P2PGen P2PGen is a prototype system for patch-guided web vulnerability reproduction. It combines entry URL generation, forced path exploration, and vulnerability-oriented directed fuzzing for PHP web applications. This repository is prepared as a research artifact. The recommended artifact-review path is documented in ARTIFACT.md. The artifact focuses on code availability, functional execution, and reuse by other researchers; it does not aim to reproduce every result reported in the paper. ## Repository Layout text P2PGen/ |-- Dataset/ # CVE metadata and setup helpers |-- EntryURLGeneration/ # LLM-powered entry URL generation |-- FPE/ # Forced Path Exploration module |-- Predator_Plus/ # Vulnerability-oriented directed fuzzing engine |-- scripts/ # Artifact helper scripts |-- ARTIFACT.md # Artifact-review guide |-- requirements.txt # Python dependency manifest |-- .env.example # Environment variable template ## Requirements P2PGen is designed for Linux-based artifact environments. - Ubuntu 20.04 or 22.04 - Python 3.8+ - Node.js 16+ - Docker 20+ - Neo4j 3.x - Instrumented PHP runtime for P2PGen's runtime monitors - PHPJoy for CPG construction: https://github.com/seclab-fudan/PHPJoy For a first reviewer pass, run the smoke check before configuring the full system: bash bash scripts/smoke_check.sh The smoke check validates the repository shape, JSON files, and JavaScript syntax. It does not start Docker, Neo4j, or the instrumented PHP runtime. ## Installation Create a Python environment and install the documented dependencies: bash python3 -m venv .venv source .venv/bin/activate python -m pip install --upgrade pip python -m pip install -r requirements.txt Install the FPE Node.js dependencies: bash npm --prefix FPE install Copy the environment template and update paths, URLs, and credentials for your VM: bash cp .env.example .env The checked-in configuration files are examples. Avoid committing local credentials, absolute paths, generated logs, or benchmark-specific outputs. ## Dataset Configuration Initialize generated dataset configuration files: bash python ./Dataset/Scripts/configure_dataset.py This script generates or updates: - ./EntryURLGeneration/EntryAnalysis/dataset/patch.json - ./Predator_Plus/working/tchecker-results/[CMS_NAME]/target.csv ## Code Property Graph Construction P2PGen relies on graph-based static analysis to collect entry context. 1. Construct the CPG using PHPJoy. 2. Import the generated CPG into a Neo4j database under: text ./EntryURLGeneration/EntryAnalysis/Neo4jDatabase 3. Configure Neo4j connectors: bash python ./Dataset/Scripts/configure_neo4j.py ## Predator Plus Setup Build the directed fuzzing Docker images: bash cd ./Predator_Plus/docker ./build-all.sh Start a container for the target PHP application: bash testid=CMS plus=vul1 docker kill "$testid-$plus" || true docker run -p 8080:80 -id --rm --name "$testid-$plus" -w "$(pwd)" witcher/directphp7run docker exec -it -u wc "$testid-$plus" bash Move the following CPG outputs into: text ./Predator_Plus/working/tchecker-results/[CMS_NAME]/ - nodes.csv - rels.csv - cpg_edges.csv ## Instrumented PHP Runtime Build the instrumented PHP runtime used by the sink monitor and condition monitor. The source package is distributed separately as php-instr.tar.gz. bash tar -xf php-instr.tar.gz cd php-instr ./configure make -j"$(nproc)" sudo make install Make sure the runtime can write monitor logs. By default, the current prototype uses paths under /var/log, such as /var/log/condition/fuzz_jmp.log and /var/log/sink_feedback/*.cov. In an artifact VM, create these directories with permissions for the web-server user. ## Usage ### Step 1: Entry URL Generation Run static entry analysis: bash cd ./EntryURLGeneration/EntryAnalysis python main.py Run dynamic entry URL generation: bash cd ./EntryURLGeneration/EntryURLGenerator python inject_token.py python run_dynamic_save_multitest.py ### Step 2: Patch-Reached URL Evolution Generate Predator Plus instrumentation metadata: bash cd ./Predator_Plus/scripts python __main__.py -w ../working/analysis-results/[CMS_NAME] -o ../working/instrument-info Copy required files into the target container: bash docker cp ./Predator_Plus/working/instrument-info/[CMS_NAME]/instr-info.csv [CONTAINER_NAME]:/tmp docker cp ./Predator_Plus/working/instrument-info/[CMS_NAME]/data_flow_origins.csv [CONTAINER_NAME]:/tmp docker cp ./EntryURLGeneration/EntryURLGenerator/storage/entry_url.json [CONTAINER_NAME]:/test/request_data.json docker cp ./Predator_Plus/working/instrument-info/witcher_config.json [CONTAINER_NAME]:/test docker exec -u wc -w /test [CONTAINER_NAME] bash -c "python3 -m witcher --testver WICHR" ### Step 3: Forced Path Exploration Run FPE with the generated patch URL file and local config: bash node ./FPE/main.js ./FPE/storage/patch_url.json ./FPE/config/config.json ./FPE/storage Expected sink locations are written to: text ./FPE/storage/target.csv ### Step 4: Vulnerability-Oriented Parameter Fuzzing Use FPE sink locations as Predator Plus targets: bash cp ./FPE/storage/target.csv ./Predator_Plus/working/tchecker-results/[CMS_NAME]/target.csv Regenerate instrumentation metadata and rerun Predator Plus: bash cd ./Predator_Plus/scripts python __main__.py -w ../working/analysis-results/[CMS_NAME] -o ../working/instrument-info docker cp ./Predator_Plus/working/instrument-info/[CMS_NAME]/instr-info.csv [CONTAINER_NAME]:/tmp docker cp ./Predator_Plus/working/instrument-info/[CMS_NAME]/data_flow_origins.csv [CONTAINER_NAME]:/tmp docker cp ./FPE/storage/entry_url.json [CONTAINER_NAME]:/test/request_data.json docker cp ./Predator_Plus/working/instrument-info/witcher_config.json [CONTAINER_NAME]:/test docker exec -u wc -w /test [CONTAINER_NAME] bash -c "python3 -m witcher --testver WICHR" ## Artifact Notes - Use ARTIFACT.md as the reviewer-facing guide. - Use .env.example and FPE/config/config.example.json as templates for local VM setup. - Generated files, logs, local credentials, node_modules, Python caches, and benchmark outputs should not be committed. - For archival release, publish a versioned GitHub release and archive the release on Zenodo or an equivalent repository to obtain a DOI. ## Citation See CITATION.cff. ## License See LICENSE.