Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def test_get_concrete_memory_value(self):
global flag
self.Triton = TritonContext()
self.Triton.setArchitecture(ARCH.X86_64)
flag = False
self.Triton.addCallback(self.cb_flag, CALLBACK.GET_CONCRETE_MEMORY_VALUE)
# movabs rax, qword ptr [0x1000]
self.Triton.processing(Instruction(b"\x48\xa1\x00\x10\x00\x00\x00\x00\x00\x00"))
self.assertTrue(flag)
flag = False
self.Triton.removeCallback(self.cb_flag, CALLBACK.GET_CONCRETE_MEMORY_VALUE)
# movabs rax, qword ptr [0x1000]
self.Triton.processing(Instruction(b"\x48\xa1\x00\x10\x00\x00\x00\x00\x00\x00"))
self.assertFalse(flag)
def test_1(self):
ctx = TritonContext()
ctx.setArchitecture(ARCH.X86_64)
ctx.setMode(MODE.ONLY_ON_TAINTED, False)
self.assertEqual(ctx.isModeEnabled(MODE.ONLY_ON_TAINTED), False)
inst = Instruction(b"\x48\x89\xc3") # mov rbx, rax
self.assertTrue(ctx.processing(inst))
self.assertTrue(checkAstIntegrity(inst))
self.assertEqual(len(inst.getReadRegisters()), 1)
self.assertEqual(len(inst.getWrittenRegisters()), 2)
ctx.setMode(MODE.ONLY_ON_TAINTED, True)
self.assertEqual(ctx.isModeEnabled(MODE.ONLY_ON_TAINTED), True)
self.assertTrue(ctx.processing(inst))
self.assertTrue(checkAstIntegrity(inst))
def setUp(self):
"""Define the arch and modes."""
self.Triton = TritonContext()
self.Triton.setArchitecture(ARCH.X86_64)
self.Triton.enableMode(MODE.ALIGNED_MEMORY, True)
self.Triton.enableMode(MODE.AST_OPTIMIZATIONS, True)
super(TestSymbolicEngineAlignedSymOpti, self).setUp()
def setUp(self):
"""Define the arch."""
self.Triton = TritonContext()
self.Triton.setArchitecture(ARCH.X86_64)
self.bv = self.Triton.registers.rax.getBitvector()
def test_2(self):
ctx = TritonContext()
ctx.setArchitecture(ARCH.X86_64)
self.assertEqual(ctx.isModeEnabled(MODE.ONLY_ON_TAINTED), False)
ctx.setMode(MODE.ONLY_ON_TAINTED, True)
self.assertEqual(ctx.isModeEnabled(MODE.ONLY_ON_TAINTED), True)
ctx.taintRegister(ctx.registers.rax)
inst = Instruction(b"\x48\x89\xc3") # mov rbx, rax
self.assertTrue(ctx.processing(inst))
self.assertTrue(checkAstIntegrity(inst))
self.assertEqual(len(inst.getReadRegisters()), 1)
self.assertEqual(len(inst.getWrittenRegisters()), 2)
self.assertEqual(len(inst.getLoadAccess()), 0)
self.assertEqual(len(inst.getStoreAccess()), 0)
print()
return
# This function initializes the context memory.
def initContext():
Triton.setConcreteRegisterValue(Triton.registers.rsp, 0x7fffffff)
Triton.setConcreteRegisterValue(Triton.registers.rbp, 0x99999999)
return
if __name__ == '__main__':
# Set the architecture
Triton.setArchitecture(ARCH.X86_64)
# Symbolic optimization
Triton.setMode(MODE.ALIGNED_MEMORY, True)
# Define entry point
ENTRY = 0x40056d
# Init context memory
initContext()
# Emulate
run(ENTRY)
sys.exit(0)
c2 = node.getChildren()[1]
if c1.getType() == AST_NODE.BVAND and c2.getType() == AST_NODE.BVAND:
c1_not = getNot(c1)
c2_not = getNot(c2)
c1_nonNot = getNonNot(c1)
c2_nonNot = getNonNot(c2)
if c1_not.equalTo(~c2_nonNot) and c2_not.equalTo(~c1_nonNot):
return c1_nonNot ^ c2_nonNot
return node
if __name__ == "__main__":
# Set arch to init engines
Triton.setArchitecture(ARCH.X86_64)
# Record simplifications
Triton.addCallback(xor_1, CALLBACK.SYMBOLIC_SIMPLIFICATION)
Triton.addCallback(xor_2, CALLBACK.SYMBOLIC_SIMPLIFICATION)
astCtxt = Triton.getAstContext()
a = astCtxt.bv(1, 8)
b = astCtxt.bv(2, 8)
# Example 1
c = a ^ a
print 'Expr: ', c
c = Triton.simplify(c)
print 'Simp: ', c
arch = self.r2p.arch
bits = self.r2p.bits
self.arch = tritonarch[arch][bits]
self.trace = collections.Counter()
triton.setArchitecture(self.arch)
triton.setAstRepresentationMode(triton.AST_REPRESENTATION.PYTHON)
# Hack in order to be able to get triton register ids by name
for r in triton.getAllRegisters():
self.triton_regs[r.getName()] = r
if self.arch == triton.ARCH.X86:
self.pcreg = triton.REG.EIP
elif self.arch == triton.ARCH.X86_64:
self.pcreg = triton.REG.RIP
else:
raise(ValueError("Architecture not implemented"))
setattr(self.memoryCaching, "memsolver", self.r2p)
if s in regs:
v = regs[s]
elif s in flags:
v = flags[s]
elif s in self.exports:
v = self.exports[s]
elif s.startswith("0x"):
v = int(s, 16)
else:
v = int(s)
return v
tritonarch = {
"x86": {
32: triton.ARCH.X86,
64: triton.ARCH.X86_64
}
}
class Pimp(object):
CMD_HANDLED = 1
CMD_NOT_HANDLED = 0
def __init__(self, context=None):
self.r2p = None
self.comments = {}
self.arch = None
self.inputs = collections.OrderedDict()
self.regs = {}
self.triton_regs = {}
self.commands = {}
self.last_symjump = None
self.input_type = None
def symbolizeInputs(seed):
# Clean symbolic state
Triton.concretizeAllRegister()
Triton.concretizeAllMemory()
for address, value in list(seed.items()):
Triton.setConcreteMemoryValue(address, value)
Triton.convertMemoryToSymbolicVariable(MemoryAccess(address, CPUSIZE.BYTE))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(address+1, CPUSIZE.BYTE))
return
if __name__ == '__main__':
# Set the architecture
Triton.setArchitecture(ARCH.X86_64)
# Symbolic optimization
Triton.enableMode(MODE.ALIGNED_MEMORY, True)
# Define entry point
ENTRY = 0x40056d
# We start the execution with a random value located at 0x1000.
lastInput = list()
worklist = list([{0x1000:1}])
while worklist:
# Take the first seed
seed = worklist[0]
print('Seed injected:', seed)