angr 9.2.103__py3-none-macosx_11_0_arm64.whl

angr/engines/soot/expressions/constants.py

@@ -0,0 +1,45 @@
+from archinfo.arch_soot import SootClassDescriptor, SootNullConstant
+from claripy import FSORT_DOUBLE, FSORT_FLOAT
+
+from ..values import SimSootValue_StringRef
+from .base import SimSootExpr
+
+
+class SimSootExpr_IntConstant(SimSootExpr):
+    def _execute(self):
+        self.expr = self.state.solver.BVV(self.expr.value, 32)
+
+
+class SimSootExpr_LongConstant(SimSootExpr):
+    def _execute(self):
+        self.expr = self.state.solver.BVV(self.expr.value, 64)
+
+
+class SimSootExpr_FloatConstant(SimSootExpr):
+    def _execute(self):
+        self.expr = self.state.solver.FPV(self.expr.value, FSORT_FLOAT)
+
+
+class SimSootExpr_DoubleConstant(SimSootExpr):
+    def _execute(self):
+        self.expr = self.state.solver.FPV(self.expr.value, FSORT_DOUBLE)
+
+
+class SimSootExpr_StringConstant(SimSootExpr):
+    def _execute(self):
+        # strip away quotes introduced by soot
+        str_val = self.state.solver.StringV(self.expr.value.strip('"'))
+        str_ref = SimSootValue_StringRef(self.state.memory.get_new_uuid())
+        self.state.memory.store(str_ref, str_val)
+        self.expr = str_ref
+
+
+class SimSootExpr_ClassConstant(SimSootExpr):
+    def _execute(self):
+        class_name = self.expr.value[8:-2].replace("/", ".")
+        self.expr = SootClassDescriptor(class_name)
+
+
+class SimSootExpr_NullConstant(SimSootExpr):
+    def _execute(self):
+        self.expr = SootNullConstant()

angr/engines/soot/expressions/instanceOf.py

@@ -0,0 +1,11 @@
+import logging
+
+from .base import SimSootExpr
+
+l = logging.getLogger(name=__name__)
+
+
+class SimSootExpr_InstanceOf(SimSootExpr):
+    def _execute(self):
+        obj = self._translate_value(self.expr.value)
+        self.expr = self.state.solver.StringV(obj.type) == self.state.solver.StringV(self.expr.check_type)

angr/engines/soot/expressions/instancefieldref.py

@@ -0,0 +1,7 @@
+from .base import SimSootExpr
+
+
+class SimSootExpr_InstanceFieldRef(SimSootExpr):
+    def _execute(self):
+        field_ref = self._translate_value(self.expr)
+        self.expr = self.state.memory.load(field_ref, none_if_missing=True)

angr/engines/soot/expressions/invoke.py

@@ -0,0 +1,117 @@
+from archinfo.arch_soot import SootArgument, SootMethodDescriptor
+
+from . import translate_expr
+from ..method_dispatcher import resolve_method
+from ..exceptions import SootMethodNotLoadedException
+from .base import SimSootExpr
+
+
+class InvokeBase(SimSootExpr):
+    def __init__(self, expr, state):
+        super().__init__(expr, state)
+        self.method = None
+        self.args = None
+
+    def _execute(self):
+        # the invoke target gets resolved differently based on the invoke type
+        # => static vs. virtual vs. special (= non-virtual)
+        self.method = self._resolve_invoke_target(self.expr, self.state)
+        # translate arguments
+        self.args = self._translate_args()
+
+    def _translate_args(self):
+        args = []
+        # for instance method calls, add the 'this' reference
+        if isinstance(self, SimSootExpr_VirtualInvoke) or isinstance(self, SimSootExpr_SpecialInvoke):
+            this_ref_base = self._translate_value(self.expr.base)
+            this_ref = self.state.memory.load(this_ref_base, none_if_missing=True)
+            this_ref_type = this_ref.type if this_ref is not None else None
+            args += [SootArgument(this_ref, this_ref_type, is_this_ref=True)]
+
+        # translate function arguments
+        for arg in self.expr.args:
+            if "Constant" in arg.__class__.__name__:
+                # argument is a constant
+                # => translate the expr to get the value
+                arg_value = self._translate_expr(arg).expr
+            else:
+                # argument is a variable
+                # => load value from memory
+                arg_value = self.state.memory.load(self._translate_value(arg), none_if_missing=True)
+            args += [SootArgument(arg_value, arg.type)]
+
+        return args
+
+    def _resolve_invoke_target(self, expr, state):
+        raise NotImplementedError()
+
+
+class SimSootExpr_VirtualInvoke(InvokeBase):
+    """
+    Instance methods are dynamically resolved by the actual type of the
+    base object (i.e. the object on which the method is invoked) and *not*
+    by the type of the variable storing the reference.
+    """
+
+    def _resolve_invoke_target(self, expr, state):
+        # get the type of the base object
+        base = translate_expr(self.expr.base, self.state).expr
+        if base is not None:
+            base_type = base.type
+        else:
+            # the base is not set, for example if we process an invocation of an
+            # unloaded library function
+            # => fallback: use the statically retrieved type
+            base_type = self.expr.class_name
+
+        # based on the class of the base object, we resolve the invoke target
+        try:
+            return resolve_method(
+                state=self.state,
+                method_name=self.expr.method_name,
+                class_name=base_type,
+                params=self.expr.method_params,
+                ret_type=self.expr.type,
+                raise_exception_if_not_found=True,
+            )
+        except SootMethodNotLoadedException:
+            # in case that the method is not loaded, continue with the infos
+            # available from the invoke expression
+            return SootMethodDescriptor(
+                self.expr.class_name, self.expr.method_name, self.expr.method_params, ret_type=self.expr.type
+            )
+
+
+class SimSootExpr_SpecialInvoke(InvokeBase):
+    """
+    Special invocations are used either for invoking instance methods of a
+    superclass or a constructor. Compared to virtual invokes, the class
+    containing the method is passed explicitly in the invoke expression
+    (@expr.class_name) rather than determined dynamically by the type of the
+    base objects.
+    """
+
+    def _resolve_invoke_target(self, expr, state):
+        return resolve_method(
+            state=self.state,
+            method_name=self.expr.method_name,
+            class_name=self.expr.class_name,
+            params=self.expr.method_params,
+            ret_type=self.expr.type,
+        )
+
+
+class SimSootExpr_StaticInvoke(InvokeBase):
+    def _resolve_invoke_target(self, expr, state):
+        return resolve_method(
+            state=self.state,
+            method_name=self.expr.method_name,
+            class_name=self.expr.class_name,
+            params=self.expr.method_params,
+            ret_type=self.expr.type,
+        )
+
+
+class SimSootExpr_InterfaceInvoke(SimSootExpr_VirtualInvoke):
+    def _resolve_invoke_target(self, expr, state):
+        return super()._resolve_invoke_target(expr, state)

angr/engines/soot/expressions/length.py

@@ -0,0 +1,7 @@
+from .base import SimSootExpr
+
+
+class SimSootExpr_Length(SimSootExpr):
+    def _execute(self):
+        operand = self._translate_expr(self.expr.value)
+        self.expr = operand.expr.size

angr/engines/soot/expressions/local.py

@@ -0,0 +1,7 @@
+from .base import SimSootExpr
+
+
+class SimSootExpr_Local(SimSootExpr):
+    def _execute(self):
+        local = self._translate_value(self.expr)
+        self.expr = self.state.memory.load(local, none_if_missing=True)

angr/engines/soot/expressions/new.py

@@ -0,0 +1,15 @@
+import logging
+
+from ..values import SimSootValue_ThisRef
+from .base import SimSootExpr
+
+l = logging.getLogger("angr.engines.soot.expressions.new")
+
+
+class SimSootExpr_New(SimSootExpr):
+    def _execute(self):
+        # get object class
+        obj_class = self.state.javavm_classloader.get_class(class_name=self.expr.type, init_class=True)
+        # return object reference
+        # => fields getting lazy initialized in the javavm memory
+        self.expr = SimSootValue_ThisRef(heap_alloc_id=self.state.memory.get_new_uuid(), type_=obj_class.name)

angr/engines/soot/expressions/newArray.py

@@ -0,0 +1,51 @@
+import logging
+
+from ..values import SimSootValue_ArrayBaseRef
+from .base import SimSootExpr
+
+l = logging.getLogger("angr.engines.soot.expressions.newarray")
+
+
+class SimSootExpr_NewArray(SimSootExpr):
+    def _execute(self):
+        element_type = self.expr.base_type
+        size = self._translate_expr(self.expr.size).expr
+        self.expr = self.new_array(self.state, element_type, size)
+
+    @staticmethod
+    def new_array(state, element_type, size):
+        """
+        Allocates a new array in memory and returns the reference to the base.
+        """
+        size_bounded = SimSootExpr_NewArray._bound_array_size(state, size)
+        # return the reference of the array base
+        # => elements getting lazy initialized in the javavm memory
+        return SimSootValue_ArrayBaseRef(
+            heap_alloc_id=state.javavm_memory.get_new_uuid(), element_type=element_type, size=size_bounded
+        )
+
+    @staticmethod
+    def _bound_array_size(state, array_size):
+        # check if array size can exceed MAX_ARRAY_SIZE
+        max_array_size = state.solver.BVV(state.javavm_memory.max_array_size, 32)
+        size_stays_below_maximum = state.solver.eval_upto(max_array_size.SGE(array_size), 2)
+
+        # overwrite size, if it *always* exceeds the maximum
+        if True not in size_stays_below_maximum:
+            l.warning(
+                "Array size %s always exceeds maximum size. It gets overwritten with the maximum %s.",
+                array_size,
+                max_array_size,
+            )
+            return max_array_size
+
+        # bound size, if it *can* exceeds the maximum
+        if True in size_stays_below_maximum and False in size_stays_below_maximum:
+            l.warning(
+                "Array size %s can exceed maximum size. It gets bounded with the maximum %s.",
+                array_size,
+                max_array_size,
+            )
+            state.solver.add(max_array_size.UGE(array_size))
+
+        return array_size

angr/engines/soot/expressions/newMultiArray.py

@@ -0,0 +1,84 @@
+import logging
+
+from .base import SimSootExpr
+from .newArray import SimSootExpr_NewArray
+from ..values import SimSootValue_ArrayBaseRef
+
+l = logging.getLogger("angr.engines.soot.expressions.newmultiarray")
+
+
+class SimSootExpr_NewMultiArray(SimSootExpr):
+    def _execute(self):
+        # TODO: move this fix to pysoot
+        # pysoot returns square brackets in the element type, which is inconsistent with respect to SimpleArray
+        element_type = self.expr.base_type[:-2]
+        sizes = [self._translate_expr(size).expr for size in self.expr.sizes]
+        size = sizes.pop(0)
+        self.expr = self.new_array(
+            self.state,
+            element_type,
+            size,
+            default_value_generator=lambda s: SimSootExpr_NewMultiArray._generate_inner_array(s, element_type, sizes),
+        )
+
+    @staticmethod
+    def new_array(state, element_type, size, default_value_generator=None):
+        """
+        Allocates a new multi array in memory and returns the reference to the base.
+        """
+        size_bounded = SimSootExpr_NewMultiArray._bound_multi_array_size(state, size)
+        # return the reference of the array base
+        # => elements getting lazy initialized in the javavm memory
+        return SimSootValue_ArrayBaseRef(
+            heap_alloc_id=state.javavm_memory.get_new_uuid(),
+            element_type=element_type,
+            size=size_bounded,
+            default_value_generator=default_value_generator,
+        )
+
+    @staticmethod
+    def _bound_multi_array_size(state, multi_array_size):
+        # check if array size can exceed MAX_ARRAY_SIZE
+        max_multi_array_size = state.solver.BVV(state.javavm_memory.max_array_size, 32)
+        size_stays_below_maximum = state.solver.eval_upto(max_multi_array_size.SGE(multi_array_size), 2)
+
+        # overwrite size, if it *always* exceeds the maximum
+        if True not in size_stays_below_maximum:
+            l.warning(
+                "Array size %s always exceeds maximum size. It gets overwritten with the maximum %s.",
+                multi_array_size,
+                max_multi_array_size,
+            )
+            return max_multi_array_size
+
+        # bound size, if it *can* exceeds the maximum
+        if True in size_stays_below_maximum and False in size_stays_below_maximum:
+            l.warning(
+                "Array size %s can exceed maximum size. It gets bounded with the maximum %s.",
+                multi_array_size,
+                max_multi_array_size,
+            )
+            state.solver.add(max_multi_array_size.UGE(multi_array_size))
+
+        return multi_array_size
+
+    @staticmethod
+    def _generate_inner_array(state, element_type, inner_sizes):
+        # create a copy of the list
+        inner_sizes = list(inner_sizes)
+        size = inner_sizes.pop(0)
+        element_type = element_type[:-2]
+
+        if inner_sizes:
+            # there are other inner sizes, we need to allocate a MultiArrayRef
+            return SimSootExpr_NewMultiArray.new_array(
+                state,
+                element_type,
+                size,
+                default_value_generator=lambda s: SimSootExpr_NewMultiArray._generate_inner_array(
+                    s, element_type, inner_sizes
+                ),
+            )
+        else:
+            # otherwise, we allocate a simple Array
+            return SimSootExpr_NewArray.new_array(state, element_type, size)

angr/engines/soot/expressions/paramref.py

@@ -0,0 +1,7 @@
+from .base import SimSootExpr
+
+
+class SimSootExpr_ParamRef(SimSootExpr):
+    def _execute(self):
+        paramref = self._translate_value(self.expr)
+        self.expr = self.state.memory.load(paramref, none_if_missing=True)

angr/engines/soot/expressions/phi.py

@@ -0,0 +1,29 @@
+import logging
+
+from .base import SimSootExpr
+
+l = logging.getLogger("angr.engines.soot.expressions.phi")
+
+
+class SimSootExpr_Phi(SimSootExpr):
+    def _execute(self):
+        # One value will be defined, based on the taken path
+        # We first try to take the value from the source block, otherwise we iterate to find a define value
+        # One case in which the value is NOT in the source block is when the source block is in native code
+        if hasattr(self.state.scratch.source, "block_idx"):
+            local_values = [
+                self._translate_value(v) for v, idx in self.expr.values if idx == self.state.scratch.source.block_idx
+            ]
+            if len(local_values) > 0:
+                # fastpath
+                local = local_values[0]
+                value = self.state.memory.load(local, none_if_missing=True)
+                self.expr = value
+                return
+
+        local_options = [self._translate_value(v) for v, idx in self.expr.values[::-1]]
+        for local in local_options:
+            value = self.state.memory.load(local, none_if_missing=True)
+            if value is not None:
+                self.expr = value
+                return

angr/engines/soot/expressions/staticfieldref.py

@@ -0,0 +1,7 @@
+from .base import SimSootExpr
+
+
+class SimSootExpr_StaticFieldRef(SimSootExpr):
+    def _execute(self):
+        field_ref = self._translate_value(self.expr)
+        self.expr = self.state.memory.load(field_ref, none_if_missing=True)

angr/engines/soot/expressions/thisref.py

@@ -0,0 +1,6 @@
+from .base import SimSootExpr
+
+
+class SimSootExpr_ThisRef(SimSootExpr):
+    def _execute(self):
+        self.expr = self._translate_value(self.expr)

angr/engines/soot/expressions/unsupported.py

@@ -0,0 +1,6 @@
+from .base import SimSootExpr
+
+
+class SimSootExpr_Unsupported(SimSootExpr):
+    def _execute(self):
+        pass

angr/engines/soot/field_dispatcher.py

@@ -0,0 +1,49 @@
+import logging
+
+from archinfo.arch_soot import SootFieldDescriptor
+
+from .exceptions import SootFieldNotLoadedException
+
+
+l = logging.getLogger("angr.engines.soot.field_dispatcher")
+
+
+def resolve_field(state, field_class, field_name, field_type, raise_exception_if_not_found=False):
+    # In Java, fields are not polymorphic and the class declaring the field is
+    # determined statically by the declaring variable. Also fields are uniquely
+    # defined by the tuple (field_name, field_type) and in particular *not* by
+    # its attributes (e.g. 'STATIC').
+    # => This both together implies that w e do not have to distinguish between
+    #    static and instance fields.
+
+    # fields can be defined in superclasses (and TODO: superinterfaces)
+    # => walk up in class hierarchy
+    class_hierarchy = state.javavm_classloader.get_class_hierarchy(field_class)
+    for class_ in class_hierarchy:
+        # check for every class, if it contains the field
+        if _class_contains_field(class_, field_name, field_type):
+            state.javavm_classloader.init_class(class_)
+            # if so, create the field_id and return a reference to it
+            field_id = SootFieldDescriptor(class_.name, field_name, field_type)
+            return field_id
+
+    # field could not be found
+    l.warning("Couldn't find field %s in classes %s.", field_name, class_hierarchy)
+    if raise_exception_if_not_found:
+        raise SootFieldNotLoadedException()
+    else:
+        return SootFieldDescriptor(field_class, field_name, field_type)
+
+
+def _class_contains_field(field_class, field_name, field_type):
+    # check if field is loaded in CLE
+    if not field_class.is_loaded:
+        return False
+    # check if a field with the given name exists
+    if field_name not in field_class.fields:
+        return False
+    field = field_class.fields[field_name]
+    # check type
+    if field[1] != field_type:
+        return False
+    return True

angr/engines/soot/method_dispatcher.py

@@ -0,0 +1,49 @@
+import logging
+
+from archinfo.arch_soot import SootMethodDescriptor
+
+from .exceptions import SootMethodNotLoadedException
+
+l = logging.getLogger("angr.engines.soot.method_dispatcher")
+
+
+def resolve_method(
+    state,
+    method_name,
+    class_name,
+    params=(),
+    ret_type=None,
+    include_superclasses=True,
+    init_class=True,
+    raise_exception_if_not_found=False,
+):
+    """
+    Resolves the method based on the given characteristics (name, class and
+    params) The method may be defined in one of the superclasses of the given
+    class (TODO: support interfaces).
+
+    :rtype: archinfo.arch_soot.SootMethodDescriptor
+    """
+    base_class = state.javavm_classloader.get_class(class_name)
+    if include_superclasses:
+        class_hierarchy = state.javavm_classloader.get_class_hierarchy(base_class)
+    else:
+        class_hierarchy = [base_class]
+    # walk up in class hierarchy, until method is found
+    for class_descriptor in class_hierarchy:
+        java_binary = state.project.loader.main_object
+        soot_method = java_binary.get_soot_method(method_name, class_descriptor.name, params, none_if_missing=True)
+        if soot_method is not None:
+            # init the class
+            if init_class:
+                state.javavm_classloader.init_class(class_descriptor)
+            return SootMethodDescriptor.from_soot_method(soot_method)
+
+    # method could not be found
+    # => we are executing code that is not loaded (typically library code)
+    # => fallback: continue with infos available from the invocation, so we
+    #              still can use SimProcedures
+    if raise_exception_if_not_found:
+        raise SootMethodNotLoadedException()
+    else:
+        return SootMethodDescriptor(class_name, method_name, params, ret_type=ret_type)

angr/engines/soot/statements/__init__.py

@@ -0,0 +1,30 @@
+import logging
+
+l = logging.getLogger("angr.engines.soot.statements")
+
+
+def translate_stmt(stmt, state):
+    stmt_name = stmt.__class__.__name__.split(".")[-1]
+    if stmt_name.endswith("Stmt"):
+        stmt_name = stmt_name[:-4]
+
+    stmt_cls_name = "SimSootStmt_%s" % stmt_name
+    if stmt_cls_name in globals():
+        stmt_class = globals()[stmt_cls_name]
+        s = stmt_class(stmt, state)
+        s.process()
+        return s
+
+    else:
+        l.warning("Unsupported Soot statement %s.", stmt_cls_name)
+        return None
+
+
+from .assign import SimSootStmt_Assign
+from .return_ import SimSootStmt_Return, SimSootStmt_ReturnVoid
+from .identity import SimSootStmt_Identity
+from .goto import SimSootStmt_Goto
+from .invoke import SimSootStmt_Invoke
+from .if_ import SimSootStmt_If
+from .switch import SimSootStmt_TableSwitch, SimSootStmt_LookupSwitch
+from .throw import SimSootStmt_Throw

angr/engines/soot/statements/assign.py

@@ -0,0 +1,29 @@
+import logging
+
+from ..expressions.invoke import InvokeBase
+from .base import SimSootStmt
+
+l = logging.getLogger("angr.engines.soot.statements.assign")
+
+
+class SimSootStmt_Assign(SimSootStmt):
+    def _execute(self):
+        dst = self._translate_value(self.stmt.left_op)
+        src_expr = self._translate_expr(self.stmt.right_op)
+        if isinstance(src_expr, InvokeBase):
+            # right hand side of the the assignment is an invocation
+            # => The assumption is that if the src_expr contains an invoke, it
+            #    is always just that invoke. In other words, the only possible
+            #    form of "invoke in assignment" is: reg = invoke.
+            #    This requirement *should* be enforced by the lifting to Soot IR.
+            # => We deal with the invoke assignment, by
+            #    1) saving the destination variable
+            #    2) executing the function
+            #    3) assign the return value to the destination variables
+            #       after the function returns
+            self._add_invoke_target(invoke_expr=src_expr, ret_var=dst)
+            # exit prematurely
+            return
+        src_val = src_expr.expr
+        l.debug("Assign %r := %r", dst, src_val)
+        self.state.memory.store(dst, src_val)

angr/engines/soot/statements/base.py

@@ -0,0 +1,80 @@
+import logging
+
+from archinfo.arch_soot import SootAddressDescriptor
+
+from ..exceptions import IncorrectLocationException
+from ..expressions import translate_expr
+from ..values import translate_value
+
+l = logging.getLogger("angr.engines.soot.statements.if")
+
+
+class SimSootStmt:
+    """
+    The base class of all Soot statements.
+    """
+
+    def __init__(self, stmt, state):
+        self.stmt = stmt
+        self.state = state
+
+        self.invoke_expr = None
+        self.jmp_targets_with_conditions = []
+
+    def process(self):
+        """
+        Process the statement and apply all effects on the state.
+        :return: None
+        """
+        self._execute()
+
+    def _execute(self):
+        raise NotImplementedError()
+
+    def _translate_expr(self, expr):
+        expr_ = translate_expr(expr, self.state)
+        return expr_
+
+    def _translate_value(self, value):
+        value_ = translate_value(value, self.state)
+        return value_
+
+    def _get_bb_addr_from_instr(self, instr):
+        """
+        Returns the address of the methods basic block that contains the given
+        instruction.
+
+        :param instr: The index of the instruction (within the current method).
+        :rtype: SootAddressDescriptor
+        """
+        current_method = self.state.addr.method
+        try:
+            bb = current_method.block_by_label[instr]
+        except KeyError:
+            l.error("Possible jump to a non-existing bb %s --> %d", self.state.addr, instr)
+            raise IncorrectLocationException()
+
+        return SootAddressDescriptor(current_method, bb.idx, 0)
+
+    #
+    # Jumps
+    #
+
+    def _add_jmp_target(self, target, condition):
+        self.jmp_targets_with_conditions += [(target, condition)]
+
+    @property
+    def has_jump_targets(self):
+        return self.jmp_targets_with_conditions != []
+
+    #
+    # Invocations
+    #
+
+    def _add_invoke_target(self, invoke_expr, ret_var=None):
+        self.invoke_expr = invoke_expr
+        self.invoke_expr.ret_var = ret_var
+
+    @property
+    def has_invoke_target(self):
+        return self.invoke_expr is not None

angr/engines/soot/statements/goto.py

@@ -0,0 +1,11 @@
+import logging
+
+from .base import SimSootStmt
+
+l = logging.getLogger("angr.engines.soot.statements.goto")
+
+
+class SimSootStmt_Goto(SimSootStmt):
+    def _execute(self):
+        jmp_target = self._get_bb_addr_from_instr(instr=self.stmt.target)
+        self._add_jmp_target(target=jmp_target, condition=self.state.solver.true)