angr 9.2.165__cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

angr/procedures/libc/error.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+import angr
+
+
+class error(angr.SimProcedure):
+    # pylint:disable=arguments-differ,missing-class-docstring
+
+    NO_RET = None
+    DYNAMIC_RET = True
+
+    def run(self, status, errnum, fmt):  # pylint:disable=unused-argument
+        fd = self.state.posix.get_fd(1)
+        fprintf = angr.SIM_PROCEDURES["libc"]["fprintf"]
+        self.inline_call(fprintf, fd, fmt)  # FIXME: This will not properly replace format strings
+
+        if status.concrete and self.state.solver.eval(status) != 0:
+            self.exit(status)
+
+    def dynamic_returns(self, blocks, **kwargs) -> bool:
+        # Execute those blocks with a blank state, and then dump the arguments
+        blank_state = angr.SimState(
+            project=self.project,
+            mode="fastpath",
+            cle_memory_backer=self.project.loader.memory,
+            add_options={
+                angr.options.SYMBOL_FILL_UNCONSTRAINED_MEMORY,
+                angr.options.SYMBOL_FILL_UNCONSTRAINED_REGISTERS,
+            },
+        )
+        # Execute each block
+        state = blank_state
+        for idx, b in enumerate(blocks):
+            successors = self.project.factory.default_engine.process(state, irsb=b, force_addr=b.addr)
+            if successors.all_successors:
+                state = successors.all_successors[0]
+                # if it was a call before reaching the last block, pick the one with Ijk_FakeRet
+                if (
+                    idx < len(blocks) - 1
+                    and b.jumpkind
+                    and (b.jumpkind == "Ijk_Call" or b.jumpkind.startswith("Ijk_Sys"))
+                ):
+                    fakerets = [succ for succ in successors.all_successors if succ.history.jumpkind == "Ijk_FakeRet"]
+                    if fakerets:
+                        state = fakerets[0]
+            else:
+                break
+
+        # take a look at the first argument (status)
+        cc = angr.default_cc(
+            self.arch.name, platform=self.project.simos.name if self.project.simos is not None else None
+        )(self.arch)
+        ty = angr.sim_type.parse_signature("void x(int, int, char*)").with_arch(self.arch)
+        args = cc.get_args(state, ty)
+        return bool(args[0].concrete and state.solver.eval(args[0]) == 0)

angr/procedures/libc/exit.py

@@ -0,0 +1,11 @@
+from __future__ import annotations
+import angr
+
+
+class exit(angr.SimProcedure):  # pylint:disable=redefined-builtin
+    # pylint:disable=arguments-differ
+
+    NO_RET = True
+
+    def run(self, exit_code):
+        self.exit(exit_code)

angr/procedures/libc/fclose.py

@@ -0,0 +1,19 @@
+from __future__ import annotations
+import angr
+
+from cle.backends.externs.simdata.io_file import io_file_data_for_arch
+
+
+class fclose(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, fd_p):
+        # Resolve file descriptor
+        fd_offset = io_file_data_for_arch(self.state.arch)["fd"]
+        fileno = self.state.mem[fd_p + fd_offset :].int.resolved
+
+        # TODO: use a procedure that's not a linux syscall
+        sys_close = angr.SIM_PROCEDURES["posix"]["close"]
+
+        # Call system close and return
+        return self.inline_call(sys_close, fileno).ret_expr

angr/procedures/libc/feof.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+import claripy
+from cle.backends.externs.simdata.io_file import io_file_data_for_arch
+
+import angr
+
+
+class feof(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, file_ptr):
+        # TODO handle errors
+        fd_offset = io_file_data_for_arch(self.state.arch)["fd"]
+        fileno = self.state.mem[file_ptr + fd_offset :].int.concrete
+        simfd = self.state.posix.get_fd(fileno)
+        if simfd is None:
+            return None
+        return claripy.If(simfd.eof(), claripy.BVV(1, self.arch.sizeof["int"]), 0)
+
+
+feof_unlocked = feof

angr/procedures/libc/fflush.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+import angr
+
+import logging
+
+l = logging.getLogger(name=__name__)
+
+
+class fflush(angr.SimProcedure):
+    # pylint:disable=arguments-differ,unused-argument
+
+    def run(self, fd):
+        return 0
+
+
+fflush_unlocked = fflush

angr/procedures/libc/fgetc.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+import claripy
+
+import angr
+
+
+class fgetc(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+    def run(self, stream, simfd=None):
+        if simfd is None:
+            fileno = angr.SIM_PROCEDURES["posix"]["fileno"]
+            fd = self.inline_call(fileno, stream).ret_expr
+            simfd = self.state.posix.get_fd(fd)
+
+        if simfd is None:
+            return -1
+
+        (
+            data,
+            real_length,
+        ) = simfd.read_data(1)
+        return claripy.If(real_length == 0, -1, data.zero_extend(self.arch.sizeof["int"] - 8))
+
+
+getc = fgetc
+fgetc_unlocked = fgetc
+getc_unlocked = fgetc

angr/procedures/libc/fgets.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+import claripy
+from cle.backends.externs.simdata.io_file import io_file_data_for_arch
+
+import angr
+from angr.storage.memory_mixins.address_concretization_mixin import MultiwriteAnnotation
+
+
+class fgets(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, dst, size, file_ptr):
+        size = size.zero_extend(self.arch.bits - self.arch.sizeof["int"])
+
+        # let's get the memory back for the file we're interested in and find the newline
+        fd_offset = io_file_data_for_arch(self.state.arch)["fd"]
+        fd = self.state.mem[file_ptr + fd_offset :].int.resolved
+        simfd = self.state.posix.get_fd(fd)
+        if simfd is None:
+            return -1
+
+        # case 0: empty read
+        if self.state.solver.is_true(size == 0):
+            return 0
+
+        # case 1: the data is concrete. we should read it a byte at a time since we can't seek for
+        # the newline and we don't have any notion of buffering in-memory
+        if simfd.read_storage.concrete and not size.symbolic:
+            size = self.state.solver.eval(size)
+            count = 0
+            while count < size - 1:
+                data, real_size = simfd.read_data(1)
+                if self.state.solver.is_true(real_size == 0):
+                    break
+                self.state.memory.store(dst + count, data)
+                count += 1
+                if self.state.solver.is_true(data == b"\n"):
+                    break
+            self.state.memory.store(dst + count, b"\0")
+            return count
+
+        # case 2: the data is symbolic, the newline could be anywhere. Read the maximum number of bytes
+        # (SHORT_READS should take care of the variable length) and add a constraint to assert the
+        # newline nonsense.
+        # caveat: there could also be no newline and the file could EOF.
+        data, real_size = simfd.read_data(size - 1)
+
+        for i, byte in enumerate(data.chop(8)):
+            self.state.add_constraints(
+                claripy.If(
+                    i + 1 != real_size,
+                    byte != b"\n",  # if not last byte returned, not newline
+                    claripy.Or(  # otherwise one of the following must be true:
+                        i + 2 == size,  # - we ran out of space, or
+                        simfd.eof(),  # - the file is at EOF, or
+                        byte == b"\n",  # - it is a newline
+                    ),
+                )
+            )
+        self.state.memory.store(dst, data, size=real_size)
+        end_address = dst + real_size
+        end_address = end_address.annotate(MultiwriteAnnotation())
+        self.state.memory.store(end_address, b"\0")
+
+        return real_size
+
+
+fgets_unlocked = fgets

angr/procedures/libc/fopen.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+import claripy
+from cle.backends.externs.simdata.io_file import io_file_data_for_arch
+
+import angr
+
+
+def mode_to_flag(mode):
+    # TODO improve this: handle mode = strings
+    if mode[-1] == ord("b") or mode[-1] == ord("t"):  # lol who uses windows
+        mode = mode[:-1]
+    mode = mode.replace(b"c", b"").replace(b"e", b"")
+    all_modes = {
+        b"r": angr.storage.file.Flags.O_RDONLY,
+        b"r+": angr.storage.file.Flags.O_RDWR,
+        b"w": angr.storage.file.Flags.O_WRONLY | angr.storage.file.Flags.O_CREAT,
+        b"w+": angr.storage.file.Flags.O_RDWR | angr.storage.file.Flags.O_CREAT,
+        b"a": angr.storage.file.Flags.O_WRONLY | angr.storage.file.Flags.O_CREAT | angr.storage.file.Flags.O_APPEND,
+        b"a+": angr.storage.file.Flags.O_RDWR | angr.storage.file.Flags.O_CREAT | angr.storage.file.Flags.O_APPEND,
+    }
+    if mode not in all_modes:
+        raise angr.SimProcedureError(f"unsupported file open mode {mode}")
+
+    return all_modes[mode]
+
+
+class fopen(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, p_addr, m_addr):
+        strlen = angr.SIM_PROCEDURES["libc"]["strlen"]
+
+        p_strlen = self.inline_call(strlen, p_addr)
+        m_strlen = self.inline_call(strlen, m_addr)
+        p_expr = self.state.memory.load(p_addr, p_strlen.max_null_index, endness="Iend_BE")
+        m_expr = self.state.memory.load(m_addr, m_strlen.max_null_index, endness="Iend_BE")
+        path = self.state.solver.eval(p_expr, cast_to=bytes)
+        mode = self.state.solver.eval(m_expr, cast_to=bytes)
+
+        # TODO: handle append
+        fd = self.state.posix.open(path, mode_to_flag(mode))
+        fd_concr = self.state.posix.get_concrete_fd(fd)
+
+        if fd_concr == -1:
+            # if open failed return NULL
+            return 0
+
+        # Allocate a FILE struct in heap
+        malloc = angr.SIM_PROCEDURES["libc"]["malloc"]
+        io_file_data = io_file_data_for_arch(self.state.arch)
+        file_struct_ptr = self.inline_call(malloc, io_file_data["size"]).ret_expr
+
+        # Write the fd
+        size = 4  # int
+        self.state.memory.store(
+            file_struct_ptr + io_file_data["fd"], fd, size=size, endness=self.state.arch.memory_endness
+        )
+
+        if self.state.solver.is_true(fd == fd_concr):
+            return file_struct_ptr
+        # still possible that open failed
+        null = claripy.BVV(0, self.state.arch.bits)
+        return claripy.If(fd == fd_concr, file_struct_ptr, null)

angr/procedures/libc/fprintf.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+import logging
+
+from angr.procedures.stubs.format_parser import FormatParser
+
+from cle.backends.externs.simdata.io_file import io_file_data_for_arch
+
+l = logging.getLogger(name=__name__)
+
+
+class fprintf(FormatParser):
+    def run(self, file_ptr, fmt):  # pylint:disable=unused-argument
+        fd_offset = io_file_data_for_arch(self.state.arch)["fd"]
+        fileno = self.state.mem[file_ptr + fd_offset :].int.resolved
+        simfd = self.state.posix.get_fd(fileno)
+        if simfd is None:
+            return -1
+
+        # The format str is at index 1
+        fmt_str = self._parse(fmt)
+        out_str = fmt_str.replace(self.va_arg)
+
+        simfd.write_data(out_str, out_str.size() // 8)
+
+        return out_str.size() // 8

angr/procedures/libc/fputc.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+import angr
+
+from cle.backends.externs.simdata.io_file import io_file_data_for_arch
+
+
+class fputc(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, c, file_ptr):
+        fd_offset = io_file_data_for_arch(self.state.arch)["fd"]
+        fileno = self.state.mem[file_ptr + fd_offset :].int.resolved
+        simfd = self.state.posix.get_fd(fileno)
+        if simfd is None:
+            return -1
+
+        simfd.write_data(c[7:0])
+        return c & 0xFF
+
+
+putc = fputc
+fputc_unlocked = fputc
+putc_unlocked = fputc

angr/procedures/libc/fputs.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+import angr
+
+from cle.backends.externs.simdata.io_file import io_file_data_for_arch
+
+
+class fputs(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, str_addr, file_ptr):
+        # TODO handle errors
+        fd_offset = io_file_data_for_arch(self.state.arch)["fd"]
+        fileno = self.state.mem[file_ptr + fd_offset :].int.resolved
+        simfd = self.state.posix.get_fd(fileno)
+        if simfd is None:
+            return -1
+
+        strlen = angr.SIM_PROCEDURES["libc"]["strlen"]
+        p_strlen = self.inline_call(strlen, str_addr)
+        simfd.write(str_addr, p_strlen.max_null_index)
+        return 1
+
+
+fputs_unlocked = fputs

angr/procedures/libc/fread.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+import claripy
+from cle.backends.externs.simdata.io_file import io_file_data_for_arch
+
+import angr
+
+
+class fread(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, dst, size, nm, file_ptr):
+        # TODO handle errors
+
+        fd_offset = io_file_data_for_arch(self.state.arch)["fd"]
+        fd = self.state.mem[file_ptr + fd_offset :].int.resolved
+        simfd = self.state.posix.get_fd(fd)
+        if simfd is None:
+            return -1
+
+        ret = simfd.read(dst, size * nm)
+        return claripy.If(claripy.Or(size == 0, nm == 0), 0, ret // size)
+
+
+fread_unlocked = fread

angr/procedures/libc/free.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+import angr
+
+
+class free(angr.SimProcedure):
+    # pylint:disable=arguments-differ,unused-argument
+
+    def run(self, ptr):
+        self.state.heap._free(ptr)

angr/procedures/libc/fscanf.py

@@ -0,0 +1,20 @@
+from __future__ import annotations
+from angr.procedures.stubs.format_parser import ScanfFormatParser
+
+from cle.backends.externs.simdata.io_file import io_file_data_for_arch
+
+
+class fscanf(ScanfFormatParser):
+    # pylint:disable=arguments-differ
+
+    def run(self, file_ptr, fmt):  # pylint:disable=unused-argument
+        # TODO handle errors
+
+        fd_offset = io_file_data_for_arch(self.state.arch)["fd"]
+        fd = self.state.mem[file_ptr + fd_offset :].int.resolved
+        simfd = self.state.posix.get_fd(fd)
+        if simfd is None:
+            return -1
+
+        fmt_str = self._parse(fmt)
+        return fmt_str.interpret(self.va_arg, simfd=simfd)

angr/procedures/libc/fseek.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+import claripy
+from cle.backends.externs.simdata.io_file import io_file_data_for_arch
+
+import angr
+from angr.errors import SimSolverError
+
+
+class fseek(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, file_ptr, offset, whence):
+        # TODO: Support symbolic file_ptr, offset, and whence
+
+        # Make sure whence can only be one of the three values: SEEK_SET(0), SEEK_CUR(1), and SEEK_END(2)
+        try:
+            whence = self.state.solver.eval_one(whence)
+        except SimSolverError as err:
+            raise angr.SimProcedureError('multi-valued "whence" is not supported in fseek.') from err
+
+        try:
+            whence = {0: "start", 1: "current", 2: "end"}[whence]
+        except KeyError:
+            return -1  # EINVAL
+
+        fd_offset = io_file_data_for_arch(self.state.arch)["fd"]
+        fd = self.state.mem[file_ptr + fd_offset].int.resolved
+        simfd = self.state.posix.get_fd(fd)
+        if simfd is None:
+            return -1
+        return claripy.If(simfd.seek(offset, whence), claripy.BVV(0, self.arch.sizeof["int"]), -1)
+
+
+fseeko = fseek

angr/procedures/libc/ftell.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+import angr
+
+from cle.backends.externs.simdata.io_file import io_file_data_for_arch
+
+
+class ftell(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, file_ptr):
+        fd_offset = io_file_data_for_arch(self.state.arch)["fd"]
+        fd = self.state.mem[file_ptr + fd_offset].int.resolved
+        simfd = self.state.posix.get_fd(fd)
+        if simfd is None:
+            return -1
+        pos = simfd.tell()
+        if pos is None:
+            return -1
+        return pos
+
+
+ftello = ftell

angr/procedures/libc/fwrite.py

@@ -0,0 +1,19 @@
+from __future__ import annotations
+import angr
+
+from cle.backends.externs.simdata.io_file import io_file_data_for_arch
+
+
+class fwrite(angr.SimProcedure):
+    # pylint:disable=arguments-differ
+
+    def run(self, src, size, nmemb, file_ptr):
+        fd_offset = io_file_data_for_arch(self.state.arch)["fd"]
+        fileno = self.state.mem[file_ptr + fd_offset :].int.resolved
+        simfd = self.state.posix.get_fd(fileno)
+        if simfd is None:
+            return -1
+        return simfd.write(src, size * nmemb)
+
+
+fwrite_unlocked = fwrite

angr/procedures/libc/getchar.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+import angr
+
+
+class getchar(angr.SimProcedure):
+    # pylint: disable=arguments-differ
+    def run(self):
+        fgetc = angr.SIM_PROCEDURES["libc"]["fgetc"]
+        stdin = self.state.posix.get_fd(0)
+        return self.inline_call(fgetc, 0, simfd=stdin).ret_expr
+
+
+getchar_unlocked = getchar

angr/procedures/libc/getdelim.py

@@ -0,0 +1,99 @@
+from __future__ import annotations
+import logging
+
+import claripy
+from cle.backends.externs.simdata.io_file import io_file_data_for_arch
+
+import angr
+
+
+l = logging.getLogger(name=__name__)
+
+
+class __getdelim(angr.SimProcedure):
+    # this code is modified from the 'fgets' implementation
+    #   to take an arbitrary delimiter
+    #   with no max size for concrete data
+
+    # pylint: disable=arguments-differ
+    def run(self, line_ptrptr, len_ptr, delim, file_ptr):
+        # let's get the memory back for the file we're interested in and find the delimiter
+        fd_offset = io_file_data_for_arch(self.state.arch)["fd"]
+        fd = self.state.mem[file_ptr + fd_offset :].int.resolved
+        simfd = self.state.posix.get_fd(fd)
+        if simfd is None:
+            return -1
+
+        # symbolic delimiters will make this tricky
+        if delim.symbolic:
+            raise angr.SimProcedureError("I don't know how to handle a symbolic delimiter")
+
+        # case 1: the data is concrete. we should read it a byte at a time since we can't seek for
+        # the newline and we don't have any notion of buffering in-memory
+        if simfd.read_storage.concrete:
+            if self.state.solver.is_true(simfd.eof()):
+                # End-of-file reached
+                return -1
+
+            realloc = angr.SIM_PROCEDURES["libc"]["realloc"]
+
+            # #dereference the destination buffer
+            line_ptr = self.state.memory.load(line_ptrptr, 8)
+            size = 120
+            # im just always going to realloc and restart at size = 120, regardless of if a proper size buffer exists.
+            # this doesn't match the exact behavior of get delim, but is the easiest way to ignore symbolic sizes.
+            dst = self.inline_call(realloc, line_ptr, size).ret_expr
+
+            count = 0
+            while True:
+                data, real_size = simfd.read_data(1)
+                if self.state.solver.is_true(real_size == 0):
+                    break
+                self.state.memory.store(dst + count, data)
+                count += 1
+                if count == size:
+                    size = count + size + 1
+                    dst = self.inline_call(realloc, dst, size).ret_expr
+                if delim.size() > data.size():
+                    data = data.zero_extend(delim.size() - data.size())
+                if self.state.solver.is_true(data == delim):
+                    break
+
+            self.state.memory.store(dst + count, b"\0")
+            self.state.memory.store(len_ptr, count)
+            self.state.memory.store(line_ptrptr, dst)
+            return count
+
+        # case 2: the data is symbolic, the delimiter could be anywhere. Read some maximum number of bytes
+        # and add a constraint to assert the delimiter nonsense.
+        # caveat: there could also be no delimiter and the file could EOF.
+        # Just a guess as to a good value for a max size
+        size = 1024
+
+        data, real_size = simfd.read_data(size - 1)
+        delim_byte = chr(self.state.solver.eval(delim))
+
+        for i, byte in enumerate(data.chop(8)):
+            self.state.add_constraints(
+                claripy.If(
+                    i + 1 != real_size,
+                    byte != delim_byte,  # if not last byte returned, not newline
+                    claripy.Or(  # otherwise one of the following must be true:
+                        i + 2 == size,  # - we ran out of space, or
+                        simfd.eof(),  # - the file is at EOF, or
+                        byte == delim_byte,  # - it is a newline
+                    ),
+                )
+            )
+
+        malloc = angr.SIM_PROCEDURES["libc"]["malloc"]
+
+        dst = self.inline_call(malloc, real_size).ret_expr
+
+        self.state.memory.store(dst, data, size=real_size)
+        self.state.memory.store(dst + real_size, b"\0")
+
+        self.state.memory.store(len_ptr, real_size)
+        self.state.memory.store(line_ptrptr, dst)
+
+        return real_size

angr/procedures/libc/getegid.py

@@ -0,0 +1,8 @@
+from __future__ import annotations
+import angr
+
+
+class getegid(angr.SimProcedure):
+    # pylint: disable=arguments-differ
+    def run(self):
+        return 1000

angr/procedures/libc/geteuid.py

@@ -0,0 +1,8 @@
+from __future__ import annotations
+import angr
+
+
+class geteuid(angr.SimProcedure):
+    # pylint: disable=arguments-differ
+    def run(self):
+        return 1000

angr/procedures/libc/getgid.py

@@ -0,0 +1,8 @@
+from __future__ import annotations
+import angr
+
+
+class getgid(angr.SimProcedure):
+    # pylint: disable=arguments-differ
+    def run(self):
+        return 1000