angr 9.2.192__cp311-cp311-macosx_10_12_x86_64.whl

angr/state_plugins/light_registers.py

@@ -0,0 +1,168 @@
+from __future__ import annotations
+import claripy
+import logging
+
+from .plugin import SimStatePlugin
+from angr.errors import SimFastMemoryError
+from angr.misc.ux import once
+from angr import sim_options as options
+
+l = logging.getLogger(__name__)
+
+
+class SimLightRegisters(SimStatePlugin):
+    def __init__(self, reg_map=None, registers=None):
+        super().__init__()
+
+        self.reg_map = {} if reg_map is None else reg_map
+        self.registers = {} if registers is None else registers
+
+    @SimStatePlugin.memo
+    def copy(self, _memo):
+        return type(self)(reg_map=self.reg_map, registers=dict(self.registers))
+
+    def set_state(self, state):
+        super().set_state(state)
+
+        if not self.registers:
+            ip_name = state.arch.register_names[state.arch.ip_offset]
+            self.registers[ip_name] = claripy.BVV(0, state.arch.registers[ip_name][1])
+
+        if self.reg_map:
+            return
+
+        bw = state.arch.byte_width
+        for reg in state.arch.register_list:
+            self.reg_map[(reg.vex_offset, reg.size)] = reg.name, None, reg.size * bw
+            for _subreg_name, subreg_suboffset, subreg_size in reg.subregisters:
+                # endian swap gets undone here
+                if state.arch.register_endness == "Iend_BE":
+                    extract_high = (reg.size - 1 - subreg_suboffset) * bw + 7
+                    extract_low = extract_high - subreg_size * bw + 1
+                else:
+                    extract_low = subreg_suboffset * bw
+                    extract_high = extract_low + subreg_size * bw - 1
+                self.reg_map[(reg.vex_offset + subreg_suboffset, subreg_size)] = (
+                    reg.name,
+                    (extract_high, extract_low),
+                    subreg_size * bw,
+                )
+
+    def resolve_register(self, offset, size):
+        if isinstance(offset, str):
+            offset, size = self.state.arch.registers[offset]
+        else:
+            if not isinstance(size, int):
+                try:
+                    if size.symbolic:
+                        raise SimFastMemoryError("Can't handle symbolic register access")
+                    size = offset.args[0]
+                except AttributeError:
+                    raise TypeError("Invalid size argument") from None
+
+            if not isinstance(offset, int):
+                try:
+                    if offset.symbolic:
+                        raise SimFastMemoryError("Can't handle symbolic register access")
+                    offset = offset.args[0]
+                except AttributeError:
+                    raise TypeError("Invalid offset argument") from None
+
+            if size is None:
+                raise SimFastMemoryError("No size for register access available")
+
+        try:
+            return self.reg_map[(offset, size)]
+        except KeyError as e:
+            raise SimFastMemoryError("Register access to an unknown register or register slice") from e
+
+    def load(self, offset, size=None, **kwargs):
+        name, extract, _ = self.resolve_register(offset, size)
+        return self._complex_load(name, extract)
+
+    def _complex_load(self, name, extract):
+        val = self._simple_load(name)
+        if extract is not None:
+            val = val[extract[0] : extract[1]]
+        return val
+
+    def _simple_load(self, name):
+        try:
+            return self.registers[name]
+        except KeyError:
+            pass
+
+        try:
+            size = self.state.arch.registers[name][1]
+        except KeyError as e:
+            raise KeyError("Critical programming error in SimLightRegisters - pls report") from e
+
+        return self._fill(name, size)
+
+    def store(self, offset, value, size=None, endness=None, **kwargs):
+        if size is None and not isinstance(offset, str) and not isinstance(value, int):
+            try:
+                size = len(value) // self.state.arch.byte_width
+            except TypeError:
+                raise SimFastMemoryError("Invalid register store value") from None
+
+        name, extract, xsize = self.resolve_register(offset, size)
+
+        if size is not None:
+            try:
+                if not self.state.solver.is_true(size * self.state.arch.byte_width == xsize):
+                    raise SimFastMemoryError("Inconsistent register store size")
+            except TypeError:
+                raise SimFastMemoryError("Invalid register store value") from None
+
+        if isinstance(value, int):
+            value = claripy.BVV(value, xsize)
+
+        if endness is not None and endness != self.state.arch.register_endness:
+            # ???????
+            value = value.reversed
+
+        self._complex_store(name, value, extract)
+
+    def _complex_store(self, name, value, extract):
+        if extract is not None:
+            baseval = self._simple_load(name)
+            if extract[0] != len(baseval) - 1:
+                value = baseval[len(baseval) - 1 : extract[0] + 1].concat(value)
+            if extract[1] != 0:
+                value = value.concat(baseval[extract[1] - 1 : 0])
+
+        self._simple_store(name, value)
+
+    def _simple_store(self, name, value):
+        self.registers[name] = value
+
+    def _fill(self, name, size):
+        size_bits = size * self.state.arch.byte_width
+        if options.ZERO_FILL_UNCONSTRAINED_REGISTERS in self.state.options:
+            value = claripy.BVV(0, size_bits)
+        else:
+            if options.SYMBOL_FILL_UNCONSTRAINED_REGISTERS not in self.state.options:
+                if once("mem_fill_warning"):
+                    l.warning(
+                        "The program is accessing memory or registers with an unspecified value. "
+                        "This could indicate unwanted behavior."
+                    )
+                    l.warning(
+                        "angr will cope with this by generating an unconstrained symbolic variable and continuing. "
+                        "You can resolve this by:"
+                    )
+                    l.warning("1) setting a value to the initial state")
+                    l.warning(
+                        "2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, "
+                        "to make unknown regions hold null"
+                    )
+                    l.warning(
+                        "3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY_REGISTERS}, "
+                        "to suppress these messages."
+                    )
+                l.warning("Filling register %s with %d unconstrained bytes", name, size)
+            return self.state.solver.Unconstrained(f"reg_{name}", size_bits, key=("reg", name), eternal=True)  # :)
+
+        self.registers[name] = value
+        return value

angr/state_plugins/log.py

@@ -0,0 +1,84 @@
+from __future__ import annotations
+
+import itertools
+import logging
+
+from angr.errors import SimEventError
+from angr.sim_state import SimState
+from .plugin import SimStatePlugin
+from .sim_event import SimEvent
+from .sim_action import SimAction, SimActionConstraint
+
+
+l = logging.getLogger(name=__name__)
+
+
+class SimStateLog(SimStatePlugin):
+    def __init__(self, log=None):
+        SimStatePlugin.__init__(self)
+
+        # general events
+        self.events = []
+
+        if log is not None:
+            self.events.extend(log.events)
+
+    @property
+    def actions(self):
+        for e in self.events:
+            if isinstance(e, SimAction):
+                yield e
+
+    def add_event(self, event_type, **kwargs):
+        try:
+            new_event = SimEvent(self.state, event_type, **kwargs)
+            self.events.append(new_event)
+        except TypeError as e:
+            raise SimEventError("Exception encountered when logging event") from e
+
+    def _add_event(self, event):
+        self.events.append(event)
+
+    def add_action(self, action):
+        self.events.append(action)
+
+    def extend_actions(self, new_actions):
+        self.events.extend(new_actions)
+
+    def events_of_type(self, event_type):
+        return [e for e in self.events if e.type == event_type]
+
+    def actions_of_type(self, action_type):
+        return [action for action in self.actions if action.type == action_type]
+
+    @property
+    def fresh_constraints(self):
+        # pylint: disable=no-member
+        return [ev.constraint.ast for ev in self.events if isinstance(ev, SimActionConstraint)]
+
+    @SimStatePlugin.memo
+    def copy(self, memo):  # pylint: disable=unused-argument
+        return SimStateLog(log=self)
+
+    def _combine(self, others):
+        all_events = [e.events for e in itertools.chain([self], others)]
+        self.events = [SimEvent(self.state, "merge", event_lists=all_events)]
+        return False
+
+    def merge(self, others, merge_conditions, common_ancestor=None):  # pylint: disable=unused-argument
+        return self._combine(others)
+
+    def widen(self, others):
+        return self._combine(others)
+
+    def clear(self):
+        s = self.state
+        self.__init__()
+        self.state = s
+        # self.events = [ ]
+        # self.temps.clear()
+        # self.used_variables.clear()
+        # self.input_variables.clear()
+
+
+SimState.register_default("log", SimStateLog)

angr/state_plugins/loop_data.py

@@ -0,0 +1,92 @@
+from __future__ import annotations
+import logging
+import copy
+from collections import defaultdict
+
+from angr.sim_state import SimState
+from .plugin import SimStatePlugin
+
+
+l = logging.getLogger(name=__name__)
+
+
+class SimStateLoopData(SimStatePlugin):
+    """
+    This class keeps track of loop-related information for states.
+    Note that we have 2 counters for loop iterations (trip counts): the first
+    recording the number of times one of the back edges (or continue edges) of
+    a loop is taken, whereas the second recording the number of times the loop
+    header (or loop entry) is executed. These 2 counters may differ since
+    compilers usually optimize loops hence completely change the loop structure
+    at the binary level.
+    This is supposed to be used with `LoopSeer` exploration technique, which
+    monitors loop execution. For the moment, the only thing we want to analyze
+    is loop trip counts, but nothing prevents us from extending this plugin for
+    other loop analyses.
+    """
+
+    def __init__(self, back_edge_trip_counts=None, header_trip_counts=None, current_loop=None):
+        """
+        :param back_edge_trip_counts: Dictionary that stores back edge based trip counts for each loop.
+                                      Keys are address of loop headers.
+        :param header_trip_counts:    Dictionary that stores header based trip counts for each loop.
+                                      Keys are address of loop headers.
+        :param current_loop:          List of currently running loops. Each element is a tuple
+                                      (loop object, list of loop exits).
+        """
+        # This is why header based trip counter is not always accurate:
+        #
+        # 0x10812: movs r3, #0          -> this block dominates the loop
+        # 0x10814: str  r3, [r7, #20]
+        # 0x10816: b    0x10868
+        #
+        # 0x10818: movs r3, #0          -> the real loop body starts here
+        # ...
+        #
+        # 0x10868: ldr  r3, [r7, #20]   -> the loop header is executed the first time without executing the loop body
+        # 0x1086a: cmp  r3, #3
+        # 0x1086c: ble  0x10818         -> the back edge
+        #
+        # This is why back edge based trip counter is not always accurate. The
+        # compiler divides the logic of the loop body in 2 parts A and B. This loop
+        # structure implies that the back edge is taken one time less than the number
+        # of times the full loop body is executed.
+        #
+        # 0x10768: movs r3, #0          -> this block contains part A of the logic
+        # ...                              for the first iteration and dominates the loop
+        # 0x10816: b    0x10868
+        #
+        # 0x10818: movs r3, #0          -> part A of the logic for other iterations is put in this block
+        # ...
+        #
+        # 0x10868: add  r2, r0, r1      -> part B of the logic for all iterations is put in the loop header
+        # ...
+        # 0x10898: ldr  r3, [r7, #20]
+        # 0x1089a: cmp  r3, #3
+        # 0x1089c: ble  0x10818         -> the back edge
+        #
+        # And yes, another example for the latter case is a do-while loop!
+
+        SimStatePlugin.__init__(self)
+        self.back_edge_trip_counts = defaultdict(list) if back_edge_trip_counts is None else back_edge_trip_counts
+        self.header_trip_counts = defaultdict(list) if header_trip_counts is None else header_trip_counts
+        self.current_loop = [] if current_loop is None else current_loop
+
+    def merge(self, others, merge_conditions, common_ancestor=None):  # pylint: disable=unused-argument
+        l.warning("Merging is not implemented for loop data!")
+        return False
+
+    def widen(self, others):  # pylint: disable=unused-argument
+        l.warning("Widening is not implemented for loop data!")
+        return False
+
+    @SimStatePlugin.memo
+    def copy(self, memo):  # pylint: disable=unused-argument
+        return SimStateLoopData(
+            back_edge_trip_counts=copy.deepcopy(self.back_edge_trip_counts),
+            header_trip_counts=copy.deepcopy(self.header_trip_counts),
+            current_loop=list(self.current_loop),
+        )
+
+
+SimState.register_default("loop_data", SimStateLoopData)

angr/state_plugins/plugin.py

@@ -0,0 +1,176 @@
+from __future__ import annotations
+
+# pylint: disable=import-outside-toplevel
+
+from typing import Any, Generic, ParamSpec, cast, TypeVar, Protocol
+from collections.abc import Callable
+from functools import wraps
+
+import logging
+
+import angr
+from angr.misc.ux import once
+
+l = logging.getLogger(name=__name__)
+
+T = TypeVar("T")
+S_co = TypeVar("S_co", covariant=True)
+P = ParamSpec("P")
+
+
+class _CopyFunc(Protocol, Generic[S_co]):
+    """
+    Function wrapping copy method for memo tracking.
+    """
+
+    @staticmethod
+    def __call__(_self: Any, memo: dict[int, Any] | None = None) -> S_co: ...
+
+
+class SimStatePlugin:
+    """
+    This is a base class for SimState plugins. A SimState plugin will be copied along with the state when the state is
+    branched. They are intended to be used for things such as tracking open files, tracking heap details, and providing
+    storage and persistence for SimProcedures.
+    """
+
+    STRONGREF_STATE = False
+
+    def __init__(self):
+        self.state: angr.SimState = cast(angr.SimState, None)
+
+    def set_state(self, state):
+        """
+        Sets a new state (for example, if the state has been branched)
+        """
+        self.state = state._get_weakref()
+
+    def set_strongref_state(self, state):
+        pass
+
+    def __getstate__(self):
+        d = dict(self.__dict__)
+        d["state"] = None
+        return d
+
+    @staticmethod
+    def memo(f: Callable[[Any, dict[int, Any]], S_co]) -> _CopyFunc[S_co]:
+        """
+        A decorator function you should apply to ``copy``
+        """
+
+        @wraps(f)
+        def inner(self: Any, memo: dict[int, Any] | None = None) -> S_co:
+            if memo is None:
+                memo = {}
+            if id(self) in memo:
+                return memo[id(self)]
+            c = f(self, memo)
+            memo[id(self)] = c
+            return c
+
+        # Type-checking fails here because we can't express the `self` partial-application with a Protocol
+        # and we can't express the optional `memo` parameter without a Protocol
+        return inner  # type: ignore
+
+    @memo
+    def copy(self, _memo):
+        """
+        Should return a copy of the plugin without any state attached. Should check the memo first, and add itself to
+        memo if it ends up making a new copy.
+
+        In order to simplify using the memo, you should annotate implementations of this function with
+        ``SimStatePlugin.memo``
+
+        The base implementation of this function constructs a new instance of the plugin's class without calling its
+        initializer. If you super-call down to it, make sure you instantiate all the fields in your copy method!
+
+        :param memo:    A dictionary mapping object identifiers (id(obj)) to their copied instance.  Use this to avoid
+                        infinite recursion and diverged copies.
+        """
+        o = type(self).__new__(type(self))
+        o.state = None  # type: ignore
+        return o
+
+    def merge(self, others, merge_conditions, common_ancestor=None):  # pylint:disable=unused-argument
+        """
+        Should merge the state plugin with the provided others. This will be called by ``state.merge()`` after copying
+        the target state, so this should mutate the current instance to merge with the others.
+
+        Note that when multiple instances of a single plugin object (for example, a file) are referenced in the state,
+        it is important that merge only ever be called once. This should be solved by designating one of the plugin's
+        referees as the "real owner", who should be the one to actually merge it. This technique doesn't work to
+        resolve the similar issue that arises during copying because merging doesn't produce a new reference to insert.
+
+        There will be n ``others`` and n+1 merge conditions, since the first condition corresponds to self.
+        To match elements up to conditions, say ``zip([self] + others, merge_conditions)``
+
+        When implementing this, make sure that you "deepen" both ``others`` and ``common_ancestor`` before calling
+        sub-elements' merge methods, e.g.
+
+        .. code-block:: python
+
+           self.foo.merge(
+               [o.foo for o in others],
+               merge_conditions,
+               common_ancestor=common_ancestor.foo if common_ancestor is not None else None
+           )
+
+        During static analysis, merge_conditions can be None, in which case you should use
+        ``state.solver.union(values)``.
+        TODO: fish please make this less bullshit
+
+        There is a utility ``claripy.ite_cases`` which will help with constructing arbitrarily large merged ASTs.
+        Use it like ``self.bar = claripy.ite_cases(zip(conditions[1:], [o.bar for o in others]), self.bar)``
+
+        :param others: the other state plugins to merge with
+        :param merge_conditions: a symbolic condition for each of the plugins
+        :param common_ancestor: a common ancestor of this plugin and the others being merged
+        :returns: True if the state plugins are actually merged.
+        :rtype: bool
+        """
+        raise NotImplementedError(f"merge() not implement for {self.__class__.__name__}")
+
+    def widen(self, others):  # pylint:disable=unused-argument
+        """
+        The widening operation for plugins. Widening is a special kind of merging that produces a more general state
+        from several more specific states. It is used only during intensive static analysis. The same behavior
+        regarding copying and mutation from ``merge`` should be followed.
+
+        :param others: the other state plugin
+
+        :returns: True if the state plugin is actually widened.
+        :rtype: bool
+        """
+        raise NotImplementedError(f"widen() not implemented for {self.__class__.__name__}")
+
+    @classmethod
+    def register_default(cls, name, xtr=None):
+        if cls is SimStatePlugin:
+            if once("simstateplugin_register_default deprecation"):
+                l.critical(
+                    "SimStatePlugin.register_default(name, cls) is deprecated, "
+                    "please use SimState.register_default(name)"
+                )
+
+            from angr.sim_state import SimState
+
+            SimState.register_default(name, xtr)
+
+        else:
+            if xtr is cls:
+                if once("simstateplugin_register_default deprecation case 2"):
+                    l.critical(
+                        "SimStatePlugin.register_default(name, cls) is deprecated, "
+                        "please use cls.register_default(name)"
+                    )
+                xtr = None
+
+            from angr.sim_state import SimState
+
+            SimState.register_default(name, cls, xtr if xtr is not None else "default")
+
+    def init_state(self):
+        """
+        Use this function to perform any initialization on the state at plugin-add time
+        """