angr 9.2.192__cp311-cp311-macosx_10_12_x86_64.whl

angr/analyses/cfg/indirect_jump_resolvers/syscall_resolver.py

@@ -0,0 +1,92 @@
+from __future__ import annotations
+import contextlib
+from typing import TYPE_CHECKING
+import logging
+
+from angr import sim_options as o
+from angr import BP, BP_AFTER
+from angr.errors import (
+    AngrUnsupportedSyscallError,
+    SimOperationError,
+    SimError,
+)
+
+from .resolver import IndirectJumpResolver
+from .constant_value_manager import ConstantValueManager
+
+if TYPE_CHECKING:
+    from angr import Block
+    from angr.engines import SimSuccessors
+    from angr.sim_state import SimState
+    from angr.sim_procedure import SimProcedure
+
+
+_l = logging.getLogger(name=__name__)
+
+
+class SyscallResolver(IndirectJumpResolver):
+    """
+    Resolve syscalls to SimProcedures.
+    """
+
+    def __init__(self, project):
+        super().__init__(project, timeless=True)
+
+    def filter(self, cfg, addr, func_addr, block, jumpkind):
+        return jumpkind.startswith("Ijk_Sys")
+
+    def resolve(  # pylint:disable=unused-argument
+        self, cfg, addr: int, func_addr: int, block: Block, jumpkind: str, func_graph_complete: bool = True, **kwargs
+    ):
+        stub = self._resolve_syscall_to_stub(cfg, addr, func_addr, block)
+        return (True, [stub.addr]) if stub else (False, [])
+
+    def _resolve_syscall_to_stub(self, cfg, addr: int, func_addr: int, block: Block) -> SimProcedure | None:
+        if not cfg.functions.contains_addr(func_addr):
+            return None
+        func = cfg.functions.get_by_addr(func_addr)
+
+        cv_manager = ConstantValueManager(self.project, cfg.kb, func, addr)
+        constant_value_reg_read_bp = BP(when=BP_AFTER, enabled=True, action=cv_manager.reg_read_callback)
+
+        state = self.project.factory.blank_state(
+            mode="fastpath",
+            addr=block.addr,
+            add_options={o.SYMBOL_FILL_UNCONSTRAINED_MEMORY, o.SYMBOL_FILL_UNCONSTRAINED_REGISTERS},
+        )
+        state.inspect.add_breakpoint("reg_read", constant_value_reg_read_bp)
+
+        successors = self._simulate_block_with_resilience(state)
+        if successors:
+            state = self._get_syscall_state_from_successors(successors)
+            if state:
+                with contextlib.suppress(AngrUnsupportedSyscallError):
+                    return self.project.simos.syscall(state)
+        return None
+
+    def _simulate_block_with_resilience(self, state: SimState) -> SimSuccessors | None:
+        """
+        Execute a basic block with "On Error Resume Next". Give up when there is no way moving forward.
+        """
+
+        stmt_idx = 0
+        successors = None  # make PyCharm's linting happy
+
+        while True:
+            try:
+                successors = self.project.factory.successors(state, skip_stmts=stmt_idx)
+                break
+            except SimOperationError:
+                stmt_idx += 1
+                continue
+            except SimError:
+                return None
+
+        return successors
+
+    @staticmethod
+    def _get_syscall_state_from_successors(successors: SimSuccessors) -> SimState | None:
+        for state in successors.flat_successors:
+            if state.history.jumpkind and state.history.jumpkind.startswith("Ijk_Sys"):
+                return state
+        return None

angr/analyses/cfg/indirect_jump_resolvers/x86_elf_pic_plt.py

@@ -0,0 +1,88 @@
+from __future__ import annotations
+import logging
+
+import archinfo
+import cle
+
+from .resolver import IndirectJumpResolver
+
+
+l = logging.getLogger(name=__name__)
+
+
+class X86ElfPicPltResolver(IndirectJumpResolver):
+    """
+    In X86 ELF position-independent code, PLT stubs uses ebx to resolve library calls, where ebx stores the address to
+    the beginning of the GOT. We resolve the target by forcing ebx to be the beginning of the GOT and simulate the
+    execution in fast path mode.
+    """
+
+    def __init__(self, project):
+        super().__init__(project, timeless=True)
+
+        self._got_addr_cache = {}
+
+    def _got_addr(self, obj):
+        if obj not in self._got_addr_cache:
+            if not isinstance(obj, cle.MetaELF):
+                self._got_addr_cache[obj] = None
+            else:
+                # ALERT: HACKS AHEAD
+
+                got_plt_section = obj.sections_map.get(".got.plt", None)
+                got_section = obj.sections_map.get(".got", None)
+                if got_plt_section is not None:
+                    l.debug("Use address of .got.plt section as the GOT base for object %s.", obj)
+                    self._got_addr_cache[obj] = got_plt_section.vaddr
+                elif got_section is not None:
+                    l.debug("Use address of .got section as the GOT base for object %s.", obj)
+                    self._got_addr_cache[obj] = got_section.vaddr
+                else:
+                    l.debug("Cannot find GOT base for object %s.", obj)
+                    self._got_addr_cache[obj] = None
+
+        return self._got_addr_cache[obj]
+
+    def filter(self, cfg, addr, func_addr, block, jumpkind):
+        if not isinstance(self.project.arch, archinfo.ArchX86):
+            return False
+
+        section = self.project.loader.find_section_containing(addr)
+
+        if section is None:
+            return False
+
+        if section.name != ".plt":
+            return False
+
+        if block.size != 6:
+            return False
+
+        # TODO: check whether ebx/edx is used
+
+        return block.instructions == 1
+
+    def resolve(
+        self, cfg, addr, func_addr, block, jumpkind, func_graph_complete: bool = True, **kwargs
+    ):  # pylint:disable=unused-argument
+        obj = self.project.loader.find_object_containing(addr)
+        if obj is None:
+            return False, []
+
+        got_addr = self._got_addr(obj)
+
+        if got_addr is None:
+            # cannot get the base address of GOT
+            return False, []
+
+        state = cfg._initial_state.copy() if cfg._initial_state is not None else self.project.factory.blank_state()
+        state.regs.ebx = got_addr
+
+        successors = self.project.factory.default_engine.process(state, block=block, force_addr=addr)
+
+        if len(successors.flat_successors) != 1:
+            return False, []
+
+        target = state.solver.eval_one(successors.flat_successors[0].ip)
+
+        return True, [target]

angr/analyses/cfg/indirect_jump_resolvers/x86_pe_iat.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+import logging
+
+from capstone.x86_const import X86_OP_MEM
+
+from .resolver import IndirectJumpResolver
+
+l = logging.getLogger(name=__name__)
+
+
+class X86PeIatResolver(IndirectJumpResolver):
+    """
+    A timeless indirect jump resolver for IAT in x86 PEs and xbes.
+    """
+
+    def __init__(self, project):
+        super().__init__(project, timeless=True)
+
+    def filter(self, cfg, addr, func_addr, block, jumpkind):
+        if jumpkind not in {"Ijk_Call", "Ijk_Boring"}:  # both call and jmp
+            return False
+
+        insns = self.project.factory.block(addr).capstone.insns
+        if not insns:
+            return False
+        if not insns[-1].insn.operands:
+            return False
+
+        opnd = insns[-1].insn.operands[0]
+        # Must be of the form: call ds:0xABCD
+        return bool(opnd.type == X86_OP_MEM and opnd.mem.disp and not opnd.mem.base and not opnd.mem.index)
+
+    def resolve(
+        self, cfg, addr, func_addr, block, jumpkind, func_graph_complete: bool = True, **kwargs
+    ):  # pylint:disable=unused-argument
+        slot = self.project.factory.block(addr).capstone.insns[-1].insn.disp
+        target = cfg._fast_memory_load_pointer(slot)
+        if target is None:
+            l.warning("Address %#x does not appear to be mapped", slot)
+            return False, []
+
+        if not self.project.is_hooked(target):
+            return False, []
+
+        dest = self.project.hooked_by(target)
+        l.debug("Resolved target to %s", dest.display_name)
+        return True, [target]

angr/analyses/cfg_slice_to_sink/__init__.py

@@ -0,0 +1,11 @@
+from __future__ import annotations
+
+from .graph import slice_callgraph, slice_cfg_graph, slice_function_graph
+from .cfg_slice_to_sink import CFGSliceToSink
+
+__all__ = (
+    "CFGSliceToSink",
+    "slice_callgraph",
+    "slice_cfg_graph",
+    "slice_function_graph",
+)

angr/analyses/cfg_slice_to_sink/cfg_slice_to_sink.py

@@ -0,0 +1,117 @@
+from __future__ import annotations
+from typing import Any
+from functools import reduce
+
+from .transitions import merge_transitions
+
+
+class CFGSliceToSink:
+    """
+    The representation of a slice of a CFG.
+    """
+
+    def __init__(self, target, transitions=None):
+        """
+        :param angr.knowledge_plugins.functions.function.Function target:
+            The targeted sink, to which every path in the slice leads.
+        :param Dict[int,List[int]] transitions:
+            A mapping representing transitions in the graph.
+            Indexes are source addresses and values a list of destination addresses, for which there exists a transition
+            in the slice from source to destination.
+        """
+        self._target = target
+        self._transitions = transitions or {}
+
+    @property
+    def transitions(self):
+        """
+        :return Dict[int,List[int]]: The transitions in the slice.
+        """
+        return self._transitions
+
+    @property
+    def transitions_as_tuples(self):
+        """
+        :return List[Tuple[int,int]]: The list of transitions as pairs of (source, destination).
+        """
+        return reduce(
+            lambda acc, source: acc + [(source, destination) for destination in self._transitions[source]],
+            self._transitions.keys(),
+            [],
+        )
+
+    @property
+    def target(self):
+        """
+        :return angr.knowledge_plugins.functions.function.Function:
+            The targeted sink function, from which the slice is constructed.
+        """
+        return self._target
+
+    @property
+    def _origins(self):
+        return set(self._transitions.keys())
+
+    @property
+    def _destinations(self):
+        return set(reduce(lambda acc, destinations: acc + destinations, self._transitions.values(), []))
+
+    @property
+    def nodes(self) -> list[int]:
+        """
+        :return: The complete list of addresses present in the slice.
+        """
+        return list(self._origins | self._destinations)
+
+    @property
+    def entrypoints(self):
+        """
+        Entrypoints are all source addresses that are not the destination address of any transition.
+
+        :return List[int]: The list of entrypoints addresses.
+        """
+        return sorted(self._origins - self._destinations)
+
+    def add_transitions(self, transitions):
+        """
+        Add the given transitions to the current slice.
+
+        :param Dict[int,List[int]] transitions:
+            The list of transitions to be added to `self.transitions`.
+
+        :return Dict[int,List[int]]: Return the updated list of transitions.
+        """
+        self._transitions = merge_transitions(transitions, self._transitions)
+        return self._transitions
+
+    def is_empty(self):
+        """
+        Test if a given slice does not contain any transition.
+
+        :return bool: True if the <CFGSliceToSink> instance does not contain any transitions. False otherwise.
+        """
+        return not bool(self._transitions)
+
+    def path_between(self, source: int, destination: int, visited: set[Any] | None = None) -> bool:
+        """
+        Check the existence of a path in the slice between two given node addresses.
+
+        :param source: The source address.
+        :param destination: The destination address.
+        :param visited: Used to avoid infinite recursion if loops are present in the slice.
+
+        :return:
+            True if there is a path between the source and the destination in the CFG, False if not,
+            or if we have been unable to decide (because of loops).
+        """
+        _visited = set() if visited is None else visited
+
+        if source not in self._transitions or source in _visited:
+            return False
+        _visited.add(source)
+
+        direct_successors = self._transitions[source]
+
+        if destination in direct_successors:
+            return True
+        return any(self.path_between(s, destination, _visited) for s in direct_successors)

angr/analyses/cfg_slice_to_sink/graph.py

@@ -0,0 +1,87 @@
+from __future__ import annotations
+
+
+def slice_callgraph(callgraph, cfg_slice_to_sink):
+    """
+    Slice a callgraph, keeping only the nodes present in the <CFGSliceToSink> representation, and th transitions for
+    which a path exists.
+
+    *Note* that this function mutates the graph passed as an argument.
+
+    :param networkx.MultiDiGraph callgraph:
+        The callgraph to update.
+    :param CFGSliceToSink cfg_slice_to_sink:
+        The representation of the slice, containing the data to update the callgraph from.
+    """
+
+    edges_to_remove = list(filter(lambda e: not cfg_slice_to_sink.path_between(*e), callgraph.edges()))
+
+    nodes_to_remove = list(filter(lambda node: node not in cfg_slice_to_sink.nodes, callgraph.nodes()))
+
+    callgraph.remove_edges_from(edges_to_remove)
+    callgraph.remove_nodes_from(nodes_to_remove)
+
+    return callgraph
+
+
+def slice_cfg_graph(graph, cfg_slice_to_sink):
+    """
+    Slice a CFG graph, keeping only the transitions and nodes present in the <CFGSliceToSink> representation.
+
+    *Note* that this function mutates the graph passed as an argument.
+
+    :param networkx.DiGraph graph: The graph to slice.
+    :param CFGSliceToSink cfg_slice_to_sink:
+        The representation of the slice, containing the data to update the CFG from.
+
+    :return networkx.DiGraph: The sliced graph.
+    """
+
+    def _edge_in_slice_transitions(transitions, edge):
+        if edge[0].addr not in transitions:
+            return False
+        return edge[1].addr in cfg_slice_to_sink.transitions[edge[0].addr]
+
+    edges_to_remove = list(
+        filter(lambda edge: not _edge_in_slice_transitions(cfg_slice_to_sink.transitions, edge), graph.edges())
+    )
+
+    nodes_to_remove = list(filter(lambda node: node.addr not in cfg_slice_to_sink.nodes, graph.nodes()))
+
+    graph.remove_edges_from(edges_to_remove)
+    graph.remove_nodes_from(nodes_to_remove)
+
+    return graph
+
+
+def slice_function_graph(function_graph, cfg_slice_to_sink):
+    """
+    Slice a function graph, keeping only the nodes present in the <CFGSliceToSink> representation.
+
+    Because the <CFGSliceToSink> is build from the CFG, and the function graph is *NOT* a subgraph of the CFG, edges of
+    the function graph will no be present in the <CFGSliceToSink> transitions.
+    However, we use the fact that if there is an edge between two nodes in the function graph, then there must exist
+    a path between these two nodes in the slice; Proof idea:
+    - The <CFGSliceToSink> is backward and recursively constructed;
+    - If a node is in the slice, then all its predecessors will be (transitively);
+    - If there is an edge between two nodes in the function graph, there is a path between them in the CFG;
+    - So: The origin node is a transitive predecessor of the destination one, hence if destination is in the slice,
+    then origin will be too.
+
+    In consequence, in the end, removing the only nodes not present in the slice, and their related transitions gives
+    us the expected result: a function graph representing (a higher view of) the flow in the slice.
+
+    *Note* that this function mutates the graph passed as an argument.
+
+    :param networkx.DiGraph graph: The graph to slice.
+    :param CFGSliceToSink cfg_slice_to_sink:
+        The representation of the slice, containing the data to update the CFG from.
+
+    :return networkx.DiGraph: The sliced graph.
+    """
+
+    nodes_to_remove = list(filter(lambda node: node.addr not in cfg_slice_to_sink.nodes, function_graph.nodes()))
+
+    function_graph.remove_nodes_from(nodes_to_remove)
+
+    return function_graph

angr/analyses/cfg_slice_to_sink/transitions.py

@@ -0,0 +1,27 @@
+"""
+Some utilitary functions to manage our representation of transitions:
+    A dictionary, indexed by int (source addresses), which values are list of ints (target addresses).
+"""
+
+from __future__ import annotations
+
+
+def merge_transitions(transitions, existing_transitions):
+    """
+    Merge two dictionaries of transitions together.
+
+    :param Dict[int,List[int]] transitions:          Some transitions.
+    :param Dict[int,List[int]] existing_transitions: Other transitions.
+
+    :return Dict[int,List[int]]: The merge of the two parameters.
+    """
+
+    def _add_to_existing(address, values):
+        if address in existing_transitions:
+            values += existing_transitions[address]
+            values = list(set(values))
+        existing_transitions.update({address: values})
+
+    [_add_to_existing(x[0], x[1]) for x in transitions.items()]
+
+    return existing_transitions

angr/analyses/class_identifier.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+from angr.sim_type import SimCppClass, SimTypeCppFunction
+from angr.analyses import AnalysesHub
+from angr.utils.cpp import is_cpp_funcname_ctor
+from . import Analysis, CFGFast, VtableFinder
+
+
+class ClassIdentifier(Analysis):
+    """
+    This is a class identifier for non stripped or partially stripped binaries, it identifies classes based on the
+    demangled function names, and also assigns functions to their respective classes based on their names. It also uses
+    the results from the VtableFinder analysis to assign the corresponding vtable to the classes.
+
+     self.classes contains a mapping between class names and SimCppClass objects
+
+     e.g. A::tool() and A::qux() belong to the class A
+    """
+
+    def __init__(self):
+        if "CFGFast" not in self.project.kb.cfgs:
+            self.project.analyses[CFGFast].prep()(cross_references=True)
+        self.classes = {}
+        vtable_analysis = self.project.analyses[VtableFinder].prep()()
+        self.vtables_list = vtable_analysis.vtables_list
+        self._analyze()
+
+    def _analyze(self):
+        # Assigning function to classes
+        for func in self.project.kb.functions.values():
+            if func.is_plt:
+                continue
+            col_ind = func.demangled_name.rfind("::")
+            class_name = func.demangled_name[:col_ind]
+            class_name = class_name.removeprefix("non-virtual thunk for ")
+            if col_ind != -1:
+                if class_name not in self.classes:
+                    ctor = is_cpp_funcname_ctor(func.demangled_name)
+                    function_members = {func.addr: SimTypeCppFunction([], None, label=func.demangled_name, ctor=ctor)}
+                    new_class = SimCppClass(name=class_name, function_members=function_members)
+                    self.classes[class_name] = new_class
+
+                else:
+                    ctor = is_cpp_funcname_ctor(func.demangled_name)
+                    cur_class = self.classes[class_name]
+                    cur_class.function_members[func.addr] = SimTypeCppFunction(
+                        [], None, label=func.demangled_name, ctor=ctor
+                    )
+
+        # Assigning a vtable to a class
+        for vtable in self.vtables_list:
+            for ref in self.project.kb.xrefs.xrefs_by_dst[vtable.vaddr]:
+                vtable_calling_func = self.project.kb.functions.floor_func(ref.ins_addr)
+                tmp_col_ind = vtable_calling_func.demangled_name.rfind("::")
+                possible_constructor_class_name = vtable_calling_func.demangled_name[:tmp_col_ind]
+                if (
+                    is_cpp_funcname_ctor(vtable_calling_func.demangled_name)
+                    and possible_constructor_class_name in self.classes
+                ):
+                    self.classes[possible_constructor_class_name].vtable_ptrs.append(vtable.vaddr)
+
+
+AnalysesHub.register_default("ClassIdentifier", ClassIdentifier)

angr/analyses/code_tagging.py

@@ -0,0 +1,123 @@
+from __future__ import annotations
+import pyvex
+
+from angr.utils import looks_like_sql
+from angr.knowledge_plugins.xrefs import XRef
+from . import Analysis, AnalysesHub
+
+
+class CodeTags:
+    HAS_XOR = "HAS_XOR"
+    HAS_BITSHIFTS = "HAS_BITSHIFTS"
+    HAS_SQL = "HAS_SQL"
+    LARGE_SWITCH = "LARGE_SWITCH"
+
+
+class CodeTagging(Analysis):
+    def __init__(self, func):
+        self._function = func
+        self.tags = set()
+
+        self.ANALYSES = [
+            (self.has_xor, {"X86", "AMD64"}),
+            (self.has_bitshifts, {"X86", "AMD64"}),
+            (self.has_sql, {"X86", "AMD64"}),
+        ]
+
+        self.analyze()
+
+    def analyze(self):
+        for analysis, arches in self.ANALYSES:
+            if arches is not None and self.project.arch.name not in arches:
+                continue
+            tags = analysis()
+            if tags:
+                self.tags |= tags
+
+    #
+    # Handlers
+    #
+
+    def has_xor(self):
+        """
+        Detects if there is any xor operation in the function.
+
+        :return: Tags
+        """
+
+        def _has_xor(expr):
+            return isinstance(expr, pyvex.IRExpr.Binop) and expr.op.startswith("Iop_Xor")
+
+        found_xor = False
+
+        for block in self._function.blocks:
+            if block.size == 0:
+                continue
+            for stmt in block.vex.statements:
+                if isinstance(stmt, (pyvex.IRStmt.Put, pyvex.IRStmt.WrTmp)):
+                    found_xor = found_xor or _has_xor(stmt.data)
+            if found_xor:
+                break
+
+        if found_xor:
+            return {CodeTags.HAS_XOR}
+        return None
+
+    def has_bitshifts(self):
+        """
+        Detects if there is any bitwise operation in the function.
+
+        :return: Tags.
+        """
+
+        def _has_bitshifts(expr):
+            if isinstance(expr, pyvex.IRExpr.Binop):
+                return expr.op.startswith("Iop_Shl") or expr.op.startswith("Iop_Shr") or expr.op.startswith("Iop_Sar")
+            return False
+
+        found_bitops = False
+
+        for block in self._function.blocks:
+            if block.size == 0:
+                continue
+            for stmt in block.vex.statements:
+                if isinstance(stmt, (pyvex.IRStmt.Put, pyvex.IRStmt.WrTmp)):
+                    found_bitops = found_bitops or _has_bitshifts(stmt.data)
+
+            if found_bitops:
+                break
+
+        if found_bitops:
+            return {CodeTags.HAS_BITSHIFTS}
+        return None
+
+    def has_sql(self):
+        """
+        Detects if there is any reference to strings that look like SQL queries.
+        """
+
+        if self._function.is_plt or self._function.is_simprocedure:
+            return False
+
+        min_addr, max_addr = None, None
+        # what strings are the current function referencing?
+        for block in self._function.blocks:
+            if min_addr is None or block.addr < min_addr:
+                min_addr = block.addr
+            if max_addr is None or block.addr + block.size > max_addr:
+                max_addr = block.addr + block.size
+
+        xrefs = self.kb.xrefs.get_xrefs_by_ins_addr_region(min_addr, max_addr)
+        for xref in xrefs:
+            xref: XRef
+            if (
+                xref.memory_data is not None
+                and xref.memory_data.sort == "string"
+                and looks_like_sql(xref.memory_data.content.decode("utf-8"))
+            ):
+                return {CodeTags.HAS_SQL}
+
+        return False
+
+
+AnalysesHub.register_default("CodeTagging", CodeTagging)