angr 9.2.166__cp310-abi3-manylinux_2_28_x86_64.whl

angr/analyses/identifier/functions/sprintf.py

@@ -0,0 +1,116 @@
+from __future__ import annotations
+import random
+import string
+
+import claripy
+
+from angr.analyses.identifier.func import Func, TestData
+
+
+class sprintf(Func):
+    non_null = [chr(i) for i in range(1, 256)]
+
+    def __init__(self):
+        super().__init__()
+        self.format_spec_char = None
+        self.string_spec_char = None
+        self.allows_n = False
+
+    def rand_str(self, length, byte_list=None):  # pylint disable=no-self-use
+        if byte_list is None:
+            return "".join(chr(random.randint(0, 255)) for _ in range(length))
+        return "".join(random.choice(byte_list) for _ in range(length))
+
+    def num_args(self):
+        return 2
+
+    def args(self):  # pylint disable=no-self-use
+        return ["buf", "format"]
+
+    def get_name(self):
+        return "sprintf"
+
+    def var_args(self):
+        return True
+
+    def gen_input_output_pair(self):
+        # I'm kinda already assuming it's snprintf if it passed pretests...
+
+        return None
+
+    def pre_test(self, func, runner):
+        # make sure it prints alphanumeric stuff
+        length = 10
+        test_str = self.rand_str(length, string.ascii_letters + string.digits)
+        outbuf = self.rand_str(length + 2)
+        test_input = [outbuf, test_str]
+        test_output = [test_str + "\x00", test_str]
+        max_steps = 20
+        test = TestData(test_input, test_output, None, max_steps)
+        if not runner.test(func, test):
+            return False
+
+        # find interesting characters
+        test_input = [outbuf, claripy.BVS("input", 10 * 8)]
+        test_output = [None, None]
+        test = TestData(test_input, test_output, None, max_steps)
+        s = runner.get_base_call_state(func, test)
+        pg = runner.project.factory.simulation_manager(s)
+        pg.run(n=18)
+        interesting_chars = set()
+        for p in pg.active:
+            for g in p.history.jump_guards:
+                if g.op == "__ne__" or g.op == "__eq__":
+                    for a in g.args:
+                        if not a.symbolic:
+                            interesting_chars.add(s.solver.eval(a))
+
+        interesting_chars = {chr(a) for a in interesting_chars if 0 < a < 0x80}
+        alphanum = set(string.ascii_letters + string.digits)
+        possible_format_specifiers = [c for c in interesting_chars if c not in alphanum]
+        possible_formats = [c for c in interesting_chars if c in alphanum]
+
+        if len(possible_format_specifiers) > 10:
+            # too many to test :(
+            return False
+
+        # find the format specifier
+        second_str = "findme"
+        for char in possible_format_specifiers:
+            if self.format_spec_char is not None:
+                break
+            for cc in possible_formats:
+                test_str = char + cc + "\n\x00"
+                test_input = [outbuf, test_str, second_str]
+                test_output = [second_str + "\n" + "\x00", test_str, second_str]
+                max_steps = 20
+                test = TestData(test_input, test_output, None, max_steps)
+                if runner.test(func, test):
+                    self.format_spec_char = char
+                    self.string_spec_char = cc
+                    break
+
+        # brute force...
+        if self.format_spec_char is None:
+            second_str = "findme"
+            for char in possible_format_specifiers:
+                if self.format_spec_char is not None:
+                    break
+                for cc in string.ascii_lowercase:
+                    if cc in possible_formats:
+                        continue
+                    test_str = char + cc + "\n\x00"
+                    test_input = [outbuf, test_str, second_str]
+                    test_output = [second_str + "\n" + "\x00", test_str, second_str]
+                    max_steps = 20
+                    test = TestData(test_input, test_output, None, max_steps)
+                    if runner.test(func, test):
+                        self.format_spec_char = char
+                        self.string_spec_char = cc
+                        break
+
+        if self.format_spec_char is None:
+            return False
+
+        self._runner = runner
+        return True

angr/analyses/identifier/functions/strcasecmp.py

@@ -0,0 +1,33 @@
+from __future__ import annotations
+import random
+
+from .strcmp import strcmp
+
+
+def rand_str(length, byte_list=None):
+    if byte_list is None:
+        return "".join(chr(random.randint(0, 255)) for _ in range(length))
+    return "".join(random.choice(byte_list) for _ in range(length))
+
+
+class strcasecmp(strcmp):
+    non_null = [chr(i) for i in range(1, 256)]
+
+    def __init__(self):
+        super().__init__()  # pylint disable=useless-super-delegation
+
+    def get_name(self):
+        return "strcasecmp"
+
+    def num_args(self):
+        return 2
+
+    def can_call_other_funcs(self):
+        return True
+
+    def pre_test(self, func, runner):
+        r = self._strcmp_pretest(func, runner)
+        if not isinstance(r, bool):
+            v1, v2, v3, v4 = r
+            return v1 == 0 and v2 != 0 and v3 == 0 and v4 != 0
+        return r

angr/analyses/identifier/functions/strcmp.py

@@ -0,0 +1,113 @@
+from __future__ import annotations
+import random
+
+from angr.analyses.identifier.func import Func, TestData
+
+
+def rand_str(length, byte_list=None):
+    if byte_list is None:
+        return "".join(chr(random.randint(0, 255)) for _ in range(length))
+    return "".join(random.choice(byte_list) for _ in range(length))
+
+
+class strcmp(Func):
+    non_null = [chr(i) for i in range(1, 256)]
+
+    def __init__(self):
+        super().__init__()  # pylint disable=useless-super-delegation
+
+    def get_name(self):
+        return "strcmp"
+
+    def num_args(self):
+        return 2
+
+    def args(self):  # pylint disable=no-self-use
+        return ["buf1", "buf2"]
+
+    def gen_input_output_pair(self):
+        l = 5
+        rand_str(l, strcmp.non_null)  # s
+
+        return
+
+    def can_call_other_funcs(self):
+        return False
+
+    def pre_test(self, func, runner):
+        r = self._strcmp_pretest(func, runner)
+        if not isinstance(r, bool):
+            v1, v2, v3, v4 = r
+            return v1 == 0 and v2 != 0 and v3 != 0 and v4 != 0
+        return r
+
+    @staticmethod
+    def _strcmp_pretest(func, runner):
+        # todo we don't test which order it returns the signs in
+        bufa = "asdf\x00"
+        bufb = "asdf\x00"
+        test_input = [bufa, bufb]
+        test_output = [bufa, bufb]
+        max_steps = 10
+        return_val = None
+        test = TestData(test_input, test_output, return_val, max_steps)
+        s = runner.get_out_state(func, test)
+        if s is None or s.solver.eval(s.regs.eax) != 0:
+            return False
+
+        bufa = "asde\x00"
+        bufb = "asde\x00"
+        test_input = [bufa, bufb]
+        test_output = [bufa, bufb]
+        max_steps = 10
+        return_val = None
+        test = TestData(test_input, test_output, return_val, max_steps)
+        s = runner.get_out_state(func, test)
+        if s is None or s.solver.eval(s.regs.eax) != 0:
+            return False
+
+        # should return true for strcmp, false for memcpy
+        bufa = "asdfa\x00sfdadfsa"
+        bufb = "asdfa\x00sadfsadf"
+        test_input = [bufa, bufb]
+        test_output = [bufa, bufb]
+        test = TestData(test_input, test_output, return_val, max_steps)
+        s = runner.get_out_state(func, test)
+        if s is None:
+            return False
+        outval1 = s.solver.eval(s.regs.eax)
+
+        # should fail
+        bufa = "asdfc\x00as"
+        bufb = "asdfb\x0011232"
+        test_input = [bufa, bufb]
+        test_output = [bufa, bufb]
+        test = TestData(test_input, test_output, return_val, max_steps)
+        s = runner.get_out_state(func, test)
+        if s is None:
+            return False
+        outval2 = s.solver.eval(s.regs.eax)
+
+        # should prevent us from misidentifying strcasecmp
+        bufa = "ASDFC\x00"
+        bufb = "asdfc\x00"
+        test_input = [bufa, bufb]
+        test_output = [bufa, bufb]
+        test = TestData(test_input, test_output, return_val, max_steps)
+        s = runner.get_out_state(func, test)
+        if s is None:
+            return False
+        outval3 = s.solver.eval(s.regs.eax)
+
+        # should distinguish between strcmp and strncmp
+        bufa = "abc555"
+        bufb = "abc666"
+        test_input = [bufa, bufb, 3]
+        test_output = [bufa, bufb, 3]
+        test = TestData(test_input, test_output, return_val, max_steps)
+        s = runner.get_out_state(func, test)
+        if s is None:
+            return False
+        outval4 = s.solver.eval(s.regs.eax)
+
+        return outval1, outval2, outval3, outval4

angr/analyses/identifier/functions/strcpy.py

@@ -0,0 +1,43 @@
+from __future__ import annotations
+import random
+
+from angr.analyses.identifier.func import Func, TestData
+
+
+def rand_str(length, byte_list=None):
+    if byte_list is None:
+        return bytes(random.randint(0, 255) for _ in range(length))
+    return bytes(random.choice(byte_list) for _ in range(length))
+
+
+class strcpy(Func):
+    non_null = list(range(1, 256))
+
+    def __init__(self):
+        super().__init__()  # pylint disable=useless-super-delegation
+
+    def get_name(self):
+        return "strcpy"
+
+    def num_args(self):
+        return 2
+
+    def args(self):  # pylint disable=no-self-use
+        return ["dst", "src"]
+
+    def can_call_other_funcs(self):
+        return False
+
+    def gen_input_output_pair(self):
+        # TODO we don't check the return val, some cases I saw char * strcpy, some size_t strcpy
+        strlen = random.randint(1, 80)
+        buf = rand_str(strlen, byte_list=strcpy.non_null) + b"\x00"
+        result_buf = rand_str(strlen + 1)
+        test_input = [result_buf, buf]
+        test_output = [buf, buf]
+        max_steps = 20
+        return_val = None
+        return TestData(test_input, test_output, return_val, max_steps)
+
+    def pre_test(self, func, runner):
+        return True

angr/analyses/identifier/functions/strlen.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+import random
+
+from angr.analyses.identifier.func import Func, TestData
+
+
+class strlen(Func):
+    non_null = list(range(1, 256))
+
+    def rand_str(self, length, byte_list=None):  # pylint disable=no-self-use
+        if byte_list is None:
+            return bytes(random.randint(0, 255) for _ in range(length))
+        return bytes(random.choice(byte_list) for _ in range(length))
+
+    def num_args(self):
+        return 1
+
+    def get_name(self):
+        return "strlen"
+
+    def gen_input_output_pair(self):
+        length = random.randint(2, 100)
+        s = self.rand_str(length, strlen.non_null) + b"\x00" + self.rand_str(length)
+        test_input = [s]
+        test_output = [s]
+        max_steps = 20
+        return TestData(test_input, test_output, length, max_steps)

angr/analyses/identifier/functions/strncmp.py

@@ -0,0 +1,104 @@
+from __future__ import annotations
+import random
+
+from angr.analyses.identifier.func import Func, TestData
+
+
+def rand_str(length, byte_list=None):
+    if byte_list is None:
+        return "".join(chr(random.randint(0, 255)) for _ in range(length))
+    return "".join(random.choice(byte_list) for _ in range(length))
+
+
+class strncmp(Func):
+    non_null = [chr(i) for i in range(1, 256)]
+
+    def __init__(self):
+        super().__init__()  # pylint disable=useless-super-delegation
+
+    def get_name(self):
+        return "strncmp"
+
+    def num_args(self):
+        return 3
+
+    def args(self):  # pylint disable=no-self-use
+        return ["buf1", "buf2", "len"]
+
+    def gen_input_output_pair(self):
+        l = 5
+        rand_str(l, strncmp.non_null)  # s
+        return
+
+    def can_call_other_funcs(self):
+        return False
+
+    def pre_test(self, func, runner):
+        # todo we don't test which order it returns the signs in
+        bufa = "asdf\x00"
+        bufb = "asdf\x00"
+        test_input = [bufa, bufb, 5]
+        test_output = [bufa, bufb, 5]
+        max_steps = 10
+        return_val = None
+        test = TestData(test_input, test_output, return_val, max_steps)
+        s = runner.get_out_state(func, test)
+        if s is None or s.solver.eval(s.regs.eax) != 0:
+            return False
+
+        # should return true for strcmp, false for memcpy
+        bufa = "asdfa\x00sfdadfsa"
+        bufb = "asdfa\x00sadfsadf"
+        test_input = [bufa, bufb, 10]
+        test_output = [bufa, bufb, 10]
+        test = TestData(test_input, test_output, return_val, max_steps)
+        s = runner.get_out_state(func, test)
+        if s is None:
+            return False
+        outval1 = s.solver.eval(s.regs.eax)
+
+        # should fail
+        bufa = "asdfc\x00as"
+        bufb = "asdfb\x0011232"
+        test_input = [bufa, bufb, 10]
+        test_output = [bufa, bufb, 10]
+        test = TestData(test_input, test_output, return_val, max_steps)
+        s = runner.get_out_state(func, test)
+        if s is None:
+            return False
+        outval2 = s.solver.eval(s.regs.eax)
+
+        # should prevent us from misidentifying strcasecmp
+        bufa = "ASDFC\x00"
+        bufb = "asdfc\x00"
+        test_input = [bufa, bufb, 5]
+        test_output = [bufa, bufb, 5]
+        test = TestData(test_input, test_output, return_val, max_steps)
+        s = runner.get_out_state(func, test)
+        if s is None:
+            return False
+        outval3 = s.solver.eval(s.regs.eax)
+
+        # should distinguish strncmp and strcmp
+        bufa = "abc5555"
+        bufb = "abc6666"
+        test_input = [bufa, bufb, 3]
+        test_output = [bufa, bufb, 3]
+        test = TestData(test_input, test_output, return_val, max_steps)
+        s = runner.get_out_state(func, test)
+        if s is None:
+            return False
+        outval4 = s.solver.eval(s.regs.eax)
+
+        # should distinguish strncmp and strcmp
+        bufa = "abc5555"
+        bufb = "abc6666"
+        test_input = [bufa, bufb, 6]
+        test_output = [bufa, bufb, 6]
+        test = TestData(test_input, test_output, return_val, max_steps)
+        s = runner.get_out_state(func, test)
+        if s is None:
+            return False
+        outval5 = s.solver.eval(s.regs.eax)
+
+        return outval1 == 0 and outval2 != 0 and outval3 != 0 and outval4 == 0 and outval5 != 0

angr/analyses/identifier/functions/strncpy.py

@@ -0,0 +1,65 @@
+from __future__ import annotations
+import random
+
+from angr.analyses.identifier.func import Func, TestData
+
+
+def rand_str(length, byte_list=None):
+    if byte_list is None:
+        return bytes(random.randint(0, 255) for _ in range(length))
+    return bytes(random.choice(byte_list) for _ in range(length))
+
+
+class strncpy(Func):
+    non_null = list(range(1, 256))
+
+    def __init__(self):
+        super().__init__()
+        self.forced_null = False
+
+    def get_name(self):
+        if self.forced_null:
+            return "strncpy_null"
+        return "strncpy"
+
+    def num_args(self):
+        return 3
+
+    def args(self):  # pylint disable=no-self-use
+        return ["dst", "src", "len"]
+
+    def can_call_other_funcs(self):
+        return False
+
+    def gen_input_output_pair(self):
+        # TODO we don't check the return val, some cases I saw char * strcpy, some size_t strcpy
+        strlen = random.randint(1, 20)
+        max_len = random.randint(1, 10)
+        buf = rand_str(strlen, byte_list=strncpy.non_null) + b"\x00"
+        result_buf = rand_str(strlen + 1)
+        test_input = [result_buf, buf, max_len]
+        outlen = min(max_len, strlen + 1)
+        test_output = [buf[:outlen], buf, None]
+        max_steps = 5
+        return_val = None
+        return TestData(test_input, test_output, return_val, max_steps)
+
+    def pre_test(self, func, runner):
+        # check only copies up to null
+        test_input = ["A" * 7, "abc\x00ccc", 7]
+        test_output = ["abc\x00AAA", "abc\x00ccc", None]
+        max_steps = 5
+        return_val = None
+        test = TestData(test_input, test_output, return_val, max_steps)
+        if not runner.test(func, test):
+            return False
+        # check has a max to copy
+        test_input = ["A" * 7, "ccccccc", 3]
+        test_output = ["cccAAAA", "ccccccc", 7]
+        max_steps = 5
+        return_val = None
+        test = TestData(test_input, test_output, return_val, max_steps)
+
+        if not runner.test(func, test):
+            self.forced_null = True
+        return True

angr/analyses/identifier/functions/strtol.py

@@ -0,0 +1,89 @@
+from __future__ import annotations
+import random
+import string
+
+from angr.analyses.identifier.func import Func, TestData
+
+
+digs = string.digits + string.ascii_letters
+
+
+def int2base(x, base):
+    if x < 0:
+        sign = -1
+    elif x == 0:
+        return digs[0]
+    else:
+        sign = 1
+    x *= sign
+    digits = []
+    while x:
+        digits.append(digs[x % base])
+        x //= base
+    if sign < 0:
+        digits.append("-")
+    digits.reverse()
+    return "".join(digits)
+
+
+class strtol(Func):
+    def __init__(self):
+        super().__init__()
+        self.skips_whitespace = False
+        self.version = ""
+
+    def rand_str(self, length, byte_list=None):  # pylint disable=no-self-use
+        if byte_list is None:
+            return "".join(chr(random.randint(0, 255)) for _ in range(length))
+        return "".join(random.choice(byte_list) for _ in range(length))
+
+    def num_args(self):  # pylint disable=no-self-use
+        return 3
+
+    def args(self):  # pylint disable=no-self-use
+        return ["nptr", "endpointer", "base"]
+
+    def get_name(self):
+        return "strtol" + self.version
+
+    def gen_input_output_pair(self):
+        num = random.randint(-(2**31), 2**31 - 1)
+
+        base = random.randint(2, 16)
+        s = int2base(num, base)
+        test_input = [s, 0, base]
+        test_output = [s, None, None]
+        return_val = num
+        max_steps = 20
+        return TestData(test_input, test_output, return_val, max_steps)
+
+    def pre_test(self, func, runner):
+        num = random.randint(-(2**31), 2**31 - 1)
+
+        s = str(num)
+        test_input = [s, 0, 10]
+        test_output = [s, None, None]
+        return_val = num
+        max_steps = 20
+        test = TestData(test_input, test_output, return_val, max_steps)
+        if not runner.test(func, test):
+            return False
+
+        s = str(num)
+        s = self.rand_str(10, string.whitespace) + s
+        test_input = [s, 0, 10]
+        test_output = [s, None, None]
+        return_val = num
+        max_steps = 20
+        test = TestData(test_input, test_output, return_val, max_steps)
+        self.skips_whitespace = runner.test(func, test)
+
+        # base 0
+        base = 0
+        s = hex(num)
+        test_input = [s, 0, base]
+        test_output = [s, None, None]
+        return_val = num
+        max_steps = 20
+        test = TestData(test_input, test_output, return_val, max_steps)
+        return runner.test(func, test)