);
1063 NSLog(
@"Shift pixel values applied at Pixel[%zu, %zu]", x, y);
1066 unsigned char temp = rawData[pixelIndex + 2];
1067 rawData[pixelIndex + 2] = rawData[pixelIndex + 1];
1068 rawData[pixelIndex + 1] = rawData[pixelIndex];
1069 rawData[pixelIndex] = temp;
1073 NSLog(
@"Extreme contrast adjustment at Pixel[%zu, %zu]", x, y);
1075 for (
int i = 0; i < 3; i++) {
1076 rawData[pixelIndex + i] = rawData[pixelIndex + i] < 128 ? 0 : 255;
1081 NSLog(
@"Conditional color swap at Pixel[%zu, %zu]", x, y);
1084 if ((x + y) % 2 == 0) {
1085 unsigned char temp = rawData[pixelIndex];
1086 rawData[pixelIndex] = rawData[pixelIndex + 2];
1087 rawData[pixelIndex + 2] = temp;
1093 NSLog(
@"Color Shift applied at Pixel[%zu, %zu]", x, y);
1099 NSLog(
@"Pixel Scramble applied at Pixel[%zu, %zu]", x, y);
1108 NSLog(
@"Successfully injected all %zu strings.", totalStringsInjected);
1110 NSLog(
@"Error: Not all strings were successfully injected. Total injected: %zu", totalStringsInjected);
1112 NSLog(
@"Enhanced fuzzing on bitmap context completed.");
1116#pragma mark - applyEnhancedFuzzingToBitmapContextWithFloats
1140 if (!rawData || width == 0 || height == 0) {
1141 NSLog(
@"Invalid parameters for enhanced fuzzing.");
1148 NSLog(
@"Starting enhanced fuzzing with injection string %d: %s", stringIndex + 1,
injectStrings[stringIndex]);
1154 for (
size_t y = 0; y < height; y++) {
1155 for (
size_t x = 0; x < width; x++) {
1156 size_t pixelIndex = (y * width + x) * 4;
1162 for (
int i = 0; i < 4; i++) {
1163 rawData[pixelIndex + i] += ((float)arc4random_uniform(6) / RAND_MAX * 2.0f - 1.0f);
1168 for (
int i = 0; i < 4; i++) {
1169 rawData[pixelIndex + i] *= ((float)arc4random_uniform(6) / RAND_MAX * 2.0f);
1174 for (
int i = 0; i < 3; i++) {
1175 rawData[pixelIndex + i] = 1.0f - rawData[pixelIndex + i];
1180 for (
int i = 0; i < 4; i++) {
1181 rawData[pixelIndex + i] = (arc4random_uniform(6) % 2) ? FLT_MAX : FLT_MIN;
1186 for (
int i = 0; i < 4; i++) {
1187 switch (arc4random_uniform(6) % 3) {
1188 case 0: rawData[pixelIndex + i] = NAN;
break;
1189 case 1: rawData[pixelIndex + i] = INFINITY;
break;
1190 case 2: rawData[pixelIndex + i] = -INFINITY;
break;
1200 NSLog(
@"Enhanced fuzzing with injection string %d: %s completed", stringIndex + 1,
injectStrings[stringIndex]);
1206 NSLog(
@"All enhanced fuzzing processes completed.");
1210#pragma mark - applyEnhancedFuzzingToBitmapContextAlphaOnly
1224 if (!alphaData || width == 0 || height == 0) {
1225 NSLog(
@"No valid alpha data or dimensions available for enhanced fuzzing.");
1230 NSLog(
@"Starting enhanced fuzzing on Alpha-only bitmap context");
1233 for (
size_t y = 0; y < height; y++) {
1234 for (
size_t x = 0; x < width; x++) {
1235 size_t pixelIndex = y * width + x;
1238 switch (arc4random_uniform(3)) {
1240 alphaData[pixelIndex] = 255 - alphaData[pixelIndex];
1243 if (arc4random_uniform(2) == 0) {
1244 alphaData[pixelIndex] = 0;
1246 alphaData[pixelIndex] = 255;
1251 int noise = (arc4random_uniform(51)) - 25;
1252 int newAlpha = (int)alphaData[pixelIndex] + noise;
1253 alphaData[pixelIndex] = (
unsigned char)fmax(0, fmin(255, newAlpha));
1261 NSLog(
@"Enhanced fuzzing on Alpha-only bitmap context completed");
1265#pragma mark - applyFuzzingToBitmapContext
1282 NSLog(
@"Beginning fuzzing operation on bitmap context.");
1284 for (
size_t y = 0; y < height; y++) {
1285 for (
size_t x = 0; x < width; x++) {
1286 size_t pixelIndex = (y * width + x) * 4;
1289 for (
int i = 0; i < 3; i++) {
1291 int fuzzFactor = (int)arc4random_uniform(51) - 25;
1292 int newValue = rawData[pixelIndex + i] + fuzzFactor;
1293 rawData[pixelIndex + i] = (
unsigned char) fmax(0, fmin(255, newValue));
1304 NSLog(
@"Fuzzing applied to RGB components of the bitmap context. Injection data encoded in the alpha channel of the first row.");
1307#pragma mark - Memory Handling
1309#pragma mark - debugMemoryHandling
1334 const size_t sz = 0x10000;
1335 char* chunks[64] = { NULL };
1336 for (
int i = 0; i < 64; i++) {
1337 char* chunk = (
char *)mmap(0, sz, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
1338 if (chunk == MAP_FAILED) {
1339 NSLog(
@"Failed to map memory for chunk %d", i);
1342 memset(chunk, 0x41, sz);
1343 NSLog(
@"Chunk @ %p", chunk);
1347 for (
int i = 0; i < 64; i++) {
1348 if (chunks[i] != NULL) {
1349 if (munmap(chunks[i], sz) == -1) {
1350 NSLog(
@"Failed to unmap chunk @ %p", chunks[i]);
1352 NSLog(
@"Successfully unmapped chunk @ %p", chunks[i]);
1360#pragma mark - Hash String
1372 unsigned long hash = 5381;
1376 while ((c = *str++)) {
1377 hash = ((hash << 5) + hash) + c;
1383#pragma mark - Random Images
1385#pragma mark - performAllImagePermutations
1405 size_t height = 128;
1406 CFStringRef imageType = (__bridge CFStringRef)UTTypePNG.identifier;
1410 NSString *path =
@"/tmp/fuzzed_image.png";
1411 [fuzzedImage writeToFile:path atomically:YES];
1414 UIImage *image = [UIImage imageWithData:fuzzedImage];
1416 NSLog(
@"Failed to load generated image from path: %@", path);
1424#pragma mark - generateFuzzedImageData
1447 size_t bytesPerPixel = 4;
1448 size_t bitsPerComponent = 8;
1449 size_t bytesPerRow = width * bytesPerPixel;
1450 size_t bufferSize = bytesPerRow * height;
1452 uint8_t *buffer = (uint8_t *)malloc(bufferSize);
1453 for (
size_t i = 0; i < bufferSize; i++) {
1454 buffer[i] = arc4random_uniform(256);
1457 CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
1458 CGContextRef context = CGBitmapContextCreate(buffer, width, height, bitsPerComponent, bytesPerRow, colorSpace, kCGImageAlphaPremultipliedLast);
1459 CGImageRef imageRef = CGBitmapContextCreateImage(context);
1461 NSMutableData *imageData = [NSMutableData data];
1462 CGImageDestinationRef destination = CGImageDestinationCreateWithData((CFMutableDataRef)imageData, imageType, 1, NULL);
1463 CGImageDestinationAddImage(destination, imageRef, NULL);
1464 CGImageDestinationFinalize(destination);
1466 CGColorSpaceRelease(colorSpace);
1467 CGContextRelease(context);
1468 CGImageRelease(imageRef);
1469 CFRelease(destination);
1475#pragma mark - Application Entry Point
1497int main(
int argc,
const char * argv[]) {
1501 NSLog(
@"XNU Image Fuzzer starting %@", currentTime);
1504 const char *envVars[] = {
1505 "CGBITMAP_CONTEXT_LOG_ERRORS",
"CG_PDF_VERBOSE",
"CG_CONTEXT_SHOW_BACKTRACE",
1506 "CG_CONTEXT_SHOW_BACKTRACE_ON_ERROR",
"CG_IMAGE_SHOW_MALLOC",
"CG_LAYER_SHOW_BACKTRACE",
1507 "CGBITMAP_CONTEXT_LOG",
"CGCOLORDATAPROVIDER_VERBOSE",
"CGPDF_LOG_PAGES",
1508 "MALLOC_CHECK_",
"NSZombieEnabled",
"NSAssertsEnabled",
"NSShowAllViews",
1509 "IDELogRedirectionPolicy"
1511 const char *envValues[] = {
1512 "1",
"1",
"1",
"1",
"1",
"1",
"1",
"1",
"1",
"1",
"YES",
"YES",
"YES",
"oslogToStdio"
1514 for (
int i = 0; i <
sizeof(envVars) /
sizeof(
char *); i++) {
1515 setenv(envVars[i], envValues[i], 1);
1519 if (argc > 2 && argv[1][0] !=
'-') {
1520 NSString *imageName = [NSString stringWithUTF8String:argv[1]];
1521 int permutation = atoi(argv[2]);
1523 NSLog(
@"Loading file: %@", imageName);
1526 NSLog(
@"Failed to find path for image: %@", imageName);
1527 NSLog(
@"Failed to load image: %@", imageName);
1536 NSLog(
@"XNU Image Fuzzer ✅ %@", currentTime);
1538 }
else if (argc == 1 || (argc > 2 && argv[1][0] ==
'-')) {
1543 NSLog(
@"Incorrect usage. Expected 0 or 2 arguments, got %d", argc - 1);
1544 NSLog(
@"Usage: %s <imagePath> <permutation>", argv[0]);
1550#pragma mark - isImagePathValid
1575 BOOL fileExists = [[NSFileManager defaultManager] fileExistsAtPath:path];
1576 NSLog(fileExists ?
@"Valid image path: %@" :
@"Invalid image path: %@", path);
1580#pragma mark - loadImageFromFile
1606 NSLog(
@"Loading file: %@", imageName);
1607 NSString *imagePath = [[NSBundle mainBundle] pathForResource:imageName ofType:nil];
1609 NSLog(
@"Failed to find path for image: %@", imageName);
1612 NSLog(
@"Image path: %@", imagePath);
1614 NSData *content = [NSData dataWithContentsOfFile:imagePath];
1616 NSLog(
@"Failed to load data from file: %@", imagePath);
1620 UIImage *image = [UIImage imageWithData:content];
1622 NSLog(
@"Failed to create UIImage from data.");
1626 NSLog(
@"UIImage created: %@, Size: {width: %.2f, height: %.2f}, Scale: %f, Orientation: %ld",
1627 image, image.size.width, image.size.height, image.scale, (
long)image.imageOrientation);
1632#pragma mark - Process Image
1656 CGImageRef cgImg = [image CGImage];
1658 NSLog(
@"Failed to get CGImage from UIImage.");
1661 NSLog(
@"CGImage created from UIImage. Dimensions: %zu x %zu", CGImageGetWidth(cgImg), CGImageGetHeight(cgImg));
1663 if (permutation == -1) {
1664 for (
int i = 1; i <= 12; i++) {
1667 NSLog(
@"Case: Creating bitmap context with Standard RGB settings");
1671 NSLog(
@"Case: Creating bitmap context with Premultiplied First Alpha settings");
1675 NSLog(
@"Case: Creating bitmap context with Non-Premultiplied Alpha settings");
1679 NSLog(
@"Case: Creating bitmap context with 16-bit depth settings");
1683 NSLog(
@"Grayscale image processing is currently pending implementation.");
1686 NSLog(
@"Case: Creating bitmap context with HDR Float Components settings");
1690 NSLog(
@"Case: Creating bitmap context with Alpha Only settings");
1694 NSLog(
@"Case: Creating bitmap context with 1-bit Monochrome settings");
1698 NSLog(
@"Case: Creating bitmap context with Big Endian pixel format settings");
1702 NSLog(
@"Case: Creating bitmap context with Little Endian pixel format settings");
1706 NSLog(
@"Case: Creating bitmap context with 8-bit depth, inverted colors settings");
1710 NSLog(
@"Case: Creating bitmap context with 32-bit float, 4-component settings");
1714 NSLog(
@"Case: Invalid permutation number %d", permutation);
1717 NSLog(
@"Completed image processing for permutation %d", i);
1720 switch (permutation) {
1722 NSLog(
@"Case: Creating bitmap context with Standard RGB settings");
1726 NSLog(
@"Case: Creating bitmap context with Premultiplied First Alpha settings");
1730 NSLog(
@"Case: Creating bitmap context with Non-Premultiplied Alpha settings");
1734 NSLog(
@"Case: Creating bitmap context with 16-bit depth settings");
1738 NSLog(
@"Grayscale image processing is currently pending implementation.");
1741 NSLog(
@"Case: Creating bitmap context with HDR Float Components settings");
1745 NSLog(
@"Case: Creating bitmap context with Alpha Only settings");
1749 NSLog(
@"Case: Creating bitmap context with 1-bit Monochrome settings");
1753 NSLog(
@"Case: Creating bitmap context with Big Endian pixel format settings");
1757 NSLog(
@"Case: Creating bitmap context with Little Endian pixel format settings");
1761 NSLog(
@"Case: Creating bitmap context with 8-bit depth, inverted colors settings");
1765 NSLog(
@"Case: Creating bitmap context with 32-bit float, 4-component settings");
1769 NSLog(
@"Case: Invalid permutation number %d", permutation);
1771 NSLog(
@"Completed image processing for permutation %d", permutation);
1775#pragma mark - createBitmapContextStandardRBG
1814 NSLog(
@"Creating bitmap context with Standard RGB settings and applying fuzzing");
1818 NSLog(
@"Invalid CGImageRef provided.");
1822 size_t width = CGImageGetWidth(cgImg);
1823 size_t height = CGImageGetHeight(cgImg);
1824 size_t bytesPerRow = width * 4;
1826 unsigned char *rawData = (
unsigned char *)calloc(height * bytesPerRow,
sizeof(
unsigned char));
1828 NSLog(
@"Failed to allocate memory for image processing");
1833 CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
1835 NSLog(
@"Failed to create color space");
1841 CGBitmapInfo bitmapInfo = kCGImageAlphaPremultipliedLast | kCGBitmapByteOrder32Big;
1842 CGContextRef ctx = CGBitmapContextCreate(rawData, width, height, 8, bytesPerRow, colorSpace, bitmapInfo);
1844 CGColorSpaceRelease(colorSpace);
1847 NSLog(
@"Failed to create bitmap context");
1853 CGContextDrawImage(ctx, CGRectMake(0, 0, width, height), cgImg);
1855 NSLog(
@"Applying enhanced fuzzing logic to the bitmap context");
1858 size_t unchangedCount = 0;
1859 size_t changedCount = 0;
1862 for (
size_t i = 0; i < height * bytesPerRow; i++) {
1863 if (rawData[i] == 0x41) {
1867 if (changedCount < 10) {
1868 NSLog(
@"Detected change from 0x41 at byte offset %zu, new value: 0x%X", i, rawData[i]);
1875 if (unchangedCount > 0) {
1876 NSLog(
@"Detected unchanged 0x41 pattern in %zu places.", unchangedCount);
1878 NSLog(
@"Detected changes in %zu places.", changedCount);
1880 CGImageRef newCgImg = CGBitmapContextCreateImage(ctx);
1882 NSLog(
@"Failed to create CGImage from context");
1884 UIImage *newImage = [UIImage imageWithCGImage:newCgImg];
1885 CGImageRelease(newCgImg);
1891 NSLog(
@"Modified UIImage created and saved successfully.");
1894 CGContextRelease(ctx);
1899#pragma mark - createBitmapContextPremultipliedFirstAlpha
1920 NSLog(
@"Creating bitmap context with Premultiplied First Alpha settings");
1923 NSLog(
@"Invalid CGImageRef provided.");
1927 size_t width = CGImageGetWidth(cgImg);
1928 size_t height = CGImageGetHeight(cgImg);
1929 size_t bytesPerRow = width * 4;
1931 unsigned char *rawData = (
unsigned char *)calloc(height * bytesPerRow,
sizeof(
unsigned char));
1933 NSLog(
@"Failed to allocate memory for image processing");
1938 memset(rawData, 0x41, height * bytesPerRow);
1940 CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
1942 NSLog(
@"Failed to create color space");
1947 CGBitmapInfo bitmapInfo = kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Big;
1948 CGContextRef ctx = CGBitmapContextCreate(rawData, width, height, 8, bytesPerRow, colorSpace, bitmapInfo);
1949 CGColorSpaceRelease(colorSpace);
1952 NSLog(
@"Failed to create bitmap context");
1957 CGContextDrawImage(ctx, CGRectMake(0, 0, width, height), cgImg);
1959 NSLog(
@"Applying enhanced fuzzing logic to the bitmap context");
1963 size_t unchangedCount = 0;
1964 size_t changedCount = 0;
1967 for (
size_t i = 0; i < height * bytesPerRow; i++) {
1968 if (rawData[i] == 0x41) {
1972 if (changedCount < 10) {
1973 NSLog(
@"Detected change from 0x41 at byte offset %zu, new value: 0x%X", i, rawData[i]);
1980 if (unchangedCount > 0) {
1981 NSLog(
@"Detected unchanged 0x41 pattern in %zu places.", unchangedCount);
1983 NSLog(
@"Detected changes in %zu places.", changedCount);
1985 CGImageRef newCgImg = CGBitmapContextCreateImage(ctx);
1987 NSLog(
@"Failed to create CGImage from context");
1989 UIImage *newImage = [UIImage imageWithCGImage:newCgImg];
1990 CGImageRelease(newCgImg);
1998 NSLog(
@"Modified UIImage created and saved successfully in both PNG and JPEG formats.");
2001 CGContextRelease(ctx);
2005#pragma mark - createBitmapContextNonPremultipliedAlpha
2036 NSLog(
@"Creating bitmap context with Non-Premultiplied Alpha settings");
2039 NSLog(
@"Invalid CGImageRef provided.");
2043 size_t width = CGImageGetWidth(cgImg);
2044 size_t height = CGImageGetHeight(cgImg);
2045 size_t bytesPerRow = width * 4;
2048 unsigned char *rawData = (
unsigned char *)calloc(height * bytesPerRow,
sizeof(
unsigned char));
2050 NSLog(
@"Failed to allocate memory for image processing");
2055 CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
2057 NSLog(
@"Failed to create color space");
2063 CGBitmapInfo bitmapInfo = kCGImageAlphaNoneSkipLast | kCGBitmapByteOrder32Big;
2064 CGContextRef ctx = CGBitmapContextCreate(rawData, width, height, 8, bytesPerRow, colorSpace, bitmapInfo);
2065 CGColorSpaceRelease(colorSpace);
2068 NSLog(
@"Failed to create bitmap context");
2074 CGContextDrawImage(ctx, CGRectMake(0, 0, width, height), cgImg);
2077 NSLog(
@"Applying enhanced fuzzing logic to the bitmap context with non-premultiplied alpha");
2080 size_t unchangedCount = 0;
2081 size_t changedCount = 0;
2084 for (
size_t i = 0; i < height * bytesPerRow; i++) {
2085 if (rawData[i] == 0x41) {
2089 if (changedCount < 10) {
2090 NSLog(
@"Detected change from 0x41 at byte offset %zu, new value: 0x%X", i, rawData[i]);
2097 if (unchangedCount > 0) {
2098 NSLog(
@"Detected unchanged 0x41 pattern in %zu places.", unchangedCount);
2100 NSLog(
@"Detected changes in %zu places.", changedCount);
2103 CGImageRef newCgImg = CGBitmapContextCreateImage(ctx);
2105 NSLog(
@"Failed to create CGImage from context");
2107 UIImage *newImage = [UIImage imageWithCGImage:newCgImg];
2108 CGImageRelease(newCgImg);
2115 NSLog(
@"Modified UIImage created and saved successfully for non-premultiplied alpha in both PNG, JPEG and GIF formats.");
2119 CGContextRelease(ctx);
2123#pragma mark - createBitmapContext16BitDepth
2153 NSLog(
@"Creating bitmap context with 16-bit depth per channel");
2159 NSLog(
@"Invalid CGImageRef provided.");
2163 size_t width = CGImageGetWidth(cgImg);
2164 size_t height = CGImageGetHeight(cgImg);
2166 size_t bytesPerRow = width * 8;
2169 unsigned char *rawData = (
unsigned char *)calloc(height * bytesPerRow,
sizeof(
unsigned char));
2171 NSLog(
@"Failed to allocate memory for image processing");
2177 CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
2179 NSLog(
@"Failed to create color space");
2186 CGBitmapInfo bitmapInfo = kCGImageAlphaPremultipliedLast | kCGBitmapByteOrderDefault;
2187 CGContextRef ctx = CGBitmapContextCreate(rawData, width, height, 16, bytesPerRow, colorSpace, bitmapInfo);
2188 CGColorSpaceRelease(colorSpace);
2191 NSLog(
@"Failed to create bitmap context");
2198 CGContextDrawImage(ctx, CGRectMake(0, 0, width, height), cgImg);
2201 NSLog(
@"Applying enhanced fuzzing logic to the bitmap context with 16-bit depth");
2204 size_t unchangedCount = 0;
2205 size_t changedCount = 0;
2209 for (
size_t i = 0; i < height * bytesPerRow; i++) {
2210 if (rawData[i] == 0x41) {
2214 if (changedCount < 10) {
2215 NSLog(
@"Detected change from 0x41 at byte offset %zu, new value: 0x%X", i, rawData[i]);
2222 if (unchangedCount > 0) {
2223 NSLog(
@"Detected unchanged 0x41 pattern in %zu places.", unchangedCount);
2225 NSLog(
@"Detected changes in %zu places.", changedCount);
2228 CGImageRef newCgImg = CGBitmapContextCreateImage(ctx);
2230 NSLog(
@"Failed to create CGImage from context");
2232 UIImage *newImage = [UIImage imageWithCGImage:newCgImg];
2233 CGImageRelease(newCgImg);
2240 NSLog(
@"Modified UIImage created and saved successfully in both PNG and JPEG formats.");
2244 CGContextRelease(ctx);
2249#pragma mark - createBitmapContextGrayscale
2252 NSLog(
@"Grayscale image processing is not yet implemented.");
2256#pragma mark - createBitmapContextHDRFloatComponents
2285 NSLog(
@"Creating bitmap context with HDR and floating-point components");
2288 NSLog(
@"Invalid CGImageRef provided.");
2292 size_t width = CGImageGetWidth(cgImg);
2293 size_t height = CGImageGetHeight(cgImg);
2294 size_t bytesPerRow = width * 16;
2297 float *rawData = (
float *)calloc(height * bytesPerRow,
sizeof(
float));
2299 NSLog(
@"Failed to allocate memory for image processing");
2303 CGColorSpaceRef colorSpace = CGColorSpaceCreateWithName(kCGColorSpaceExtendedLinearSRGB);
2305 NSLog(
@"Failed to create HDR color space");
2310 CGBitmapInfo bitmapInfo = kCGImageAlphaPremultipliedLast | kCGBitmapFloatComponents | kCGBitmapByteOrder32Little;
2311 CGContextRef ctx = CGBitmapContextCreate(rawData, width, height, 32, bytesPerRow, colorSpace, bitmapInfo);
2312 CGColorSpaceRelease(colorSpace);
2315 NSLog(
@"Failed to create bitmap context for HDR");
2320 CGContextDrawImage(ctx, CGRectMake(0, 0, width, height), cgImg);
2322 NSLog(
@"Applying enhanced fuzzing logic to the HDR bitmap context");
2325 static int currentStringIndex = 0;
2330 size_t unchangedCount = 0;
2331 size_t changedCount = 0;
2334 for (
size_t i = 0; i < height * bytesPerRow; i++) {
2335 if (rawData[i] == 0x41) {
2339 if (changedCount < 10) {
2346 floatToHex.f = rawData[i];
2348 NSLog(
@"Detected change from 0x41 at byte offset %zu, new value: 0x%X", i, floatToHex.u);
2355 if (unchangedCount > 0) {
2356 NSLog(
@"Detected unchanged 0x41 pattern in %zu places.", unchangedCount);
2358 NSLog(
@"Detected changes in %zu places.", changedCount);
2360 CGImageRef newCgImg = CGBitmapContextCreateImage(ctx);
2362 NSLog(
@"Failed to create CGImage from HDR context");
2364 UIImage *newImage = [UIImage imageWithCGImage:newCgImg];
2365 CGImageRelease(newCgImg);
2370 NSLog(
@"Modified UIImage with HDR and floating-point components created and saved successfully in both PNG, JPEG and GIF formats.");
2373 CGContextRelease(ctx);
2377#pragma mark - createBitmapContextAlphaOnly
2407 NSLog(
@"Creating bitmap context for Alpha channel only");
2413 NSLog(
@"Invalid CGImageRef provided.");
2417 size_t width = CGImageGetWidth(cgImg);
2418 size_t height = CGImageGetHeight(cgImg);
2419 size_t bytesPerRow = width;
2422 unsigned char *alphaData = (
unsigned char *)calloc(height * bytesPerRow,
sizeof(
unsigned char));
2424 NSLog(
@"Failed to allocate memory for alpha channel processing");
2431 CGBitmapInfo bitmapInfo = kCGImageAlphaOnly | kCGBitmapByteOrderDefault;
2433 CGContextRef ctx = CGBitmapContextCreate(alphaData, width, height, 8, bytesPerRow, NULL, bitmapInfo);
2436 NSLog(
@"Failed to create bitmap context for Alpha channel");
2444 CGContextDrawImage(ctx, CGRectMake(0, 0, width, height), cgImg);
2447 NSLog(
@"Applying enhanced fuzzing logic to the Alpha-only bitmap context");
2454 CGImageRef newCgImg = CGBitmapContextCreateImage(ctx);
2456 NSLog(
@"Failed to create CGImage from context");
2458 UIImage *newImage = [UIImage imageWithCGImage:newCgImg];
2459 CGImageRelease(newCgImg);
2465 NSLog(
@"Modified UIImage created and saved successfully.");
2468 CGContextRelease(ctx);
2472 NSLog(
@"Alpha-only bitmap context processing completed.");
2475#pragma mark - createBitmapContext1BitMonochrome
2505 NSLog(
@"Invalid CGImageRef provided.");
2509 NSLog(
@"Creating bitmap context with 1-bit Monochrome settings");
2511 size_t width = CGImageGetWidth(cgImg);
2512 size_t height = CGImageGetHeight(cgImg);
2514 size_t bytesPerRow = (width + 7) / 8;
2515 CGContextRef ctx = CGBitmapContextCreate(NULL, width, height, 1, bytesPerRow, NULL, kCGImageAlphaNone);
2517 NSLog(
@"Failed to create bitmap context with 1-bit Monochrome settings");
2522 CGContextSetFillColorWithColor(ctx, [UIColor whiteColor].CGColor);
2523 CGContextFillRect(ctx, CGRectMake(0, 0, width, height));
2526 CGContextDrawImage(ctx, CGRectMake(0, 0, width, height), cgImg);
2529 unsigned char *rawData = CGBitmapContextGetData(ctx);
2531 NSLog(
@"Converting bitmap data to 1-bit Monochrome");
2536 CGImageRef newCgImg = CGBitmapContextCreateImage(ctx);
2538 NSLog(
@"Failed to create CGImage from 1-bit Monochrome context");
2540 UIImage *newImage = [UIImage imageWithCGImage:newCgImg];
2541 CGImageRelease(newCgImg);
2545 NSLog(
@"Modified UIImage with 1-bit Monochrome settings created and saved successfully.");
2548 NSLog(
@"Bitmap context with 1-bit Monochrome settings created and handled successfully");
2549 CGContextRelease(ctx);
2552#pragma mark - createBitmapContextBigEndian
2580 NSLog(
@"Invalid CGImageRef provided.");
2584 NSLog(
@"Creating bitmap context with Big Endian settings");
2586 size_t width = CGImageGetWidth(cgImg);
2587 size_t height = CGImageGetHeight(cgImg);
2588 CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
2590 NSLog(
@"Failed to create color space for Big Endian settings");
2594 CGContextRef ctx = CGBitmapContextCreate(NULL, width, height, 8, width * 4, colorSpace, kCGImageAlphaPremultipliedLast | kCGBitmapByteOrder32Big);
2595 CGColorSpaceRelease(colorSpace);
2598 NSLog(
@"Failed to create bitmap context with Big Endian settings");
2603 CGContextDrawImage(ctx, CGRectMake(0, 0, width, height), cgImg);
2606 unsigned char *rawData = CGBitmapContextGetData(ctx);
2608 NSLog(
@"Applying enhanced fuzzing logic to the Big Endian bitmap context");
2613 CGImageRef newCgImg = CGBitmapContextCreateImage(ctx);
2615 NSLog(
@"Failed to create CGImage from Big Endian context");
2617 UIImage *newImage = [UIImage imageWithCGImage:newCgImg];
2618 CGImageRelease(newCgImg);
2624 NSLog(
@"Modified UIImage with Big Endian settings created and saved successfully in PNG, JPEG and GIF.");
2627 NSLog(
@"Bitmap context with Big Endian settings created and handled successfully for PNG, JPG and GIF");
2628 CGContextRelease(ctx);
2631#pragma mark - createBitmapContextLittleEndian
2657 NSLog(
@"Invalid CGImageRef provided.");
2661 NSLog(
@"Creating bitmap context with Little Endian settings");
2663 size_t width = CGImageGetWidth(cgImg);
2664 size_t height = CGImageGetHeight(cgImg);
2665 CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
2667 NSLog(
@"Failed to create color space for Little Endian settings");
2671 CGContextRef ctx = CGBitmapContextCreate(NULL, width, height, 8, width * 4, colorSpace, kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Little);
2672 CGColorSpaceRelease(colorSpace);
2675 NSLog(
@"Failed to create bitmap context with Little Endian settings");
2680 CGContextDrawImage(ctx, CGRectMake(0, 0, width, height), cgImg);
2683 unsigned char *rawData = CGBitmapContextGetData(ctx);
2685 NSLog(
@"Applying enhanced fuzzing logic to the Little Endian bitmap context");
2690 CGImageRef newCgImg = CGBitmapContextCreateImage(ctx);
2692 NSLog(
@"Failed to create CGImage from Little Endian context");
2694 UIImage *newImage = [UIImage imageWithCGImage:newCgImg];
2695 CGImageRelease(newCgImg);
2701 NSLog(
@"Modified UIImage with Little Endian settings created and saved successfully for PNG, JPG and GIF.");
2704 NSLog(
@"Bitmap context with Little Endian settings created successfully");
2705 CGContextRelease(ctx);
2708#pragma mark - createBitmapContext8BitInvertedColors
2737 NSLog(
@"Invalid CGImageRef provided.");
2741 NSLog(
@"Creating bitmap context with 8-bit depth, inverted colors");
2743 size_t width = CGImageGetWidth(cgImg);
2744 size_t height = CGImageGetHeight(cgImg);
2745 CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
2747 NSLog(
@"Failed to create color space for 8-bit depth, inverted colors");
2751 CGContextRef ctx = CGBitmapContextCreate(NULL, width, height, 8, width * 4, colorSpace, kCGImageAlphaNoneSkipLast | kCGBitmapByteOrder32Little);
2752 CGColorSpaceRelease(colorSpace);
2755 NSLog(
@"Failed to create bitmap context with 8-bit depth, inverted colors");
2760 CGContextDrawImage(ctx, CGRectMake(0, 0, width, height), cgImg);
2763 unsigned char *rawData = CGBitmapContextGetData(ctx);
2766 for (
size_t i = 0; i < width * height * 4; i += 4) {
2767 rawData[i] = 255 - rawData[i];
2768 rawData[i + 1] = 255 - rawData[i + 1];
2769 rawData[i + 2] = 255 - rawData[i + 2];
2778 CGImageRef newCgImg = CGBitmapContextCreateImage(ctx);
2780 NSLog(
@"Failed to create CGImage from 8-bit depth, inverted colors");
2782 UIImage *newImage = [UIImage imageWithCGImage:newCgImg];
2783 CGImageRelease(newCgImg);
2789 NSLog(
@"Modified UIImage with createBitmapContext8BitInvertedColors settings created and saved successfully for PNG, JPG and GIF.");
2792 CGContextRelease(ctx);
2795#pragma mark - createBitmapContext32BitFloat4Component
2834 static dispatch_once_t onceToken;
2835 static os_log_t createBitmapContextLog;
2836 dispatch_once(&onceToken, ^{
2837 createBitmapContextLog = os_log_create(
"cx.srd.xnuimagefuzzer",
"CreateBitmapContext");
2840 os_signpost_id_t spid = os_signpost_id_generate(createBitmapContextLog);
2841 os_signpost_event_emit(createBitmapContextLog, spid,
"Start creating createBitmapContext32BitFloat4Component context");
2844 NSLog(
@"Invalid CGImageRef provided.");
2848 NSLog(
@"Creating bitmap context with 32-bit float, 4-component settings");
2850 size_t width = CGImageGetWidth(cgImg);
2851 size_t height = CGImageGetHeight(cgImg);
2852 size_t bytesPerRow = width * 4 *
sizeof(float);
2854 CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
2856 NSLog(
@"Failed to create color space");
2860 CGBitmapInfo bitmapInfo = kCGImageAlphaPremultipliedLast | kCGBitmapFloatComponents;
2861 CGContextRef ctx = CGBitmapContextCreate(NULL, width, height, 32, bytesPerRow, colorSpace, bitmapInfo);
2862 CGColorSpaceRelease(colorSpace);
2865 NSLog(
@"Failed to create bitmap context with 32-bit float, 4-component settings");
2869 CGContextDrawImage(ctx, CGRectMake(0, 0, width, height), cgImg);
2871 NSLog(
@"Applying enhanced fuzzing logic to the bitmap context");
2875 CGImageRef newCgImg = CGBitmapContextCreateImage(ctx);
2877 NSLog(
@"Failed to create CGImage from context");
2879 UIImage *newImage = [UIImage imageWithCGImage:newCgImg];
2880 CGImageRelease(newCgImg);
2885 NSLog(
@"Modified UIImage with 32-bit float, 4-component settings created and saved successfully for PNG, JPG and GIF.");
2888 CGContextRelease(ctx);
2890 os_signpost_event_emit(createBitmapContextLog, spid,
"Finished creating bitmap context for 32bit_float4");
void printColored(const char *color, const char *message)
Prints a message with specified ANSI color to the console.
void createBitmapContext16BitDepth(CGImageRef cgImg)
Creates a bitmap graphics context for 16-bit depth per channel processing.
void applyColorShift(unsigned char *data, size_t index)
Applies a color shift to a specific pixel within the image data.
void applyMultiplicativeNoise(float *pixel)
unsigned long hashString(const char *str)
Computes a hash value for a given string.
void createBitmapContextPremultipliedFirstAlpha(CGImageRef cgImg)
Creates a bitmap context with Premultiplied First Alpha settings and applies image processing.
void createBitmapContextBigEndian(CGImageRef cgImg)
Creates a bitmap context with Big Endian byte ordering for image data processing.
void createBitmapContext8BitInvertedColors(CGImageRef cgImg)
Transforms the color representation of an image by inverting its colors and applying an 8-bit color d...
void createBitmapContextHDRFloatComponents(CGImageRef cgImg)
Initializes a bitmap context for HDR content with floating-point components.
#define READ_COMM_PAGE_VALUE(type, address)
Dumps key communication page details for diagnostic purposes.
void dumpDeviceInfo(void)
Logs comprehensive information about the current device.
void createBitmapContext1BitMonochrome(CGImageRef cgImg)
Creates a bitmap context for 1-bit monochrome image processing.
void LogRandomPixelData(unsigned char *rawData, size_t width, size_t height, const char *message)
Logs information about a random set of pixels from an image's raw data.
#define COMM_PAGE_CPU_CAPABILITIES64
NSString * createUniqueDirectoryForSavingImages(void)
Creates a unique directory for saving images within the documents directory.
#define INJECT_STRING_1
Configures robust strings for security testing within the application.
void performAllImagePermutations(void)
Generates a random image and processes it with all permutation strategies.
void applyExtremeValues(float *pixel)
void createBitmapContextNonPremultipliedAlpha(CGImageRef cgImg)
Creates a bitmap graphics context with Non-Premultiplied Alpha settings for processing a CGImage.
void applyFuzzingToBitmapContext(unsigned char *rawData, size_t width, size_t height)
Applies fuzzing to the RGB components of each pixel in a bitmap context.
void invertColor(float *pixel)
static int verboseLogging
Core and external libraries necessary for the fuzzer functionality.
void debugMemoryHandling(void)
Allocates and deallocates memory chunks using mmap and munmap for debugging.
void applyPixelScramble(unsigned char *data, size_t index)
Randomly scrambles the RGB values of a pixel.
UIImage * loadImageFromFile(NSString *path)
Loads an image from the application bundle into a UIImage object.
#define NUMBER_OF_STRINGS
BOOL isValidImagePath(NSString *path)
Prototypes for utility functions used in image processing.
void createBitmapContextStandardRGB(CGImageRef cgImg, int permutation)
Creates a bitmap context with standard RGB settings, applies a fuzzing process to alter the image,...
void saveMonochromeImage(UIImage *image, NSString *identifier)
Saves a monochrome UIImage with a specified identifier to the documents directory.
void convertTo1BitMonochrome(unsigned char *rawData, size_t width, size_t height)
Converts image data to 1-bit monochrome using a simple thresholding technique.
void logPixelData(unsigned char *rawData, size_t width, size_t height, const char *message, BOOL verbose)
Logs information about a random set of pixels from an image's raw data.
void createBitmapContextGrayscale(CGImageRef cgImg)
void applyEnhancedFuzzingToBitmapContext(unsigned char *rawData, size_t width, size_t height, BOOL verbose)
Applies enhanced fuzzing techniques to bitmap data.
void processImage(UIImage *image, int permutation)
Processes an image using various bitmap context configurations.
const char * cpu_cap_strings[]
Identifies the CPU's supported capabilities.
void addAdditiveNoise(float *pixel)
void saveFuzzedImage(UIImage *image, NSString *contextDescription)
Saves a modified (fuzzed) UIImage to the documents directory.
int main(int argc, const char *argv[])
Entry point of the application, handling initialization, argument parsing, and image processing.
void assignSpecialFloatValues(float *pixel)
void applyEnhancedFuzzingToBitmapContextWithFloats(float *rawData, size_t width, size_t height, BOOL verboseLogging)
Applies enhanced fuzzing techniques to bitmap data using 32-bit floating-point precision.
void createBitmapContext32BitFloat4Component(CGImageRef cgImg)
Creates a bitmap context with standard RGB settings, applies a fuzzing process to alter the image,...
NSData * generateFuzzedImageData(size_t width, size_t height, CFStringRef imageType)
Generates a random image for fuzzing.
void dumpMacDeviceInfo(void)
Logs system information for macOS devices.
NSString * formattedCurrentDateTime(void)
void createBitmapContextAlphaOnly(CGImageRef cgImg)
Creates a bitmap context for alpha channel manipulation of a CGImageRef.
void applyEnhancedFuzzingToBitmapContextAlphaOnly(unsigned char *alphaData, size_t width, size_t height, BOOL verboseLogging)
Applies enhanced fuzzing techniques to the alpha channel of bitmap pixel data.
void dump_comm_page(void)
#define COMM_PAGE64_BASE_ADDRESS
NSData * UIImageGIFRepresentation(UIImage *image)
Creates a GIF representation of a UIImage. This custom function handles the conversion of a UIImage t...
void createBitmapContextLittleEndian(CGImageRef cgImg)
Initializes a bitmap context with Little Endian settings for image data processing.