angr 9.2.192__cp311-cp311-macosx_10_12_x86_64.whl

angr/storage/memory_mixins/convenient_mappings_mixin.py

@@ -0,0 +1,256 @@
+# pylint:disable=arguments-differ,assignment-from-no-return,isinstance-second-argument-not-valid-type
+from __future__ import annotations
+import logging
+
+import claripy
+
+from angr import sim_options as options
+from angr.utils.cowdict import ChainMapCOW
+from angr.errors import SimMemoryError, SimMemoryMissingError
+from angr.storage.memory_mixins.memory_mixin import MemoryMixin
+
+l = logging.getLogger(name=__name__)
+
+
+class ConvenientMappingsMixin(MemoryMixin):
+    """
+    Implements mappings between names and hashes of symbolic variables and these variables themselves.
+    """
+
+    def __init__(self, **kwargs):
+        super().__init__(**kwargs)
+
+        self._symbolic_addrs: set = set()
+        self._name_mapping = ChainMapCOW()
+        self._hash_mapping = ChainMapCOW()
+        self._updated_mappings = set()
+
+    def copy(self, memo):
+        o = super().copy(memo)
+        o._symbolic_addrs = set(self._symbolic_addrs)
+        o._name_mapping = self._name_mapping.copy()
+        o._hash_mapping = self._hash_mapping.copy()
+        o._updated_mappings = set()
+        return o
+
+    def store(self, addr, data, size=None, **kwargs):
+        if options.MEMORY_SYMBOLIC_BYTES_MAP in self.state.options:
+            if data.symbolic:
+                self._symbolic_addrs.update(range(addr, addr + size))
+            else:
+                self._symbolic_addrs.difference_update(range(addr, addr + size))
+
+        if not (
+            options.REVERSE_MEMORY_NAME_MAP in self.state.options
+            or options.REVERSE_MEMORY_HASH_MAP in self.state.options
+        ):
+            return super().store(addr, data, size=size, **kwargs)
+
+        if options.REVERSE_MEMORY_HASH_MAP not in self.state.options and not data.variables:
+            return super().store(addr, data, size=size, **kwargs)
+
+        try:
+            if options.REVERSE_MEMORY_NAME_MAP in self.state.options:
+                # remove this address for the old variables
+                old_obj = self.load(addr, size=size, fill_missing=False, disable_actions=True, inspect=False)
+
+                obj_vars = old_obj.variables
+                for v in obj_vars:
+                    self._mark_updated_mapping(self._name_mapping, v)
+                    self._name_mapping[v].difference_update(range(addr, addr + size))
+                    if len(self._name_mapping[v]) == 0:
+                        self._name_mapping.pop(v, None)
+                        self._updated_mappings.remove((v, id(self._name_mapping)))
+
+                if options.REVERSE_MEMORY_HASH_MAP in self.state.options:
+                    h = old_obj.hash()
+                    self._mark_updated_mapping(self._hash_mapping, h)
+                    self._hash_mapping[h].difference_update(range(addr, addr + size))
+                    if len(self._hash_mapping[h]) == 0:
+                        self._hash_mapping.pop(h, None)
+                        self._updated_mappings.remove((h, id(self._hash_mapping)))
+        except SimMemoryMissingError:
+            pass
+
+        if options.REVERSE_MEMORY_NAME_MAP in self.state.options:
+            # add the new variables to the mapping
+            for v in data.variables:
+                self._mark_updated_mapping(self._name_mapping, v)
+                if v not in self._name_mapping:
+                    self._name_mapping[v] = set()
+                self._name_mapping[v].update(range(addr, addr + size))
+
+        if options.REVERSE_MEMORY_HASH_MAP in self.state.options:
+            # add the new variables to the hash->addrs mapping
+            h = data.hash()
+            self._mark_updated_mapping(self._hash_mapping, h)
+            if h not in self._hash_mapping:
+                self._hash_mapping[h] = set()
+            self._hash_mapping[h].update(range(addr, addr + size))
+
+        return super().store(addr, data, size=size, **kwargs)
+
+    def _default_value(self, addr, size, **kwargs):
+        d = super()._default_value(addr, size, **kwargs)
+        if type(addr) is int:
+            self._update_mappings(addr, None, d)
+        return d
+
+    def _mark_updated_mapping(self, d, m):
+        if (m, id(d)) in self._updated_mappings:
+            return
+
+        if options.REVERSE_MEMORY_HASH_MAP not in self.state.options and d is self._hash_mapping:
+            return
+        if options.REVERSE_MEMORY_NAME_MAP not in self.state.options and d is self._name_mapping:
+            return
+
+        if d is self._hash_mapping:
+            d = self._hash_mapping = d.clean()
+        elif d is self._name_mapping:
+            d = self._name_mapping = d.clean()
+
+        try:
+            d[m] = set(d[m])
+        except KeyError:
+            d[m] = set()
+        self._updated_mappings.add((m, id(d)))
+
+    def _update_mappings(self, actual_addr: int, old_obj: claripy.ast.BV | None, new_obj: claripy.ast.BV):
+        if options.MEMORY_SYMBOLIC_BYTES_MAP in self.state.options:
+            if self.state.solver.symbolic(new_obj):
+                self._symbolic_addrs.add(actual_addr)
+            else:
+                self._symbolic_addrs.discard(actual_addr)
+
+        if not (
+            options.REVERSE_MEMORY_NAME_MAP in self.state.options
+            or options.REVERSE_MEMORY_HASH_MAP in self.state.options
+        ):
+            return
+
+        if (options.REVERSE_MEMORY_HASH_MAP not in self.state.options) and len(
+            self.state.solver.variables(new_obj)
+        ) == 0:
+            return
+
+        l.debug("Updating mappings at address %#x", actual_addr)
+
+        # remove this address for the old variables
+        if isinstance(old_obj, claripy.ast.BV):
+            l.debug("... removing old mappings")
+            if options.REVERSE_MEMORY_NAME_MAP in self.state.options:
+                var_set = self.state.solver.variables(old_obj)
+                for v in var_set:
+                    self._mark_updated_mapping(self._name_mapping, v)
+                    self._name_mapping[v].discard(actual_addr)
+                    if len(self._name_mapping[v]) == 0:
+                        self._name_mapping.pop(v, None)
+
+            if options.REVERSE_MEMORY_HASH_MAP in self.state.options:
+                h = old_obj.hash()
+                self._mark_updated_mapping(self._hash_mapping, h)
+                self._hash_mapping[h].discard(actual_addr)
+                if len(self._hash_mapping[h]) == 0:
+                    self._hash_mapping.pop(h, None)
+
+        l.debug("... adding new mappings")
+        if options.REVERSE_MEMORY_NAME_MAP in self.state.options:
+            # add the new variables to the mapping
+            var_set = self.state.solver.variables(new_obj)
+            for v in var_set:
+                self._mark_updated_mapping(self._name_mapping, v)
+                if v not in self._name_mapping:
+                    self._name_mapping[v] = set()
+                self._name_mapping[v].add(actual_addr)
+
+        if options.REVERSE_MEMORY_HASH_MAP in self.state.options:
+            # add the new variables to the hash->addrs mapping
+            h = new_obj.hash()
+            self._mark_updated_mapping(self._hash_mapping, h)
+            if h not in self._hash_mapping:
+                self._hash_mapping[h] = set()
+            self._hash_mapping[h].add(actual_addr)
+
+    def get_symbolic_addrs(self):
+        return self._symbolic_addrs
+
+    def addrs_for_name(self, n):
+        """
+        Returns addresses that contain expressions that contain a variable named `n`.
+        """
+        if n not in self._name_mapping:
+            return
+
+        self._mark_updated_mapping(self._name_mapping, n)
+
+        to_discard = set()
+        for e in self._name_mapping[n]:
+            try:
+                if n in self.load(e, size=1).variables:
+                    yield e
+                else:
+                    to_discard.add(e)
+            except KeyError:
+                to_discard.add(e)
+        self._name_mapping[n] -= to_discard
+
+    def addrs_for_hash(self, h):
+        """
+        Returns addresses that contain expressions that contain a variable with the hash of `h`.
+        """
+        if h not in self._hash_mapping:
+            return
+
+        self._mark_updated_mapping(self._hash_mapping, h)
+
+        to_discard = set()
+        for e in self._hash_mapping[h]:
+            try:
+                present = self.load(e, size=1)
+                if h == present.hash() or (
+                    present.op == "Extract" and present.args[0] - present.args[1] == 7 and h == present.args[2].hash()
+                ):
+                    yield e
+                else:
+                    to_discard.add(e)
+            except KeyError:
+                to_discard.add(e)
+        self._hash_mapping[h] -= to_discard
+
+    def replace_all(self, old: claripy.ast.BV, new: claripy.ast.BV):
+        """
+        Replaces all instances of expression `old` with expression `new`.
+
+        :param old: A claripy expression. Must contain at least one named variable (to make it possible to use the
+                    name index for speedup).
+        :param new: The new variable to replace it with.
+        """
+
+        if options.REVERSE_MEMORY_NAME_MAP not in self.state.options:
+            raise SimMemoryError(
+                "replace_all is not doable without a reverse name mapping. Please add "
+                "sim_options.REVERSE_MEMORY_NAME_MAP to the state options"
+            )
+
+        if not isinstance(old, claripy.ast.BV) or not isinstance(new, claripy.ast.BV):
+            raise SimMemoryError("old and new arguments to replace_all() must be claripy.BV objects")
+
+        if len(old.variables) == 0:
+            raise SimMemoryError("old argument to replace_all() must have at least one named variable")
+
+        # Computer an intersection between sets of memory addresses for each unique variable name. The eventual address
+        # set contains all addresses whose memory objects we should update.
+        addrs: set | None = None
+        for v in old.variables:
+            v: str
+            if addrs is None:
+                addrs = set(self.addrs_for_name(v))
+            elif len(addrs) == 0:
+                # It's a set and it's already empty
+                # there is no way for it to go back...
+                break
+            else:
+                addrs &= set(self.addrs_for_name(v))
+
+        self._replace_all(addrs, old, new)

angr/storage/memory_mixins/default_filler_mixin.py

@@ -0,0 +1,144 @@
+from __future__ import annotations
+import logging
+
+import claripy
+
+from angr.storage.memory_mixins.memory_mixin import MemoryMixin
+from angr import sim_options as options
+from angr.misc.ux import once
+from angr.errors import SimMemoryMissingError
+
+l = logging.getLogger(__name__)
+
+
+class DefaultFillerMixin(MemoryMixin):
+    def _default_value(
+        self, addr, size, *, name=None, inspect=True, events=True, key=None, fill_missing: bool = True, **kwargs
+    ):
+        if self.state.project and self.state.project.concrete_target:
+            mem = self.state.project.concrete_target.read_memory(addr, size)
+            endness = kwargs["endness"]
+            bvv = claripy.BVV(mem)
+            return bvv if endness == "Iend_BE" else bvv.reversed
+
+        if fill_missing is False:
+            raise SimMemoryMissingError(addr, size)
+
+        bits = size * self.state.arch.byte_width
+
+        if (
+            type(addr) is int
+            and self.category == "mem"
+            and options.ZERO_FILL_UNCONSTRAINED_MEMORY in self.state.options
+        ) or (self.category == "reg" and options.ZERO_FILL_UNCONSTRAINED_REGISTERS in self.state.options):
+            return claripy.BVV(0, bits)
+
+        if self.category == "reg" and type(addr) is int and addr == self.state.arch.ip_offset:
+            # short-circuit this pathological case
+            return claripy.BVV(0, self.state.arch.bits)
+
+        is_mem = (
+            self.category == "mem"
+            and options.ZERO_FILL_UNCONSTRAINED_MEMORY not in self.state.options
+            and options.SYMBOL_FILL_UNCONSTRAINED_MEMORY not in self.state.options
+        )
+        is_reg = (
+            self.category == "reg"
+            and options.ZERO_FILL_UNCONSTRAINED_REGISTERS not in self.state.options
+            and options.SYMBOL_FILL_UNCONSTRAINED_REGISTERS not in self.state.options
+        )
+        if type(addr) is int and (is_mem or is_reg):
+            if once("mem_fill_warning"):
+                what = "memory" if is_mem else "register"
+                l.warning(
+                    "The program is accessing %s with an unspecified value. This could indicate unwanted behavior.",
+                    what,
+                )
+                l.warning(
+                    "angr will cope with this by generating an unconstrained symbolic variable and continuing. "
+                    "You can resolve this by:"
+                )
+                l.warning("1) setting a value to the initial state")
+                l.warning(
+                    "2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, "
+                    "to make unknown regions hold null"
+                )
+                l.warning(
+                    "3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, "
+                    "to suppress these messages."
+                )
+
+            if is_mem:
+                refplace_int = self.state.solver.eval(self.state._ip)
+                if self.state.project:
+                    refplace_str = self.state.project.loader.describe_addr(refplace_int)
+                else:
+                    refplace_str = "unknown"
+                l.warning(
+                    "Filling memory at %#x with %d unconstrained bytes referenced from %#x (%s)",
+                    addr,
+                    size,
+                    refplace_int,
+                    refplace_str,
+                )
+            else:
+                if addr == self.state.arch.ip_offset:
+                    refplace_int = 0
+                    refplace_str = "symbolic"
+                else:
+                    refplace_int = self.state.solver.eval(self.state._ip)
+                    if self.state.project:
+                        refplace_str = self.state.project.loader.describe_addr(refplace_int)
+                    else:
+                        refplace_str = "unknown"
+                reg_str = self.state.arch.translate_register_name(addr, size=size)
+                l.warning(
+                    "Filling register %s with %d unconstrained bytes referenced from %#x (%s)",
+                    reg_str,
+                    size,
+                    refplace_int,
+                    refplace_str,
+                )
+                if name is None and not reg_str.isdigit():
+                    name = "reg_" + reg_str
+
+        if name is None:
+            name = f"{self.id}_{addr:x}" if type(addr) is int else self.category
+
+        return self.state.solver.Unconstrained(name, bits, key=key, inspect=inspect, events=events)
+
+
+class SpecialFillerMixin(MemoryMixin):
+    def __init__(self, special_memory_filler=None, **kwargs):
+        super().__init__(**kwargs)
+        self._special_memory_filler = special_memory_filler
+
+    def _default_value(self, addr, size, *, name=None, **kwargs):
+        if (
+            options.SPECIAL_MEMORY_FILL in self.state.options
+            and self.state._special_memory_filler is not None
+            and type(addr) is int
+        ):
+            return self.state._special_memory_filler(name, addr, size * self.state.arch.byte_width, self.state)
+        return super()._default_value(addr, size, name=name, **kwargs)
+
+    def copy(self, memo):
+        o = super().copy(memo)
+        o._special_memory_filler = self._special_memory_filler
+        return o
+
+
+class ExplicitFillerMixin(MemoryMixin):
+    def __init__(self, uninitialized_read_handler=None, **kwargs):
+        super().__init__(**kwargs)
+        self._uninitialized_read_handler = uninitialized_read_handler
+
+    def _default_value(self, addr, size, *, inspect=True, events=True, **kwargs):
+        if self._uninitialized_read_handler is not None:
+            return self._uninitialized_read_handler(addr, size, inspect=inspect, events=events)
+        return super()._default_value(addr, size, inspect=inspect, events=events, **kwargs)
+
+    def copy(self, memo):
+        o = super().copy(memo)
+        o._uninitialized_read_handler = self._uninitialized_read_handler
+        return o

angr/storage/memory_mixins/dirty_addrs_mixin.py

@@ -0,0 +1,11 @@
+from __future__ import annotations
+
+from angr.storage.memory_mixins.memory_mixin import MemoryMixin
+
+
+class DirtyAddrsMixin(MemoryMixin):
+    def store(self, addr, data, size=None, **kwargs):
+        assert type(size) is int
+        if self.category == "mem":
+            self.state.scratch.dirty_addrs.update(range(addr, addr + size))
+        super().store(addr, data, size=size, **kwargs)

angr/storage/memory_mixins/hex_dumper_mixin.py

@@ -0,0 +1,82 @@
+from __future__ import annotations
+import string
+
+from angr.errors import SimValueError
+from angr.storage.memory_mixins.memory_mixin import MemoryMixin
+import contextlib
+
+
+class HexDumperMixin(MemoryMixin):
+    def hex_dump(
+        self,
+        start,
+        size,
+        word_size=4,
+        words_per_row=4,
+        endianness="Iend_BE",
+        symbolic_char="?",
+        unprintable_char=".",
+        solve=False,
+        extra_constraints=None,
+        inspect=False,
+        disable_actions=True,
+    ):
+        """
+        Returns a hex dump as a string. The solver, if enabled, is called once for every byte
+        potentially making this function very slow. It is meant to be used mainly as a
+        "visualization" for debugging.
+
+        Warning: May read and display more bytes than `size` due to rounding. Particularly,
+        if size is less than, or not a multiple of word_size*words_per_line.
+
+        :param start: starting address from which to print
+        :param size: number of bytes to display
+        :param word_size: number of bytes to group together as one space-delimited unit
+        :param words_per_row: number of words to display per row of output
+        :param endianness: endianness to use when displaying each word (ASCII representation is unchanged)
+        :param symbolic_char: the character to display when a byte is symbolic and has multiple solutions
+        :param unprintable_char: the character to display when a byte is not printable
+        :param solve: whether or not to attempt to solve (warning: can be very slow)
+        :param extra_constraints: extra constraints to pass to the solver is solve is True
+        :param inspect: whether or not to trigger SimInspect breakpoints for the memory load
+        :param disable_actions: whether or not to disable SimActions for the memory load
+        :return: hex dump as a string
+        """
+        end = 1 if endianness == "Iend_BE" else -1
+        if extra_constraints is None:
+            extra_constraints = []
+
+        # round up size so that chop() works
+        line_size = word_size * words_per_row
+        size = size if size % line_size == 0 else size + line_size - size % line_size
+        raw_mem = super().load(start, size=size, inspect=inspect, disable_actions=disable_actions)
+
+        i = start
+        dump_str = ""
+        for line in raw_mem.chop(line_size * self.state.arch.byte_width):
+            dump = f"{i:x}:"
+            group_str = ""
+            for word in line.chop(word_size * self.state.arch.byte_width):
+                word_bytes = ""
+                word_str = ""
+                for byte_ in word.chop(self.state.arch.byte_width)[::end]:
+                    byte_value = None
+                    if not self.state.solver.symbolic(byte_) or solve:
+                        with contextlib.suppress(SimValueError):
+                            byte_value = self.state.solver.eval_one(byte_, extra_constraints=extra_constraints)
+
+                    if byte_value is not None:
+                        word_bytes += f"{byte_value:02x}"
+                        if chr(byte_value) in string.printable[:-5]:
+                            word_str += chr(byte_value)
+                        else:
+                            word_str += unprintable_char
+                    else:
+                        word_bytes += symbolic_char * 2
+                        word_str += symbolic_char
+                dump += " " + word_bytes
+                group_str += word_str[::end]  # always print ASCII representation in little-endian
+            dump += " " + group_str
+            i += line_size
+            dump_str += dump + "\n"
+        return dump_str