angr 9.2.192__cp311-cp311-macosx_10_12_x86_64.whl

angr/block.py

@@ -0,0 +1,509 @@
+# pylint:disable=wrong-import-position,arguments-differ
+from __future__ import annotations
+import logging
+from typing import TYPE_CHECKING
+
+import pyvex
+from pyvex import IRSB
+from archinfo import Arch, ArchARM
+
+from .protos import primitives_pb2 as pb2
+from .serializable import Serializable
+
+try:
+    from .engines import pcode
+except ImportError:
+    pcode = None
+
+if TYPE_CHECKING:
+    from angr import Project
+    from angr.engines.vex import VEXLifter
+    from angr.engines.pcode.lifter import PcodeLifterEngineMixin, IRSB as PcodeIRSB
+    from angr.engines.soot.engine import SootMixin
+
+
+l = logging.getLogger(name=__name__)
+
+
+class DisassemblerBlock:
+    """
+    Helper class to represent a block of disassembled target architecture
+    instructions
+    """
+
+    __slots__ = ["addr", "arch", "insns", "thumb"]
+
+    def __init__(self, addr, insns, thumb, arch):
+        self.addr = addr
+        self.insns = insns
+        self.thumb = thumb
+        self.arch = arch
+
+    def pp(self):
+        print(str(self))
+
+    def __str__(self):
+        return "\n".join(str(x) for x in self.insns)
+
+    def __repr__(self):
+        return f"<DisassemblerBlock for {self.addr:#x}>"
+
+
+class DisassemblerInsn:
+    """
+    Helper class to represent a disassembled target architecture instruction
+    """
+
+    __slots__ = ()
+
+    @property
+    def size(self) -> int:
+        raise NotImplementedError
+
+    @property
+    def address(self) -> int:
+        raise NotImplementedError
+
+    @property
+    def mnemonic(self) -> str:
+        raise NotImplementedError
+
+    @property
+    def op_str(self) -> str:
+        raise NotImplementedError
+
+    def __str__(self):
+        return f"{self.address:#x}:\t{self.mnemonic}\t{self.op_str}"
+
+    def __repr__(self):
+        return f'<DisassemblerInsn "{self.mnemonic}" for {self.address:#x}>'
+
+
+class CapstoneBlock(DisassemblerBlock):
+    """
+    Deep copy of the capstone blocks, which have serious issues with having extended lifespans
+    outside of capstone itself
+    """
+
+    __slots__ = ()
+
+
+class CapstoneInsn(DisassemblerInsn):
+    """
+    Represents a capstone instruction.
+    """
+
+    __slots__ = ("insn",)
+
+    def __init__(self, capstone_insn):
+        self.insn = capstone_insn
+
+    @property
+    def size(self) -> int:
+        return self.insn.size
+
+    @property
+    def address(self) -> int:
+        return self.insn.address
+
+    @property
+    def mnemonic(self) -> str:
+        return self.insn.mnemonic
+
+    @property
+    def op_str(self) -> str:
+        return self.insn.op_str
+
+    def __getattr__(self, item):
+        if item in ("__str__", "__repr__"):
+            return self.__getattribute__(item)
+        if hasattr(self.insn, item):
+            return getattr(self.insn, item)
+        raise AttributeError
+
+
+class Block(Serializable):
+    """
+    Represents a basic block in a binary or a program.
+    """
+
+    BLOCK_MAX_SIZE = 4096
+
+    __slots__ = [
+        "_backup_state",
+        "_bytes",
+        "_capstone",
+        "_collect_data_refs",
+        "_const_prop",
+        "_cross_insn_opt",
+        "_disassembly",
+        "_extra_stop_points",
+        "_initial_regs",
+        "_instruction_addrs",
+        "_instructions",
+        "_load_from_ro_regions",
+        "_max_size",
+        "_opt_level",
+        "_project",
+        "_strict_block_end",
+        "_traceflags",
+        "_vex",
+        "_vex_nostmt",
+        "addr",
+        "arch",
+        "size",
+        "thumb",
+    ]
+
+    def __init__(
+        self,
+        addr,
+        project=None,
+        arch: Arch | None = None,
+        size=None,
+        max_size=None,
+        byte_string=None,
+        thumb=False,
+        backup_state=None,
+        extra_stop_points=None,
+        opt_level=None,
+        num_inst=None,
+        traceflags=0,
+        strict_block_end=None,
+        collect_data_refs=False,
+        cross_insn_opt=True,
+        load_from_ro_regions=False,
+        const_prop=False,
+        initial_regs=None,
+        skip_stmts=False,
+    ):
+        if arch is not None:
+            self.arch = arch
+        elif project is not None:
+            self.arch = project.arch
+        else:
+            raise ValueError('Either "project" or "arch" has to be specified.')
+
+        if project is not None and backup_state is None and project.kb.patches.values():
+            backup_state = project.kb.patches.patched_entry_state
+
+        if isinstance(self.arch, ArchARM):
+            if addr & 1 == 1:
+                thumb = True
+            elif thumb:
+                addr |= 1
+        else:
+            thumb = False
+
+        self._project = project
+        self.addr = addr
+        self._backup_state = backup_state
+        self.thumb = thumb
+        self._opt_level = opt_level
+        self._initial_regs = initial_regs if (collect_data_refs or const_prop) else None
+        self._traceflags = traceflags
+        self._extra_stop_points = extra_stop_points
+        self._max_size = max_size if max_size is not None else self.BLOCK_MAX_SIZE
+
+        if self._project is None and byte_string is None:
+            raise ValueError('"byte_string" has to be specified if "project" is not provided.')
+
+        self._vex = None
+        self._vex_nostmt = None
+        self._disassembly = None
+        self._capstone = None
+        self._collect_data_refs = collect_data_refs
+        self._strict_block_end = strict_block_end
+        self._cross_insn_opt = cross_insn_opt
+        self._load_from_ro_regions = load_from_ro_regions
+        self._const_prop = const_prop
+
+        self._instructions: int | None = num_inst
+        self._instruction_addrs: list[int] = []
+
+        self._bytes = byte_string
+        self.size = size
+
+        if size is None:
+            if byte_string is not None:
+                size = len(byte_string)
+            else:
+                vex = self._lift_nocache(skip_stmts)
+                size = vex.size
+
+                if skip_stmts:
+                    self._vex_nostmt = vex
+                else:
+                    self._vex = vex
+
+        self.size = size
+
+        if skip_stmts:
+            self._parse_vex_info(self._vex_nostmt)
+        else:
+            self._parse_vex_info(self._vex)
+
+        if byte_string is None:
+            if backup_state is not None:
+                buffer, _, offset = self._vex_engine._load_bytes(addr - thumb, size, state=backup_state)
+                self._bytes = buffer[offset:]
+                if type(self._bytes) is memoryview:
+                    self._bytes = bytes(self._bytes)
+                elif type(self._bytes) is not bytes:
+                    self._bytes = bytes(pyvex.ffi.buffer(self._bytes, size))  # type:ignore
+            else:
+                self._bytes = None
+        elif type(byte_string) is bytes:
+            if self.size is not None:
+                self._bytes = byte_string[: self.size]
+            else:
+                self._bytes = byte_string
+        else:
+            # Convert bytestring to a str
+            # size will ALWAYS be known at this point
+            self._bytes = bytes(pyvex.ffi.buffer(byte_string, self.size))  # type:ignore
+
+    def _parse_vex_info(self, vex_block):
+        if vex_block is not None:
+            self._instructions = vex_block.instructions
+            self._instruction_addrs = vex_block.instruction_addresses
+            self.size = vex_block.size
+
+    def __repr__(self):
+        return f"<Block for {self.addr:#x}, {self.size} bytes>"
+
+    def __getstate__(self):
+        return {k: getattr(self, k) for k in self.__slots__ if k not in {"_capstone", "_disassembly", "_project"}}
+
+    def __setstate__(self, data):
+        for k, v in data.items():
+            setattr(self, k, v)
+        self._capstone = None
+        self._disassembly = None
+        self._project = None
+
+    def __hash__(self):
+        return hash((type(self), self.addr, self.bytes))
+
+    def __eq__(self, other):
+        return type(self) is type(other) and self.addr == other.addr and self.bytes == other.bytes
+
+    def __ne__(self, other):
+        return not self == other
+
+    def pp(self, **kwargs):
+        if self._project is not None:
+            addr = self.addr - 1 if self.thumb else self.addr
+            print(
+                self._project.analyses.Disassembly(
+                    ranges=[(addr, addr + self.size)],
+                    thumb=self.thumb,
+                    block_bytes=self.bytes,
+                ).render(**kwargs)
+            )
+        else:
+            self.disassembly.pp()
+
+    def set_initial_regs(self):
+        # for data reference collection, on some architectures, we need to set up initial registers
+        if self._initial_regs is not None:
+            for offset, size, value in self._initial_regs:  # pylint:disable=not-an-iterable
+                pyvex.pvc.register_initial_register_value(offset, size, value)
+
+    @staticmethod
+    def reset_initial_regs():
+        pyvex.pvc.reset_initial_register_values()
+
+    @property
+    def _vex_engine(self) -> VEXLifter | PcodeLifterEngineMixin:
+        if self._project is None:
+            raise ValueError("Project is not set")
+        return self._project.factory.default_engine  # type:ignore
+
+    def _lift_nocache(self, skip_stmts: bool) -> IRSB | PcodeIRSB:
+        clemory = None
+        if self._project is not None:
+            clemory = (
+                self._project.loader.memory_ro_view
+                if self._project.loader.memory_ro_view is not None
+                else self._project.loader.memory
+            )
+
+        if self._initial_regs:
+            self.set_initial_regs()
+
+        vex = self._vex_engine.lift_vex(
+            addr=self.addr,
+            state=self._backup_state,
+            clemory=clemory,
+            insn_bytes=self._bytes,
+            arch=self.arch,
+            size=self.size,
+            num_inst=self._instructions,
+            traceflags=self._traceflags,
+            thumb=self.thumb,
+            extra_stop_points=self._extra_stop_points,
+            opt_level=self._opt_level,
+            strict_block_end=self._strict_block_end,
+            skip_stmts=skip_stmts,
+            collect_data_refs=self._collect_data_refs,
+            cross_insn_opt=self._cross_insn_opt,
+            load_from_ro_regions=self._load_from_ro_regions,
+            const_prop=self._const_prop,
+        )
+
+        if self._initial_regs:
+            self.reset_initial_regs()
+
+        return vex
+
+    @property
+    def vex(self) -> IRSB | PcodeIRSB:
+        if not self._vex:
+            self._vex = self._lift_nocache(False)
+            self._parse_vex_info(self._vex)
+
+        return self._vex
+
+    @property
+    def vex_nostmt(self):
+        if self._vex_nostmt:
+            return self._vex_nostmt
+        if self._vex:
+            return self._vex
+
+        self._vex_nostmt = self._lift_nocache(True)
+        self._parse_vex_info(self._vex_nostmt)
+
+        return self._vex_nostmt
+
+    @property
+    def _using_pcode_engine(self) -> bool:
+        return (pcode is not None) and isinstance(self._vex_engine, pcode.HeavyPcodeMixin)
+
+    @property
+    def disassembly(self) -> DisassemblerBlock:
+        """
+        Provide a disassembly object using whatever disassembler is available
+        """
+        if self._disassembly is None:
+            if self._using_pcode_engine:
+                self._disassembly = self.vex.disassembly  # type:ignore
+            else:
+                self._disassembly = self.capstone
+        return self._disassembly
+
+    @property
+    def capstone(self) -> CapstoneBlock:
+        if self._capstone:
+            return self._capstone
+
+        cs = self.arch.capstone if not self.thumb else self.arch.capstone_thumb  # type:ignore
+
+        insns = []
+
+        block_bytes = self.bytes
+        if self.size is not None:
+            block_bytes = block_bytes[: self.size]
+        for cs_insn in cs.disasm(block_bytes, self.addr):
+            insns.append(CapstoneInsn(cs_insn))
+        block = CapstoneBlock(self.addr, insns, self.thumb, self.arch)
+
+        self._capstone = block
+        return block
+
+    @property
+    def codenode(self):
+        return BlockNode(self.addr, self.size, bytestr=self.bytes, thumb=self.thumb)
+
+    @property
+    def bytes(self) -> bytes | None:
+        if self._bytes is None:
+            addr = self.addr
+            if self.thumb:
+                addr = (addr >> 1) << 1
+            if self._project is not None:
+                mem = (
+                    self._project.loader.memory_ro_view
+                    if self._project.loader.memory_ro_view is not None
+                    else self._project.loader.memory
+                )
+                self._bytes = mem.load(addr, self.size)
+        return self._bytes
+
+    @property
+    def instructions(self) -> int:
+        if not self._instructions and self._vex is None and self._vex_nostmt is None:
+            # initialize from VEX, but we do not need statements to know instructions
+            _ = self.vex_nostmt
+
+        assert self._instructions is not None
+        return self._instructions
+
+    @property
+    def instruction_addrs(self):
+        if self.size == 0:
+            # hooks and other pseudo-functions
+            return []
+
+        if not self._instruction_addrs and self._vex is None and self._vex_nostmt is None:
+            # initialize instruction addrs, but we do not need statements
+            _ = self.vex_nostmt
+
+        return self._instruction_addrs
+
+    @classmethod
+    def _get_cmsg(cls):
+        return pb2.Block()  # pylint: disable=no-member
+
+    def serialize_to_cmessage(self):
+        obj = self._get_cmsg()
+        obj.ea = self.addr
+        obj.size = self.size
+        obj.bytes = self.bytes
+
+        return obj
+
+    @classmethod
+    def parse_from_cmessage(cls, cmsg):
+        return cls(
+            cmsg.ea,
+            size=cmsg.size,
+            byte_string=cmsg.bytes,
+        )
+
+
+class SootBlock:
+    """
+    Represents a Soot IR basic block.
+    """
+
+    def __init__(self, addr, *, project: Project, arch: Arch):
+        self.addr = addr
+        self.arch = arch
+        self._project = project
+        self._the_binary = project.loader.main_object
+
+    @property
+    def _soot_engine(self) -> SootMixin:
+        if self._project is None:
+            assert False, "This should be unreachable"
+        return self._project.factory.default_engine  # type:ignore
+
+    @property
+    def soot(self):
+        return self._soot_engine.lift_soot(self.addr, the_binary=self._the_binary)
+
+    @property
+    def size(self):
+        stmts = None if self.soot is None else self.soot.statements
+        return len(stmts) if stmts else 0
+
+    @property
+    def codenode(self):
+        stmts = None if self.soot is None else self.soot.statements
+        stmts_len = len(stmts) if stmts else 0
+        return SootBlockNode(self.addr, stmts_len, stmts=stmts)
+
+
+from .codenode import BlockNode, SootBlockNode

angr/callable.py

@@ -0,0 +1,176 @@
+from __future__ import annotations
+import pycparser
+
+from angr.exploration_techniques.base import ExplorationTechnique
+from angr.project import Project
+from angr.sim_state import SimState
+from angr.sim_type import SimTypeFunction
+
+from .sim_manager import SimulationManager
+from .errors import AngrCallableError, AngrCallableMultistateError
+from .calling_conventions import default_cc, SimCC
+
+
+class Callable:
+    """
+    Callable is a representation of a function in the binary that can be
+    interacted with like a native python function.
+
+    If you set perform_merge=True (the default), the result will be returned to you, and
+    you can get the result state with callable.result_state.
+
+    Otherwise, you can get the resulting simulation manager at callable.result_path_group.
+    """
+
+    def __init__(
+        self,
+        project: Project,
+        addr: int,
+        prototype: SimTypeFunction | None = None,
+        concrete_only=False,
+        perform_merge=True,
+        base_state: SimState | None = None,
+        toc=None,
+        cc: SimCC | None = None,
+        add_options: set[str] | None = None,
+        remove_options: set[str] | None = None,
+        step_limit: int | None = None,
+        techniques: list[ExplorationTechnique] | None = None,
+    ):
+        """
+        :param project:         The project to operate on
+        :param addr:            The address of the function to use
+
+        The following parameters are optional:
+
+        :param prototype:         The signature of the calls you would like to make. This really shouldn't be optional.
+        :param concrete_only:   Throw an exception if the execution splits into multiple paths
+        :param perform_merge:   Merge all result states into one at the end (only relevant if concrete_only=False)
+        :param base_state:      The state from which to do these runs
+        :param toc:             The address of the table of contents for ppc64
+        :param cc:              The SimCC to use for a calling convention
+        """
+
+        self._project = project
+        self._addr = addr
+        self._concrete_only = concrete_only
+        self._perform_merge = perform_merge
+        self._base_state = base_state
+        self._toc = toc
+        self._cc = (
+            cc
+            if cc is not None
+            else default_cc(project.arch.name, platform=project.simos.name if project.simos is not None else None)(
+                project.arch
+            )
+        )
+        self._techniques = techniques
+        self._deadend_addr = project.simos.return_deadend
+        self._func_ty = prototype
+        self._add_options = add_options if add_options else set()
+        self._remove_options = remove_options if remove_options else set()
+        self._step_limit = step_limit
+        self._techniques = techniques or []
+
+        self.result_path_group = None
+        self.result_state = None
+
+    def set_base_state(self, state):
+        """
+        Swap out the state you'd like to use to perform the call
+        :param state: The state to use to perform the call
+        """
+        self._base_state = state
+
+    def __call__(self, *args):
+        prototype = SimCC.guess_prototype(args, self._func_ty).with_arch(self._project.arch)
+        self.perform_call(*args, prototype=prototype)
+        if self.result_state is not None and prototype.returnty is not None:
+            loc = self._cc.return_val(prototype.returnty)
+            if loc is not None:
+                val = loc.get_value(self.result_state, stack_base=self.result_state.regs.sp - self._cc.STACKARG_SP_DIFF)
+                return self.result_state.solver.simplify(val)
+        return None
+
+    def perform_call(self, *args, prototype=None):
+        prototype = SimCC.guess_prototype(args, prototype or self._func_ty).with_arch(self._project.arch)
+        state = self._project.factory.call_state(
+            self._addr,
+            *args,
+            prototype=prototype,
+            cc=self._cc,
+            base_state=self._base_state,
+            ret_addr=self._deadend_addr,
+            toc=self._toc,
+            add_options=self._add_options,
+            remove_options=self._remove_options,
+        )
+
+        caller = self._project.factory.simulation_manager(state, techniques=self._techniques)
+        caller.run(step_func=self._step_func).unstash(from_stash="deadended")
+        caller.prune(filter_func=lambda pt: pt.addr == self._deadend_addr)
+
+        if "step_limited" in caller.stashes:
+            caller.stash(from_stash="step_limited", to_stash="active")
+        if len(caller.active) == 0:
+            raise AngrCallableError("No paths returned from function")
+
+        self.result_path_group = caller.copy()
+
+        if self._perform_merge:
+            caller.merge()
+            self.result_state = caller.active[0]
+        elif len(caller.active) == 1:
+            self.result_state = caller.active[0]
+
+    def call_c(self, c_args):
+        """
+        Call this Callable with a string of C-style arguments.
+
+        :param str c_args:  C-style arguments.
+        :return:            The return value from the call.
+        :rtype:             claripy.Ast
+        """
+
+        c_args = c_args.strip()
+        if c_args[0] != "(":
+            c_args = "(" + c_args
+        if c_args[-1] != ")":
+            c_args += ")"
+
+        # Parse arguments
+        content = f"int main() {{ func{c_args}; }}"
+        ast = pycparser.CParser().parse(content)
+
+        if not ast.ext or not isinstance(ast.ext[0], pycparser.c_ast.FuncDef):
+            raise AngrCallableError("Error in parsing the given C-style argument string.")
+
+        if not ast.ext[0].body.block_items or not isinstance(ast.ext[0].body.block_items[0], pycparser.c_ast.FuncCall):
+            raise AngrCallableError(
+                "Error in parsing the given C-style argument string: Cannot find the expected function call."
+            )
+
+        arg_exprs = ast.ext[0].body.block_items[0].args.exprs
+
+        args = []
+        for expr in arg_exprs:
+            if isinstance(expr, pycparser.c_ast.Constant):
+                # string
+                if expr.type == "string":
+                    args.append(expr.value[1:-1])
+                elif expr.type == "int":
+                    args.append(int(expr.value))
+                else:
+                    raise AngrCallableError(f"Unsupported expression type {expr.type}.")
+            else:
+                raise AngrCallableError(f"Unsupported expression type {type(expr)}.")
+
+        return self.__call__(*args)
+
+    def _step_func(self, pg: SimulationManager):
+        pg2 = pg.prune()
+        if self._concrete_only and len(pg2.active) > 1:
+            raise AngrCallableMultistateError("Execution split on symbolic condition!")
+        if self._step_limit:
+            pg2.stash(filter_func=lambda p: p.history.depth >= self._step_limit, to_stash="step_limited")
+        return pg2