how to use s_size() primitive's argument 'math'?

[spwpun]

how to use s_size() primitive's argument 'math'?

My code:

s_initialize("bgp_openmessage")
if s_block_start("BGP"):
    if s_block_start("Header"):
        s_bytes(value=b"\xFF", padding=b"\xFF", size=16, name="Marker", fuzzable=False)
        # The length should be calculated automatically: 
        # len is the open message length, 19 is the length of the header
        s_size(block_name="Open", length=2, math=lambda x: x + 19, name="Length", fuzzable=False)
        # s_word(value=4096, endian=BIG_ENDIAN, name="Length", fuzzable=True) # original field
        # Type is always 1 for open messages
        s_byte(value=0x01, endian=BIG_ENDIAN, name="Type", fuzzable=False)
    s_block_end()
    
    if s_block_start("Open"):
......

The problem I encounter:

Traceback (most recent call last):
  File "main/fuzz_bgp.py", line 67, in <module>
    fuzz_sess.fuzz()
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/sessions.py", line 1282, in fuzz
    self._main_fuzz_loop(self._generate_mutations_indefinitely(max_depth=max_depth))
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/sessions.py", line 1405, in _main_fuzz_loop
    self._fuzz_current_case(mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/sessions.py", line 1772, in _fuzz_current_case
    self.transmit_fuzz(
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/sessions.py", line 1184, in transmit_fuzz
    data = self.fuzz_node.render(mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/blocks/request.py", line 128, in render
    return self.get_child_data(mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/fuzzable_block.py", line 71, in get_child_data
    rendered += item.render(mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/fuzzable.py", line 153, in render
    return self.encode(value=self.get_value(mutation_context=mutation_context), mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/blocks/block.py", line 112, in encode
    child_data = super(Block, self).get_child_data(mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/fuzzable_block.py", line 71, in get_child_data
    rendered += item.render(mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/fuzzable.py", line 153, in render
    return self.encode(value=self.get_value(mutation_context=mutation_context), mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/blocks/block.py", line 112, in encode
    child_data = super(Block, self).get_child_data(mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/fuzzable_block.py", line 71, in get_child_data
    rendered += item.render(mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/fuzzable.py", line 153, in render
    return self.encode(value=self.get_value(mutation_context=mutation_context), mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/blocks/size.py", line 112, in encode
    self._length_to_bytes(self._calculated_length(mutation_context=mutation_context))
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/blocks/size.py", line 124, in _calculated_length
    + self._length_of_target_block(mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/blocks/size.py", line 11, in safe_recurse
    result = f(self, *args, **kwargs)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/blocks/size.py", line 149, in _length_of_target_block
    return len(target_block.render(mutation_context=mutation_context))
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/fuzzable.py", line 153, in render
    return self.encode(value=self.get_value(mutation_context=mutation_context), mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/blocks/block.py", line 112, in encode
    child_data = super(Block, self).get_child_data(mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/fuzzable_block.py", line 71, in get_child_data
    rendered += item.render(mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/fuzzable.py", line 153, in render
    return self.encode(value=self.get_value(mutation_context=mutation_context), mutation_context=mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/primitives/word.py", line 37, in encode
    return super(Word, self).encode(value, mutation_context)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/primitives/bit_field.py", line 133, in encode
    temp = self._render_int(
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/primitives/bit_field.py", line 163, in _render_int
    bit_stream += int_to_binary_string(value, bit_width)
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/primitives/bit_field.py", line 34, in int_to_binary_string
    return "".join(map(lambda x: str((number >> x) & 1), range(bit_width - 1, -1, -1)))
  File "/home/spwpun/FuzzPro/boofuzz/boofuzz/primitives/bit_field.py", line 34, in <lambda>
    return "".join(map(lambda x: str((number >> x) & 1), range(bit_width - 1, -1, -1)))
TypeError: unsupported operand type(s) for >>: 'list' and 'int'

[SR4ven]

Sorry for the delayed answer @spwpun.

I ran the following code using Python 3.10 and the current boofuzz master and it worked perfectly fine.

s_initialize("bgp_openmessage")
if s_block_start("BGP"):
    if s_block_start("Header"):
        s_bytes(value=b"\xFF", padding=b"\xFF", size=16, name="Marker", fuzzable=False)
        # The length should be calculated automatically:
        # len is the open message length, 19 is the length of the header
        s_size(block_name="Open", length=2, math=lambda x: x + 19, name="Length", fuzzable=False)
        # s_size(block_name="Open", length=2, name="Length", fuzzable=False)
        # s_word(value=4096, endian=BIG_ENDIAN, name="Length", fuzzable=True) # original field
        # Type is always 1 for open messages
        s_byte(value=0x01, endian=BIG_ENDIAN, name="Type", fuzzable=False)
    s_block_end()

    if s_block_start("Open"):
        s_byte(b"1")
        s_byte(b"2")
    s_block_end("Open")
s_block_end()

Which Python and boofuzz version are you using?

[spwpun]

@SR4ven
Thanks for reply, I 've checked my code, then found the error is not belong the s_size(), the root cause is that I set the value to a list in s_bytes() primitive.