How to use the archinfo.ArchAMD64 function in archinfo

To help you get started, we’ve selected a few archinfo examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github angr / angr / tests / test_ops.py View on Github external
def test_irop_perm():
    arch = archinfo.ArchAMD64()
    p = angr.load_shellcode(arch.asm('vpshufb xmm0,xmm1,xmm2'), arch)

    # concrete test
    s1 = p.factory.blank_state()
    s1.regs.xmm1 = 0x3c899a56814ee9b84c7b5d8394c85881
    s1.regs.xmm2 = 0xa55c66a2cdef1cbcd72b42078d1b7f8b
    s2 = s1.step(num_inst=1).successors[0]
    assert (s2.regs.xmm0 == 0x00567b00000056000081c84c00813c00).is_true()

    # symbolic test
    s3 = p.factory.blank_state()
    s3.regs.xmm1 = claripy.BVS('xmm1', 128)
    s3.regs.xmm2 = claripy.BVS('xmm2', 128)
    s4 = s3.step(num_inst=1).successors[0]
    s4.solver.add(s4.regs.xmm2 == 0xa55c66a2cdef1cbcd72b42078d1b7f8b)
    s4.solver.add(s4.regs.xmm0 == 0x00567b00000056000081c84c00813c00)
github angr / angr / tests / test_function_manager.py View on Github external
def test_call_to(self):
        self.project.arch = ArchAMD64()

        self.project.kb.functions._add_call_to(0x400000, 0x400410, 0x400420, 0x400414)
        nose.tools.assert_in(0x400000, self.project.kb.functions.keys())
        nose.tools.assert_in(0x400420, self.project.kb.functions.keys())
github angr / angr / tests / test_inspect.py View on Github external
exit_after = 0

    def handle_exit_before(state):
        counts.exit_before += 1
        exit_target = state.inspect.exit_target
        nose.tools.assert_equal(state.solver.eval(exit_target), 0x3f8)
        # change exit target
        state.inspect.exit_target = 0x41414141
        nose.tools.assert_equal(state.inspect.exit_jumpkind, "Ijk_Boring")
        nose.tools.assert_true(state.inspect.exit_guard.is_true())

    def handle_exit_after(state): #pylint:disable=unused-argument
        counts.exit_after += 1

    s = SimState(arch="AMD64", mode="symbolic")
    irsb = pyvex.IRSB(b"\x90\x90\x90\x90\xeb\x0a", mem_addr=1000, arch=archinfo.ArchAMD64())

    # break on exit
    s.inspect.b('exit', BP_BEFORE, action=handle_exit_before)
    s.inspect.b('exit', BP_AFTER, action=handle_exit_after)

    # step it
    succ = SimEngineVEX().process(s, irsb).flat_successors

    # check
    nose.tools.assert_equal( succ[0].solver.eval(succ[0].ip), 0x41414141)
    nose.tools.assert_equal(counts.exit_before, 1)
    nose.tools.assert_equal(counts.exit_after, 1)
github sashs / Ropper / ropper / arch.py View on Github external
def __init__(self):
        super(ArchitectureX86_64, self).__init__()
        self._name = 'x86_64'
        self._maxInvalid = 8
        if 'keystone' in globals():
            self._ksarch = (keystone.KS_ARCH_X86, keystone.KS_MODE_64)

        self._endings[gadget.GadgetType.SYS] = [(b'\x0f\x05',2),
                                                (b'\x0f\x05\xc3',3)]                            # syscall

        self._mode = CS_MODE_64
        if 'archinfo' in globals():
            self._info = archinfo.ArchAMD64()

        self._addressLength = 8
        self._pprs = [b'[\x58-\x5f]{2}\xc3', # pop reg; pop reg; ret
                        b'\x83\xc4\x08[\x58-\x5f]\xc3', # add esp, 4; pop reg; ret
                        b'[\x58-\x5f]\x83\xc4\x08\xc3', # pop reg; add esp, 4; ret
                        b'\x83\xc4\x10\xc3'             # add esp, 8; ret;
                        ]
        self._pprs.append(b'\x41?[\x58-\x5f]\x48\x83\xc4\x08\xc3')
        self._pprs.append(b'\x48\x83\xc4\x08\x41?[\x58-\x5f]\xc3')
        self._pprs.append(b'(\x41?[\x58-\x5f]){2}\xc3')
        self._pprs.append(b'\x48\x83\xc4\x10\xc3')
github jeffball55 / rop_compiler / pyrop / rop_compiler / ropme.py View on Github external
def rop_to_shellcode(files, libraries, shellcode_address, arch = archinfo.ArchAMD64(), log_level = logging.WARNING, validate_gadgets = False, bad_bytes = None):
  """Convience method to create a goal_resolver for a shellcode address goal then find a rop chain for it"""
  goal_list = [["shellcode", hex(shellcode_address)]]
  return rop(files, libraries, goal_list, arch, log_level, validate_gadgets, bad_bytes)
github HexHive / retrowrite / librw / analysis / register.py View on Github external
def _init_reg_pool(self):
        # Possible extension: add xmm registers into the pool
        amd64 = ArchAMD64()
        regmap = dict()
        for reg in amd64.register_list:
            if reg.general_purpose:
                regmap[reg.name] = reg

        # Remove rip, rsp from regpool
        del regmap["rip"]
        del regmap["rsp"]

        # Add a fake register for rflags
        rflags = Register("rflags", 64)
        regmap["rflags"] = rflags

        return regmap
github angr / cle / cle / backends / minidump / __init__.py View on Github external
self._mdf = minidumpfile.MinidumpFile.parse_bytes(self._binary_stream.read())
        else:
            self._mdf = minidumpfile.MinidumpFile.parse(self.binary)

        self.wow64 = False

        if self.arch is None:
            if getattr(self._mdf, 'sysinfo', None) is None:
                raise MinidumpMissingStreamError('SystemInfo', 'The architecture was not specified')
            arch = self._mdf.sysinfo.ProcessorArchitecture
            if arch == SystemInfoStream.PROCESSOR_ARCHITECTURE.AMD64:
                if any(module.name.endswith('wow64.dll') for module in self._mdf.modules.modules):
                    self.wow64 = True
                    self.set_arch(archinfo.ArchX86())
                else:
                    self.set_arch(archinfo.ArchAMD64())
            elif arch == SystemInfoStream.PROCESSOR_ARCHITECTURE.INTEL:
                self.set_arch(archinfo.ArchX86())
            else:
                # has not been tested with other architectures
                raise CLEError('Loading minidumps is not implemented for this architecture')

        if self._mdf.memory_segments_64 is not None:
            segments = self._mdf.memory_segments_64.memory_segments
        elif self._mdf.memory_segments is not None:
            segments = self._mdf.memory_segments.memory_segments
        else:
            raise MinidumpMissingStreamError('MemoryList', 'The memory segments were not defined')

        for segment in segments:
            data = segment.read(segment.start_virtual_address, segment.size, self._mdf.file_handle)
            self.segments.append(Segment(segment.start_file_address, segment.start_virtual_address, segment.size, segment.size))
github angr / angr / angr / calling_conventions.py View on Github external
    @staticmethod
    def _match(arch, args, sp_delta):   # pylint: disable=unused-argument
        # doesn't appear anywhere but syscalls
        return False

    @staticmethod
    def syscall_num(state):
        return state.regs.rax

class SimCCAMD64WindowsSyscall(SimCC):
    # TODO: Make sure the information is correct
    ARG_REGS = [ ]
    FP_ARG_REGS = [ ]
    RETURN_VAL = SimRegArg('rax', 8)
    RETURN_ADDR = SimRegArg('ip_at_syscall', 8)
    ARCH = archinfo.ArchAMD64

    @classmethod
    def _match(cls, arch, args, sp_delta):  # pylint: disable=unused-argument
        # never appears anywhere except syscalls
        return False

    @staticmethod
    def syscall_num(state):
        return state.regs.rax

class SimCCARM(SimCC):
    ARG_REGS = [ 'r0', 'r1', 'r2', 'r3' ]
    FP_ARG_REGS = []    # TODO: ???
    CALLER_SAVED_REGS = []   # TODO: ???
    RETURN_ADDR = SimRegArg('lr', 4)
    RETURN_VAL = SimRegArg('r0', 4)
github HexHive / retrowrite / rwtools / asan / instrument.py View on Github external
def __init__(self, rewriter, stackrz_sz=32, globalrz_sz=64):
        self.rewriter = rewriter
        self.stackrz_sz = stackrz_sz
        self.globalrz_sz = globalrz_sz
        self.global_count = 0

        # Get the register map
        amd64 = ArchAMD64()
        self.regmap = defaultdict(lambda: defaultdict(dict))
        for reg in amd64.register_list:
            if reg.general_purpose:
                for subr in reg.subregisters:
                    base = subr[1]
                    sz = subr[2] * 8
                    self.regmap[reg.name][base][sz] = subr[0]
                if reg.name in [
                        "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"]:
                    self.regmap[reg.name][0][32] = reg.name + "d"
                    self.regmap[reg.name][0][16] = reg.name + "w"
                    self.regmap[reg.name][0][8] = reg.name + "b"
                if reg.name == "rbp":
                    self.regmap[reg.name][0][32] = "ebp"
                    self.regmap[reg.name][0][16] = "bp"
                    self.regmap[reg.name][0][8] = "bpl"