angr 9.2.103__py3-none-macosx_11_0_arm64.whl

angr/procedures/posix/listen.py

@@ -0,0 +1,12 @@
+import angr
+
+import logging
+
+l = logging.getLogger(name=__name__)
+
+
+class listen(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, sockfd, backlog):  # pylint:disable=unused-argument
+        return self.state.solver.Unconstrained("listen", self.arch.sizeof["int"], key=("api", "listen"))

angr/procedures/posix/mmap.py

@@ -0,0 +1,140 @@
+import angr
+from ...storage.file import SimFileDescriptor
+
+import logging
+
+l = logging.getLogger(name=__name__)
+
+
+PROT_READ = 0x1  #    /* Page can be read.  */
+PROT_WRITE = 0x2  #    /* Page can be written.  */
+PROT_EXEC = 0x4  #    /* Page can be executed.  */
+PROT_NONE = 0x0  #    /* Page can not be accessed.  */
+MAP_SHARED = 0x01  #    /* Share changes.  */
+MAP_PRIVATE = 0x02  #    /* Changes are private.  */
+MAP_ANONYMOUS = 0x20  #    /* Don't use a file.  */
+MAP_FIXED = 0x10  #    /* Interpret addr exactly.  */
+
+
+class mmap(angr.SimProcedure):
+    def run(self, addr, length, prot, flags, fd, offset):  # pylint:disable=arguments-differ,unused-argument
+        # if self.state.solver.symbolic(flags) or self.state.solver.eval(flags) != 0x22:
+        #   raise Exception("mmap with other than MAP_PRIVATE|MAP_ANONYMOUS unsupported")
+        l.debug("mmap(%s, %s, %s, %s, %s, %s) = ...", addr, length, prot, flags, fd, offset)
+
+        #
+        # File descriptor sanity check
+        #
+        sim_fd = None
+        if self.state.solver.is_false(fd[31:0] == -1):
+            if self.state.solver.symbolic(fd):
+                raise angr.errors.SimPosixError("Can't map a symbolic file descriptor!!")
+            if self.state.solver.symbolic(offset):
+                raise angr.errors.SimPosixError("Can't map with a symbolic offset!!")
+            sim_fd = self.state.posix.get_fd(fd)
+            if sim_fd is None:
+                l.warning("Trying to map a non-exsitent fd")
+                return -1
+            if not isinstance(sim_fd, SimFileDescriptor) or sim_fd.file is None:
+                l.warning("Trying to map fd not supporting mmap (maybe a SimFileDescriptorDuplex?)")
+                return -1
+
+        #
+        # Length
+        #
+
+        if self.state.solver.symbolic(length):
+            size = self.state.solver.max_int(length)
+            if size > self.state.libc.max_variable_size:
+                l.warning(
+                    "mmap size requested of %d exceeds libc.max_variable_size. Using size %d instead.",
+                    size,
+                    self.state.libc.max_variable_size,
+                )
+                size = self.state.libc.max_variable_size
+        else:
+            size = self.state.solver.eval(length)
+
+        #
+        # Addr
+        #
+
+        # Not handling symbolic addr for now
+        addrs = self.state.solver.eval_upto(addr, 2)
+        if len(addrs) == 2:
+            err = "Cannot handle symbolic addr argument for mmap."
+            l.error(err)
+            raise angr.errors.SimPosixError(err)
+
+        addr = addrs[0]
+
+        # Call is asking for system to provide an address
+        if addr == 0:
+            addr = self.allocate_memory(size)
+
+        #
+        # Flags
+        #
+
+        # Only want concrete flags
+        flags = self.state.solver.eval_upto(flags, 2)
+
+        if len(flags) == 2:
+            err = "Cannot handle symbolic flags argument for mmap."
+            l.error(err)
+            raise angr.errors.SimPosixError(err)
+
+        flags = flags[0]
+
+        # Sanity check. All mmap must have exactly one of MAP_SHARED or MAP_PRIVATE
+        if (flags & MAP_SHARED and flags & MAP_PRIVATE) or flags & (MAP_SHARED | MAP_PRIVATE) == 0:
+            l.debug("... = -1 (bad flags)")
+            return self.state.solver.BVV(-1, self.state.arch.bits)
+
+        # Do region mapping
+        while True:
+            try:
+                self.state.memory.map_region(addr, size, prot[2:0], init_zero=bool(flags & MAP_ANONYMOUS))
+                l.debug("... = %#x", addr)
+                break
+
+            except angr.SimMemoryError:
+                # This page is already mapped
+
+                if flags & MAP_FIXED:
+                    l.debug("... = -1 (MAP_FIXED failure)")
+                    return self.state.solver.BVV(-1, self.state.arch.bits)
+
+                # Can't give you that address. Find a different one and loop back around to try again.
+                addr = self.allocate_memory(size)
+
+        # If the mapping comes with a file descriptor
+        if sim_fd:
+            if not sim_fd.file.seekable:
+                raise angr.errors.SimPosixError("Only support seekable SimFile at the moment.")
+
+            prot = self.state.solver.eval_exact(prot, 1)[0]
+
+            if prot & PROT_WRITE:
+                l.warning("Trying to map a file descriptor backed by a file")
+                l.warning("Updates to the mapping are not carried through to the underlying file")
+
+            # read data
+            saved_pos = sim_fd.tell()
+            sim_fd.seek(self.state.solver.eval(offset), whence="start")
+            data, _ = sim_fd.read_data(size)
+            sim_fd.seek(saved_pos, whence="start")
+            self.state.memory.store(addr, data)
+
+        return addr
+
+    def allocate_memory(self, size):
+        addr = self.state.heap.mmap_base
+        new_base = addr + size
+
+        if new_base & 0xFFF:
+            new_base = (new_base & ~0xFFF) + 0x1000
+
+        self.state.heap.mmap_base = new_base
+
+        return addr

angr/procedures/posix/open.py

@@ -0,0 +1,17 @@
+import angr
+
+
+class open(angr.SimProcedure):  # pylint:disable=W0622
+    # pylint:disable=arguments-differ,unused-argument
+
+    def run(self, p_addr, flags, mode):
+        strlen = angr.SIM_PROCEDURES["libc"]["strlen"]
+
+        p_strlen = self.inline_call(strlen, p_addr)
+        p_expr = self.state.memory.load(p_addr, p_strlen.max_null_index, endness="Iend_BE")
+        path = self.state.solver.eval(p_expr, cast_to=bytes)
+
+        fd = self.state.posix.open(path, flags)
+        if fd is None:
+            return -1
+        return fd

angr/procedures/posix/opendir.py

@@ -0,0 +1,9 @@
+import angr
+from .open import open
+
+
+class opendir(angr.SimProcedure):
+    def run(self, fname):
+        p_open = self.inline_call(open, fname, 0o200000, 0)  # O_DIRECTORY
+        # using the same hack we used to use for fopen etc... using the fd as a pointer
+        return p_open.ret_expr

angr/procedures/posix/poll.py

@@ -0,0 +1,54 @@
+import angr
+import select
+
+
+class poll(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, fds, nfds, timeout):  # pylint: disable=unused-argument
+        try:
+            nfds_v = self.state.solver.eval_one(nfds)
+        except angr.errors.SimSolverError as e:
+            raise angr.errors.SimProcedureArgumentError("Can't handle symbolic pollfd arguments") from e
+        ###
+        # struct pollfd {
+        #     int   fd;         /* file descriptor */
+        #     short events;     /* requested events */
+        #     short revents;    /* returned events */
+        # };
+        size_of_pollfd = 8
+        offset_fd = 0
+        offset_events = 4
+        offset_revents = 6
+
+        pollfd_array = []
+        for offset in range(0, nfds_v):
+            pollfd = {
+                "fd": self.state.memory.load(
+                    fds + offset * size_of_pollfd + offset_fd, 4, endness=self.arch.memory_endness
+                ),
+                "events": self.state.memory.load(
+                    fds + offset * size_of_pollfd + offset_events, 2, endness=self.arch.memory_endness
+                ),
+                "revents": self.state.memory.load(
+                    fds + offset * size_of_pollfd + offset_revents, 2, endness=self.arch.memory_endness
+                ),
+            }
+            pollfd_array.append(pollfd)
+        for offset, pollfd in enumerate(pollfd_array):
+            try:
+                fd = self.state.solver.eval_one(pollfd["fd"])
+                events = self.state.solver.eval_one(pollfd["events"])
+            except angr.errors.SimSolverError as e:
+                raise angr.errors.SimProcedureArgumentError("Can't handle symbolic pollfd arguments") from e
+
+            if events & select.POLLIN and fd >= 0:
+                revents = pollfd["revents"][self.arch.sizeof["short"] - 1 : 1].concat(
+                    self.state.solver.BVS("fd_POLLIN", 1)
+                )
+                self.state.memory.store(
+                    fds + offset * size_of_pollfd + offset_revents, revents, endness=self.arch.memory_endness
+                )
+
+        retval = self.state.solver.BVV(0, 1).concat(self.state.solver.BVS("poll_ret", self.state.arch.bits - 1))
+        return retval

angr/procedures/posix/pread64.py

@@ -0,0 +1,45 @@
+import angr
+
+import logging
+
+l = logging.getLogger(name=__name__)
+
+
+class pread64(angr.SimProcedure):
+    # pylint: disable=arguments-differ
+    def run(self, fd, buf, nbyte, offset):
+        SEEK_SET = 0  # Seek from beginning of file.
+        SEEK_CUR = 1  # Seek from current position.
+
+        read = angr.SIM_PROCEDURES["posix"]["read"]
+        lseek = angr.SIM_PROCEDURES["linux_kernel"]["lseek"]
+
+        if self.state.solver.symbolic(offset):
+            err = "Symbolic offset is not supported in pread"
+            l.error(err)
+            raise angr.errors.SimPosixError(err)
+
+        offset = self.state.solver.eval(offset)
+
+        old_offset = self.inline_call(lseek, fd, 0, SEEK_CUR).ret_expr
+        old_offset = self.state.solver.eval(old_offset)
+
+        if old_offset == -1:
+            return -1
+
+        lseek_ret = self.inline_call(lseek, fd, offset, SEEK_SET).ret_expr
+        lseek_ret = self.state.solver.eval(lseek_ret)
+
+        if lseek_ret == -1:
+            return -1
+
+        result = self.inline_call(read, fd, buf, nbyte).ret_expr
+        result_val = self.state.solver.eval(result)
+
+        restore_seek = self.inline_call(lseek, fd, old_offset, SEEK_SET).ret_expr
+        restore_seek = self.state.solver.eval(restore_seek)
+
+        if restore_seek == -1 or result_val == -1:
+            return -1
+
+        return result

angr/procedures/posix/pthread.py

@@ -0,0 +1,87 @@
+import angr
+
+# pylint: disable=arguments-differ,unused-argument,no-self-use,inconsistent-return-statements
+
+
+class pthread_create(angr.SimProcedure):
+    """
+    Simulates the new thread as an equally viable branch of symbolic execution.
+    """
+
+    ADDS_EXITS = True
+
+    # pylint: disable=unused-argument,arguments-differ
+    def run(self, thread, attr, start_routine, arg):
+        self.call(start_routine, (arg,), "terminate_thread", prototype="void *start_routine(void*)")
+        return 0
+
+    def terminate_thread(self, thread, attr, start_routine, arg):
+        self.exit(0)
+
+    def static_exits(self, blocks, **kwargs):
+        # Execute those blocks with a blank state, and then dump the arguments
+        blank_state = angr.SimState(project=self.project, mode="fastpath", cle_memory_backer=self.project.loader.memory)
+
+        # Execute each block
+        state = blank_state
+        for b in blocks:
+            irsb = self.project.factory.default_engine.process(state, b, force_addr=b.addr)
+            if irsb.successors:
+                state = irsb.successors[0]
+            else:
+                break
+
+        callfunc = self.cc.get_args(state, self.prototype)[2]
+        retaddr = state.memory.load(state.regs.sp, size=self.arch.bytes)
+
+        all_exits = [
+            {"address": callfunc, "jumpkind": "Ijk_Call", "namehint": "thread_entry"},
+            {"address": retaddr, "jumpkind": "Ijk_Ret", "namehint": None},
+        ]
+
+        return all_exits
+
+
+class pthread_cond_signal(angr.SimProcedure):
+    """
+    A no-op.
+    """
+
+    def run(self, arg):
+        pass
+
+
+class pthread_mutex_lock(angr.SimProcedure):
+    """
+    A no-op.
+    """
+
+    def run(self, arg):
+        pass
+
+
+class pthread_mutex_unlock(angr.SimProcedure):
+    """
+    A no-op.
+    """
+
+    def run(self, arg):
+        pass
+
+
+class pthread_once(angr.SimProcedure):
+    def run(self, control, func):
+        controlword = self.state.mem[control].char.resolved
+        if (controlword & 2).symbolic:
+            raise angr.errors.SimProcedureError("Cannot handle symbolic control data for pthread_once")
+        if self.state.solver.is_true(controlword & 2 != 0):
+            return 0
+
+        controlword |= 2
+        self.state.mem[control].char = controlword
+        self.call(func, (), "retsite", prototype="void x()")
+
+    def retsite(self, control, func):
+        return 0
+
+    # TODO: static exits

angr/procedures/posix/pwrite64.py

@@ -0,0 +1,45 @@
+import angr
+
+import logging
+
+l = logging.getLogger(name=__name__)
+
+
+class pwrite64(angr.SimProcedure):
+    # pylint: disable=arguments-differ
+    def run(self, fd, buf, nbyte, offset):
+        SEEK_SET = 0  # Seek from beginning of file.
+        SEEK_CUR = 1  # Seek from current position.
+
+        write = angr.SIM_PROCEDURES["posix"]["write"]
+        lseek = angr.SIM_PROCEDURES["linux_kernel"]["lseek"]
+
+        if self.state.solver.symbolic(offset):
+            err = "Symbolic offset is not supported in pwrite64"
+            l.error(err)
+            raise angr.errors.SimPosixError(err)
+
+        offset = self.state.solver.eval(offset)
+
+        old_offset = self.inline_call(lseek, fd, 0, SEEK_CUR).ret_expr
+        old_offset = self.state.solver.eval(old_offset)
+
+        if old_offset == -1:
+            return -1
+
+        lseek_ret = self.inline_call(lseek, fd, offset, SEEK_SET).ret_expr
+        lseek_ret = self.state.solver.eval(lseek_ret)
+
+        if lseek_ret == -1:
+            return -1
+
+        result = self.inline_call(write, fd, buf, nbyte).ret_expr
+        result_val = self.state.solver.eval(result)
+
+        restore_seek = self.inline_call(lseek, fd, old_offset, SEEK_SET).ret_expr
+        restore_seek = self.state.solver.eval(restore_seek)
+
+        if restore_seek == -1 or result_val == -1:
+            return -1
+
+        return result

angr/procedures/posix/read.py

@@ -0,0 +1,12 @@
+import angr
+
+
+class read(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, fd, dst, length):
+        simfd = self.state.posix.get_fd(fd)
+        if simfd is None:
+            return -1
+
+        return simfd.read(dst, length)

angr/procedures/posix/readdir.py

@@ -0,0 +1,59 @@
+import angr
+from collections import namedtuple
+
+import logging
+
+l = logging.getLogger(name=__name__)
+
+Dirent = namedtuple("dirent", ("d_ino", "d_off", "d_reclen", "d_type", "d_name"))
+
+
+class readdir(angr.SimProcedure):
+    struct = None
+    condition = None
+
+    def run(self, dirp):  # pylint: disable=arguments-differ
+        # TODO: make sure argument is actually a dir struct
+        if self.state.arch.name != "AMD64":
+            l.error("readdir SimProcedure is only implemented for AMD64")
+            return 0
+
+        self._build_amd64()
+        self.instrument()
+        malloc = angr.SIM_PROCEDURES["libc"]["malloc"]
+        pointer = self.inline_call(malloc, 19 + 256).ret_expr
+        self._store_amd64(pointer)
+        return self.state.solver.If(self.condition, pointer, 0)
+
+    def instrument(self):
+        """
+        Override this function to instrument the SimProcedure.
+
+        The two useful variables you can override are self.struct, a named tuple of all the struct
+        fields, and self.condition, the condition for whether the function succeeds.
+        """
+        pass
+
+    def _build_amd64(self):
+        self.struct = Dirent(
+            self.state.solver.BVV(0, 64),  # d_ino
+            self.state.solver.BVV(0, 64),  # d_off
+            self.state.solver.BVS("d_reclen", 16, key=("api", "readdir", "d_reclen")),  # d_reclen
+            self.state.solver.BVS("d_type", 8, key=("api", "readdir", "d_type")),  # d_type
+            self.state.solver.BVS("d_name", 255 * 8, key=("api", "readdir", "d_name")),
+        )  # d_name
+        self.condition = self.state.solver.BoolS("readdir_cond")  # TODO: variable key
+
+    def _store_amd64(self, ptr):
+        def stores(offset, val):
+            return self.state.memory.store(ptr + offset, val, endness="Iend_BE")
+
+        def storei(offset, val):
+            return self.state.memory.store(ptr + offset, val, endness="Iend_LE")
+
+        storei(0, self.struct.d_ino)
+        storei(8, self.struct.d_off)
+        storei(16, self.struct.d_reclen)
+        storei(18, self.struct.d_type)
+        stores(19, self.struct.d_name)
+        stores(19 + 255, self.state.solver.BVV(0, 8))

angr/procedures/posix/recv.py

@@ -0,0 +1,12 @@
+import angr
+
+
+class recv(angr.SimProcedure):
+    # pylint:disable=arguments-differ,unused-argument
+
+    def run(self, fd, dst, length, flags):
+        simfd = self.state.posix.get_fd(fd)
+        if simfd is None:
+            return -1
+
+        return simfd.read(dst, length)

angr/procedures/posix/recvfrom.py

@@ -0,0 +1,12 @@
+import angr
+
+
+class recvfrom(angr.SimProcedure):
+    # pylint:disable=arguments-differ,unused-argument
+
+    def run(self, fd, dst, length, flags, src_addr, addrlen):
+        simfd = self.state.posix.get_fd(fd)
+        if simfd is None:
+            return -1
+
+        return simfd.read(dst, length)

angr/procedures/posix/select.py

@@ -0,0 +1,46 @@
+import angr
+
+
+class select(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, nfds, readfds, writefds, exceptfds, timeout):  # pylint: disable=unused-argument
+        try:
+            nfds_v = self.state.solver.eval_one(nfds)
+            # readfds_v = self.state.solver.eval_one(readfds)
+            writefds_v = self.state.solver.eval_one(writefds)
+            exceptfds_v = self.state.solver.eval_one(exceptfds)
+        except angr.errors.SimSolverError:
+            raise angr.errors.SimProcedureArgumentError("Can't handle symbolic select arguments")
+
+        if writefds_v != 0 or exceptfds_v != 0:
+            raise angr.errors.SimProcedureError("Can't handle write or exception events in select")
+
+        arch_bits = self.arch.bits
+        arch_bytes = self.arch.bytes
+
+        long_array = []
+        long_array_size = ((nfds_v - 1) + arch_bits) // arch_bits
+        for offset in range(0, long_array_size):
+            long = self.state.memory.load(readfds + offset * arch_bytes, arch_bytes, endness=self.arch.memory_endness)
+            long_array.append(long)
+        for i in range(0, nfds_v - 1):
+            # get a bit
+            long_pos = i // arch_bits
+            bit_offset = i % arch_bits
+            bit = long_array[long_pos][bit_offset]
+
+            if bit.symbolic or self.state.solver.eval(bit) == 1:
+                # set this bit to symbolic
+                long_array[long_pos] = (
+                    long_array[long_pos][arch_bits - 1 : bit_offset + 1]
+                    .concat(self.state.solver.BVS("fd_state", 1))
+                    .concat(long_array[long_pos][bit_offset - 1 :])
+                )
+
+        # write things back
+        for offset in range(0, long_array_size):
+            self.state.memory.store(readfds + offset * arch_bytes, long_array[offset], endness=self.arch.memory_endness)
+
+        retval = self.state.solver.BVV(0, 1).concat(self.state.solver.BVS("select_ret", 31))
+        return retval

angr/procedures/posix/send.py

@@ -0,0 +1,22 @@
+import angr
+
+from ...sim_options import ALLOW_SEND_FAILURES
+
+
+class send(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, fd, src, length, flags):  # pylint:disable=unused-argument
+        simfd = self.state.posix.get_fd(fd)
+        if simfd is None:
+            return -1
+
+        send_succeeded = simfd.write(src, length)  # if send succeeds
+
+        if ALLOW_SEND_FAILURES in self.state.options:
+            retval = self.state.solver.BVS("send_ret", self.arch.bits)
+            send_failed = -1
+            self.state.add_constraints(self.state.solver.Or(retval == send_succeeded, retval == send_failed))
+            return retval
+        else:
+            return send_succeeded

angr/procedures/posix/setsockopt.py

@@ -0,0 +1,8 @@
+import angr
+
+
+class setsockopt(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, sockfd, level, optname, optval, optmain):
+        return 0

angr/procedures/posix/sigaction.py

@@ -0,0 +1,20 @@
+import angr
+import archinfo
+import logging
+
+l = logging.getLogger(name=__name__)
+
+
+class sigaction(angr.SimProcedure):
+    def run(self, signum, act, oldact):
+        l.warning("Calling sigaction for signal %s - this is emulated as a nop", signum)
+        if not self.state.solver.is_true(oldact == 0):
+            if isinstance(self.arch, archinfo.ArchAMD64):
+                self.state.memory.store(
+                    oldact, self.state.solver.BVS("sigaction_oldact", 152 * 8, key=("api", "sigaction", "oldact"))
+                )
+            elif isinstance(self.arch, archinfo.ArchX86):
+                self.state.memory.store(
+                    oldact, self.state.solver.BVS("sigaction_oldact", 140 * 8, key=("api", "sigaction", "oldact"))
+                )
+        return 0

angr/procedures/posix/sim_time.py

@@ -0,0 +1,45 @@
+import angr
+import time
+
+# pylint: disable=arguments-differ,unused-argument
+
+
+class gettimeofday(angr.SimProcedure):
+    def run(self, tv, tz):
+        if self.state.solver.is_true(tv == 0):
+            return -1
+
+        if angr.options.USE_SYSTEM_TIMES in self.state.options:
+            flt = time.time()
+            result = {"tv_sec": int(flt), "tv_usec": int(flt * 1000000)}
+        else:
+            result = {
+                "tv_sec": self.state.solver.BVS("tv_sec", self.arch.bits, key=("api", "gettimeofday", "tv_sec")),
+                "tv_usec": self.state.solver.BVS("tv_usec", self.arch.bits, key=("api", "gettimeofday", "tv_usec")),
+            }
+
+        self.state.mem[tv].struct.timeval = result
+        return 0
+
+
+class clock_gettime(angr.SimProcedure):
+    def run(self, which_clock, timespec_ptr):
+        if not self.state.solver.is_true(which_clock == 0):
+            raise angr.errors.SimProcedureError(
+                "clock_gettime doesn't know how to deal with a clock other than CLOCK_REALTIME"
+            )
+
+        if self.state.solver.is_true(timespec_ptr == 0):
+            return -1
+
+        if angr.options.USE_SYSTEM_TIMES in self.state.options:
+            flt = time.time()
+            result = {"tv_sec": int(flt), "tv_nsec": int(flt * 1000000000)}
+        else:
+            result = {
+                "tv_sec": self.state.solver.BVS("tv_sec", self.arch.bits, key=("api", "clock_gettime", "tv_sec")),
+                "tv_nsec": self.state.solver.BVS("tv_nsec", self.arch.bits, key=("api", "clock_gettime", "tv_nsec")),
+            }
+
+        self.state.mem[timespec_ptr].struct.timespec = result
+        return 0

angr/procedures/posix/sleep.py

@@ -0,0 +1,7 @@
+import angr
+
+
+class sleep(angr.SimProcedure):
+    # pylint:disable=arguments-differ,unused-argument
+    def run(self, seconds):
+        return 0