How to use the claripy.Concat function in claripy
To help you get started, we’ve selected a few claripy examples, based on popular ways it is used in public projects.
Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
angr / angr / angr / engines / vex / claripy / ccall.py View on Github 
elif v in [ data[platform]['CondTypes']['CondL'], data[platform]['CondTypes']['CondNL'] ]:
l.debug("CondL")
#sf = claripy.LShR(rdata, data[platform]['G_CC_SHIFT_S'])
#of = claripy.LShR(rdata, data[platform]['G_CC_SHIFT_O'])
r = 1 & (inv ^ (sf ^ of))
elif v in [ data[platform]['CondTypes']['CondLE'], data[platform]['CondTypes']['CondNLE'] ]:
l.debug("CondLE")
#sf = claripy.LShR(rdata, data[platform]['G_CC_SHIFT_S'])
#of = claripy.LShR(rdata, data[platform]['G_CC_SHIFT_O'])
#zf = claripy.LShR(rdata, data[platform]['G_CC_SHIFT_Z'])
r = 1 & (inv ^ ((sf ^ of) | zf))
else:
raise SimCCallError("Unrecognized condition in pc_calculate_condition. Panic.")
return claripy.Concat(claripy.BVV(0, state.arch.bits-1), r)
else:
rdata = rdata_all
v = op_concretize(cond)
inv = v & 1
l.debug("inv: %d", inv)
# THIS IS A FUCKING HACK
if v == 0xe:
# jle
pass
if v in [data[platform]['CondTypes']['CondO'], data[platform]['CondTypes']['CondNO']]:
l.debug("CondO")
of = claripy.LShR(rdata, data[platform]['CondBitOffsets']['G_CC_SHIFT_O'])
return 1 & (inv ^ of)def _op_float_op_just_low(self, args):
chopped = [arg[(self._vector_size - 1):0].raw_to_fp() for arg in args]
result = getattr(claripy, 'fp' + self._generic_name)(claripy.fp.RM.default(), *chopped).raw_to_bv()
return claripy.Concat(args[0][(args[0].length - 1):self._vector_size], result)val = claripy.Concat(*[SimCC._standardize_value(sarg, subty, state, alloc) for sarg in arg])
if ref:
val = alloc(val, state)
return val
elif isinstance(arg, tuple):
if check:
if not isinstance(ty, s_type.SimStruct):
raise TypeError("Type mismatch: Expected %s, got tuple (i.e. struct)" % ty.name)
if len(arg) != len(ty.fields):
raise TypeError("Wrong number of fields in struct, expected %d got %d" % (len(ty.fields), len(arg)))
return claripy.Concat(*[SimCC._standardize_value(sarg, sty, state, alloc)
for sarg, sty
in zip(arg, ty.fields.values())])
else:
return claripy.Concat(*[SimCC._standardize_value(sarg, None, state, alloc) for sarg in arg])
elif isinstance(arg, (int, long)):
if check and isinstance(ty, s_type.SimTypeFloat):
return SimCC._standardize_value(float(arg), ty, state, alloc)
val = state.se.BVV(arg, ty.size if check else state.arch.bits)
if state.arch.memory_endness == 'Iend_LE':
val = val.reversed
return val
elif isinstance(arg, float):
sort = claripy.FSORT_FLOAT
if check:
if isinstance(ty, s_type.SimTypeDouble):
sort = claripy.FSORT_DOUBLE
elif isinstance(ty, s_type.SimTypeFloat):def generic_compare(self, args, comparison):
if self._vector_size is not None:
res_comps = []
for i in reversed(range(self._vector_count)):
a_comp = claripy.Extract((i+1) * self._vector_size - 1,
i * self._vector_size,
args[0])
b_comp = claripy.Extract((i+1) * self._vector_size - 1,
i * self._vector_size,
args[1])
res_comps.append(claripy.If(comparison(a_comp, b_comp),
claripy.BVV(-1, self._vector_size),
claripy.BVV(0, self._vector_size)))
return claripy.Concat(*res_comps)
else:
return claripy.If(comparison(args[0], args[1]), claripy.BVV(1, 1), claripy.BVV(0, 1))controllable_constraints.append(c)
elif any(v.startswith("output_var") for v in c.variables):
# an output like a leak
pass
else:
# uncontrollable constraints will show up as zen constraints etc
uncontrollable_constraints.append(c)
if len(controllable_constraints) > 0:
l.debug("Challenge response detected!")
file_1 = state.posix.stdout
stdout = file_1.load(0, file_1.size)
stdout_len = state.solver.eval(file_1.size)
stdout_bvs = [claripy.BVS("file_stdout_%#x" % i, 8, explicit_name=True) for i in range(stdout_len)]
stdout_bv = claripy.Concat(*stdout_bvs)
state.add_constraints(stdout == stdout_bv)
# we call simplify to separate the contraints/dependencies
state.solver.simplify()
merged_solver = state.solver._solver._merged_solver_for(lst=[self._mem] + controllable_constraints)
# todo here we can verify that there are actually stdout bytes here, otherwise we have little hope
# add the important stdout vars to mem
needed_vars = []
for bv in stdout_bvs:
if len(bv.variables & merged_solver.variables) != 0:
needed_vars.append(bv)
# add the str_to_int vars and int_to_str vars
for _, v in chall_resp_info.str_to_int_pairs:"""
components = []
for a, b in self.vector_args(args):
top_a = a[self._vector_size-1]
top_b = b[self._vector_size-1]
res = a + b
top_r = res[self._vector_size-1]
if self.is_signed:
big_top_r = (~top_r).zero_extend(self._vector_size-1)
cap = (claripy.BVV(-1, self._vector_size)//2) + big_top_r
cap_cond = ((~(top_a ^ top_b)) & (top_a ^ top_r)) == 1
else:
cap = claripy.BVV(-1, self._vector_size)
cap_cond = claripy.ULT(res, a)
components.append(claripy.If(cap_cond, cap, res))
return claripy.Concat(*components)
self.patch_value_expression = imm7.zero_extend(self.bits-7) << 2
self.patch_bytes_expression = claripy.Concat(
BVV(armins >> 7, 9),
imm7
)
self._test_values = (4, 0x1fc)
elif armins & 0xFC00 == 0x1C00:
# ADD/SUB (immediate format)
# page 7
# uses sign bit, 3 bit immediate
thoughtval = (armins & 0x01C0) >> 6
if thoughtval != self.value:
raise ValueNotFoundError
imm3 = self._imm(3)
self.patch_value_expression = imm3.zero_extend(self.bits-3)
self.patch_bytes_expression = claripy.Concat(
BVV(armins >> 9, 7),
imm3,
BVV(armins & 0x3F, 6)
)
self._test_values = (1, 7)
elif armins & 0xE000 == 0x2000:
# Move/Compare/Add/Subtract immediate
# page 9
# Unsigned 8 bit immediate
thoughtval = armins & 0xFF
if thoughtval != self.value:
raise ValueNotFoundError
imm8 = self._imm(8)
self.patch_value_expression = imm8.zero_extend(self.bits-8)
self.patch_bytes_expression = claripy.Concat(
BVV(armins >> 8, 8),)
self.patch_bytes_expression = claripy.Concat(
BVV(armins >> 12, 20),
shift,
imm8
)
self._test_values = (1, 0xff, 0xff000000)
elif armins & 0x0E400090 == 0x00400090:
# LDRH
thoughtval = (armins & 0xF) | ((armins & 0xF00) >> 4)
if thoughtval != self.value:
raise ValueNotFoundError
hinib = self._imm(4, 'hinib')
lonib = self._imm(4, 'lonib')
self.patch_value_expression = claripy.Concat(hinib, lonib).zero_extend(self.bits-8)
self.patch_bytes_expression = claripy.Concat(
BVV(armins >> 12, 20),
hinib,
BVV((armins >> 4) & 0xF, 4),
lonib
)
self._test_values = (1, 0xff)
elif armins & 0x0E000000 == 0x0C000000:
# Coprocessor data transfer
# i.e. FLD/FST
thoughtval = armins & 0xFF
thoughtval *= 4
if thoughtval != self.value:
raise ValueNotFoundError
imm8 = self._imm(8)
self.patch_value_expression = imm8.zero_extend(self.bits-8) << 2
self.patch_bytes_expression = claripy.Concat(claripy
An abstraction layer for constraint solvers
