angr 9.2.192__cp311-cp311-macosx_10_12_x86_64.whl

angr/state_plugins/debug_variables.py

@@ -0,0 +1,192 @@
+from __future__ import annotations
+from typing import TYPE_CHECKING
+import logging
+
+from cle.backends.elf.variable import Variable
+from cle.backends.elf.variable_type import VariableType, PointerType, ArrayType, StructType, TypedefType
+
+from angr.sim_state import SimState
+from angr.sim_type import ALL_TYPES, SimTypeNum
+
+from .plugin import SimStatePlugin
+
+l = logging.getLogger(name=__name__)
+
+if TYPE_CHECKING:
+    from angr.state_plugins.view import SimMemView
+    from angr.sim_type import SimType
+
+
+class SimDebugVariable:
+    """
+    A SimDebugVariable will get dynamically created when queriyng for variable in a state with the
+    SimDebugVariablePlugin. It features a link to the state, an address and a type.
+    """
+
+    def __init__(self, state: SimState, addr, var_type: VariableType):
+        self.state = state
+        self.addr = addr
+        self.type = var_type
+
+    @staticmethod
+    def from_cle_variable(state: SimState, cle_variable: Variable, dwarf_cfa) -> SimDebugVariable:
+        addr = cle_variable.rebased_addr_from_cfa(dwarf_cfa)
+        var_type = cle_variable.type
+        return SimDebugVariable(state, addr, var_type)
+
+    @property
+    def mem_untyped(self) -> SimMemView:
+        if self.addr is None:
+            raise Exception("Cannot view a variable without an address")
+        return self.state.mem[self.addr]
+
+    @property
+    def mem(self) -> SimMemView:
+        if isinstance(self.type, TypedefType):
+            unpacked = SimDebugVariable(self.state, self.addr, self.type.type)
+            return unpacked.mem
+        if self.type is None or self.type.byte_size is None:
+            return self.mem_untyped
+
+        arch = self.state.arch
+        size = self.type.byte_size * arch.byte_width
+        name = self.type.name
+        if name in ALL_TYPES:
+            sim_type = ALL_TYPES[name].with_arch(arch)
+            assert size == sim_type.size
+        else:
+            # FIXME A lot more types are supported by angr that are not in ALL_TYPES (structs, arrays, pointers)
+            # Use a fallback type
+            sim_type = SimTypeNum(size, signed=False, label=name)
+        return self.mem_untyped.with_type(sim_type)
+
+    # methods and properties equivalent to SimMemView
+
+    @property
+    def string(self) -> SimMemView:
+        first_char = self.deref
+        # first char should have some char type (could be checked here)
+        return first_char.mem_untyped.string
+
+    def with_type(self, sim_type: SimType) -> SimMemView:
+        return self.mem_untyped.with_type(sim_type)
+
+    @property
+    def resolvable(self):
+        return self.mem.resolvable
+
+    @property
+    def resolved(self):
+        return self.mem.resolved
+
+    @property
+    def concrete(self):
+        return self.mem.concrete
+
+    def store(self, value):
+        return self.mem.store(value)
+
+    def __getitem__(self, i):
+        if isinstance(i, int):
+            return self.array(i)
+        if isinstance(i, str):
+            return self.member(i)
+        raise KeyError
+
+    @property
+    def deref(self) -> SimDebugVariable:
+        # dereferincing is equivalent to getting the first array element
+        return self.array(0)
+
+    def array(self, i) -> SimDebugVariable:
+        if isinstance(self.type, TypedefType):
+            unpacked = SimDebugVariable(self.state, self.addr, self.type.type)
+            return unpacked.array(i)
+        if isinstance(self.type, ArrayType):
+            # an array already addresses its first element
+            addr = self.addr
+            el_type = self.type.element_type
+        elif isinstance(self.type, PointerType):
+            if self.addr is None:
+                addr = None
+            else:
+                addr = self.state.memory.load(self.addr, self.state.arch.bytes, endness=self.state.arch.memory_endness)
+            el_type = self.type.referenced_type
+        else:
+            raise Exception(f"{self.type} object cannot be dereferenced")
+
+        if i == 0:
+            new_addr = addr
+        elif addr is None or el_type is None or el_type.byte_size is None:
+            new_addr = None
+        else:
+            new_addr = addr + i * el_type.byte_size
+        return SimDebugVariable(self.state, new_addr, el_type)
+
+    def member(self, member_name: str) -> SimDebugVariable:
+        if isinstance(self.type, TypedefType):
+            unpacked = SimDebugVariable(self.state, self.addr, self.type.type)
+            return unpacked.member(member_name)
+        if isinstance(self.type, StructType):
+            member = self.type[member_name]
+            addr = None if self.addr is None else self.addr + member.addr_offset
+            return SimDebugVariable(self.state, addr, member.type)
+
+        raise Exception(f"{self.type} object has no members")
+
+
+class SimDebugVariablePlugin(SimStatePlugin):
+    """
+    This is the plugin you'll use to interact with (global/local) program variables.
+    These variables have a name and a visibility scope which depends on the pc address of the state.
+    With this plugin, you can access/modify the value of such variable or find its memory address.
+    For creating program variables, or for importing them from cle, see the knowledge plugin debug_variables.
+    Run ``p.kb.dvars.load_from_dwarf()`` before using this plugin.
+
+    Example:
+        >>> p = angr.Project("various_variables", load_debug_info=True)
+        >>> p.kb.dvars.load_from_dwarf()
+        >>> state =  # navigate to the state you want
+        >>> state.dvars.get_variable("pointer2").deref.mem
+        <int (32 bits) <BV32 0x1> at 0x404020>
+    """
+
+    def get_variable(self, var_name: str) -> SimDebugVariable:
+        """
+        Returns the visible variable (if any) with name ``var_name`` based on the current ``state.ip``.
+        """
+        kb = self.state.project.kb
+        cle_var = kb.dvars[var_name][self.state.ip]
+        if cle_var:
+            return SimDebugVariable.from_cle_variable(self.state, cle_var, self.dwarf_cfa)
+        return None
+
+    def __getitem__(self, var_name: str) -> SimDebugVariable:
+        return self.get_variable(var_name)
+
+    # DWARF cfa
+    @property
+    def dwarf_cfa(self):
+        """
+        Returns the current cfa computation. Set this property to the correct value if needed.
+        """
+        try:
+            return self._dwarf_cfa
+        except AttributeError:
+            return self.dwarf_cfa_approx
+
+    @dwarf_cfa.setter
+    def dwarf_cfa(self, new_val):
+        self._dwarf_cfa = new_val
+
+    @property
+    def dwarf_cfa_approx(self):
+        # FIXME This is only an approximation!
+        if self.state.arch.name == "AMD64":
+            return self.state.regs.rbp + 16
+        if self.state.arch.name == "X86":
+            return self.state.regs.ebp + 8
+        return 0
+
+
+SimState.register_default("dvars", SimDebugVariablePlugin)

angr/state_plugins/filesystem.py

@@ -0,0 +1,463 @@
+from __future__ import annotations
+import os
+import logging
+from collections import namedtuple
+
+from .plugin import SimStatePlugin
+from angr.storage.file import SimFile
+from angr.errors import SimMergeError
+from angr.misc.ux import once
+
+l = logging.getLogger(name=__name__)
+
+Stat = namedtuple(
+    "Stat",
+    (
+        "st_dev",
+        "st_ino",
+        "st_nlink",
+        "st_mode",
+        "st_uid",
+        "st_gid",
+        "st_rdev",
+        "st_size",
+        "st_blksize",
+        "st_blocks",
+        "st_atime",
+        "st_atimensec",
+        "st_mtime",
+        "st_mtimensec",
+        "st_ctime",
+        "st_ctimensec",
+    ),
+)
+
+
+class SimFilesystem(SimStatePlugin):  # pretends links don't exist
+    """
+    angr's emulated filesystem. Available as state.fs.
+    When constructing, all parameters are optional.
+
+    :param files:       A mapping from filepath to SimFile
+    :param pathsep:     The character used to separate path elements, default forward slash.
+    :param cwd:         The path of the current working directory to use
+    :param mountpoints: A mapping from filepath to SimMountpoint
+
+    :ivar pathsep:      The current pathsep
+    :ivar cwd:          The current working directory
+    :ivar unlinks:      A list of unlink operations, tuples of filename and simfile. Be careful, this list is
+                        shallow-copied from successor to successor, so don't mutate anything in it without copying.
+    """
+
+    def __init__(self, files=None, pathsep=None, cwd=None, mountpoints=None):
+        super().__init__()
+
+        if files is None:
+            files = {}
+        if pathsep is None:
+            pathsep = b"/"
+        if cwd is None:
+            cwd = pathsep
+        if mountpoints is None:
+            mountpoints = {}
+
+        self.pathsep = pathsep
+        self.cwd = cwd
+        self._unlinks = []
+        self._files = {}
+        self._mountpoints = {}
+
+        for fname in mountpoints:
+            self.mount(fname, mountpoints[fname])
+        for fname in files:
+            self.insert(fname, files[fname])
+
+    @SimStatePlugin.memo
+    def copy(self, memo):
+        o = super().copy(memo)
+
+        o.pathsep = self.pathsep
+        o.cwd = self.cwd
+        o._unlinks = list(self._unlinks)
+        o._files = {k: v.copy(memo) for k, v in self._files.items()}
+        o._mountpoints = {k: v.copy(memo) for k, v in self._mountpoints.items()}
+
+        return o
+
+    @property
+    def unlinks(self):
+        for _, f in self._unlinks:
+            f.set_state(self.state)
+        return self._unlinks
+
+    def set_state(self, state):
+        super().set_state(state)
+        for fname in self._files:
+            self._files[fname].set_state(state)
+        for fname in self._mountpoints:
+            self._mountpoints[fname].set_state(state)
+
+    def merge(self, others, merge_conditions, common_ancestor=None):
+        for o in others:
+            if o.cwd != self.cwd:
+                raise SimMergeError("Can't merge filesystems with disparate cwds")
+            if len(o._mountpoints) != len(self._mountpoints):
+                raise SimMergeError("Can't merge filesystems with disparate mountpoints")
+            if list(map(id, o.unlinks)) != list(map(id, self.unlinks)):
+                raise SimMergeError("Can't merge filesystems with disparate unlinks")
+
+        for fname in self._mountpoints:
+            try:
+                subdeck = [o._mountpoints[fname] for o in others]
+            except KeyError as err:
+                raise SimMergeError("Can't merge filesystems with disparate file sets") from err
+
+            if common_ancestor is not None and fname in common_ancestor._mountpoints:
+                common_mp = common_ancestor._mountpoints[fname]
+            else:
+                common_mp = None
+
+            self._mountpoints[fname].merge(subdeck, merge_conditions, common_ancestor=common_mp)
+
+        # this is a little messy
+        deck = [self, *others]
+        all_files = set.union(*(set(o._files.keys()) for o in deck))
+        for fname in all_files:
+            subdeck = [o._files.get(fname, None) for o in deck]
+            representative = next(x for x in subdeck if x is not None)
+            for i, v in enumerate(subdeck):
+                if v is None:
+                    subdeck[i] = representative()
+                    if i == 0:
+                        self._files[fname] = subdeck[i]
+
+            if common_ancestor is not None and fname in common_ancestor._files:
+                common_simfile = common_ancestor._files[fname]
+            else:
+                common_simfile = None
+
+            subdeck[0].merge(subdeck[1:], merge_conditions, common_ancestor=common_simfile)
+
+        return True
+
+    def widen(self, others):  # pylint: disable=unused-argument
+        if once("fs_widen_warning"):
+            l.warning("Filesystems can't be widened yet - beware unsoundness")
+
+    def _normalize_path(self, path):
+        """
+        Takes a path and returns a simple absolute path as a list of directories from the root
+        """
+        if type(path) is str:
+            path = path.encode()
+        path = path.split(b"\0")[0]
+
+        if path[0:1] != self.pathsep:
+            path = self.cwd + self.pathsep + path
+        keys = path.split(self.pathsep)
+        i = 0
+        while i < len(keys):
+            if keys[i] == b"" or keys[i] == b".":
+                keys.pop(i)
+            elif keys[i] == b"..":
+                keys.pop(i)
+                if i != 0:
+                    keys.pop(i - 1)
+                    i -= 1
+            else:
+                i += 1
+        return keys
+
+    def _join_chunks(self, keys):
+        """
+        Takes a list of directories from the root and joins them into a string path
+        """
+        return self.pathsep + self.pathsep.join(keys)
+
+    def chdir(self, path):
+        """
+        Changes the current directory to the given path
+        """
+        self.cwd = self._join_chunks(self._normalize_path(path))
+
+    def get(self, path):
+        """
+        Get a file from the filesystem. Returns a SimFile or None.
+        """
+        mountpoint, chunks = self.get_mountpoint(path)
+
+        if mountpoint is None:
+            return self._files.get(self._join_chunks(chunks))
+        return mountpoint.get(chunks)
+
+    def insert(self, path, simfile):
+        """
+        Insert a file into the filesystem. Returns whether the operation was successful.
+        """
+        if self.state is not None:
+            simfile.set_state(self.state)
+        mountpoint, chunks = self.get_mountpoint(path)
+
+        if mountpoint is None:
+            self._files[self._join_chunks(chunks)] = simfile
+            return True
+        return mountpoint.insert(chunks, simfile)
+
+    def delete(self, path):
+        """
+        Remove a file from the filesystem. Returns whether the operation was successful.
+
+        This will add a ``fs_unlink`` event with the path of the file and also the index into the `unlinks` list.
+        """
+        mountpoint, chunks = self.get_mountpoint(path)
+        apath = self._join_chunks(chunks)
+
+        if mountpoint is None:
+            try:
+                simfile = self._files.pop(apath)
+            except KeyError:
+                return False
+            else:
+                self.state.history.add_event("fs_unlink", path=apath, unlink_idx=len(self.unlinks))
+                self.unlinks.append((apath, simfile))
+                return True
+        else:
+            return mountpoint.delete(chunks)
+
+    def mount(self, path, mount):
+        """
+        Add a mountpoint to the filesystem.
+        """
+        self._mountpoints[self._join_chunks(self._normalize_path(path))] = mount
+
+    def unmount(self, path):
+        """
+        Remove a mountpoint from the filesystem.
+        """
+        del self._mountpoints[self._join_chunks(self._normalize_path(path))]
+
+    def get_mountpoint(self, path):
+        """
+        Look up the mountpoint servicing the given path.
+
+        :return: A tuple of the mount and a list of path elements traversing from the mountpoint to the specified file.
+        """
+        path_chunks = self._normalize_path(path)
+        for i in range(len(path_chunks) - 1, -1, -1):
+            partial_path = self._join_chunks(path_chunks[:-i])
+            if partial_path in self._mountpoints:
+                mountpoint = self._mountpoints[partial_path]
+                if mountpoint is None:
+                    break
+                return mountpoint, path_chunks[-i:]
+
+        return None, path_chunks
+
+
+SimFilesystem.register_default("fs")
+
+
+class SimMount(SimStatePlugin):
+    """
+    This is the base class for "mount points" in angr's simulated filesystem. Subclass this class and
+    give it to the filesystem to intercept all file creations and opens below the mountpoint.
+    Since this a SimStatePlugin you may also want to implement set_state, copy, merge, etc.
+    """
+
+    def get(self, path_elements):
+        """
+        Implement this function to instrument file lookups.
+
+        :param path_elements:   A list of path elements traversing from the mountpoint to the file
+        :return:                A SimFile, or None
+        """
+        raise NotImplementedError
+
+    def insert(self, path_elements, simfile):
+        """
+        Implement this function to instrument file creation.
+
+        :param path_elements:   A list of path elements traversing from the mountpoint to the file
+        :param simfile:         The file to insert
+        :return:                A bool indicating whether the insert occurred
+        """
+        raise NotImplementedError
+
+    def delete(self, path_elements):
+        """
+        Implement this function to instrument file deletion.
+
+        :param path_elements:   A list of path elements traversing from the mountpoint to the file
+        :return:                A bool indicating whether the delete occurred
+        """
+        raise NotImplementedError
+
+    def lookup(self, sim_file):
+        """
+        Look up the path of a SimFile in the mountpoint
+
+        :param sim_file:        A SimFile object needs to be looked up
+        :return:                A string representing the path of the file in the mountpoint
+                                Or None if the SimFile does not exist in the mountpoint
+        """
+        raise NotImplementedError
+
+
+class SimConcreteFilesystem(SimMount):
+    """
+    Abstract SimMount allowing the user to import files from some external source into the guest
+
+    :param str pathsep:         The host path separator character, default os.path.sep
+    """
+
+    def __init__(self, pathsep=os.path.sep):
+        super().__init__()
+        self.pathsep = pathsep
+        self.cache = {}
+        self.deleted_list = set()
+
+    def get(self, path_elements):
+        path = self._join_chunks([x.decode() for x in path_elements])
+        if path in self.deleted_list:
+            return None
+        if path not in self.cache:
+            simfile = self._load_file(path)
+            if simfile is None:
+                return None
+            self.insert(path_elements, simfile)
+
+        return self.cache[path]
+
+    def _load_file(self, guest_path):
+        raise NotImplementedError
+
+    def _get_stat(self, guest_path, dereference=False):
+        raise NotImplementedError
+
+    def insert(self, path_elements, simfile):
+        path = self._join_chunks([x.decode() for x in path_elements])
+        simfile.set_state(self.state)
+        self.cache[path] = simfile
+        self.deleted_list.discard(path)
+        return True
+
+    def delete(self, path_elements):
+        path = self._join_chunks([x.decode() for x in path_elements])
+        self.deleted_list.add(path)
+        return self.cache.pop(path, None) is not None
+
+    def lookup(self, sim_file):
+        for key, val in self.cache.items():
+            if sim_file == val:
+                return key
+        return None
+
+    @SimStatePlugin.memo
+    def copy(self, memo):
+        x = type(self)(pathsep=self.pathsep)
+        x.cache = {fname: self.cache[fname].copy(memo) for fname in self.cache}
+        x.deleted_list = set(self.deleted_list)
+        return x
+
+    def set_state(self, state):
+        super().set_state(state)
+        for fname in self.cache:
+            self.cache[fname].set_state(state)
+
+    def merge(self, others, merge_conditions, common_ancestor=None):
+        merging_occurred = False
+
+        for o in others:
+            if o.pathsep != self.pathsep:
+                raise SimMergeError("Can't merge concrete filesystems with disparate pathseps")
+            if o.deleted_list != self.deleted_list:
+                raise SimMergeError("Can't merge concrete filesystems with disparate deleted files")
+
+        deck = [self, *others]
+        all_files = set.union(*(set(o._files.keys()) for o in deck))
+        for fname in all_files:
+            subdeck = []
+            basecase = None
+            for o in deck:
+                try:
+                    subdeck.append(o.cache[fname])
+                except KeyError:
+                    if basecase is None:
+                        basecase = self._load_file(fname)
+                    subdeck.append(basecase)
+
+            if common_ancestor is not None and fname in common_ancestor.cache:
+                common_simfile = common_ancestor.cache[fname]
+            else:
+                common_simfile = None
+
+            merging_occurred |= subdeck[0].merge(subdeck[1:], merge_conditions, common_ancestor=common_simfile)
+        return merging_occurred
+
+    def widen(self, others):  # pylint: disable=unused-argument
+        if once("host_fs_widen_warning"):
+            l.warning("The host filesystem mount can't be widened yet - beware unsoundness")
+
+    def _join_chunks(self, keys):
+        """
+        Takes a list of directories from the root and joins them into a string path
+        """
+        return self.pathsep + self.pathsep.join(keys)
+
+
+class SimHostFilesystem(SimConcreteFilesystem):
+    """
+    Simulated mount that makes some piece from the host filesystem available to the guest.
+
+    :param str host_path:       The path on the host to mount
+    :param str pathsep:         The host path separator character, default os.path.sep
+    """
+
+    def __init__(self, host_path=None, **kwargs):
+        super().__init__(**kwargs)
+        self.host_path = host_path if host_path is not None else self.pathsep
+
+    @SimStatePlugin.memo
+    def copy(self, memo):
+        o = super().copy(memo)
+        o.host_path = self.host_path
+        return o
+
+    def _load_file(self, guest_path):
+        guest_path = guest_path.lstrip(self.pathsep)
+        path = os.path.join(self.host_path, guest_path)
+        try:
+            with open(path, "rb") as fp:
+                content = fp.read()
+        except OSError:
+            return None
+        else:
+            return SimFile(name="file://" + os.path.realpath(path), content=content, size=len(content))
+
+    def _get_stat(self, guest_path, dereference=False):
+        guest_path = guest_path.lstrip(self.pathsep)
+        path = os.path.join(self.host_path, guest_path)
+        try:
+            if dereference:
+                path = os.path.realpath(path)
+            s = os.stat(path)
+            return Stat(
+                s.st_dev,
+                s.st_ino,
+                s.st_nlink,
+                s.st_mode,
+                s.st_uid,
+                s.st_gid,
+                s.st_rdev,
+                s.st_size,
+                s.st_blksize,
+                s.st_blocks,
+                round(s.st_atime),
+                s.st_atime_ns,
+                round(s.st_mtime),
+                s.st_mtime_ns,
+                round(s.st_ctime),
+                s.st_ctime_ns,
+            )
+        except OSError:
+            return None