angr 9.2.131__py3-none-manylinux2014_aarch64.whl → 9.2.133__py3-none-manylinux2014_aarch64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +128 -128
- angr/analyses/__init__.py +38 -38
- angr/analyses/analysis.py +6 -2
- angr/analyses/backward_slice.py +3 -4
- angr/analyses/binary_optimizer.py +5 -12
- angr/analyses/bindiff.py +3 -6
- angr/analyses/calling_convention.py +3 -4
- angr/analyses/cfg/__init__.py +3 -3
- angr/analyses/cfg/cfg_base.py +1 -1
- angr/analyses/cfg/cfg_emulated.py +5 -5
- angr/analyses/cfg/cfg_fast.py +19 -17
- angr/analyses/cfg/indirect_jump_resolvers/__init__.py +5 -5
- angr/analyses/cfg/indirect_jump_resolvers/amd64_elf_got.py +1 -1
- angr/analyses/cfg/indirect_jump_resolvers/jumptable.py +148 -101
- angr/analyses/cfg/indirect_jump_resolvers/x86_elf_pic_plt.py +1 -1
- angr/analyses/data_dep/__init__.py +4 -4
- angr/analyses/datagraph_meta.py +1 -1
- angr/analyses/ddg.py +16 -17
- angr/analyses/decompiler/__init__.py +12 -12
- angr/analyses/decompiler/ail_simplifier.py +24 -12
- angr/analyses/decompiler/block_similarity.py +2 -4
- angr/analyses/decompiler/block_simplifier.py +10 -21
- angr/analyses/decompiler/callsite_maker.py +1 -1
- angr/analyses/decompiler/ccall_rewriters/rewriter_base.py +1 -1
- angr/analyses/decompiler/clinic.py +122 -41
- angr/analyses/decompiler/condition_processor.py +57 -39
- angr/analyses/decompiler/counters/__init__.py +3 -3
- angr/analyses/decompiler/decompilation_cache.py +7 -7
- angr/analyses/decompiler/dephication/__init__.py +1 -1
- angr/analyses/decompiler/dephication/graph_rewriting.py +1 -1
- angr/analyses/decompiler/dephication/graph_vvar_mapping.py +11 -3
- angr/analyses/decompiler/dephication/rewriting_engine.py +169 -45
- angr/analyses/decompiler/dephication/seqnode_dephication.py +5 -4
- angr/analyses/decompiler/expression_narrower.py +1 -1
- angr/analyses/decompiler/graph_region.py +8 -8
- angr/analyses/decompiler/optimization_passes/__init__.py +20 -20
- angr/analyses/decompiler/optimization_passes/const_derefs.py +1 -0
- angr/analyses/decompiler/optimization_passes/deadblock_remover.py +1 -2
- angr/analyses/decompiler/optimization_passes/div_simplifier.py +41 -16
- angr/analyses/decompiler/optimization_passes/duplication_reverter/duplication_reverter.py +8 -7
- angr/analyses/decompiler/optimization_passes/duplication_reverter/utils.py +1 -3
- angr/analyses/decompiler/optimization_passes/engine_base.py +262 -84
- angr/analyses/decompiler/optimization_passes/inlined_string_transformation_simplifier.py +175 -39
- angr/analyses/decompiler/optimization_passes/ite_region_converter.py +2 -5
- angr/analyses/decompiler/optimization_passes/lowered_switch_simplifier.py +5 -5
- angr/analyses/decompiler/optimization_passes/mod_simplifier.py +12 -3
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +42 -19
- angr/analyses/decompiler/optimization_passes/stack_canary_simplifier.py +9 -5
- angr/analyses/decompiler/peephole_optimizations/__init__.py +1 -1
- angr/analyses/decompiler/peephole_optimizations/base.py +6 -6
- angr/analyses/decompiler/peephole_optimizations/remove_noop_conversions.py +2 -0
- angr/analyses/decompiler/peephole_optimizations/rewrite_bit_extractions.py +1 -1
- angr/analyses/decompiler/presets/__init__.py +1 -1
- angr/analyses/decompiler/region_simplifiers/expr_folding.py +3 -3
- angr/analyses/decompiler/region_simplifiers/switch_cluster_simplifier.py +8 -12
- angr/analyses/decompiler/ssailification/rewriting.py +1 -2
- angr/analyses/decompiler/ssailification/rewriting_engine.py +139 -56
- angr/analyses/decompiler/ssailification/ssailification.py +2 -1
- angr/analyses/decompiler/ssailification/traversal.py +4 -6
- angr/analyses/decompiler/ssailification/traversal_engine.py +125 -42
- angr/analyses/decompiler/structured_codegen/__init__.py +5 -5
- angr/analyses/decompiler/structured_codegen/base.py +3 -3
- angr/analyses/decompiler/structured_codegen/c.py +39 -40
- angr/analyses/decompiler/structuring/__init__.py +3 -3
- angr/analyses/decompiler/structuring/phoenix.py +45 -29
- angr/analyses/decompiler/structuring/structurer_base.py +2 -2
- angr/analyses/decompiler/structuring/structurer_nodes.py +23 -14
- angr/analyses/deobfuscator/__init__.py +3 -3
- angr/analyses/deobfuscator/irsb_reg_collector.py +29 -60
- angr/analyses/deobfuscator/string_obf_finder.py +2 -2
- angr/analyses/deobfuscator/string_obf_opt_passes.py +1 -1
- angr/analyses/disassembly.py +4 -4
- angr/analyses/forward_analysis/__init__.py +1 -1
- angr/analyses/forward_analysis/visitors/graph.py +6 -6
- angr/analyses/init_finder.py +47 -22
- angr/analyses/loop_analysis.py +1 -1
- angr/analyses/loopfinder.py +1 -1
- angr/analyses/propagator/engine_base.py +21 -14
- angr/analyses/propagator/engine_vex.py +149 -179
- angr/analyses/propagator/outdated_definition_walker.py +12 -6
- angr/analyses/propagator/propagator.py +10 -28
- angr/analyses/propagator/top_checker_mixin.py +211 -5
- angr/analyses/propagator/vex_vars.py +4 -4
- angr/analyses/reaching_definitions/__init__.py +9 -9
- angr/analyses/reaching_definitions/call_trace.py +2 -2
- angr/analyses/reaching_definitions/dep_graph.py +1 -1
- angr/analyses/reaching_definitions/engine_ail.py +304 -329
- angr/analyses/reaching_definitions/engine_vex.py +243 -229
- angr/analyses/reaching_definitions/function_handler.py +3 -3
- angr/analyses/reaching_definitions/function_handler_library/__init__.py +1 -1
- angr/analyses/reaching_definitions/rd_state.py +47 -42
- angr/analyses/reassembler.py +26 -31
- angr/analyses/s_liveness.py +8 -0
- angr/analyses/s_propagator.py +18 -3
- angr/analyses/s_reaching_definitions/s_rda_view.py +2 -5
- angr/analyses/s_reaching_definitions/s_reaching_definitions.py +9 -5
- angr/analyses/stack_pointer_tracker.py +4 -4
- angr/analyses/typehoon/simple_solver.py +14 -14
- angr/analyses/typehoon/translator.py +10 -2
- angr/analyses/typehoon/typeconsts.py +11 -3
- angr/analyses/typehoon/typevars.py +26 -26
- angr/analyses/unpacker/__init__.py +1 -1
- angr/analyses/variable_recovery/engine_ail.py +299 -259
- angr/analyses/variable_recovery/engine_base.py +138 -121
- angr/analyses/variable_recovery/engine_vex.py +175 -185
- angr/analyses/variable_recovery/irsb_scanner.py +49 -38
- angr/analyses/variable_recovery/variable_recovery.py +28 -5
- angr/analyses/variable_recovery/variable_recovery_base.py +33 -34
- angr/analyses/variable_recovery/variable_recovery_fast.py +4 -8
- angr/analyses/veritesting.py +2 -2
- angr/analyses/vfg.py +5 -5
- angr/analyses/xrefs.py +46 -19
- angr/angrdb/serializers/__init__.py +1 -1
- angr/annocfg.py +20 -15
- angr/blade.py +2 -2
- angr/block.py +20 -25
- angr/calling_conventions.py +12 -14
- angr/code_location.py +6 -10
- angr/codenode.py +3 -3
- angr/engines/__init__.py +12 -14
- angr/engines/engine.py +24 -61
- angr/engines/light/__init__.py +13 -5
- angr/engines/light/data.py +1 -1
- angr/engines/light/engine.py +1003 -1185
- angr/engines/pcode/__init__.py +1 -1
- angr/engines/pcode/behavior.py +1 -1
- angr/engines/pcode/cc.py +2 -0
- angr/engines/pcode/lifter.py +13 -15
- angr/engines/soot/expressions/__init__.py +12 -12
- angr/engines/soot/statements/__init__.py +6 -6
- angr/engines/soot/values/__init__.py +6 -6
- angr/engines/soot/values/arrayref.py +2 -2
- angr/engines/soot/values/constants.py +1 -1
- angr/engines/soot/values/instancefieldref.py +1 -1
- angr/engines/soot/values/paramref.py +1 -1
- angr/engines/soot/values/staticfieldref.py +1 -1
- angr/engines/successors.py +15 -14
- angr/engines/vex/__init__.py +5 -5
- angr/engines/vex/claripy/ccall.py +2 -2
- angr/engines/vex/claripy/datalayer.py +1 -1
- angr/engines/vex/claripy/irop.py +19 -19
- angr/engines/vex/heavy/__init__.py +2 -2
- angr/engines/vex/heavy/actions.py +1 -3
- angr/engines/vex/heavy/heavy.py +4 -6
- angr/engines/vex/lifter.py +2 -4
- angr/engines/vex/light/light.py +0 -2
- angr/engines/vex/light/slicing.py +5 -5
- angr/exploration_techniques/__init__.py +19 -142
- angr/exploration_techniques/base.py +126 -0
- angr/exploration_techniques/bucketizer.py +1 -1
- angr/exploration_techniques/dfs.py +3 -1
- angr/exploration_techniques/director.py +2 -3
- angr/exploration_techniques/driller_core.py +1 -1
- angr/exploration_techniques/explorer.py +4 -2
- angr/exploration_techniques/lengthlimiter.py +2 -1
- angr/exploration_techniques/local_loop_seer.py +2 -1
- angr/exploration_techniques/loop_seer.py +5 -5
- angr/exploration_techniques/manual_mergepoint.py +2 -1
- angr/exploration_techniques/memory_watcher.py +3 -1
- angr/exploration_techniques/oppologist.py +4 -5
- angr/exploration_techniques/slicecutor.py +4 -2
- angr/exploration_techniques/spiller.py +1 -1
- angr/exploration_techniques/stochastic.py +2 -1
- angr/exploration_techniques/stub_stasher.py +2 -1
- angr/exploration_techniques/suggestions.py +3 -1
- angr/exploration_techniques/symbion.py +3 -1
- angr/exploration_techniques/tech_builder.py +2 -1
- angr/exploration_techniques/threading.py +2 -11
- angr/exploration_techniques/timeout.py +4 -2
- angr/exploration_techniques/tracer.py +4 -3
- angr/exploration_techniques/unique.py +3 -2
- angr/exploration_techniques/veritesting.py +1 -1
- angr/factory.py +36 -6
- angr/keyed_region.py +4 -4
- angr/knowledge_base.py +1 -1
- angr/knowledge_plugins/__init__.py +11 -11
- angr/knowledge_plugins/cfg/__init__.py +5 -5
- angr/knowledge_plugins/cfg/cfg_manager.py +2 -2
- angr/knowledge_plugins/cfg/cfg_model.py +8 -8
- angr/knowledge_plugins/cfg/cfg_node.py +19 -19
- angr/knowledge_plugins/cfg/indirect_jump.py +6 -6
- angr/knowledge_plugins/cfg/memory_data.py +5 -7
- angr/knowledge_plugins/functions/function.py +48 -52
- angr/knowledge_plugins/functions/function_parser.py +4 -4
- angr/knowledge_plugins/key_definitions/__init__.py +3 -3
- angr/knowledge_plugins/key_definitions/atoms.py +8 -8
- angr/knowledge_plugins/key_definitions/definition.py +1 -1
- angr/knowledge_plugins/key_definitions/live_definitions.py +30 -27
- angr/knowledge_plugins/labels.py +1 -1
- angr/knowledge_plugins/propagations/__init__.py +1 -1
- angr/knowledge_plugins/propagations/prop_value.py +2 -2
- angr/knowledge_plugins/propagations/propagation_model.py +7 -8
- angr/knowledge_plugins/propagations/states.py +44 -39
- angr/knowledge_plugins/variables/variable_access.py +2 -2
- angr/knowledge_plugins/variables/variable_manager.py +24 -10
- angr/knowledge_plugins/xrefs/xref.py +5 -8
- angr/misc/__init__.py +4 -4
- angr/misc/hookset.py +4 -5
- angr/misc/loggers.py +2 -2
- angr/misc/telemetry.py +1 -1
- angr/procedures/__init__.py +1 -1
- angr/procedures/cgc/fdwait.py +2 -2
- angr/procedures/definitions/__init__.py +2 -2
- angr/procedures/definitions/linux_kernel.py +0 -1
- angr/procedures/definitions/parse_syscalls_from_local_system.py +1 -1
- angr/procedures/definitions/parse_win32json.py +0 -1
- angr/procedures/ntdll/exceptions.py +1 -1
- angr/procedures/stubs/format_parser.py +3 -3
- angr/procedures/win32/dynamic_loading.py +1 -1
- angr/protos/__init__.py +3 -3
- angr/sim_manager.py +3 -5
- angr/sim_state.py +40 -42
- angr/sim_state_options.py +3 -3
- angr/sim_type.py +15 -14
- angr/sim_variable.py +42 -45
- angr/simos/__init__.py +4 -4
- angr/simos/cgc.py +1 -1
- angr/simos/simos.py +1 -1
- angr/simos/userland.py +1 -1
- angr/slicer.py +4 -7
- angr/state_plugins/__init__.py +34 -34
- angr/state_plugins/callstack.py +5 -12
- angr/state_plugins/heap/__init__.py +2 -2
- angr/state_plugins/heap/heap_brk.py +2 -4
- angr/state_plugins/heap/heap_ptmalloc.py +1 -1
- angr/state_plugins/jni_references.py +3 -2
- angr/state_plugins/scratch.py +1 -1
- angr/state_plugins/sim_action.py +1 -4
- angr/state_plugins/sim_event.py +1 -1
- angr/state_plugins/solver.py +7 -9
- angr/state_plugins/uc_manager.py +1 -1
- angr/state_plugins/view.py +2 -2
- angr/storage/__init__.py +1 -1
- angr/storage/file.py +10 -10
- angr/storage/memory_mixins/__init__.py +46 -46
- angr/storage/memory_mixins/default_filler_mixin.py +1 -3
- angr/storage/memory_mixins/javavm_memory_mixin.py +2 -2
- angr/storage/memory_mixins/name_resolution_mixin.py +2 -2
- angr/storage/memory_mixins/paged_memory/paged_memory_mixin.py +1 -3
- angr/storage/memory_mixins/paged_memory/pages/__init__.py +6 -6
- angr/storage/memory_mixins/paged_memory/pages/list_page.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/multi_values.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/mv_list_page.py +1 -1
- angr/storage/memory_mixins/paged_memory/pages/ultra_page.py +2 -4
- angr/storage/memory_mixins/regioned_memory/__init__.py +3 -3
- angr/storage/memory_mixins/regioned_memory/region_data.py +5 -5
- angr/storage/memory_mixins/regioned_memory/region_meta_mixin.py +7 -9
- angr/storage/memory_mixins/regioned_memory/regioned_memory_mixin.py +4 -4
- angr/storage/memory_object.py +4 -4
- angr/utils/__init__.py +3 -3
- angr/utils/bits.py +12 -0
- angr/utils/dynamic_dictlist.py +1 -1
- angr/utils/graph.py +1 -1
- angr/utils/orderedset.py +4 -1
- angr/utils/segment_list.py +2 -2
- angr/utils/ssa/__init__.py +33 -8
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/METADATA +6 -6
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/RECORD +262 -263
- angr/analyses/propagator/engine_ail.py +0 -1562
- angr/storage/memory_mixins/__init__.pyi +0 -48
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/LICENSE +0 -0
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/WHEEL +0 -0
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/entry_points.txt +0 -0
- {angr-9.2.131.dist-info → angr-9.2.133.dist-info}/top_level.txt +0 -0
|
@@ -1,129 +1,6 @@
|
|
|
1
|
-
# pylint:disable=unused-import,missing-class-docstring,wrong-import-position
|
|
2
1
|
from __future__ import annotations
|
|
3
|
-
import angr # For type annotations
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
class ExplorationTechnique:
|
|
7
|
-
"""
|
|
8
|
-
An otiegnqwvk is a set of hooks for a simulation manager that assists in the implementation of new techniques in
|
|
9
|
-
symbolic exploration.
|
|
10
|
-
|
|
11
|
-
TODO: choose actual name for the functionality (techniques? strategies?)
|
|
12
|
-
|
|
13
|
-
Any number of these methods may be overridden by a subclass.
|
|
14
|
-
To use an exploration technique, call ``simgr.use_technique`` with an *instance* of the technique.
|
|
15
|
-
"""
|
|
16
|
-
|
|
17
|
-
# this is the master list of hook functinos
|
|
18
|
-
_hook_list = ("step", "filter", "selector", "step_state", "successors")
|
|
19
|
-
|
|
20
|
-
def _get_hooks(self):
|
|
21
|
-
return {name: getattr(self, name) for name in self._hook_list if self._is_overridden(name)}
|
|
22
|
-
|
|
23
|
-
def _is_overridden(self, name):
|
|
24
|
-
return getattr(self, name).__code__ is not getattr(ExplorationTechnique, name).__code__
|
|
25
|
-
|
|
26
|
-
def __init__(self):
|
|
27
|
-
# this attribute will be set from above by the manager
|
|
28
|
-
if not hasattr(self, "project"):
|
|
29
|
-
self.project: angr.project.Project = None
|
|
30
|
-
|
|
31
|
-
def setup(self, simgr):
|
|
32
|
-
"""
|
|
33
|
-
Perform any initialization on this manager you might need to do.
|
|
34
|
-
|
|
35
|
-
:param angr.SimulationManager simgr: The simulation manager to which you have just been added
|
|
36
|
-
"""
|
|
37
|
-
|
|
38
|
-
def step(self, simgr, stash="active", **kwargs): # pylint:disable=no-self-use
|
|
39
|
-
"""
|
|
40
|
-
Hook the process of stepping a stash forward. Should call ``simgr.step(stash, **kwargs)`` in order to do the
|
|
41
|
-
actual processing.
|
|
42
|
-
|
|
43
|
-
:param angr.SimulationManager simgr:
|
|
44
|
-
:param str stash:
|
|
45
|
-
"""
|
|
46
|
-
simgr.step(stash=stash, **kwargs)
|
|
47
|
-
|
|
48
|
-
def filter(self, simgr, state, **kwargs): # pylint:disable=no-self-use
|
|
49
|
-
"""
|
|
50
|
-
Perform filtering on which stash a state should be inserted into.
|
|
51
|
-
|
|
52
|
-
If the state should be filtered, return the name of the stash to move the state to.
|
|
53
|
-
If you want to modify the state before filtering it, return a tuple of the stash to move the state to and the
|
|
54
|
-
modified state.
|
|
55
|
-
To defer to the original categorization procedure, return the result of ``simgr.filter(state, **kwargs)``
|
|
56
|
-
|
|
57
|
-
If the user provided a ``filter_func`` in their step or run command, it will appear here.
|
|
58
|
-
|
|
59
|
-
:param angr.SimulationManager simgr:
|
|
60
|
-
:param angr.SimState state:
|
|
61
|
-
"""
|
|
62
|
-
return simgr.filter(state, **kwargs)
|
|
63
|
-
|
|
64
|
-
def selector(self, simgr, state, **kwargs): # pylint:disable=no-self-use
|
|
65
|
-
"""
|
|
66
|
-
Determine if a state should participate in the current round of stepping.
|
|
67
|
-
Return True if the state should be stepped, and False if the state should not be stepped.
|
|
68
|
-
To defer to the original selection procedure, return the result of ``simgr.selector(state, **kwargs)``.
|
|
69
|
-
|
|
70
|
-
If the user provided a ``selector_func`` in their step or run command, it will appear here.
|
|
71
|
-
|
|
72
|
-
:param angr.SimulationManager simgr:
|
|
73
|
-
:param angr.SimState state:
|
|
74
|
-
"""
|
|
75
|
-
return simgr.selector(state, **kwargs)
|
|
76
|
-
|
|
77
|
-
def step_state(self, simgr, state, **kwargs): # pylint:disable=no-self-use
|
|
78
|
-
"""
|
|
79
|
-
Determine the categorization of state successors into stashes. The result should be a dict mapping stash names
|
|
80
|
-
to the list of successor states that fall into that stash, or None as a stash name to use the original stash
|
|
81
|
-
name.
|
|
82
|
-
|
|
83
|
-
If you would like to directly work with a `SimSuccessors` object, you can obtain it with
|
|
84
|
-
``simgr.successors(state, **kwargs)``. This is not recommended, as it denies other hooks the opportunity to
|
|
85
|
-
look at the successors. Therefore, the usual technique is to call ``simgr.step_state(state, **kwargs)`` and
|
|
86
|
-
then mutate the returned dict before returning it yourself.
|
|
87
|
-
|
|
88
|
-
..note:: This takes precedence over the `filter` hook - `filter` is only applied to states returned from here
|
|
89
|
-
in the None stash.
|
|
90
|
-
|
|
91
|
-
:param angr.SimulationManager simgr:
|
|
92
|
-
:param angr.SimState state:
|
|
93
|
-
"""
|
|
94
|
-
return simgr.step_state(state, **kwargs)
|
|
95
|
-
|
|
96
|
-
def successors(self, simgr, state, **kwargs): # pylint:disable=no-self-use
|
|
97
|
-
"""
|
|
98
|
-
Perform the process of stepping a state forward, returning a SimSuccessors object.
|
|
99
|
-
|
|
100
|
-
To defer to the original succession procedure, return the result of ``simgr.successors(state, **kwargs)``.
|
|
101
|
-
Be careful about not calling this method (e.g. calling ``project.factory.successors`` manually) as it denies
|
|
102
|
-
other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs for the step before
|
|
103
|
-
calling the original, and mutate the result before returning it yourself.
|
|
104
|
-
|
|
105
|
-
If the user provided a ``successor_func`` in their step or run command, it will appear here.
|
|
106
|
-
|
|
107
|
-
:param angr.SimulationManager simgr:
|
|
108
|
-
:param angr.SimState state:
|
|
109
|
-
"""
|
|
110
|
-
return simgr.successors(state, **kwargs)
|
|
111
|
-
|
|
112
|
-
def complete(self, simgr): # pylint:disable=no-self-use,unused-argument
|
|
113
|
-
"""
|
|
114
|
-
Return whether or not this manager has reached a "completed" state, i.e. ``SimulationManager.run()`` should
|
|
115
|
-
halt.
|
|
116
|
-
|
|
117
|
-
This is the one hook which is *not* subject to the nesting rules of hooks.
|
|
118
|
-
You should *not* call ``simgr.complete``, you should make your own decision and return True or False.
|
|
119
|
-
Each of the techniques' completion checkers will be called and the final result will be compted with
|
|
120
|
-
``simgr.completion_mode``.
|
|
121
|
-
|
|
122
|
-
:param angr.SimulationManager simgr:
|
|
123
|
-
"""
|
|
124
|
-
return False
|
|
125
|
-
|
|
126
2
|
|
|
3
|
+
from .base import ExplorationTechnique
|
|
127
4
|
from .slicecutor import Slicecutor
|
|
128
5
|
from .driller_core import DrillerCore
|
|
129
6
|
from .loop_seer import LoopSeer
|
|
@@ -149,30 +26,30 @@ from .suggestions import Suggestions
|
|
|
149
26
|
from .stub_stasher import StubStasher
|
|
150
27
|
|
|
151
28
|
__all__ = (
|
|
152
|
-
"
|
|
153
|
-
"
|
|
29
|
+
"DFS",
|
|
30
|
+
"Bucketizer",
|
|
31
|
+
"CallFunctionGoal",
|
|
32
|
+
"Director",
|
|
154
33
|
"DrillerCore",
|
|
155
|
-
"
|
|
156
|
-
"
|
|
34
|
+
"ExecuteAddressGoal",
|
|
35
|
+
"ExplorationTechnique",
|
|
157
36
|
"Explorer",
|
|
158
|
-
"Threading",
|
|
159
|
-
"DFS",
|
|
160
37
|
"LengthLimiter",
|
|
161
|
-
"
|
|
38
|
+
"LocalLoopSeer",
|
|
39
|
+
"LoopSeer",
|
|
40
|
+
"ManualMergepoint",
|
|
41
|
+
"MemoryWatcher",
|
|
162
42
|
"Oppologist",
|
|
163
|
-
"
|
|
164
|
-
"ExecuteAddressGoal",
|
|
165
|
-
"CallFunctionGoal",
|
|
43
|
+
"Slicecutor",
|
|
166
44
|
"Spiller",
|
|
167
|
-
"ManualMergepoint",
|
|
168
|
-
"TechniqueBuilder",
|
|
169
45
|
"StochasticSearch",
|
|
170
|
-
"
|
|
46
|
+
"StubStasher",
|
|
47
|
+
"Suggestions",
|
|
171
48
|
"Symbion",
|
|
172
|
-
"
|
|
173
|
-
"
|
|
174
|
-
"LocalLoopSeer",
|
|
49
|
+
"TechniqueBuilder",
|
|
50
|
+
"Threading",
|
|
175
51
|
"Timeout",
|
|
176
|
-
"
|
|
177
|
-
"
|
|
52
|
+
"Tracer",
|
|
53
|
+
"UniqueSearch",
|
|
54
|
+
"Veritesting",
|
|
178
55
|
)
|
|
@@ -0,0 +1,126 @@
|
|
|
1
|
+
from __future__ import annotations
|
|
2
|
+
|
|
3
|
+
from typing import TYPE_CHECKING
|
|
4
|
+
|
|
5
|
+
if TYPE_CHECKING:
|
|
6
|
+
import angr
|
|
7
|
+
|
|
8
|
+
|
|
9
|
+
class ExplorationTechnique:
|
|
10
|
+
"""
|
|
11
|
+
An ExplorationTechnique is a set of hooks for a simulation manager that
|
|
12
|
+
assists in the implementation of new techniques in symbolic exploration.
|
|
13
|
+
|
|
14
|
+
Any number of these methods may be overridden by a subclass.
|
|
15
|
+
To use an exploration technique, call ``simgr.use_technique`` with an
|
|
16
|
+
*instance* of the technique.
|
|
17
|
+
"""
|
|
18
|
+
|
|
19
|
+
# this is the master list of hook functinos
|
|
20
|
+
_hook_list = ("step", "filter", "selector", "step_state", "successors")
|
|
21
|
+
|
|
22
|
+
def _get_hooks(self):
|
|
23
|
+
return {name: getattr(self, name) for name in self._hook_list if self._is_overridden(name)}
|
|
24
|
+
|
|
25
|
+
def _is_overridden(self, name):
|
|
26
|
+
return getattr(self, name).__code__ is not getattr(ExplorationTechnique, name).__code__
|
|
27
|
+
|
|
28
|
+
def __init__(self):
|
|
29
|
+
# this attribute will be set from above by the manager
|
|
30
|
+
if not hasattr(self, "project"):
|
|
31
|
+
self.project: angr.Project = None
|
|
32
|
+
|
|
33
|
+
def setup(self, simgr):
|
|
34
|
+
"""
|
|
35
|
+
Perform any initialization on this manager you might need to do.
|
|
36
|
+
|
|
37
|
+
:param angr.SimulationManager simgr: The simulation manager to which you have just been added
|
|
38
|
+
"""
|
|
39
|
+
|
|
40
|
+
def step(self, simgr, stash="active", **kwargs): # pylint:disable=no-self-use
|
|
41
|
+
"""
|
|
42
|
+
Hook the process of stepping a stash forward. Should call ``simgr.step(stash, **kwargs)`` in order to do the
|
|
43
|
+
actual processing.
|
|
44
|
+
|
|
45
|
+
:param angr.SimulationManager simgr:
|
|
46
|
+
:param str stash:
|
|
47
|
+
"""
|
|
48
|
+
simgr.step(stash=stash, **kwargs)
|
|
49
|
+
|
|
50
|
+
def filter(self, simgr, state, **kwargs): # pylint:disable=no-self-use
|
|
51
|
+
"""
|
|
52
|
+
Perform filtering on which stash a state should be inserted into.
|
|
53
|
+
|
|
54
|
+
If the state should be filtered, return the name of the stash to move the state to.
|
|
55
|
+
If you want to modify the state before filtering it, return a tuple of the stash to move the state to and the
|
|
56
|
+
modified state.
|
|
57
|
+
To defer to the original categorization procedure, return the result of ``simgr.filter(state, **kwargs)``
|
|
58
|
+
|
|
59
|
+
If the user provided a ``filter_func`` in their step or run command, it will appear here.
|
|
60
|
+
|
|
61
|
+
:param angr.SimulationManager simgr:
|
|
62
|
+
:param angr.SimState state:
|
|
63
|
+
"""
|
|
64
|
+
return simgr.filter(state, **kwargs)
|
|
65
|
+
|
|
66
|
+
def selector(self, simgr, state, **kwargs): # pylint:disable=no-self-use
|
|
67
|
+
"""
|
|
68
|
+
Determine if a state should participate in the current round of stepping.
|
|
69
|
+
Return True if the state should be stepped, and False if the state should not be stepped.
|
|
70
|
+
To defer to the original selection procedure, return the result of ``simgr.selector(state, **kwargs)``.
|
|
71
|
+
|
|
72
|
+
If the user provided a ``selector_func`` in their step or run command, it will appear here.
|
|
73
|
+
|
|
74
|
+
:param angr.SimulationManager simgr:
|
|
75
|
+
:param angr.SimState state:
|
|
76
|
+
"""
|
|
77
|
+
return simgr.selector(state, **kwargs)
|
|
78
|
+
|
|
79
|
+
def step_state(self, simgr, state, **kwargs): # pylint:disable=no-self-use
|
|
80
|
+
"""
|
|
81
|
+
Determine the categorization of state successors into stashes. The result should be a dict mapping stash names
|
|
82
|
+
to the list of successor states that fall into that stash, or None as a stash name to use the original stash
|
|
83
|
+
name.
|
|
84
|
+
|
|
85
|
+
If you would like to directly work with a `SimSuccessors` object, you can obtain it with
|
|
86
|
+
``simgr.successors(state, **kwargs)``. This is not recommended, as it denies other hooks the opportunity to
|
|
87
|
+
look at the successors. Therefore, the usual technique is to call ``simgr.step_state(state, **kwargs)`` and
|
|
88
|
+
then mutate the returned dict before returning it yourself.
|
|
89
|
+
|
|
90
|
+
..note:: This takes precedence over the `filter` hook - `filter` is only applied to states returned from here
|
|
91
|
+
in the None stash.
|
|
92
|
+
|
|
93
|
+
:param angr.SimulationManager simgr:
|
|
94
|
+
:param angr.SimState state:
|
|
95
|
+
"""
|
|
96
|
+
return simgr.step_state(state, **kwargs)
|
|
97
|
+
|
|
98
|
+
def successors(self, simgr, state, **kwargs): # pylint:disable=no-self-use
|
|
99
|
+
"""
|
|
100
|
+
Perform the process of stepping a state forward, returning a SimSuccessors object.
|
|
101
|
+
|
|
102
|
+
To defer to the original succession procedure, return the result of ``simgr.successors(state, **kwargs)``.
|
|
103
|
+
Be careful about not calling this method (e.g. calling ``project.factory.successors`` manually) as it denies
|
|
104
|
+
other hooks the opportunity to instrument the step. Instead, you can mutate the kwargs for the step before
|
|
105
|
+
calling the original, and mutate the result before returning it yourself.
|
|
106
|
+
|
|
107
|
+
If the user provided a ``successor_func`` in their step or run command, it will appear here.
|
|
108
|
+
|
|
109
|
+
:param angr.SimulationManager simgr:
|
|
110
|
+
:param angr.SimState state:
|
|
111
|
+
"""
|
|
112
|
+
return simgr.successors(state, **kwargs)
|
|
113
|
+
|
|
114
|
+
def complete(self, simgr): # pylint:disable=no-self-use,unused-argument
|
|
115
|
+
"""
|
|
116
|
+
Return whether or not this manager has reached a "completed" state, i.e. ``SimulationManager.run()`` should
|
|
117
|
+
halt.
|
|
118
|
+
|
|
119
|
+
This is the one hook which is *not* subject to the nesting rules of hooks.
|
|
120
|
+
You should *not* call ``simgr.complete``, you should make your own decision and return True or False.
|
|
121
|
+
Each of the techniques' completion checkers will be called and the final result will be compted with
|
|
122
|
+
``simgr.completion_mode``.
|
|
123
|
+
|
|
124
|
+
:param angr.SimulationManager simgr:
|
|
125
|
+
"""
|
|
126
|
+
return False
|
|
@@ -2,15 +2,14 @@ from __future__ import annotations
|
|
|
2
2
|
import logging
|
|
3
3
|
from collections import defaultdict
|
|
4
4
|
|
|
5
|
-
import networkx
|
|
6
|
-
|
|
7
5
|
import claripy
|
|
6
|
+
import networkx
|
|
8
7
|
|
|
9
8
|
from angr.sim_type import SimType, SimTypePointer, SimTypeChar, SimTypeString, SimTypeReg
|
|
10
9
|
from angr.calling_conventions import default_cc
|
|
11
10
|
from angr.knowledge_base import KnowledgeBase
|
|
12
11
|
from angr.errors import AngrDirectorError
|
|
13
|
-
from . import ExplorationTechnique
|
|
12
|
+
from .base import ExplorationTechnique
|
|
14
13
|
|
|
15
14
|
l = logging.getLogger(name=__name__)
|
|
16
15
|
|
|
@@ -1,11 +1,13 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
|
+
|
|
2
3
|
import logging
|
|
4
|
+
|
|
3
5
|
import claripy
|
|
4
6
|
|
|
5
|
-
from . import ExplorationTechnique
|
|
6
|
-
from .common import condition_to_lambda
|
|
7
7
|
from angr import sim_options
|
|
8
8
|
from angr.state_plugins.sim_event import resource_event
|
|
9
|
+
from .base import ExplorationTechnique
|
|
10
|
+
from .common import condition_to_lambda
|
|
9
11
|
|
|
10
12
|
l = logging.getLogger(name=__name__)
|
|
11
13
|
|
|
@@ -1,10 +1,9 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
2
|
import logging
|
|
3
3
|
|
|
4
|
-
from . import ExplorationTechnique
|
|
5
4
|
from angr.knowledge_base import KnowledgeBase
|
|
6
5
|
from angr.knowledge_plugins.functions import Function
|
|
7
|
-
|
|
6
|
+
from .base import ExplorationTechnique
|
|
8
7
|
|
|
9
8
|
l = logging.getLogger(name=__name__)
|
|
10
9
|
|
|
@@ -52,6 +51,10 @@ class LoopSeer(ExplorationTechnique):
|
|
|
52
51
|
self.limit_concrete_loops = limit_concrete_loops
|
|
53
52
|
self.loops = {}
|
|
54
53
|
self.cut_succs = []
|
|
54
|
+
|
|
55
|
+
# Delayed import
|
|
56
|
+
from angr.analyses.loopfinder import Loop
|
|
57
|
+
|
|
55
58
|
if type(loops) is Loop:
|
|
56
59
|
loops = [loops]
|
|
57
60
|
|
|
@@ -231,6 +234,3 @@ class LoopSeer(ExplorationTechnique):
|
|
|
231
234
|
f = func
|
|
232
235
|
|
|
233
236
|
return f
|
|
234
|
-
|
|
235
|
-
|
|
236
|
-
from angr.analyses.loopfinder import Loop
|
|
@@ -1,18 +1,17 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
|
-
import claripy
|
|
3
2
|
import functools
|
|
4
|
-
|
|
5
3
|
import logging
|
|
6
4
|
|
|
7
|
-
|
|
5
|
+
import claripy
|
|
8
6
|
|
|
9
7
|
from angr.errors import AngrError, SimError, SimUnsupportedError, SimCCallError
|
|
10
8
|
from angr import sim_options
|
|
11
9
|
from angr.engines.successors import SimSuccessors
|
|
10
|
+
from .base import ExplorationTechnique
|
|
12
11
|
|
|
13
|
-
|
|
12
|
+
l = logging.getLogger(name=__name__)
|
|
14
13
|
|
|
15
|
-
|
|
14
|
+
exc_list = (AngrError, SimError, claripy.ClaripyError, TypeError, ValueError, ArithmeticError, MemoryError)
|
|
16
15
|
|
|
17
16
|
|
|
18
17
|
class Oppologist(ExplorationTechnique):
|
|
@@ -1,9 +1,11 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
|
-
from angr.errors import AngrExitError
|
|
3
|
-
from . import ExplorationTechnique
|
|
4
2
|
|
|
5
3
|
import logging
|
|
6
4
|
|
|
5
|
+
from angr.errors import AngrExitError
|
|
6
|
+
from .base import ExplorationTechnique
|
|
7
|
+
|
|
8
|
+
|
|
7
9
|
l = logging.getLogger(name=__name__)
|
|
8
10
|
|
|
9
11
|
|
|
@@ -1,12 +1,14 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
|
+
|
|
2
3
|
import logging
|
|
4
|
+
|
|
3
5
|
import claripy
|
|
4
6
|
|
|
5
|
-
from . import ExplorationTechnique
|
|
6
7
|
from angr.misc.ux import once
|
|
7
8
|
from angr.misc.picklable_lock import PicklableLock
|
|
8
9
|
from angr.state_plugins.sim_action import SimActionConstraint
|
|
9
10
|
from angr.state_plugins.sim_action_object import SimActionObject
|
|
11
|
+
from .base import ExplorationTechnique
|
|
10
12
|
|
|
11
13
|
l = logging.getLogger(__name__)
|
|
12
14
|
|
|
@@ -1,11 +1,9 @@
|
|
|
1
|
-
# pylint: disable=cell-var-from-loop
|
|
2
1
|
from __future__ import annotations
|
|
2
|
+
|
|
3
3
|
import concurrent.futures
|
|
4
4
|
import logging
|
|
5
5
|
|
|
6
|
-
from . import ExplorationTechnique
|
|
7
|
-
from angr.engines.engine import TLSMixin
|
|
8
|
-
from angr.misc.ux import once
|
|
6
|
+
from .base import ExplorationTechnique
|
|
9
7
|
|
|
10
8
|
l = logging.getLogger(__name__)
|
|
11
9
|
|
|
@@ -69,10 +67,3 @@ class Threading(ExplorationTechnique):
|
|
|
69
67
|
error_list = []
|
|
70
68
|
simgr.step(stash=self.local_stash, error_list=error_list, **kwargs)
|
|
71
69
|
return state, error_list, simgr
|
|
72
|
-
|
|
73
|
-
def successors(self, simgr, state, engine=None, **kwargs):
|
|
74
|
-
engine = engine or self.project.factory.default_engine
|
|
75
|
-
if not isinstance(engine, TLSMixin) and once("tls_engine"):
|
|
76
|
-
l.error("Using Threading exploration technique but your engine is not thread-safe.")
|
|
77
|
-
l.error("Do you want to add the TLSMixin to your engine?")
|
|
78
|
-
return simgr.successors(state, engine=engine, **kwargs)
|
|
@@ -1,14 +1,15 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
|
-
|
|
2
|
+
|
|
3
3
|
import logging
|
|
4
|
-
import
|
|
4
|
+
from typing import TYPE_CHECKING
|
|
5
5
|
|
|
6
6
|
import claripy
|
|
7
|
+
import cle
|
|
7
8
|
from capstone import CS_GRP_CALL, CS_GRP_IRET, CS_GRP_JUMP, CS_GRP_RET
|
|
8
9
|
|
|
9
|
-
from . import ExplorationTechnique
|
|
10
10
|
from angr import BP_BEFORE, BP_AFTER, sim_options
|
|
11
11
|
from angr.errors import AngrTracerError, SimIRSBNoDecodeError
|
|
12
|
+
from .base import ExplorationTechnique
|
|
12
13
|
|
|
13
14
|
if TYPE_CHECKING:
|
|
14
15
|
from angr.sim_state import SimState
|
|
@@ -1,8 +1,9 @@
|
|
|
1
1
|
from __future__ import annotations
|
|
2
|
-
|
|
2
|
+
|
|
3
3
|
from collections import Counter
|
|
4
|
+
from difflib import SequenceMatcher
|
|
4
5
|
|
|
5
|
-
from . import ExplorationTechnique
|
|
6
|
+
from .base import ExplorationTechnique
|
|
6
7
|
|
|
7
8
|
|
|
8
9
|
class UniqueSearch(ExplorationTechnique):
|