angr 9.2.165__cp310-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl

angr/analyses/cfg/indirect_jump_resolvers/memload_resolver.py

@@ -0,0 +1,81 @@
+from __future__ import annotations
+import logging
+
+import pyvex
+
+from .resolver import IndirectJumpResolver
+
+_l = logging.getLogger(name=__name__)
+
+
+class MemoryLoadResolver(IndirectJumpResolver):
+    """
+    Resolve an indirect jump that looks like the following::
+
+    .text:
+                    call    off_3314A8
+
+    .data:
+    off_3314A8      dd offset sub_1E426F
+
+    This indirect jump resolver may not be the best solution for all cases (e.g., when the .data section can be
+    intentionally altered by the binary itself).
+    """
+
+    def __init__(self, project):
+        super().__init__(project, timeless=True)
+
+    def filter(self, cfg, addr, func_addr, block, jumpkind):
+        return jumpkind in {"Ijk_Boring", "Ijk_Call"}
+
+    def resolve(  # pylint:disable=unused-argument
+        self,
+        cfg,
+        addr: int,
+        func_addr: int,
+        block: pyvex.IRSB,
+        jumpkind: str,
+        func_graph_complete: bool = True,
+        **kwargs,
+    ):
+        """
+        :param cfg:         CFG with specified function
+        :param addr:        Address of indirect jump
+        :param func_addr:   Address of function of indirect jump
+        :param block:       Block of indirect jump (Block object)
+        :param jumpkind:    VEX jumpkind (Ijk_Boring or Ijk_Call)
+        :return:            Bool tuple with replacement address
+        """
+        vex_block = block
+        if isinstance(vex_block.next, pyvex.expr.RdTmp):
+            tmp_stmt_idx, tmp_ins_addr = self._find_tmp_write_stmt_and_ins(vex_block, vex_block.next.tmp)
+            if tmp_stmt_idx is None or tmp_ins_addr is None:
+                return False, []
+
+            stmt = vex_block.statements[tmp_stmt_idx]
+            assert isinstance(stmt, pyvex.IRStmt.WrTmp)
+            if (
+                isinstance(stmt.data, pyvex.IRExpr.Load)
+                and isinstance(stmt.data.addr, pyvex.IRExpr.Const)
+                and stmt.data.result_size(vex_block.tyenv) == self.project.arch.bits
+            ):
+                load_addr = stmt.data.addr.con.value
+                try:
+                    value = self.project.loader.memory.unpack_word(load_addr, size=self.project.arch.bytes)
+                    if isinstance(value, int) and self._is_target_valid(cfg, value):
+                        return True, [value]
+                except KeyError:
+                    return False, []
+
+        return False, []
+
+    @staticmethod
+    def _find_tmp_write_stmt_and_ins(vex_block, tmp: int) -> tuple[int | None, int | None]:
+        stmt_idx = None
+        for idx, stmt in enumerate(reversed(vex_block.statements)):
+            if isinstance(stmt, pyvex.IRStmt.IMark) and stmt_idx is not None:
+                ins_addr = stmt.addr + stmt.delta
+                return stmt_idx, ins_addr
+            if isinstance(stmt, pyvex.IRStmt.WrTmp) and stmt.tmp == tmp:
+                stmt_idx = len(vex_block.statements) - idx - 1
+        return None, None

angr/analyses/cfg/indirect_jump_resolvers/mips_elf_fast.py

@@ -0,0 +1,286 @@
+# pylint:disable=too-many-boolean-expressions,global-statement,too-many-positional-arguments
+from __future__ import annotations
+from typing import TYPE_CHECKING
+import logging
+from enum import Enum
+
+import archinfo
+import pyvex
+
+
+from angr.blade import Blade
+from angr.utils.constants import DEFAULT_STATEMENT
+from .resolver import IndirectJumpResolver
+
+if TYPE_CHECKING:
+    from angr.block import Block
+
+
+l = logging.getLogger(name=__name__)
+
+PROFILING = False
+HITS_CASE_1, HITS_CASE_2, MISSES = 0, 0, 0
+
+
+def enable_profiling():
+    global PROFILING, HITS_CASE_1, HITS_CASE_2, MISSES
+
+    PROFILING = True
+    HITS_CASE_1 = 0
+    HITS_CASE_2 = 0
+    MISSES = 0
+
+
+def disable_profiling():
+    global PROFILING
+    PROFILING = False
+
+
+class Case2Result(Enum):
+    """
+    Describes the result of resolving case 2 function calls.
+    """
+
+    SUCCESS = 0
+    FAILURE = 1
+    RESUME = 2
+
+
+class MipsElfFastResolver(IndirectJumpResolver):
+    """
+    A timeless indirect jump resolver for R9-based indirect function calls in MIPS ELFs.
+    """
+
+    def __init__(self, project):
+        super().__init__(project, timeless=True)
+
+    def filter(self, cfg, addr, func_addr, block, jumpkind):
+        return isinstance(self.project.arch, (archinfo.ArchMIPS32, archinfo.ArchMIPS64))
+
+    def resolve(  # pylint:disable=unused-argument
+        self, cfg, addr, func_addr, block, jumpkind, func_graph_complete: bool = True, **kwargs
+    ):
+        """
+        Wrapper for _resolve that slowly increments the max_depth used by Blade for finding sources
+        until we can resolve the addr or we reach the default max_depth
+
+        :param cfg: A CFG instance.
+        :param int addr: IRSB address.
+        :param int func_addr: The function address.
+        :param pyvex.IRSB block: The IRSB.
+        :param str jumpkind: The jumpkind.
+        :return: If it was resolved and targets alongside it
+        :rtype: tuple
+        """
+        global MISSES
+
+        resolved, resolved_targets = self._resolve(cfg, addr, func_addr, block, jumpkind, max_level=2)
+        if resolved:
+            return resolved, resolved_targets
+
+        if PROFILING:
+            MISSES += 1
+        return False, []
+
+    def _resolve(self, cfg, addr, func_addr, block, jumpkind, max_level):  # pylint:disable=unused-argument
+        """
+        Resolves the indirect jump in MIPS ELF binaries where all external function calls are indexed using gp.
+
+        :param cfg: A CFG instance.
+        :param int addr: IRSB address.
+        :param int func_addr: The function address.
+        :param pyvex.IRSB block: The IRSB.
+        :param str jumpkind: The jumpkind.
+        :param int max_level: maximum level for Blade to resolve when looking for sources
+        :return: If it was resolved and targets alongside it
+        :rtype: tuple
+        """
+
+        global HITS_CASE_1, HITS_CASE_2
+
+        func = cfg.kb.functions.function(addr=func_addr)
+        b = Blade(
+            cfg.graph,
+            addr,
+            -1,
+            cfg=cfg,
+            project=self.project,
+            ignore_sp=True,
+            ignore_bp=True,
+            ignored_regs=("gp",),
+            cross_insn_opt=False,
+            stop_at_calls=True,
+            max_level=max_level,
+            include_imarks=False,
+        )
+
+        gp_value = func.info.get("gp", None)
+
+        # see if gp is used on this slice at all
+        gp_used = self._is_gp_used_on_slice(self.project, b)
+        if gp_used and gp_value is None:
+            # this might a special case: gp is only used once in this function, and it can be initialized right
+            # before its use site.
+            # however, it should have been determined in CFGFast
+            # cannot determine the value of gp. quit
+            l.warning("Failed to determine value of register gp for function %#x.", func.addr)
+            return False, []
+
+        # we support two cases:
+        # Case 1. t9 is set in the current block, and jalr $t9 at the end of the same block.
+        # Case 2. t9 is set in both predecessor blocks, and jalr $t9 at the end of the current block.
+
+        block_addrs = {block_addr for block_addr, _ in b.slice}
+        if len(block_addrs) == 2 and addr in block_addrs:
+            first_block_addr = next(iter(block_addrs - {addr}))
+            r, target = self._resolve_case_2(first_block_addr, block, func_addr, gp_value, cfg)
+            if r == Case2Result.SUCCESS:
+                if PROFILING:
+                    HITS_CASE_2 += 1
+                return True, [target]
+            if r == Case2Result.FAILURE:
+                return False, []
+            # otherwise, we need to resume the analysis
+
+        target = self._resolve_case_1(addr, block, func_addr, gp_value, cfg)
+        if target is not None:
+            if PROFILING:
+                HITS_CASE_1 += 1
+            return True, [target]
+
+        # no luck
+        return False, []
+
+    def _resolve_case_1(self, addr: int, block: pyvex.IRSB, func_addr: int, gp_value: int, cfg) -> int | None:
+        # lift the block again with the correct setting
+
+        inital_regs = [(self.project.arch.registers["t9"][0], self.project.arch.registers["t9"][1], func_addr)]
+        if gp_value is not None:
+            inital_regs.append((self.project.arch.registers["gp"][0], self.project.arch.registers["gp"][1], gp_value))
+
+        first_irsb = self.project.factory.block(
+            addr,
+            size=block.size,
+            collect_data_refs=False,
+            const_prop=True,
+            cross_insn_opt=False,
+            load_from_ro_regions=True,
+            initial_regs=inital_regs,
+        ).vex_nostmt
+
+        if not isinstance(first_irsb.next, pyvex.IRExpr.RdTmp):
+            return None
+        target_tmp = first_irsb.next.tmp
+        if first_irsb.const_vals is None:
+            return None
+
+        # find the value of the next tmp
+        for cv in first_irsb.const_vals:
+            if cv.tmp == target_tmp:
+                target = cv.value
+                if self._is_target_valid(cfg, target):
+                    return target
+                break
+
+        return None
+
+    def _resolve_case_2(
+        self, first_block_addr: int, second_block: pyvex.IRSB, func_addr: int, gp_value: int, cfg
+    ) -> tuple[Case2Result, int | None]:
+        jump_target_reg = self._get_jump_target_reg(second_block)
+        if jump_target_reg is None:
+            return Case2Result.FAILURE, None
+        last_reg_setting_tmp = self._get_last_reg_setting_tmp(second_block, jump_target_reg)
+        if last_reg_setting_tmp is not None:
+            # the register (t9) is set in this block - we can resolve the jump target using only the current block
+            return Case2Result.RESUME, None
+
+        inital_regs = [(self.project.arch.registers["t9"][0], self.project.arch.registers["t9"][1], func_addr)]
+        if gp_value is not None:
+            inital_regs.append((self.project.arch.registers["gp"][0], self.project.arch.registers["gp"][1], gp_value))
+
+        # lift the first block again with the correct setting
+        first_irsb = self.project.factory.block(
+            first_block_addr,
+            cross_insn_opt=False,
+            collect_data_refs=False,
+            const_prop=True,
+            load_from_ro_regions=True,
+            initial_regs=inital_regs,
+        ).vex_nostmt
+
+        last_reg_setting_tmp = self._get_last_reg_setting_tmp(first_irsb, jump_target_reg)
+        if last_reg_setting_tmp is None:
+            return Case2Result.FAILURE, None
+
+        # find the value of the next tmp
+        if first_irsb.const_vals is None:
+            return Case2Result.FAILURE, None
+        for cv in first_irsb.const_vals:
+            if cv.tmp == last_reg_setting_tmp:
+                target = cv.value
+                if self._is_target_valid(cfg, target):
+                    return Case2Result.SUCCESS, target
+                break
+
+        return Case2Result.FAILURE, None
+
+    @staticmethod
+    def _get_jump_target_reg(block: pyvex.IRSB) -> int | None:
+        if block.jumpkind != "Ijk_Call":
+            return None
+        if not isinstance(block.next, pyvex.IRExpr.RdTmp):
+            return None
+        next_tmp = block.next.tmp
+
+        for stmt in reversed(block.statements):
+            if (
+                isinstance(stmt, pyvex.IRStmt.Put)
+                and isinstance(stmt.data, pyvex.IRExpr.RdTmp)
+                and stmt.data.tmp == next_tmp
+            ):
+                return stmt.offset
+            if (
+                isinstance(stmt, pyvex.IRStmt.WrTmp)
+                and stmt.tmp == next_tmp
+                and isinstance(stmt.data, pyvex.IRExpr.Get)
+            ):
+                return stmt.data.offset
+
+        return None
+
+    @staticmethod
+    def _get_last_reg_setting_tmp(block: pyvex.IRSB, target_reg: int) -> int | None:
+        for stmt in reversed(block.statements):
+            if isinstance(stmt, pyvex.IRStmt.Put) and stmt.offset == target_reg:
+                if isinstance(stmt.data, pyvex.IRExpr.RdTmp):
+                    return stmt.data.tmp
+                return None
+
+        return None
+
+    @staticmethod
+    def _is_gp_used_on_slice(project, b: Blade) -> bool:
+        gp_offset = project.arch.registers["gp"][0]
+        blocks_on_slice: dict[int, Block] = {}
+        for block_addr, block_stmt_idx in b.slice.nodes():
+            if block_addr not in blocks_on_slice:
+                blocks_on_slice[block_addr] = project.factory.block(block_addr, cross_insn_opt=False)
+            block = blocks_on_slice[block_addr]
+            if block_stmt_idx == DEFAULT_STATEMENT:
+                if isinstance(block.vex.next, pyvex.IRExpr.Get) and block.vex.next.offset == gp_offset:
+                    gp_used = True
+                    break
+            else:
+                stmt = block.vex.statements[block_stmt_idx]
+                if (
+                    isinstance(stmt, pyvex.IRStmt.WrTmp)
+                    and isinstance(stmt.data, pyvex.IRExpr.Get)
+                    and stmt.data.offset == gp_offset
+                ):
+                    gp_used = True
+                    break
+        else:
+            gp_used = False
+
+        return gp_used

angr/analyses/cfg/indirect_jump_resolvers/mips_elf_got.py

@@ -0,0 +1,148 @@
+# pylint:disable=too-many-positional-arguments
+from __future__ import annotations
+import logging
+
+from capstone.mips_const import (
+    MIPS_REG_T7,
+    MIPS_REG_T8,
+    MIPS_REG_T9,
+    MIPS_REG_RA,
+    MIPS_REG_ZERO,
+    MIPS_OP_REG,
+    MIPS_OP_IMM,
+)
+
+import cle
+
+from .resolver import IndirectJumpResolver
+
+l = logging.getLogger(name=__name__)
+
+
+class MipsElfGotResolver(IndirectJumpResolver):
+    """
+    A timeless indirect jump resolver that resolves GOT stub entries in MIPS ELF binaries.
+
+    Reference: MIPS Assembly Language Programmer's Guide, Calling Position Independent Functions
+    """
+
+    def __init__(self, project):
+        super().__init__(project, timeless=True)
+
+        self._section_cache: dict[tuple[int, str], int] = {}
+        self._simproc_cache: dict[str, int] | None = None
+
+    def filter(self, cfg, addr, func_addr, block, jumpkind):
+        return jumpkind == "Ijk_Call" and addr == func_addr
+
+    def resolve(  # pylint:disable=unused-argument
+        self, cfg, addr, func_addr, block, jumpkind, func_graph_complete: bool = True, **kwargs
+    ):
+        # The stub must look like the following:
+        #   585b80  lw      $t9, -0x7ff0($gp)
+        #   585b84  move    $t7, $ra
+        #   585b88  jalr    $t9
+        #   585b8c  addiu   $t8, $zero, 0x84b
+
+        obj = self.project.loader.find_object_containing(addr)
+        if obj is None:
+            return False, []
+        if not isinstance(obj, cle.ELF):
+            return False, []
+        dynsym_addr = self._find_and_cache_section_addr(obj, ".dynsym")
+        if dynsym_addr is None:
+            return False, []
+
+        dynstr_addr = self._find_and_cache_section_addr(obj, ".dynstr")
+        if dynstr_addr is None:
+            return False, []
+
+        if block.size != 16:
+            return False, []
+        the_block = self.project.factory.block(block.addr, size=block.size)
+        if len(the_block.capstone.insns) != 4:
+            return False, []
+
+        insn0 = the_block.capstone.insns[0]
+        if not (
+            insn0.insn.mnemonic == "lw"
+            and insn0.insn.operands[0].type == MIPS_OP_REG
+            and insn0.insn.operands[0].reg == MIPS_REG_T9
+        ):
+            return False, []
+
+        insn1 = the_block.capstone.insns[1]
+        if not (
+            insn1.insn.mnemonic == "move"
+            and insn1.insn.operands[0].type == MIPS_OP_REG
+            and insn1.insn.operands[0].reg == MIPS_REG_T7
+            and insn1.insn.operands[1].type == MIPS_OP_REG
+            and insn1.insn.operands[1].reg == MIPS_REG_RA
+        ):
+            return False, []
+
+        insn2 = the_block.capstone.insns[2]
+        if not (
+            insn2.insn.mnemonic == "jalr"
+            and insn2.insn.operands[0].type == MIPS_OP_REG
+            and insn2.insn.operands[0].reg == MIPS_REG_T9
+        ):
+            return False, []
+
+        insn3 = the_block.capstone.insns[3]
+        if not (
+            insn3.insn.mnemonic == "addiu"
+            and insn3.insn.operands[0].type == MIPS_OP_REG
+            and insn3.insn.operands[0].reg == MIPS_REG_T8
+            and insn3.insn.operands[1].type == MIPS_OP_REG
+            and insn3.insn.operands[1].reg == MIPS_REG_ZERO
+            and insn3.insn.operands[2].type == MIPS_OP_IMM
+        ):
+            return False, []
+
+        dynsym_index = insn3.insn.operands[2].imm
+        symbol_addr = dynsym_addr + dynsym_index * 16
+
+        symbol_name_index = self.project.loader.memory.unpack_word(symbol_addr, size=4)
+        symbol_name_addr = dynstr_addr + symbol_name_index
+        symbol_name_bytes = self.project.loader.memory.load_null_terminated_bytes(symbol_name_addr, 512)
+
+        try:
+            symbol_name = symbol_name_bytes.strip(b"\x00").decode("ascii")
+        except UnicodeDecodeError:
+            return False, []
+
+        symbol = obj.symbols_by_name.get(symbol_name, None)
+        if symbol is None:
+            return False, []
+
+        if symbol.rebased_addr != func_addr:
+            l.debug("Resolved target to %s @ %#x", symbol_name, symbol.rebased_addr)
+            return True, [symbol.rebased_addr]
+
+        # find out if there is a SimProcedure for this import symbol
+        simproc_addr = self._cache_and_find_simproc_by_name(symbol_name)
+        if simproc_addr is not None:
+            l.debug("Resolved target to %s @ %#x", symbol_name, simproc_addr)
+            return True, [simproc_addr]
+        return False, []
+
+    def _find_and_cache_section_addr(self, obj, section_name: str) -> int | None:
+        cache_key = (obj.min_addr, section_name)
+        if cache_key in self._section_cache:
+            return self._section_cache[cache_key]
+
+        for sec in obj.sections:
+            if sec.name == section_name:
+                # cache it
+                self._section_cache[cache_key] = sec.vaddr
+                return sec.vaddr
+        return None
+
+    def _cache_and_find_simproc_by_name(self, symbol_name: str) -> int | None:
+        if self._simproc_cache is None:
+            self._simproc_cache = {}
+            for addr, simproc in self.project._sim_procedures.items():
+                self._simproc_cache[simproc.display_name] = addr
+
+        return self._simproc_cache.get(symbol_name)

angr/analyses/cfg/indirect_jump_resolvers/propagator_utils.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+import claripy
+
+
+class PropagatorLoadCallback:
+    """
+    Implement the load callback for Propagator that should be used across all jump table resolvers.
+    """
+
+    def __init__(self, project):
+        self.project = project
+
+    def propagator_load_callback(self, addr: claripy.ast.BV | int, size: int) -> bool:  # pylint:disable=unused-argument
+        # only allow loading if the address falls into a read-only region
+        if isinstance(addr, claripy.ast.BV) and addr.op == "BVV":
+            addr_v = addr.args[0]
+        elif isinstance(addr, int):
+            addr_v = addr
+        else:
+            return False
+        section = self.project.loader.find_section_containing(addr_v)
+        segment = None
+        if section is not None:
+            if section.is_readable and not section.is_writable:
+                # read-only section
+                return True
+        else:
+            segment = self.project.loader.find_segment_containing(addr_v)
+            if segment is not None and segment.is_readable and not segment.is_writable:
+                # read-only segment
+                return True
+
+        if (size == self.project.arch.bytes and (section is not None and section.is_readable)) or (
+            segment is not None and segment.is_readable
+        ):
+            # memory is mapped and readable. does it contain a valid address?
+            try:
+                target_addr = self.project.loader.memory.unpack_word(
+                    addr_v, size=size, endness=self.project.arch.memory_endness
+                )
+                if target_addr >= 0x1000 and self.project.loader.find_object_containing(target_addr) is not None:
+                    return True
+            except KeyError:
+                return False
+
+        return False

angr/analyses/cfg/indirect_jump_resolvers/resolver.py

@@ -0,0 +1,74 @@
+from __future__ import annotations
+import typing
+
+from angr.errors import SimMemoryError
+
+if typing.TYPE_CHECKING:
+    from angr import Project
+
+
+class IndirectJumpResolver:
+    def __init__(self, project, timeless=False, base_state=None):
+        self.project: Project = project
+        self.timeless = timeless
+        self.base_state = base_state
+
+    def filter(self, cfg, addr, func_addr, block, jumpkind):
+        """
+        Check if this resolution method may be able to resolve the indirect jump or not.
+
+        :param int addr:        Basic block address of this indirect jump.
+        :param int func_addr:   Address of the function that this indirect jump belongs to.
+        :param block:           The basic block. The type is determined by the backend being used. It's pyvex.IRSB if
+                                pyvex is used as the backend.
+        :param str jumpkind:    The jumpkind.
+        :return: True if it is possible for this resolution method to resolve the specific indirect jump, False
+                 otherwise.
+        :rtype:  bool
+        """
+
+        raise NotImplementedError
+
+    def resolve(self, cfg, addr, func_addr, block, jumpkind, func_graph_complete: bool = True, **kwargs):
+        """
+        Resolve an indirect jump.
+
+        :param cfg:             The CFG analysis object.
+        :param int addr:        Basic block address of this indirect jump.
+        :param int func_addr:   Address of the function that this indirect jump belongs to.
+        :param block:           The basic block. The type is determined by the backend being used. It's pyvex.IRSB if
+                                pyvex is used as the backend.
+        :param str jumpkind:    The jumpkind.
+        :param func_graph_complete: True if the function graph is complete at this point (except for nodes that this
+                                indirect jump node dominates).
+        :return:                A tuple of a boolean indicating whether the resolution is successful or not, and a list
+                                of resolved targets (ints).
+        :rtype:                 tuple
+        """
+
+        raise NotImplementedError
+
+    def _is_target_valid(self, cfg, target):  # pylint:disable=no-self-use
+        """
+        Check if the resolved target is valid.
+
+        :param cfg:         The CFG analysis object.
+        :param int target:  The target to check.
+        :return:            True if the target is valid. False otherwise.
+        :rtype:             bool
+        """
+
+        if self.base_state is not None:
+            try:
+                if self.base_state.solver.is_true((self.base_state.memory.permissions(target) & 4) == 4):
+                    return True
+            except SimMemoryError:
+                pass
+            return False
+
+        if cfg._addr_in_exec_memory_regions(target):
+            # the jump target is executable
+            return True
+
+        # if true, the jump target is hooked
+        return bool(self.project.is_hooked(target))