Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def test_build_register(self):
"""Check symbolic register has correct size and location."""
expr1 = self.Triton.newSymbolicExpression(self.astCtxt.bv(0x1122334455667788, CPUSIZE.QWORD_BIT))
self.Triton.assignSymbolicExpressionToRegister(expr1, self.Triton.registers.rax)
node = self.Triton.getRegisterAst(self.Triton.registers.rax)
self.assertEqual(node.evaluate(), 0x1122334455667788)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.QWORD_BIT)
node = self.Triton.getRegisterAst(self.Triton.registers.eax)
self.assertEqual(node.evaluate(), 0x55667788)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.DWORD_BIT)
node = self.Triton.getRegisterAst(self.Triton.registers.ax)
self.assertEqual(node.evaluate(), 0x7788)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.WORD_BIT)
node = self.Triton.getRegisterAst(self.Triton.registers.ah)
self.assertEqual(node.evaluate(), 0x77)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.BYTE_BIT)
node = self.Triton.getRegisterAst(self.Triton.registers.al)
self.assertEqual(node.evaluate(), 0x88)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.BYTE_BIT)
def test_bind_expr_to_multi_memory(self):
"""Check symbolic expression binded to multiple memory location."""
# Bind expr to multi memory location (0x100, 0x101, 0x102, 0x103)
expr1 = self.Triton.newSymbolicExpression(self.astCtxt.bv(0x11223344, 32))
mem = MemoryAccess(0x100, CPUSIZE.DWORD)
self.Triton.assignSymbolicExpressionToMemory(expr1, mem)
# Check we can get back the same values
expr2 = self.Triton.getSymbolicMemory(0x100)
expr3 = self.Triton.getSymbolicMemory(0x101)
expr4 = self.Triton.getSymbolicMemory(0x102)
expr5 = self.Triton.getSymbolicMemory(0x103)
self.assertEqual(expr2.getAst().evaluate(), 0x44)
self.assertEqual(expr3.getAst().evaluate(), 0x33)
self.assertEqual(expr4.getAst().evaluate(), 0x22)
self.assertEqual(expr5.getAst().evaluate(), 0x11)
self.assertEqual(self.Triton.getSymbolicMemoryValue(mem), 0x11223344)
def test_build_register(self):
"""Check symbolic register has correct size and location."""
expr1 = self.Triton.newSymbolicExpression(self.astCtxt.bv(0x1122334455667788, CPUSIZE.QWORD_BIT))
self.Triton.assignSymbolicExpressionToRegister(expr1, self.Triton.registers.rax)
node = self.Triton.getRegisterAst(self.Triton.registers.rax)
self.assertEqual(node.evaluate(), 0x1122334455667788)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.QWORD_BIT)
node = self.Triton.getRegisterAst(self.Triton.registers.eax)
self.assertEqual(node.evaluate(), 0x55667788)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.DWORD_BIT)
node = self.Triton.getRegisterAst(self.Triton.registers.ax)
self.assertEqual(node.evaluate(), 0x7788)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.WORD_BIT)
node = self.Triton.getRegisterAst(self.Triton.registers.ah)
self.assertEqual(node.evaluate(), 0x77)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.BYTE_BIT)
node = self.Triton.getRegisterAst(self.Triton.registers.al)
self.assertEqual(node.evaluate(), 0x88)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.BYTE_BIT)
Triton.setConcreteMemoryValue(MemoryAccess(user_input+28, CPUSIZE.DWORD), variables[0x07])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+32, CPUSIZE.DWORD), variables[0x08])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+36, CPUSIZE.DWORD), variables[0x09])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+40, CPUSIZE.DWORD), variables[0x0a])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+44, CPUSIZE.DWORD), variables[0x0b])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+48, CPUSIZE.DWORD), variables[0x0c])
# Create symbolic variables.
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+0, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+4, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+8, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+12, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+16, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+20, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+24, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+28, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+32, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+36, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+40, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+44, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+48, CPUSIZE.DWORD))
return
def hookingHandler():
pc = Triton.getConcreteRegisterValue(Triton.registers.rip)
for rel in customRelocation:
if rel[2] == pc:
# Emulate the routine and the return value
ret_value = rel[1]()
Triton.setConcreteRegisterValue(Triton.registers.rax, ret_value)
# Get the return address
ret_addr = Triton.getConcreteMemoryValue(MemoryAccess(Triton.getConcreteRegisterValue(Triton.registers.rsp), CPUSIZE.QWORD))
# Hijack RIP to skip the call
Triton.setConcreteRegisterValue(Triton.registers.rip, ret_addr)
# Restore RSP (simulate the ret)
Triton.setConcreteRegisterValue(Triton.registers.rsp, Triton.getConcreteRegisterValue(Triton.registers.rsp)+CPUSIZE.QWORD)
return
# RAX must be equal to 0xad6d to win
if instruction.getAddress() == 0x4005ce:
print('[+] Please wait, computing in progress...')
rax = Triton.getSymbolicRegister(Triton.registers.rax)
SymVar_0 = Triton.getSymbolicVariableFromName('SymVar_0')
SymVar_1 = Triton.getSymbolicVariableFromName('SymVar_1')
SymVar_2 = Triton.getSymbolicVariableFromName('SymVar_2')
SymVar_3 = Triton.getSymbolicVariableFromName('SymVar_3')
SymVar_4 = Triton.getSymbolicVariableFromName('SymVar_4')
astCtxt = Triton.getAstContext()
# We want printable characters
expr = astCtxt.land([
astCtxt.bvugt(astCtxt.variable(SymVar_0), astCtxt.bv(96, CPUSIZE.QWORD_BIT)),
astCtxt.bvult(astCtxt.variable(SymVar_0), astCtxt.bv(123, CPUSIZE.QWORD_BIT)),
astCtxt.bvugt(astCtxt.variable(SymVar_1), astCtxt.bv(96, CPUSIZE.QWORD_BIT)),
astCtxt.bvult(astCtxt.variable(SymVar_1), astCtxt.bv(123, CPUSIZE.QWORD_BIT)),
astCtxt.bvugt(astCtxt.variable(SymVar_2), astCtxt.bv(96, CPUSIZE.QWORD_BIT)),
astCtxt.bvult(astCtxt.variable(SymVar_2), astCtxt.bv(123, CPUSIZE.QWORD_BIT)),
astCtxt.bvugt(astCtxt.variable(SymVar_3), astCtxt.bv(96, CPUSIZE.QWORD_BIT)),
astCtxt.bvult(astCtxt.variable(SymVar_3), astCtxt.bv(123, CPUSIZE.QWORD_BIT)),
astCtxt.bvugt(astCtxt.variable(SymVar_4), astCtxt.bv(96, CPUSIZE.QWORD_BIT)),
astCtxt.bvult(astCtxt.variable(SymVar_4), astCtxt.bv(123, CPUSIZE.QWORD_BIT)),
astCtxt.equal(rax.getAst(), astCtxt.bv(0xad6d, CPUSIZE.QWORD_BIT)) # collision: (assert (= rax 0xad6d)
])
# Get max 20 different models
models = Triton.getModels(expr, 20)
for model in models:
print({k: "0x%x, '%c'" % (v.getValue(), v.getValue()) for k, v in list(model.items())})