angr 9.2.103__py3-none-macosx_11_0_arm64.whl

angr/procedures/glibc/__libc_start_main.py

@@ -0,0 +1,294 @@
+import logging
+
+from cle import AT
+
+import angr
+
+l = logging.getLogger(name=__name__)
+
+
+class __libc_start_main(angr.SimProcedure):
+    # pylint:disable=arguments-differ,unused-argument,attribute-defined-outside-init,missing-class-docstring
+
+    ADDS_EXITS = True
+    NO_RET = True
+    local_vars = ("main", "argc", "argv", "init", "fini", "initializers")
+
+    def _initialize_b_loc_table(self):
+        """
+        Initialize ptable for ctype
+
+        See __ctype_b_loc.c in libc implementation
+        """
+        malloc = angr.SIM_PROCEDURES["libc"]["malloc"]
+        table = self.inline_call(malloc, 768).ret_expr
+        table_ptr = self.inline_call(malloc, self.state.arch.bytes).ret_expr
+
+        for pos, c in enumerate(self.state.libc.LOCALE_ARRAY):
+            # Each entry is 2 bytes
+            self.state.memory.store(
+                table + (pos * 2),
+                self.state.solver.BVV(c, 16),
+                inspect=False,
+                disable_actions=True,
+            )
+        # Offset for negative chars
+        # 256 because 2 bytes each, -128 * 2
+        table += 256
+        self.state.memory.store(
+            table_ptr,
+            table,
+            size=self.state.arch.bytes,
+            endness=self.state.arch.memory_endness,
+            inspect=False,
+            disable_actions=True,
+        )
+
+        self.state.libc.ctype_b_loc_table_ptr = table_ptr
+
+    def _initialize_tolower_loc_table(self):
+        """
+        Initialize ptable for ctype
+
+        See __ctype_tolower_loc.c in libc implementation
+        """
+        malloc = angr.SIM_PROCEDURES["libc"]["malloc"]
+        # 384 entries, 4 bytes each
+        table = self.inline_call(malloc, 384 * 4).ret_expr
+        table_ptr = self.inline_call(malloc, self.state.arch.bytes).ret_expr
+
+        for pos, c in enumerate(self.state.libc.TOLOWER_LOC_ARRAY):
+            self.state.memory.store(
+                table + (pos * 4),
+                self.state.solver.BVV(c, 32),
+                endness=self.state.arch.memory_endness,
+                inspect=False,
+                disable_actions=True,
+            )
+
+        # Offset for negative chars: -128 index (4 bytes per index)
+        table += 128 * 4
+        self.state.memory.store(
+            table_ptr,
+            table,
+            size=self.state.arch.bytes,
+            endness=self.state.arch.memory_endness,
+            inspect=False,
+            disable_actions=True,
+        )
+
+        self.state.libc.ctype_tolower_loc_table_ptr = table_ptr
+
+    def _initialize_toupper_loc_table(self):
+        """
+        Initialize ptable for ctype
+
+        See __ctype_toupper_loc.c in libc implementation
+        """
+        malloc = angr.SIM_PROCEDURES["libc"]["malloc"]
+        # 384 entries, 4 bytes each
+        table = self.inline_call(malloc, 384 * 4).ret_expr
+        table_ptr = self.inline_call(malloc, self.state.arch.bytes).ret_expr
+
+        for pos, c in enumerate(self.state.libc.TOUPPER_LOC_ARRAY):
+            self.state.memory.store(
+                table + (pos * 4),
+                self.state.solver.BVV(c, 32),
+                endness=self.state.arch.memory_endness,
+                inspect=False,
+                disable_actions=True,
+            )
+
+        # Offset for negative chars: -128 index (4 bytes per index)
+        table += 128 * 4
+        self.state.memory.store(
+            table_ptr,
+            table,
+            size=self.state.arch.bytes,
+            endness=self.state.arch.memory_endness,
+            inspect=False,
+            disable_actions=True,
+        )
+
+        self.state.libc.ctype_toupper_loc_table_ptr = table_ptr
+
+    def _initialize_ctype_table(self):
+        self._initialize_b_loc_table()
+        self._initialize_tolower_loc_table()
+        self._initialize_toupper_loc_table()
+
+    def _initialize_errno(self):
+        malloc = angr.SIM_PROCEDURES["libc"]["malloc"]
+        errno_loc = self.inline_call(malloc, self.state.arch.bytes).ret_expr
+
+        self.state.libc.errno_location = errno_loc
+        self.state.memory.store(errno_loc, self.state.solver.BVV(0, self.state.arch.bits))
+
+    @property
+    def envp(self):
+        return self.argv + (self.argc + 1) * self.state.arch.bytes
+
+    def run(self, main, argc, argv, init, fini):
+        # TODO: handle symbolic and static modes
+
+        self._initialize_ctype_table()
+        self._initialize_errno()
+
+        self.main, self.argc, self.argv, self.init, self.fini = self._extract_args(
+            self.state, main, argc, argv, init, fini
+        )
+
+        # TODO: __cxa_atexit calls for various at-exit needs
+
+        if not self.state.solver.is_true(self.init == 0):
+            self.initializers = None
+            self.call(
+                self.init,
+                (self.argc[31:0], self.argv, self.envp),
+                "after_init",
+                prototype="int main(int argc, char **argv, char **envp)",
+            )
+        else:
+            obj = self.project.loader.main_object
+            init_func = getattr(obj, "_init_func", None)
+            init_arr = getattr(obj, "_init_arr", None)
+            init_func = [init_func] if init_func else []
+            self.initializers = init_func + list(init_arr)
+            for i, x in enumerate(self.initializers):
+                self.initializers[i] = AT.from_lva(x, obj).to_mva()
+            self.inside_init(main, argc, argv, init, fini)
+
+    def inside_init(self, main, argc, argv, init, fini):
+        if len(self.initializers) == 0:
+            self.after_init(main, argc, argv, init, fini)
+        else:
+            addr = self.initializers.pop(0)
+            self.call(
+                addr,
+                (self.argc[31:0], self.argv, self.envp),
+                "inside_init",
+                prototype="int main(int argc, char **argv, char **envp)",
+            )
+
+    def after_init(self, main, argc, argv, init, fini, exit_addr=0):
+        self.call(
+            self.main,
+            (self.argc[31:0], self.argv, self.envp),
+            "after_main",
+            prototype="int main(int argc, char **argv, char **envp)",
+        )
+
+    def after_main(self, main, argc, argv, init, fini, exit_addr=0):
+        self.exit(0)
+
+    def static_exits(self, blocks, cfg=None, **kwargs):
+        # Execute those blocks with a blank state, and then dump the arguments
+        blank_state = angr.SimState(
+            project=self.project,
+            mode="fastpath",
+            cle_memory_backer=self.project.loader.memory,
+            add_options={
+                angr.options.SYMBOL_FILL_UNCONSTRAINED_MEMORY,
+                angr.options.SYMBOL_FILL_UNCONSTRAINED_REGISTERS,
+            },
+        )
+        # set up the stack pointer
+        blank_state.regs.sp = 0x7FFFFFF0
+
+        # special handling for x86 PIE GCC binaries
+        #
+        # 08049C70 xor     ebp, ebp
+        # 08049C72 pop     esi
+        # 08049C73 mov     ecx, esp
+        # 08049C75 and     esp, 0FFFFFFF0h
+        # 08049C78 push    eax
+        # 08049C79 push    esp             ; stack_end
+        # 08049C7A push    edx             ; rtld_fini
+        # 08049C7B call    sub_8049CA3      // this is the get_pc function
+        #  // first block starts here
+        # 08049C80 add     ebx, (offset off_806B000 - $)
+        # 08049C86 lea     eax, (nullsub_2 - 806B000h)[ebx]
+        # 08049C8C push    eax             ; fini
+        # 08049C8D lea     eax, (sub_805F530 - 806B000h)[ebx]
+        # 08049C93 push    eax             ; init
+        # 08049C94 push    ecx             ; ubp_av
+        # 08049C95 push    esi             ; argc
+        # 08049C96 mov     eax, offset main
+        # 08049C9C push    eax             ; main
+        # 08049C9D call    ___libc_start_main
+        if cfg is not None and self.arch.name == "X86":
+            first_block = blocks[0]
+            first_node = cfg.model.get_any_node(first_block.addr)
+            if first_node is not None:
+                caller_nodes = cfg.model.get_predecessors(first_node, excluding_fakeret=False)
+                if len(caller_nodes) == 1:
+                    caller_node = caller_nodes[0]
+                    succ_and_jks = caller_node.successors_and_jumpkinds()
+                    if len(succ_and_jks) == 1 and succ_and_jks[0][1] == "Ijk_Call":
+                        # get_pc
+                        getpc_func = cfg.functions.get_by_addr(succ_and_jks[0][0].addr)
+                        if getpc_func is not None and "get_pc" in getpc_func.info:
+                            # GCC-generated x86-pie binary confirmed.
+                            # initialize the specified register with the block address
+                            get_pc_reg = getpc_func.info["get_pc"]
+                            setattr(blank_state.regs, "_" + get_pc_reg, first_block.addr)
+
+        # Execute each block
+        state = blank_state
+        for b in blocks:
+            irsb = self.project.factory.default_engine.process(state, irsb=b, force_addr=b.addr)
+            if irsb.successors:
+                state = irsb.successors[0]
+            else:
+                break
+
+        cc = angr.default_cc(
+            self.arch.name, platform=self.project.simos.name if self.project.simos is not None else None
+        )(self.arch)
+        ty = angr.sim_type.parse_signature("void x(void*, void*, void*, void*, void*)").with_arch(self.arch)
+        args = cc.get_args(state, ty)
+        main, _, _, init, fini = self._extract_args(blank_state, *args)
+
+        all_exits = [
+            {"address": init, "jumpkind": "Ijk_Call", "namehint": "init"},
+            {"address": main, "jumpkind": "Ijk_Call", "namehint": "main"},
+            {"address": fini, "jumpkind": "Ijk_Call", "namehint": "fini"},
+        ]
+
+        return all_exits
+
+    @staticmethod
+    def _extract_args(state, main, argc, argv, init, fini):
+        """
+        Extract arguments and set them to
+
+        :param angr.sim_state.SimState state: The program state.
+        :param main: An argument to __libc_start_main.
+        :param argc: An argument to __libc_start_main.
+        :param argv: An argument to __libc_start_main.
+        :param init: An argument to __libc_start_main.
+        :param fini: An argument to __libc_start_main.
+        :return: A tuple of five elements: (main, argc, argv, init, fini)
+        :rtype: tuple
+        """
+
+        main_ = main
+        argc_ = argc
+        argv_ = argv
+        init_ = init
+        fini_ = fini
+
+        if state.arch.name == "PPC32":
+            # for some dumb reason, PPC passes arguments to libc_start_main in some completely absurd way
+            argv_ = argc_
+            argc_ = main_
+            main_ = state.mem[state.regs.r8 + 4 :].int.resolved
+            init_ = state.mem[state.regs.r8 + 8 :].int.resolved
+            fini_ = state.mem[state.regs.r8 + 12 :].int.resolved
+
+        elif state.arch.name == "PPC64":
+            main_ = state.mem[state.regs.r8 + 8 :].long.resolved
+            init_ = state.mem[state.regs.r8 + 16 :].long.resolved
+            fini_ = state.mem[state.regs.r8 + 24 :].long.resolved
+
+        return main_, argc_, argv_, init_, fini_

angr/procedures/glibc/dynamic_loading.py

@@ -0,0 +1,19 @@
+import angr
+
+# pylint: disable=unused-argument,arguments-differ
+
+
+class _dl_vdso_vsym(angr.SimProcedure):
+    def run(self, name, vers):
+        return 0
+        # namestr = self.state.mem[name].string.concrete
+        # if namestr.startswith('_vdso_'):
+        #    realname = namestr[6:]
+        #    lib = angr.SIM_LIBRARIES['linux_kernel']
+        # else:
+        #    raise angr.SimProcedureError('_dl_vdso_vsym(%r): unsupported' % namestr)
+
+        # addr = self.project.loader.extern_object.get_pseudo_addr(realname)
+        # if not self.project.is_hooked(addr):
+        #    self.project.hook(addr, lib.get(realname, self.arch))
+        # return addr

angr/procedures/glibc/scanf.py

@@ -0,0 +1,10 @@
+from ..libc.scanf import scanf
+from ..libc.fscanf import fscanf
+
+
+class __isoc99_scanf(scanf):
+    pass
+
+
+class __isoc99_fscanf(fscanf):
+    pass

angr/procedures/glibc/sscanf.py

@@ -0,0 +1,5 @@
+from ..libc.sscanf import sscanf
+
+
+class __isoc99_sscanf(sscanf):
+    pass

angr/procedures/gnulib/__init__.py

@@ -0,0 +1,3 @@
+"""
+These procedures implement functions described in the gnulib library: https://www.gnu.org/software/gnulib/
+"""

angr/procedures/gnulib/xalloc_die.py

@@ -0,0 +1,13 @@
+import angr
+
+
+class xalloc_die(angr.SimProcedure):
+    """
+    xalloc_die
+    """
+
+    NO_RET = True
+
+    # pylint: disable=arguments-differ
+    def run(self):
+        self.exit(1)

angr/procedures/gnulib/xstrtol_fatal.py

@@ -0,0 +1,13 @@
+import angr
+
+
+class xstrtol_fatal(angr.SimProcedure):
+    """
+    xstrtol_fatal
+    """
+
+    NO_RET = True
+
+    # pylint: disable=unused-argument,arguments-differ
+    def run(self, err, opt_idx, c, long_options, arg):
+        self.exit(1)

angr/procedures/java/__init__.py

@@ -0,0 +1,38 @@
+import itertools
+
+from ...sim_procedure import SimProcedure
+from ...engines.soot.values import SimSootValue_Local, SimSootValue_ParamRef, translate_value
+from ...engines.soot.expressions import translate_expr
+
+
+class JavaSimProcedure(SimProcedure):
+    @property
+    def is_java(self):
+        return True
+
+    @property
+    def _engine(self):
+        return self.project.factory.default_engine  # FIXME: Currently we assume that it must be a SootMixin
+
+    def _setup_args(self, inst, state, _):
+        sim_args = []
+        # try to get 'this' reference
+        try:
+            this_ref = state.javavm_memory.load(addr=SimSootValue_Local("this", None))
+            sim_args += [this_ref]
+        except KeyError:
+            pass
+        # fetch all function arguments from memory
+        for idx in itertools.count():
+            try:
+                param = state.javavm_memory.load(addr=SimSootValue_ParamRef(idx, None))
+            except KeyError:
+                break
+            sim_args += [param]
+        return sim_args
+
+    def _compute_ret_addr(self, expr):
+        return self.state.callstack.ret_addr
+
+    def _prepare_ret_state(self):
+        self._engine.prepare_return_state(self.state, self.ret_expr)

angr/procedures/java/unconstrained.py

@@ -0,0 +1,64 @@
+import claripy
+
+from . import JavaSimProcedure
+from ...engines.soot.values import SimSootValue_ThisRef, SimSootValue_StringRef
+from ...engines.soot.expressions import SimSootExpr_NewArray
+from ... import sim_options as options
+
+
+class UnconstrainedMethod(JavaSimProcedure):
+    __provides__ = (("angr.unconstrained", "unconstrained()"),)
+
+    def run(self, thing, *args):
+        this_ref = thing if isinstance(thing, SimSootValue_ThisRef) else None
+
+        if args:
+            method_descriptor = args[-1]
+            args = args[:-1]
+        else:
+            # if args is empty, method is static and has no params
+            method_descriptor = thing
+
+        # return the appropriate value based on the return type of the method
+        if method_descriptor is None or method_descriptor.ret is None or method_descriptor.ret == "void":
+            ret_value = None
+        elif method_descriptor.ret in ["byte", "char", "short", "int", "boolean"]:
+            ret_value = claripy.BVS(f"unc_{method_descriptor.ret}_{method_descriptor.name}", 32)
+        elif method_descriptor.ret == "long":
+            ret_value = claripy.BVS(f"unc_long_{method_descriptor.name}", 64)
+        elif method_descriptor.ret == "float":
+            ret_value = claripy.FPS(f"unc_float_{method_descriptor.name}", claripy.FSORT_FLOAT)
+        elif method_descriptor.ret == "double":
+            ret_value = claripy.FPS(f"unc_double_{method_descriptor.name}", claripy.FSORT_DOUBLE)
+        elif method_descriptor.ret == "java.lang.String":
+            str_ref = SimSootValue_StringRef.new_string(
+                self.state, claripy.StringS(f"unc_string_{method_descriptor.name}", 1000)
+            )
+            ret_value = str_ref
+        elif method_descriptor.ret.endswith("[][]"):
+            raise NotImplementedError
+        elif method_descriptor.ret.endswith("[]"):
+            # TODO here array size should be symbolic
+            ret_value = SimSootExpr_NewArray.new_array(self.state, method_descriptor.ret[:-2], claripy.BVV(2, 32))
+        else:
+            ret_value = SimSootValue_ThisRef.new_object(
+                self.state, method_descriptor.ret, symbolic=True, init_object=False
+            )
+
+        # Simple heuristic to infer if the unknown method we are trying to execute is a getter or a setter
+        # Must be improved. This would work only if the method follows the Java naming convention.
+        # If the application is obfuscated this won't work.
+        if this_ref is not None and options.JAVA_IDENTIFY_GETTER_SETTER in self.state.options:
+            if method_descriptor.name.startswith("get"):
+                field_name = method_descriptor.name.replace("get", "")
+                field_name = field_name[0].lower() + field_name[1:]
+                return this_ref.get_field(self.state, field_name, method_descriptor.ret)
+            # We define a setter as a method that starts with set
+            # and has only one parameter (other than 'this' reference)
+            elif method_descriptor.name.startswith("set") and len(method_descriptor.params) == 1 and len(args) == 1:
+                field_name = method_descriptor.name.replace("set", "")
+                field_name = field_name[0].lower() + field_name[1:]
+                this_ref.set_field(self.state, field_name, method_descriptor.params[0], args[0])
+                return
+
+        return ret_value

angr/procedures/java_io/read.py

@@ -0,0 +1,11 @@
+from ..java import JavaSimProcedure
+
+
+class Read(JavaSimProcedure):
+    # TODO consider the fd
+
+    __provides__ = (("java.io.InputStream", "read()"),)
+
+    def run(self, this, *args):  # pylint: disable=arguments-differ,unused-argument
+        data, _, _ = self.state.posix.stdin.read(None, 1)
+        return data.zero_extend(32 - 8)

angr/procedures/java_io/write.py

@@ -0,0 +1,16 @@
+from ..java import JavaSimProcedure
+
+
+class Write(JavaSimProcedure):
+    # TODO consider the fd
+
+    __provides__ = (("java.io.PrintStream", "write(int)"),)
+
+    def run(self, this, b, *args):  # pylint: disable=arguments-differ,unused-argument
+        # we do % 256 since this is what Java implementation does.
+        # formally what happens is %0x100 and then remove the 3 0-bytes
+        # this is outputted as 1 byte only
+        # I tested with: echo "a" | java -jar simple3.jar  > /tmp/o1.bin; xxd /tmp/o1.bin; 00000000: 62
+
+        v = (b % 256).get_byte(3)
+        self.state.posix.stdout.write(None, v)