angr 9.2.103__py3-none-manylinux2014_aarch64.whl

angr/procedures/libc/gets.py

@@ -0,0 +1,66 @@
+import logging
+
+import angr
+from angr.storage.memory_mixins.address_concretization_mixin import MultiwriteAnnotation
+from angr.misc.ux import once
+
+_l = logging.getLogger(name=__name__)
+
+
+class gets(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, dst):
+        if once("gets_warning"):
+            _l.warning(
+                "The use of gets in a program usually causes buffer overflows. You may want to adjust "
+                "SimStateLibc.max_gets_size to properly mimic an overflowing read."
+            )
+
+        fd = 0
+        simfd = self.state.posix.get_fd(fd)
+        if simfd is None:
+            return 0
+
+        max_size = self.state.libc.max_gets_size
+
+        # case 0: the data is concrete. we should read it a byte at a time since we can't seek for
+        # the newline and we don't have any notion of buffering in-memory
+        if simfd.read_storage.concrete:
+            count = 0
+            while count < max_size - 1:
+                data, real_size = simfd.read_data(1)
+                if self.state.solver.is_true(real_size == 0):
+                    break
+                self.state.memory.store(dst + count, data)
+                count += 1
+                if self.state.solver.is_true(data == b"\n"):
+                    break
+            self.state.memory.store(dst + count, b"\0")
+            return dst
+
+        # case 2: the data is symbolic, the newline could be anywhere. Read the maximum number of bytes
+        # (SHORT_READS should take care of the variable length) and add a constraint to assert the
+        # newline nonsense.
+        # caveat: there could also be no newline and the file could EOF.
+        else:
+            data, real_size = simfd.read_data(max_size - 1)
+
+            for i, byte in enumerate(data.chop(8)):
+                self.state.add_constraints(
+                    self.state.solver.If(
+                        i + 1 != real_size,
+                        byte != b"\n",  # if not last byte returned, not newline
+                        self.state.solver.Or(  # otherwise one of the following must be true:
+                            i + 2 == max_size,  # - we ran out of space, or
+                            simfd.eof(),  # - the file is at EOF, or
+                            byte == b"\n",  # - it is a newline
+                        ),
+                    )
+                )
+            self.state.memory.store(dst, data, size=real_size)
+            end_address = dst + real_size
+            end_address = end_address.annotate(MultiwriteAnnotation())
+            self.state.memory.store(end_address, b"\0")
+
+            return dst

angr/procedures/libc/getuid.py

@@ -0,0 +1,7 @@
+import angr
+
+
+class getuid(angr.SimProcedure):
+    # pylint: disable=arguments-differ
+    def run(self):
+        return 1000

angr/procedures/libc/malloc.py

@@ -0,0 +1,11 @@
+import angr
+import itertools
+
+
+malloc_mem_counter = itertools.count()
+
+
+class malloc(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+    def run(self, sim_size):
+        return self.state.heap._malloc(sim_size)

angr/procedures/libc/memcmp.py

@@ -0,0 +1,69 @@
+import angr
+import logging
+
+l = logging.getLogger(name=__name__)
+
+
+class memcmp(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, s1_addr, s2_addr, n):
+        max_memcmp_size = self.state.libc.max_buffer_size
+
+        definite_size = self.state.solver.min_int(n)
+        conditional_s1_start = s1_addr + definite_size
+        conditional_s2_start = s2_addr + definite_size
+        if self.state.solver.symbolic(n):
+            conditional_size = int(max(max_memcmp_size - definite_size, 0))
+        else:
+            conditional_size = 0
+
+        l.debug("Definite size %s and conditional size: %s", definite_size, conditional_size)
+
+        int_bits = self.arch.sizeof["int"]
+        if definite_size > 0:
+            s1_part = self.state.memory.load(s1_addr, definite_size, endness="Iend_BE")
+            s2_part = self.state.memory.load(s2_addr, definite_size, endness="Iend_BE")
+            cases = [
+                [s1_part == s2_part, self.state.solver.BVV(0, int_bits)],
+                [self.state.solver.ULT(s1_part, s2_part), self.state.solver.BVV(-1, int_bits)],
+                [self.state.solver.UGT(s1_part, s2_part), self.state.solver.BVV(1, int_bits)],
+            ]
+            definite_answer = self.state.solver.ite_cases(cases, 2)
+            constraint = self.state.solver.Or(*[c for c, _ in cases])
+            self.state.add_constraints(constraint)
+
+            l.debug("Created definite answer: %s", definite_answer)
+            l.debug("Created constraint: %s", constraint)
+            l.debug("... crom cases: %s", cases)
+        else:
+            definite_answer = self.state.solver.BVV(0, int_bits)
+
+        if not self.state.solver.symbolic(definite_answer) and self.state.solver.eval(definite_answer) != 0:
+            return definite_answer
+
+        if conditional_size > 0:
+            s1_all = self.state.memory.load(conditional_s1_start, conditional_size, endness="Iend_BE")
+            s2_all = self.state.memory.load(conditional_s2_start, conditional_size, endness="Iend_BE")
+            conditional_rets = {0: definite_answer}
+
+            for byte, bit in zip(range(conditional_size), range(conditional_size * 8, 0, -8)):
+                s1_part = s1_all[conditional_size * 8 - 1 : bit - 8]
+                s2_part = s2_all[conditional_size * 8 - 1 : bit - 8]
+                cases = [
+                    [s1_part == s2_part, self.state.solver.BVV(0, int_bits)],
+                    [self.state.solver.ULT(s1_part, s2_part), self.state.solver.BVV(-1, int_bits)],
+                    [self.state.solver.UGT(s1_part, s2_part), self.state.solver.BVV(1, int_bits)],
+                ]
+                conditional_rets[byte + 1] = self.state.solver.ite_cases(cases, 0)
+                self.state.add_constraints(self.state.solver.Or(*[c for c, _ in cases]))
+
+            ret_expr = self.state.solver.If(
+                definite_answer == 0,
+                self.state.solver.ite_dict(n - definite_size, conditional_rets, 2),
+                definite_answer,
+            )
+            self.state.add_constraints(self.state.solver.Or(*[n - definite_size == c for c in conditional_rets]))
+            return ret_expr
+        else:
+            return definite_answer

angr/procedures/libc/memcpy.py

@@ -0,0 +1,37 @@
+import angr
+import logging
+
+l = logging.getLogger(name=__name__)
+
+
+class memcpy(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, dst_addr, src_addr, limit):
+        if not self.state.solver.symbolic(limit):
+            # not symbolic so we just take the value
+            conditional_size = self.state.solver.eval(limit)
+        else:
+            # constraints on the limit are added during the store
+            max_memcpy_size = self.state.libc.max_memcpy_size
+            max_limit = self.state.solver.max_int(limit)
+            min_limit = self.state.solver.min_int(limit)
+            conditional_size = min(max_memcpy_size, max(min_limit, max_limit))
+            if max_limit > max_memcpy_size and conditional_size < max_limit:
+                l.warning(
+                    "memcpy upper bound of %#x outside limit, limiting to %#x instead", max_limit, conditional_size
+                )
+
+        l.debug("Memcpy running with conditional_size %#x", conditional_size)
+
+        if conditional_size > 0:
+            src_mem = self.state.memory.load(src_addr, conditional_size, endness="Iend_BE")
+            if ABSTRACT_MEMORY in self.state.options:
+                self.state.memory.store(dst_addr, src_mem, size=conditional_size, endness="Iend_BE")
+            else:
+                self.state.memory.store(dst_addr, src_mem, size=limit, endness="Iend_BE")
+
+        return dst_addr
+
+
+from ...sim_options import ABSTRACT_MEMORY

angr/procedures/libc/memset.py

@@ -0,0 +1,69 @@
+import angr
+
+import logging
+
+l = logging.getLogger(name=__name__)
+
+
+class memset(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    @staticmethod
+    def _repeat_bytes(byt, rep):
+        """
+        Get a long number for a byte being repeated for many times. This is part of the effort of optimizing
+        performance of angr's memory operations.
+
+        :param int byt: the byte to repeat
+        :param int rep: times to repeat the byte
+        :return: a long integer representing the repeating bytes
+        ;rtype: int
+        """
+
+        if rep == 1:
+            return byt
+
+        remainder = rep % 2
+        quotient = rep // 2
+
+        r_ = memset._repeat_bytes(byt, quotient)
+        if remainder == 1:
+            r = r_ << ((quotient + 1) * 8)
+            r |= (r_ << 8) + byt
+        else:
+            r = r_ << (quotient * 8)
+            r |= r_
+        return r
+
+    def run(self, dst_addr, char, num):
+        if char.size() != self.state.arch.byte_width:  # sizeof(char)
+            char = self.state.solver.Extract(self.state.arch.byte_width - 1, 0, char)
+
+        if self.state.solver.symbolic(num):
+            l.debug("symbolic length")
+            max_size = self.state.solver.min_int(num) + self.state.libc.max_buffer_size
+            write_bytes = self.state.solver.Concat(*([char] * max_size))
+            self.state.memory.store(dst_addr, write_bytes, size=num)
+        else:
+            max_size = self.state.solver.eval(num)
+            l.debug("memset writing %d bytes", max_size)
+
+            offset = 0
+            while offset < max_size:
+                chunksize = min(max_size - offset, 0x1000)
+
+                if self.state.solver.symbolic(char):
+                    l.debug("symbolic char")
+                    write_bytes = self.state.solver.Concat(*([char] * chunksize))
+                else:
+                    # Concatenating many bytes is slow, so some sort of optimization is required
+                    if char.concrete_value == 0:
+                        write_bytes = self.state.solver.BVV(0, chunksize * 8)
+                    else:
+                        rb = memset._repeat_bytes(char.concrete_value, chunksize)
+                        write_bytes = self.state.solver.BVV(rb, chunksize * 8)
+
+                self.state.memory.store(dst_addr + offset, write_bytes)
+                offset += chunksize
+
+        return dst_addr

angr/procedures/libc/openlog.py

@@ -0,0 +1,9 @@
+import angr
+
+
+class openlog(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, ident, option, facility):
+        # A stub for openlog that does not do anything yet.
+        return

angr/procedures/libc/perror.py

@@ -0,0 +1,12 @@
+import angr
+
+
+class perror(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, string):
+        write = angr.SIM_PROCEDURES["posix"]["write"]
+        strlen = angr.SIM_PROCEDURES["libc"]["strlen"]
+
+        length = self.inline_call(strlen, string).ret_expr
+        self.inline_call(write, 2, string, length)

angr/procedures/libc/printf.py

@@ -0,0 +1,33 @@
+import logging
+
+from angr.procedures.stubs.format_parser import FormatParser
+
+l = logging.getLogger(name=__name__)
+
+
+class printf(FormatParser):
+    def run(self, fmt):
+        stdout = self.state.posix.get_fd(1)
+        if stdout is None:
+            return -1
+
+        # The format str is at index 0
+        fmt_str = self._parse(fmt)
+        out_str = fmt_str.replace(self.va_arg)
+
+        stdout.write_data(out_str, out_str.size() // 8)
+        return out_str.size() // 8
+
+
+class __printf_chk(FormatParser):
+    def run(self, _, fmt):
+        stdout = self.state.posix.get_fd(1)
+        if stdout is None:
+            return -1
+
+        # The format str is at index 1
+        fmt_str = self._parse(fmt)
+        out_str = fmt_str.replace(self.va_arg)
+
+        stdout.write_data(out_str, out_str.size() // 8)
+        return out_str.size() // 8

angr/procedures/libc/putchar.py

@@ -0,0 +1,12 @@
+import angr
+
+
+class putchar(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, string):
+        stdout = self.state.posix.get_fd(1)
+        if stdout is None:
+            return -1
+        stdout.write_data(string[7:0])
+        return string & 0xFF

angr/procedures/libc/puts.py

@@ -0,0 +1,16 @@
+import angr
+
+
+class puts(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, string):
+        stdout = self.state.posix.get_fd(1)
+        if stdout is None:
+            return -1
+
+        strlen = angr.SIM_PROCEDURES["libc"]["strlen"]
+        length = self.inline_call(strlen, string).ret_expr
+        out = stdout.write(string, length)
+        stdout.write_data(self.state.solver.BVV(b"\n"))
+        return (out + 1)[31:0]

angr/procedures/libc/rand.py

@@ -0,0 +1,7 @@
+import angr
+
+
+class rand(angr.SimProcedure):
+    def run(self):
+        rval = self.state.solver.BVS("rand", 31, key=("api", "rand"))
+        return rval.zero_extend(self.arch.sizeof["int"] - 31)

angr/procedures/libc/realloc.py

@@ -0,0 +1,7 @@
+import angr
+
+
+class realloc(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+    def run(self, ptr, size):
+        return self.state.heap._realloc(ptr, size)

angr/procedures/libc/rewind.py

@@ -0,0 +1,11 @@
+import angr
+
+
+class rewind(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, file_ptr):
+        fseek = angr.SIM_PROCEDURES["libc"]["fseek"]
+        self.inline_call(fseek, file_ptr, 0, 0)
+
+        return None

angr/procedures/libc/scanf.py

@@ -0,0 +1,20 @@
+import logging
+
+from angr.procedures.stubs.format_parser import ScanfFormatParser
+
+l = logging.getLogger(name=__name__)
+
+
+class scanf(ScanfFormatParser):
+    # pylint:disable=arguments-differ,unused-argument
+
+    def run(self, fmt):
+        fmt_str = self._parse(fmt)
+
+        # we're reading from stdin so the region is the file's content
+        simfd = self.state.posix.get_fd(0)
+        if simfd is None:
+            return -1
+
+        items = fmt_str.interpret(self.va_arg, simfd=simfd)
+        return items

angr/procedures/libc/setbuf.py

@@ -0,0 +1,8 @@
+import angr
+
+
+class setbuf(angr.SimProcedure):
+    # pylint:disable=arguments-differ, unused-argument
+
+    def run(self, stream, buf):
+        return

angr/procedures/libc/setvbuf.py

@@ -0,0 +1,6 @@
+import angr
+
+
+class setvbuf(angr.SimProcedure):
+    def run(self, stream, buf, type_, size):
+        return 0

angr/procedures/libc/snprintf.py

@@ -0,0 +1,33 @@
+import logging
+
+from angr.procedures.stubs.format_parser import FormatParser
+
+l = logging.getLogger(name=__name__)
+
+
+class snprintf(FormatParser):
+    def run(self, dst_ptr, size, fmt):  # pylint:disable=arguments-differ,unused-argument
+        if self.state.solver.eval(size) == 0:
+            return size
+
+        fmt_str = self._parse(fmt)
+        out_str = fmt_str.replace(self.va_arg)
+        self.state.memory.store(dst_ptr, out_str)
+
+        # place the terminating null byte
+        self.state.memory.store(dst_ptr + (out_str.size() // self.arch.byte_width), self.state.solver.BVV(0, 8))
+
+        return out_str.size() // self.arch.byte_width
+
+
+class __snprintf_chk(FormatParser):
+    def run(self, dst_ptr, maxlen, flag, size, fmt):  # pylint:disable=arguments-differ,unused-argument
+        # The format str is at index 4
+        fmt_str = self._parse(fmt)
+        out_str = fmt_str.replace(self.va_arg)
+        self.state.memory.store(dst_ptr, out_str)
+
+        # place the terminating null byte
+        self.state.memory.store(dst_ptr + (out_str.size() // self.arch.byte_width), self.state.solver.BVV(0, 8))
+
+        return out_str.size() // self.arch.byte_width

angr/procedures/libc/sprintf.py

@@ -0,0 +1,22 @@
+import logging
+
+from angr.procedures.stubs.format_parser import FormatParser
+
+l = logging.getLogger(name=__name__)
+
+
+class sprintf(FormatParser):
+    # pylint:disable=arguments-differ
+
+    def run(self, dst_ptr, fmt):  # pylint:disable=unused-argument
+        # The format str is at index 1
+        fmt_str = self._parse(fmt)
+        out_str = fmt_str.replace(self.va_arg)
+        self.state.memory.store(dst_ptr, out_str)
+
+        # place the terminating null byte
+        self.state.memory.store(
+            dst_ptr + (out_str.size() // self.arch.byte_width), self.state.solver.BVV(0, self.arch.byte_width)
+        )
+
+        return out_str.size() // self.arch.byte_width

angr/procedures/libc/srand.py

@@ -0,0 +1,6 @@
+import angr
+
+
+class srand(angr.SimProcedure):
+    def run(self, seed):
+        self.ret()

angr/procedures/libc/sscanf.py

@@ -0,0 +1,13 @@
+import logging
+
+from angr.procedures.stubs.format_parser import ScanfFormatParser
+
+l = logging.getLogger(name=__name__)
+
+
+class sscanf(ScanfFormatParser):
+    # pylint:disable=arguments-differ,unused-argument
+    def run(self, data, fmt):
+        fmt_str = self._parse(fmt)
+        items = fmt_str.interpret(self.va_arg, addr=data)
+        return items

angr/procedures/libc/stpcpy.py

@@ -0,0 +1,18 @@
+import angr
+
+
+class stpcpy(angr.SimProcedure):
+    """stpcpy"""
+
+    # pylint:disable=arguments-differ
+
+    def run(self, dst, src):
+        strlen = angr.SIM_PROCEDURES["libc"]["strlen"]
+        strncpy = angr.SIM_PROCEDURES["libc"]["strncpy"]
+        src_len = self.inline_call(strlen, src)
+
+        ret_expr = (
+            self.inline_call(strncpy, dst, src, src_len.ret_expr + 1, src_len=src_len.ret_expr).ret_expr
+            + src_len.ret_expr
+        )
+        return ret_expr

angr/procedures/libc/strcat.py

@@ -0,0 +1,13 @@
+import angr
+
+
+class strcat(angr.SimProcedure):
+    # pylint: disable=arguments-differ
+    def run(self, dst, src):
+        strlen = angr.SIM_PROCEDURES["libc"]["strlen"]
+        strncpy = angr.SIM_PROCEDURES["libc"]["strncpy"]
+        src_len = self.inline_call(strlen, src).ret_expr
+        dst_len = self.inline_call(strlen, dst).ret_expr
+
+        self.inline_call(strncpy, dst + dst_len, src, src_len + 1, src_len=src_len)
+        return dst

angr/procedures/libc/strchr.py

@@ -0,0 +1,44 @@
+import angr
+from angr.storage.memory_mixins.address_concretization_mixin import MultiwriteAnnotation
+from angr.sim_options import MEMORY_CHUNK_INDIVIDUAL_READS
+
+import logging
+
+l = logging.getLogger(name=__name__)
+
+
+class strchr(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, s_addr, c_int, s_strlen=None):
+        c = c_int[7:0]
+        s_strlen = self.inline_call(angr.SIM_PROCEDURES["libc"]["strlen"], s_addr)
+
+        chunk_size = None
+        if MEMORY_CHUNK_INDIVIDUAL_READS in self.state.options:
+            chunk_size = 1
+
+        if self.state.solver.symbolic(s_strlen.ret_expr):
+            l.debug("symbolic strlen")
+            # TODO: more constraints here to make sure we don't search too little
+            max_sym = min(self.state.solver.max_int(s_strlen.ret_expr) + 1, self.state.libc.max_symbolic_strchr)
+            a, c, i = self.state.memory.find(s_addr, c, s_strlen.max_null_index, max_symbolic_bytes=max_sym, default=0)
+        else:
+            l.debug("concrete strlen")
+            max_search = self.state.solver.eval(s_strlen.ret_expr) + 1
+            a, c, i = self.state.memory.find(s_addr, c, max_search, default=0, chunk_size=chunk_size)
+
+        if len(i) > 1:
+            a = a.annotate(MultiwriteAnnotation())
+            self.state.add_constraints(*c)
+
+        # If we found the character we are looking for, we need to
+        # ensure that the string length is long enough to include
+        # the character!
+        chrpos = a - s_addr
+        self.state.add_constraints(self.state.solver.If(a != 0, chrpos <= s_strlen.ret_expr, True))
+
+        return a
+        # self.state.add_constraints(self.state.solver.ULT(a - s_addr, s_strlen.ret_expr))
+        # self.max_chr_index = max(i)
+        # return a

angr/procedures/libc/strcmp.py

@@ -0,0 +1,28 @@
+import angr
+
+import logging
+
+l = logging.getLogger(name=__name__)
+
+
+class strcmp(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, a_addr, b_addr, wchar=False, ignore_case=False):
+        strlen = angr.SIM_PROCEDURES["libc"]["strlen"]
+
+        a_strlen = self.inline_call(strlen, a_addr, wchar=wchar)
+        b_strlen = self.inline_call(strlen, b_addr, wchar=wchar)
+        maxlen = self.state.solver.BVV(max(a_strlen.max_null_index, b_strlen.max_null_index), self.state.arch.bits)
+
+        strncmp = self.inline_call(
+            angr.SIM_PROCEDURES["libc"]["strncmp"],
+            a_addr,
+            b_addr,
+            maxlen,
+            a_len=a_strlen,
+            b_len=b_strlen,
+            wchar=wchar,
+            ignore_case=ignore_case,
+        )
+        return strncmp.ret_expr

angr/procedures/libc/strcpy.py

@@ -0,0 +1,13 @@
+import angr
+
+
+class strcpy(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, dst, src):
+        strlen = angr.SIM_PROCEDURES["libc"]["strlen"]
+        strncpy = angr.SIM_PROCEDURES["libc"]["strncpy"]
+        src_len = self.inline_call(strlen, src)
+
+        ret_expr = self.inline_call(strncpy, dst, src, src_len.ret_expr + 1, src_len=src_len.ret_expr).ret_expr
+        return ret_expr