Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def test_array_concrete():
s = SimState(arch="AMD64")
addr = 0xba5e0
s.memory.store(addr, claripy.BVV(0x1, 32), endness=Endness.LE)
s.memory.store(addr + 4, claripy.BVV(0x2, 32), endness=Endness.LE)
s.memory.store(addr + 8, claripy.BVV(0x3, 32), endness=Endness.LE)
s.memory.store(addr + 12, claripy.BVV(0x4, 32), endness=Endness.LE)
s.memory.store(addr + 16, claripy.BVV(0x5, 32), endness=Endness.LE)
nose.tools.assert_equal(s.mem[addr].dword.array(5).concrete, [0x1, 0x2, 0x3, 0x4, 0x5])
nose.tools.assert_equal(s.mem[addr].dword.array(5)[2].concrete, 0x3)
nose.tools.assert_equal(s.mem[addr].qword.array(2).concrete, [0x0000000200000001, 0x0000000400000003])
nose.tools.assert_equal(s.mem[addr].dword.array(2).array(2).concrete, [[0x1, 0x2], [0x3, 0x4]])
s.mem[addr].dword.array(5)[3] = 10
nose.tools.assert_equal(s.solver.eval(s.memory.load(addr + 12, 4, endness=Endness.LE), cast_to=int), 10)
s.mem[addr].dword.array(5).store([20,2,3,4,5])
nose.tools.assert_equal(s.mem[addr].dword.array(4).concrete, [20,2,3,4])
s.mem[addr].dword.array(2).array(2).store([[1,2], [4,3]])
def test_array_concrete():
s = SimState(arch="AMD64")
addr = 0xba5e0
s.memory.store(addr, claripy.BVV(0x1, 32), endness=Endness.LE)
s.memory.store(addr + 4, claripy.BVV(0x2, 32), endness=Endness.LE)
s.memory.store(addr + 8, claripy.BVV(0x3, 32), endness=Endness.LE)
s.memory.store(addr + 12, claripy.BVV(0x4, 32), endness=Endness.LE)
s.memory.store(addr + 16, claripy.BVV(0x5, 32), endness=Endness.LE)
nose.tools.assert_equal(s.mem[addr].dword.array(5).concrete, [0x1, 0x2, 0x3, 0x4, 0x5])
nose.tools.assert_equal(s.mem[addr].dword.array(5)[2].concrete, 0x3)
nose.tools.assert_equal(s.mem[addr].qword.array(2).concrete, [0x0000000200000001, 0x0000000400000003])
nose.tools.assert_equal(s.mem[addr].dword.array(2).array(2).concrete, [[0x1, 0x2], [0x3, 0x4]])
s.mem[addr].dword.array(5)[3] = 10
nose.tools.assert_equal(s.solver.eval(s.memory.load(addr + 12, 4, endness=Endness.LE), cast_to=int), 10)
s.mem[addr].dword.array(5).store([20,2,3,4,5])
nose.tools.assert_equal(s.mem[addr].dword.array(4).concrete, [20,2,3,4])
s.mem[addr].dword.array(2).array(2).store([[1,2], [4,3]])
nose.tools.assert_equal(s.mem[addr].dword.array(4).concrete, [1,2,4,3])
:param int size: The size in bytes to pack/unpack. Defaults to wordsize (e.g. 4 bytes on
a 32 bit architecture)
:param bool signed: Whether the data should be extracted signed/unsigned. Default unsigned
:param archinfo.Endness endness: The endian to use in packing/unpacking. Defaults to memory endness
"""
if size is not None and size > 8:
# support larger wordsizes via recursive algorithm
subsize = size >> 1
if size != subsize << 1:
raise ValueError("Cannot unpack non-power-of-two sizes")
if endness is None:
endness = self._arch.memory_endness
if endness == archinfo.Endness.BE:
lo_off, hi_off = subsize, 0
elif endness == archinfo.Endness.LE:
lo_off, hi_off = 0, subsize
else:
raise ValueError("Unsupported endness value %s." % endness)
lo = self.unpack_word(addr + lo_off, size=subsize, signed=False, endness=endness)
hi = self.unpack_word(addr + hi_off, size=subsize, signed=signed, endness=endness)
return (hi << (subsize << 3)) | lo
return self.unpack(addr, self._arch.struct_fmt(size=size, signed=signed, endness=endness))[0]
def raw(self, arch=None):
if not arch:
raise ValueError("Architecture must be specified.")
the_arch = convert_arch(arch)
if the_arch.name != "MIPS32":
raise TypeError("%s only supports MIPS32." % str(self.__class__))
if the_arch.memory_endness == Endness.LE:
return self.code_le % (struct.pack('H', (~self.fd) & 0xffff))
else:
return self.code_be % (struct.pack('H', (~self.fd) & 0xffff))
You may override any of the attributes of the word being extracted:
:param int size: The size in bytes to pack/unpack. Defaults to wordsize (e.g. 4 bytes on
a 32 bit architecture)
:param bool signed: Whether the data should be extracted signed/unsigned. Default unsigned
:param archinfo.Endness endness: The endian to use in packing/unpacking. Defaults to memory endness
"""
if size is not None and size > 8:
# support larger wordsizes via recursive algorithm
subsize = size >> 1
if size != subsize << 1:
raise ValueError("Cannot unpack non-power-of-two sizes")
if endness is None:
endness = self._arch.memory_endness
if endness == archinfo.Endness.BE:
lo_off, hi_off = subsize, 0
elif endness == archinfo.Endness.LE:
lo_off, hi_off = 0, subsize
else:
raise ValueError("Unsupported endness value %s." % endness)
lo = self.unpack_word(addr + lo_off, size=subsize, signed=False, endness=endness)
hi = self.unpack_word(addr + hi_off, size=subsize, signed=signed, endness=endness)
return (hi << (subsize << 3)) | lo
return self.unpack(addr, self._arch.struct_fmt(size=size, signed=signed, endness=endness))[0]
def __mread( self, state, addr, length ):
# dbg_prnt(DBG_LVL_3, "Reading %d bytes from 0x%x" % (length, addr))
return state.memory.load(addr, length, endness=archinfo.Endness.LE)
'''
try:
return {
1 : state.mem[ addr ].uint8_t.resolved,
2 : state.mem[ addr ].uint16_t.resolved,
4 : state.mem[ addr ].uint32_t.resolved,
8 : state.mem[ addr ].uint64_t.resolved
}[ length ]
except KeyError:
dbg_prnt(DBG_LVL_3, "Reading %d bytes from 0x%x" % (length, addr))
return state.memory.load(addr, length) # for other sizes, just use load()
'''
def get_nopsleds(arch):
arch = convert_arch(arch)
if arch.name == "X86":
return [b"\x90"] # nop
elif arch.name == "AMD64":
return [b"\x90"] # nop
elif arch.name == "MIPS32":
sleds_le = [b"\x26\x78\xe0\x01", # xor $t7, $t7, $zero
]
if arch.memory_endness == Endness.LE:
return sleds_le
elif arch.memory_endness == Endness.BE:
return [ chunk[::-1] for chunk in sleds_le ]
else:
raise NotImplementedError("get_nopsleds: Unsupported architecture %s." % arch.name)
# check if address is inside .bss or .data sections
if bss.min_addr <= addr and addr <= bss.max_addr or \
data.min_addr <= addr and addr <= data.max_addr:
# This is also works, but is for Big Endian:
# state.memory.make_symbolic('mem', state.inspect.mem_read_address, length)
# make address symbolic
symv = state.se.BVS("mem_%x" % addr, state.inspect.mem_read_length << 3)
state.memory.store(state.inspect.mem_read_address, symv,
state.inspect.mem_read_length, endness=archinfo.Endness.LE)
# we should read it to update state.inspect.mem_read_expr
state.memory.load(state.inspect.mem_read_address,
state.inspect.mem_read_length, endness=archinfo.Endness.LE)
# -------------------------------------------------------------------------------
# Identifying dereferences is a two stage process. Here (1st step) we capture all
# memory load information (which happens before the register write) that happen
# at this instruction (x64 has 1 distinct memory read per insruction; however
# instructions like popad do multiple register writes, but this is not an issue
# here).
# -------------------------------------------------------------------------------
self.__load[ state.inspect.instruction ] = (
state.inspect.mem_read_address,
state.inspect.mem_read_length,
state.inspect.mem_read_expr # this will be updated
)
# associate memory expression with memory address (needed for later on)
def __init__(self, endness=archinfo.Endness.BE):
super(ArchCT64K, self).__init__(endness)
# ---------------------------------------------------------------------
inist.regs.rax = inist.se.BVS("rax", 64) # give convenient names
inist.regs.rbx = inist.se.BVS("rbx", 64)
inist.regs.rcx = inist.se.BVS("rcx", 64)
inist.regs.rdx = inist.se.BVS("rdx", 64)
inist.regs.rsi = inist.se.BVS("rsi", 64)
inist.regs.rdi = inist.se.BVS("rdi", 64)
# rbp may also needed as it's mostly used to access local variables (e.g.,
# rax = [rbp-0x40]) but some binaries don't use rbp and all references are
# rsp related. In these cases it may worth to use rbp as well.
if MAKE_RBP_SYMBOLIC:
inist.regs.rbp = inist.se.BVS("rbp",64) # keep rbp symbolic
else:
inist.registers.store('rbp', FRAMEPTR_BASE_ADDR, size=8, endness=archinfo.Endness.LE)
# rsp must be concrete and properly initialized
inist.registers.store('rsp', RSP_BASE_ADDR, size=8, endness=archinfo.Endness.LE)
inist.regs.r8 = inist.se.BVS("r08", 64)
inist.regs.r9 = inist.se.BVS("r09", 64)
inist.regs.r10 = inist.se.BVS("r10", 64)
inist.regs.r11 = inist.se.BVS("r11", 64)
inist.regs.r12 = inist.se.BVS("r12", 64)
inist.regs.r13 = inist.se.BVS("r13", 64)
inist.regs.r14 = inist.se.BVS("r14", 64)
inist.regs.r15 = inist.se.BVS("r15", 64)
# ---------------------------------------------------------------------
# Other initializations