angr 9.2.103__py3-none-manylinux2014_aarch64.whl

angr/state_plugins/heap/heap_base.py

@@ -0,0 +1,126 @@
+from ..plugin import SimStatePlugin
+
+from ...errors import SimMemoryError
+from .. import sim_options as opts
+
+import logging
+
+l = logging.getLogger("angr.state_plugins.heap.heap_base")
+
+# TODO: derive heap location from SimOS and binary info for something more realistic (and safe?)
+DEFAULT_HEAP_LOCATION = 0xC0000000
+DEFAULT_HEAP_SIZE = 64 * 4096
+
+
+class SimHeapBase(SimStatePlugin):
+    """
+    This is the base heap class that all heap implementations should subclass. It defines a few handlers for common
+    heap functions (the libc memory management functions). Heap implementations are expected to override these
+    functions regardless of whether they implement the SimHeapLibc interface. For an example, see the SimHeapBrk
+    implementation, which is based on the original libc SimProcedure implementations.
+
+    :ivar heap_base: the address of the base of the heap in memory
+    :ivar heap_size: the total size of the main memory region managed by the heap in memory
+    :ivar mmap_base: the address of the region from which large mmap allocations will be made
+    """
+
+    def __init__(self, heap_base=None, heap_size=None):
+        super().__init__()
+
+        self.heap_base = heap_base if heap_base is not None else DEFAULT_HEAP_LOCATION
+        self.heap_size = heap_size if heap_size is not None else DEFAULT_HEAP_SIZE
+        self.mmap_base = self.heap_base + self.heap_size * 2
+
+    def copy(self, memo):
+        o = super().copy(memo)
+        o.heap_base = self.heap_base
+        o.heap_size = self.heap_size
+        o.mmap_base = self.mmap_base
+        return o
+
+    def _conc_alloc_size(self, sim_size):
+        """
+        Concretizes a size argument, if necessary, to something that makes sense when allocating space. Here we just
+        maximize its potential size up to the maximum variable size specified in the libc plugin.
+
+        TODO:
+        Further consideration of the tradeoffs of this approach is probably warranted. SimHeapPTMalloc especially makes
+        a lot of different concretization strategy assumptions, but this function handles one of the more important
+        problems that any heap implementation will face: how to decide the amount of space to allocate upon request for
+        a symbolic size. Either we do as we do here and silently constrain the amount returned to a default max value,
+        or we could add a path constraint to the state to prevent exploration of any paths that would have legitimately
+        occurred given a larger allocation size.
+
+        The first approach (the silent maximum) has its benefit in that the explored state space will not be
+        constrained. Sometimes this could work out, as when an allocation is returned that is smaller than requested but
+        which the program doesn't end up making full use of anyways. Alternatively, this lack of fidelity could cause
+        the program to overwrite other allocations made, since it should be able to assume the allocation is as large as
+        it requested it be.
+
+        The second approach (the path constraint) has its benefit in that no paths will be explored that *could* fail
+        when an allocation is made too small. On the other hand, as stated above, some of these paths might not have
+        failed anyways, and doing this causes us to lose the opportunity to explore those paths.
+
+        Perhaps these behaviors could be parameterized in the future?
+        """
+        if self.state.solver.symbolic(sim_size):
+            size = self.state.solver.max_int(sim_size)
+            if size > self.state.libc.max_variable_size:
+                l.warning(
+                    "Allocation request of %d bytes exceeded maximum of %d bytes; allocating %d bytes",
+                    size,
+                    self.state.libc.max_variable_size,
+                    self.state.libc.max_variable_size,
+                )
+                size = self.state.libc.max_variable_size
+        else:
+            size = self.state.solver.eval(sim_size)
+        return size
+
+    def _malloc(self, sim_size):
+        """
+        Handler for any libc `malloc` SimProcedure call. If the heap has faithful support for `malloc`, it ought to be
+        implemented in a `malloc` function (as opposed to the `_malloc` function).
+
+        :param sim_size: the amount of memory (in bytes) to be allocated
+        """
+        raise NotImplementedError(f"{self._malloc.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def _free(self, ptr):
+        """
+        Handler for any libc `free` SimProcedure call. If the heap has faithful support for `free`, it ought to be
+        implemented in a `free` function (as opposed to the `_free` function).
+
+        :param ptr: the location in memory to be freed
+        """
+        raise NotImplementedError(f"{self._free.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def _calloc(self, sim_nmemb, sim_size):
+        """
+        Handler for any libc `calloc` SimProcedure call. If the heap has faithful support for `calloc`, it ought to be
+        implemented in a `calloc` function (as opposed to the `_calloc` function).
+
+        :param sim_nmemb: the number of elements to allocated
+        :param sim_size: the size of each element (in bytes)
+        """
+        raise NotImplementedError(f"{self._calloc.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def _realloc(self, ptr, size):
+        """
+        Handler for any libc `realloc` SimProcedure call. If the heap has faithful support for `realloc`, it ought to be
+        implemented in a `realloc` function (as opposed to the `_realloc` function).
+
+        :param ptr: the location in memory to be reallocated
+        :param size: the new size desired for the allocation
+        """
+        raise NotImplementedError(f"{self._realloc.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def init_state(self):
+        if opts.ABSTRACT_MEMORY in self.state.options:
+            return
+
+        try:
+            self.state.memory.permissions(self.heap_base)
+        except SimMemoryError:
+            l.debug("Mapping base heap region")
+            self.state.memory.map_region(self.heap_base, self.heap_size, 3)

angr/state_plugins/heap/heap_brk.py

@@ -0,0 +1,134 @@
+from angr.errors import SimSolverError
+from ..plugin import SimStatePlugin
+from . import SimHeapBase
+
+import logging
+
+l = logging.getLogger(__name__)
+
+
+class SimHeapBrk(SimHeapBase):
+    """
+    SimHeapBrk represents a trivial heap implementation based on the Unix `brk` system call. This type of heap stores
+    virtually no metadata, so it is up to the user to determine when it is safe to release memory. This also means that
+    it does not properly support standard heap operations like `realloc`.
+
+    This heap implementation is a holdover from before any more proper implementations were modelled. At the time,
+    various libc (or win32) SimProcedures handled the heap in the same way that this plugin does now. To make future
+    heap implementations plug-and-playable, they should implement the necessary logic themselves, and dependent
+    SimProcedures should invoke a method by the same name as theirs (prepended with an underscore) upon the heap plugin.
+    Depending on the heap implementation, if the method is not supported, an error should be raised.
+
+    Out of consideration for the original way the heap was handled, this plugin implements functionality for all
+    relevant SimProcedures (even those that would not normally be supported together in a single heap implementation).
+
+    :ivar heap_location: the address of the top of the heap, bounding the allocations made starting from `heap_base`
+    """
+
+    def __init__(self, heap_base=None, heap_size=None):
+        super().__init__(heap_base, heap_size)
+        self.heap_location = self.heap_base
+
+    @SimStatePlugin.memo
+    def copy(self, memo):
+        o = super().copy(memo)
+        o.heap_location = self.heap_location
+        return o
+
+    def allocate(self, sim_size):
+        """
+        The actual allocation primitive for this heap implementation. Increases the position of the break to allocate
+        space. Has no guards against the heap growing too large.
+
+        :param sim_size: a size specifying how much to increase the break pointer by
+        :returns: a pointer to the previous break position, above which there is now allocated space
+        """
+        size = self._conc_alloc_size(sim_size)
+        while size % 16 != 0:
+            size += 1
+        addr = self.state.heap.heap_location
+        self.state.heap.heap_location += size
+        l.debug("Allocating %d bytes at address %#08x", size, addr)
+        return addr
+
+    def release(self, sim_size):
+        """
+        The memory release primitive for this heap implementation. Decreases the position of the break to deallocate
+        space. Guards against releasing beyond the initial heap base.
+
+        :param sim_size: a size specifying how much to decrease the break pointer by (may be symbolic or not)
+        """
+        requested = self._conc_alloc_size(sim_size)
+        used = self.heap_location - self.heap_base
+        released = requested if requested <= used else used
+        self.heap_location -= released
+        l.debug("Releasing %d bytes from the heap (%d bytes were requested to be released)", released, requested)
+
+    def _malloc(self, sim_size):
+        return self.allocate(sim_size)
+
+    def _free(self, ptr):  # pylint:disable=unused-argument
+        return self.state.solver.Unconstrained("free", self.state.arch.bits)
+
+    def _calloc(self, sim_nmemb, sim_size):
+        plugin = self.state.get_plugin("libc")
+
+        if self.state.solver.symbolic(sim_nmemb):
+            # TODO: find a better way
+            nmemb = self.state.solver.max_int(sim_nmemb)
+        else:
+            nmemb = self.state.solver.eval(sim_nmemb)
+
+        if self.state.solver.symbolic(sim_size):
+            # TODO: find a better way
+            size = self.state.solver.max_int(sim_size)
+        else:
+            size = self.state.solver.eval(sim_size)
+
+        final_size = size * nmemb
+
+        if self.state.solver.symbolic(sim_nmemb) or self.state.solver.symbolic(sim_size):
+            if final_size > plugin.max_variable_size:
+                final_size = plugin.max_variable_size
+
+        addr = self.state.heap.allocate(final_size)
+        v = self.state.solver.BVV(0, final_size * 8)
+        self.state.memory.store(addr, v)
+        return addr
+
+    def _realloc(self, ptr, size):
+        if size.symbolic:
+            try:
+                size_int = self.state.solver.max(size, extra_constraints=(size < self.state.libc.max_variable_size,))
+            except SimSolverError:
+                size_int = self.state.solver.min(size)
+            self.state.add_constraints(size_int == size)
+        else:
+            size_int = self.state.solver.eval(size)
+
+        addr = self.state.heap.allocate(size_int)
+
+        if self.state.solver.eval(ptr) != 0:
+            v = self.state.memory.load(ptr, size_int)
+            self.state.memory.store(addr, v)
+
+        return addr
+
+    def _combine(self, others):
+        new_heap_location = max(o.heap_location for o in others)
+        if self.heap_location != new_heap_location:
+            self.heap_location = new_heap_location
+            return True
+        else:
+            return False
+
+    def merge(self, others, merge_conditions, common_ancestor=None):  # pylint:disable=unused-argument
+        return self._combine(others)
+
+    def widen(self, others):
+        return self._combine(others)
+
+
+from angr.sim_state import SimState
+
+SimState.register_default("heap", SimHeapBrk)

angr/state_plugins/heap/heap_freelist.py

@@ -0,0 +1,210 @@
+from . import SimHeapLibc
+from .utils import concretize
+from ...errors import SimHeapError
+
+import logging
+
+l = logging.getLogger("angr.state_plugins.heap.heap_freelist")
+
+
+class Chunk:
+    """
+    The sort of chunk as would typically be found in a freelist-style heap implementation. Provides a representation of
+    a chunk via a view into the memory plugin. Chunks may be adjacent, in different senses, to as many as four other
+    chunks. For any given chunk, two of these chunks are adjacent to it in memory, and are referred to as the "previous"
+    and "next" chunks throughout this implementation. For any given free chunk, there may also be two significant chunks
+    that are adjacent to it in some linked list of free chunks. These chunks are referred to the "backward" and "foward"
+    chunks relative to the chunk in question.
+
+    :ivar base: the location of the base of the chunk in memory
+    :ivar state: the program state that the chunk is resident in
+    """
+
+    def __init__(self, base, sim_state):
+        self.state = sim_state
+
+        def sym_chunk_handler(chunk):
+            l.warning("A pointer to a chunk is symbolic; maximizing it")
+            return self.state.solver.max_int(chunk)
+
+        self.base = concretize(base, self.state.solver, sym_chunk_handler)
+
+    def get_size(self):
+        """
+        Returns the actual size of a chunk (as opposed to the entire size field, which may include some flags).
+        """
+        raise NotImplementedError(f"{self.get_size.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def get_data_size(self):
+        """
+        Returns the size of the data portion of a chunk.
+        """
+        raise NotImplementedError(f"{self.get_size.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def set_size(self, size):
+        """
+        Sets the size of the chunk, preserving any flags.
+        """
+        raise NotImplementedError(f"{self.set_size.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def data_ptr(self):
+        """
+        Returns the address of the payload of the chunk.
+        """
+        raise NotImplementedError(f"{self.data_ptr.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def is_free(self):
+        """
+        Returns a concrete determination as to whether the chunk is free.
+        """
+        raise NotImplementedError(f"{self.is_free.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def next_chunk(self):
+        """
+        Returns the chunk immediately following (and adjacent to) this one.
+        """
+        raise NotImplementedError(f"{self.next_chunk.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def prev_chunk(self):
+        """
+        Returns the chunk immediately prior (and adjacent) to this one.
+        """
+        raise NotImplementedError(f"{self.prev_chunk.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def fwd_chunk(self):
+        """
+        Returns the chunk following this chunk in the list of free chunks.
+        """
+        raise NotImplementedError(f"{self.fwd_chunk.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def set_fwd_chunk(self, fwd):
+        """
+        Sets the chunk following this chunk in the list of free chunks.
+
+        :param fwd: the chunk to follow this chunk in the list of free chunks
+        """
+        raise NotImplementedError(
+            f"{self.set_fwd_chunk.__func__.__name__} not implemented for {self.__class__.__name__}"
+        )
+
+    def bck_chunk(self):
+        """
+        Returns the chunk backward from this chunk in the list of free chunks.
+        """
+        raise NotImplementedError(f"{self.bck_chunk.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def set_bck_chunk(self, bck):
+        """
+        Sets the chunk backward from this chunk in the list of free chunks.
+
+        :param bck: the chunk to precede this chunk in the list of free chunks
+        """
+        raise NotImplementedError(
+            f"{self.set_bck_chunk.__func__.__name__} not implemented for {self.__class__.__name__}"
+        )
+
+    def _compare(self, other, comparison):
+        if self.state is other.state:
+            return comparison
+        else:
+            raise SimHeapError("Chunks must originate from the same simulation state to be compared!")
+
+    def __lt__(self, other):
+        """
+        Compares the base of this chunk with another chunk.
+        """
+        return self._compare(other, self.base < other.base)
+
+    def __le__(self, other):
+        """
+        Compares the base of this chunk with another chunk.
+        """
+        return self._compare(other, self.base <= other.base)
+
+    def __eq__(self, other):
+        """
+        Compares the base of this chunk with another chunk.
+        """
+        return self._compare(other, self.base == other.base)
+
+    def __ne__(self, other):
+        """
+        Compares the base of this chunk with another chunk.
+        """
+        return self._compare(other, self.base != other.base)
+
+    def __gt__(self, other):
+        """
+        Compares the base of this chunk with another chunk.
+        """
+        return self._compare(other, self.base > other.base)
+
+    def __ge__(self, other):
+        """
+        Compares the base of this chunk with another chunk.
+        """
+        return self._compare(other, self.base >= other.base)
+
+    def __repr__(self):
+        return "<{} ({} @ 0x{:x})>".format(self.__class__.__name__, "free" if self.is_free() else "used", self.base)
+
+
+class SimHeapFreelist(SimHeapLibc):
+    """
+    A freelist-style heap implementation. Distinguishing features of such heaps include chunks containing heap
+    metadata in addition to user data and at least (but often more than) one linked list of free chunks.
+    """
+
+    def __iter__(self):
+        return self.chunks()
+
+    def chunks(self):
+        """
+        Returns an iterator over all the chunks in the heap.
+        """
+        raise NotImplementedError(f"{self.chunks.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def allocated_chunks(self):
+        """
+        Returns an iterator over all the allocated chunks in the heap.
+        """
+        raise NotImplementedError(
+            f"{self.allocated_chunks.__func__.__name__} not implemented for {self.__class__.__name__}"
+        )
+
+    def free_chunks(self):
+        """
+        Returns an iterator over all the free chunks in the heap.
+        """
+        raise NotImplementedError(f"{self.free_chunks.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def chunk_from_mem(self, ptr):
+        """
+        Given a pointer to a user payload, return the chunk associated with that payload.
+
+        :param ptr: a pointer to the base of a user payload in the heap
+        :returns: the associated heap chunk
+        """
+        raise NotImplementedError(
+            f"{self.chunk_from_mem.__func__.__name__} not implemented for {self.__class__.__name__}"
+        )
+
+    def print_heap_state(self):
+        print("|-------------------------------|")
+        print("|--------- HEAP CHUNKS ---------|")
+        for ck in self.chunks():
+            print("│ " + str(ck) + " │")
+        print("|--------- USED CHUNKS ---------|")
+        for ck in self.allocated_chunks():
+            print("│ " + str(ck) + " │")
+        print("|--------- FREE CHUNKS ---------|")
+        for ck in self.free_chunks():
+            print("│ " + str(ck) + " │")
+        print("|-------------------------------|")
+
+    def print_all_chunks(self):
+        print("|-------------------------------|")
+        print("|--------- HEAP CHUNKS ---------|")
+        for ck in self.chunks():
+            print("│ " + str(ck) + " │")
+        print("|-------------------------------|")

angr/state_plugins/heap/heap_libc.py

@@ -0,0 +1,45 @@
+from . import SimHeapBase
+
+
+class SimHeapLibc(SimHeapBase):
+    """
+    A class of heap that implements the major libc heap management functions.
+    """
+
+    def malloc(self, sim_size):
+        """
+        A somewhat faithful implementation of libc `malloc`.
+
+        :param sim_size: the amount of memory (in bytes) to be allocated
+        :returns:        the address of the allocation, or a NULL pointer if the allocation failed
+        """
+        raise NotImplementedError(f"{self.malloc.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def free(self, ptr):  # pylint:disable=unused-argument
+        """
+        A somewhat faithful implementation of libc `free`.
+
+        :param ptr: the location in memory to be freed
+        """
+        raise NotImplementedError(f"{self.free.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def calloc(self, sim_nmemb, sim_size):
+        """
+        A somewhat faithful implementation of libc `calloc`.
+
+        :param     sim_nmemb: the number of elements to allocated
+        :param     sim_size: the size of each element (in bytes)
+        :returns:  the address of the allocation, or a NULL pointer if the allocation failed
+        """
+        raise NotImplementedError(f"{self.calloc.__func__.__name__} not implemented for {self.__class__.__name__}")
+
+    def realloc(self, ptr, size):
+        """
+        A somewhat faithful implementation of libc `realloc`.
+
+        :param ptr:  the location in memory to be reallocated
+        :param size: the new size desired for the allocation
+        :returns:    the address of the allocation, or a NULL pointer if the allocation was freed or if no new
+                     allocation was made
+        """
+        raise NotImplementedError(f"{self.realloc.__func__.__name__} not implemented for {self.__class__.__name__}")