How to use the manticore.core.smtlib.operators function in manticore

To help you get started, we’ve selected a few manticore examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github trailofbits / manticore-examples / pwnable_collision / win.py View on Github external
def init(initial_state):
    """ define constraints for symbolic ARGV before execution """

    # determine argv[1] from state.input_symbols by label name
    argv1 = next(sym for sym in initial_state.input_symbols if sym.name == "ARGV1")
    if argv1 is None:
        raise Exception("ARGV was not made symbolic")

    # apply constraint for only ASCII characters
    for i in range(20):
        initial_state.constrain(operators.AND(ord(" ") <= argv1[i], argv1[i] <= ord("}")))

    # store argv1 in global state
    with m.locked_context() as context:
        context["argv1"] = argv1
github trailofbits / manticore-examples / hxp2018_angrme / solve.py View on Github external
# manually inject symbolic variable in place of input
    with m.locked_context() as context:
        solution = state.new_symbolic_buffer(max_length)

        # constrain flag format
        state.constrain(solution[0] == ord("h"))
        state.constrain(solution[1] == ord("x"))
        state.constrain(solution[2] == ord("p"))
        state.constrain(solution[3] == ord("{"))

        # constrain characters to be printable ASCII or null byte
        for i in range(max_length):
            state.constrain(
                operators.OR(
                    solution[i] == 0,
                    operators.AND(ord(" ") <= solution[i], solution[i] <= ord("}")),
                )
            )

        address = state.cpu.RSP + 0x30
        context["input_address"] = address
        print("[+] input address: " + hex(state.cpu.RSP + 0x30))
        state.cpu.write_bytes(address, solution)