How to use the mythril.laser.smt.simplify function in mythril

To help you get started, we’ve selected a few mythril examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github ConsenSys / mythril / mythril / laser / ethereum / state / account.py View on Github external
if not isinstance(key, BitVecFunc):
            concrete_values = [self._find_value(key, model[0]) for model in models]
            if key.size() == 512:
                ex_key = Extract(511, 256, key)
            else:
                ex_key = key
            potential_values = concrete_values
            key.potential_values = []
            for i, val in enumerate(potential_values):
                key.potential_values.append(
                    (val, And(models[i][1], BitVec(key.raw) == val))
                )

            return key.potential_values
        if key.size() == 512:
            val = simplify(Extract(511, 256, key))
            concrete_vals = self._traverse_concretise(val, models)
            vals2 = self._traverse_concretise(Extract(255, 0, key), models)
            key.potential_values = []
            i = 0
            for val1, val2 in zip(concrete_vals, vals2):
                if val2 and val1:
                    c_val = Concat(val1[0], val2[0])
                    condition = And(
                        models[i][1], BitVec(key.raw) == c_val, val1[1], val2[1]
                    )
                    key.potential_values.append((c_val, condition))
                else:
                    key.potential_values.append((None, None))

        if isinstance(key.input_, BitVec) or (
            isinstance(key.input_, BitVecFunc) and key.input_.func_name == "sha3"
github ConsenSys / mythril / mythril / laser / ethereum / instructions.py View on Github external
+ "]",
                    8,
                )
                return [global_state]

            try:
                i_data = dstart
                new_memory = []
                for i in range(size):
                    value = environment.calldata[i_data]
                    new_memory.append(value)

                    i_data = (
                        i_data + 1
                        if isinstance(i_data, int)
                        else simplify(cast(BitVec, i_data) + 1)
                    )
                for i in range(len(new_memory)):
                    mstate.memory[i + mstart] = new_memory[i]

            except IndexError:
                log.debug("Exception copying calldata to memory")

                mstate.memory[mstart] = global_state.new_bitvec(
                    "calldata_"
                    + str(environment.active_account.contract_name)
                    + "["
                    + str(dstart)
                    + ": + "
                    + str(size)
                    + "]",
                    8,
github ConsenSys / mythril / mythril / laser / ethereum / svm.py View on Github external
pseudo_input = random.randint(0, 2 ** 256 - 1)
                    hex_v = hex(pseudo_input)[2:]
                    if len(hex_v) % 2 == 1:
                        hex_v += "0"
                    hash_val = symbol_factory.BitVecVal(
                        int(sha3.keccak_256(bytes.fromhex(hex_v)).hexdigest()[2:], 16),
                        256,
                    )
                    pseudo_input = symbol_factory.BitVecVal(pseudo_input, 256)
                    calldata_cond = And(
                        calldata_cond,
                        Extract(511, 256, key.input_) == hash_val,
                        Extract(511, 256, key.input_).potential_input == pseudo_input,
                    )
                    Extract(511, 256, key.input_).potential_input_cond = calldata_cond
                    if not is_true(simplify(Extract(511, 256, key.input_).potential_input_cond != calldata_cond)):
                        print(key.input_, Extract(511, 256, key.input_).concat_args)
                    assert Extract(511, 256, key.input_).potential_input_cond == calldata_cond
                    print(Extract(511, 256, key.input_), calldata_cond, "CONDED")
        for actor in ACTOR_ADDRESSES:
            try:
                models_tuple.append(
                    (
                        get_model(
                            constraints=global_state.mstate.constraints
                            + [sender == actor, calldata_cond]
                        ),
                        And(calldata_cond, sender == actor),
                    )
                )
                sat = True
            except UnsatError:
github ConsenSys / mythril / mythril / laser / ethereum / state / account.py View on Github external
def _find_value(self, symbol, model):
        if model is None:
            return
        modify = symbol
        size = min(symbol.size(), 256)
        if symbol.size() > 256:
            index = simplify(Extract(255, 0, symbol))
        else:
            index = None
        if index and not index.symbolic:
            modify = Extract(511, 256, modify)
        modify = model.eval(modify.raw)
        try:
            modify = modify.as_long()
        except AttributeError:
            modify = randint(0, 2 ** modify.size() - 1)
        modify = symbol_factory.BitVecVal(modify, size)
        if index and not index.symbolic:
            modify = Concat(modify, index)

        assert modify.size() == symbol.size()
        return modify
github ConsenSys / mythril / mythril / laser / ethereum / instructions.py View on Github external
states = []

        op0, condition = state.stack.pop(), state.stack.pop()

        try:
            jump_addr = util.get_concrete_int(op0)
        except TypeError:
            log.debug("Skipping JUMPI to invalid destination.")
            global_state.mstate.pc += 1
            global_state.mstate.min_gas_used += min_gas
            global_state.mstate.max_gas_used += max_gas
            return [global_state]

        # False case
        negated = (
            simplify(Not(condition)) if isinstance(condition, Bool) else condition == 0
        )
        negated.simplify()
        # True case
        condi = simplify(condition) if isinstance(condition, Bool) else condition != 0
        condi.simplify()

        negated_cond = (type(negated) == bool and negated) or (
            isinstance(negated, Bool) and not is_false(negated)
        )
        positive_cond = (type(condi) == bool and condi) or (
            isinstance(condi, Bool) and not is_false(condi)
        )

        if negated_cond:
            new_state = copy(global_state)
            # add JUMPI gas cost
github ConsenSys / mythril / mythril / laser / ethereum / state / calldata.py View on Github external
symbolic_base_value = If(
            expr_item >= self._size,
            symbol_factory.BitVecVal(0, 8),
            BitVec(
                symbol_factory.BitVecSym(
                    "{}_calldata_{}".format(self.tx_id, str(item)), 8
                )
            ),
        )
        return_value = symbolic_base_value
        for r_index, r_value in self._reads:
            return_value = If(r_index == expr_item, r_value, return_value)
        if not clean:
            self._reads.append((expr_item, symbolic_base_value))
        return simplify(return_value)
github ConsenSys / mythril / mythril / laser / ethereum / call.py View on Github external
(
            symbol_factory.BitVecVal(memory_start, 256)
            if isinstance(memory_start, int)
            else memory_start
        ),
    )
    memory_size = cast(
        BitVec,
        (
            symbol_factory.BitVecVal(memory_size, 256)
            if isinstance(memory_size, int)
            else memory_size
        ),
    )

    uses_entire_calldata = simplify(
        memory_size == global_state.environment.calldata.calldatasize
    )

    if is_true(uses_entire_calldata):
        return global_state.environment.calldata

    try:
        calldata_from_mem = state.memory[
            util.get_concrete_int(memory_start) : util.get_concrete_int(
                memory_start + memory_size
            )
        ]
        return ConcreteCalldata(transaction_id, calldata_from_mem)
    except TypeError:
        log.debug(
            "Unsupported symbolic memory offset %s size %s", memory_start, memory_size
github ConsenSys / mythril / mythril / laser / ethereum / state / calldata.py View on Github external
if isinstance(item, int) or isinstance(item, Expression):
            return self._load(item)

        if isinstance(item, slice):
            start = 0 if item.start is None else item.start
            step = 1 if item.step is None else item.step
            stop = self.size if item.stop is None else item.stop

            try:
                current_index = (
                    start
                    if isinstance(start, BitVec)
                    else symbol_factory.BitVecVal(start, 256)
                )
                parts = []
                while simplify(current_index != stop):
                    element = self._load(current_index)
                    if not isinstance(element, Expression):
                        element = symbol_factory.BitVecVal(element, 8)

                    parts.append(element)
                    current_index = simplify(current_index + step)
            except Z3Exception:
                raise IndexError("Invalid Calldata Slice")

            return parts

        raise ValueError
github ConsenSys / mythril / mythril / laser / ethereum / instructions.py View on Github external
try:
            jump_addr = util.get_concrete_int(op0)
        except TypeError:
            log.debug("Skipping JUMPI to invalid destination.")
            global_state.mstate.pc += 1
            global_state.mstate.min_gas_used += min_gas
            global_state.mstate.max_gas_used += max_gas
            return [global_state]

        # False case
        negated = (
            simplify(Not(condition)) if isinstance(condition, Bool) else condition == 0
        )
        negated.simplify()
        # True case
        condi = simplify(condition) if isinstance(condition, Bool) else condition != 0
        condi.simplify()

        negated_cond = (type(negated) == bool and negated) or (
            isinstance(negated, Bool) and not is_false(negated)
        )
        positive_cond = (type(condi) == bool and condi) or (
            isinstance(condi, Bool) and not is_false(condi)
        )

        if negated_cond:
            new_state = copy(global_state)
            # add JUMPI gas cost
            new_state.mstate.min_gas_used += min_gas
            new_state.mstate.max_gas_used += max_gas

            # manually increment PC