angr 9.2.192__cp311-cp311-macosx_10_12_x86_64.whl

angr/storage/memory_mixins/size_resolution_mixin.py

@@ -0,0 +1,143 @@
+from __future__ import annotations
+import logging
+
+import claripy
+
+from angr.errors import SimMemoryLimitError, SimMemoryError, SimUnsatError
+from angr.storage.memory_mixins.memory_mixin import MemoryMixin
+
+l = logging.getLogger(__name__)
+
+
+class SizeNormalizationMixin(MemoryMixin):
+    """
+    Provides basic services related to normalizing sizes. After this mixin, sizes will always be a plain int.
+    Assumes that the data is a BV.
+
+    - load will throw a TypeError if no size is provided
+    - store will default to len(data)//byte_width if no size is provided
+    """
+
+    def load(self, addr, size=None, **kwargs):
+        if size is None:
+            raise TypeError("Must provide size to load")
+        if type(size) is int:
+            out_size = size
+        elif getattr(size, "op", None) == "BVV":
+            out_size = size.args[0]
+        else:
+            raise Exception("Size must be concretely resolved by this point in the memory stack")
+
+        return super().load(addr, size=out_size, **kwargs)
+
+    def store(self, addr, data, size=None, **kwargs):
+        max_size = len(data) // self.state.arch.byte_width
+        if size is None:
+            out_size = max_size
+        elif type(size) is int:
+            out_size = size
+        elif getattr(size, "op", None) == "BVV":
+            out_size = size.args[0]
+        else:
+            raise Exception("Size must be concretely resolved by this point in the memory stack")
+
+        if out_size > max_size:
+            raise SimMemoryError("Not enough data for store")
+        if out_size == 0:
+            # skip zero-sized stores
+            return
+
+        super().store(addr, data, size=out_size, **kwargs)
+
+
+class SizeConcretizationMixin(MemoryMixin):
+    """
+    This mixin allows memory to process symbolic sizes. It will not touch any sizes which are not ASTs with non-BVV ops.
+    Assumes that the data is a BV.
+
+    - symbolic load sizes will be concretized as their maximum and a warning will be logged
+    - symbolic store sizes will be dispatched as several conditional stores with concrete sizes
+    """
+
+    def __init__(
+        self,
+        concretize_symbolic_write_size: bool = False,
+        max_concretize_count: int | None = 256,
+        max_symbolic_size: int = 0x400000,
+        raise_memory_limit_error: bool = False,
+        size_limit: int = 257,
+        **kwargs,
+    ):
+        super().__init__(**kwargs)
+        self._concretize_symbolic_write_size = (
+            concretize_symbolic_write_size  # in place of the state option CONCRETIZE_SYMBOLIC_WRITE_SIZES
+        )
+        self._max_concretize_count = max_concretize_count
+        self._max_symbolic_size = max_symbolic_size
+        self._raise_memory_limit_error = raise_memory_limit_error
+        self._size_limit = size_limit
+
+    def copy(self, memo):
+        o = super().copy(memo)
+
+        o._concretize_symbolic_write_size = self._concretize_symbolic_write_size
+        o._max_concretize_count = self._max_concretize_count
+        o._max_symbolic_size = self._max_symbolic_size
+        o._raise_memory_limit_error = self._raise_memory_limit_error
+        o._size_limit = self._size_limit
+
+        return o
+
+    def load(self, addr, size=None, **kwargs):
+        if getattr(size, "op", "BVV") == "BVV":
+            return super().load(addr, size=size, **kwargs)
+
+        l.warning("Loading symbolic size via max. be careful.")
+        out_size = self.state.solver.max(size)
+        return super().load(addr, size=out_size, **kwargs)
+
+    def store(self, addr, data, size=None, *, condition=None, **kwargs):
+        if getattr(size, "op", "BVV") == "BVV":
+            super().store(addr, data, size=size, condition=condition, **kwargs)
+            return
+
+        max_size = len(data) // self.state.arch.byte_width
+        try:
+            if self._raise_memory_limit_error:
+                conc_sizes = list(
+                    self.state.solver.eval_upto(size, self._size_limit, extra_constraints=(size <= max_size,))
+                )
+                if len(conc_sizes) == self._size_limit:
+                    raise SimMemoryLimitError("Extremely unconstrained store size")
+            else:
+                conc_sizes = list(
+                    self.state.solver.eval_upto(size, self._max_concretize_count, extra_constraints=(size <= max_size,))
+                )
+        except SimUnsatError as err:
+            # size has to be greater than max_size
+            raise SimMemoryError("Not enough data for store") from err
+
+        # filter out all concrete sizes that are greater than max_size
+        # Note that the VSA solver (used in static mode) cannot precisely handle extra constraints. As a result, we may
+        # get conc_sizes with values that violate the extra constraint (size <= max_size).
+        conc_sizes = [cs for cs in conc_sizes if cs <= max_size]
+        conc_sizes.sort()
+        if not conc_sizes:
+            raise SimMemoryError("Not enough data for store")
+        if self._max_concretize_count is not None:
+            conc_sizes = conc_sizes[: self._max_concretize_count]
+
+        if size.symbolic:
+            if any(cs > self._max_symbolic_size for cs in conc_sizes):
+                l.warning(
+                    "At least one concretized size is over the limit of %d bytes. Constrain them to the limit.",
+                    self._max_symbolic_size,
+                )
+            conc_sizes = [min(cs, self._max_symbolic_size) for cs in conc_sizes]
+
+        if condition is None:
+            condition = claripy.true()
+        for conc_size in conc_sizes:
+            if conc_size == 0:
+                continue
+            super().store(addr, data, size=conc_size, condition=condition & (size == conc_size), **kwargs)

angr/storage/memory_mixins/slotted_memory.py

@@ -0,0 +1,140 @@
+from __future__ import annotations
+import claripy
+
+from angr.storage.memory_mixins.memory_mixin import MemoryMixin
+from angr.storage.memory_mixins.paged_memory.pages.ispo_mixin import ISPOMixin
+from angr.errors import SimMergeError
+
+
+class SlottedMemoryMixin(MemoryMixin):
+    def __init__(self, width=None, **kwargs):
+        super().__init__(**kwargs)
+
+        if width is None and isinstance(self, ISPOMixin):
+            width = 4
+        self.width = width
+
+        self.contents = {}
+
+    def set_state(self, state):
+        super().set_state(state)
+        if self.width is None:
+            self.width = state.arch.bytes
+
+    def copy(self, memo):
+        o = super().copy(memo)
+        o.width = self.width
+        o.contents = dict(self.contents)
+        return o
+
+    def merge(self, others, merge_conditions, common_ancestor=None):
+        if any(o.width != self.width for o in others):
+            raise SimMergeError("Cannot merge slotted memory with disparate widths")
+        addr_set = set(self.contents)
+        for o in others:
+            addr_set.update(o.contents)
+
+        for addr in addr_set:
+            self._single_store(
+                addr,
+                0,
+                self.width,
+                claripy.ite_cases(
+                    zip(merge_conditions[1:], (o._single_load(addr, 0, self.width) for o in others)),
+                    self._single_load(addr, 0, self.width),
+                ),
+            )
+        # FIXME: Return True only when merge actually happens
+        return True
+
+    def _resolve_access(self, addr, size):
+        """
+        Resolves a memory access of a certain size. Returns a sequence of the bases, offsets, and sizes of the accesses
+        required to fulfil this.
+        """
+
+        # if we fit in one word
+        first_offset = addr % self.width
+        first_base = addr - first_offset
+        if first_offset + size <= self.width:
+            result = [(first_base, first_offset, size)]
+        else:
+            last_size = (addr + size) % self.width
+            last_base = addr + size - last_size
+
+            result = [(first_base, first_offset, self.width - first_offset)]
+            result.extend((a, 0, self.width) for a in range(first_base + self.width, last_base, self.width))
+            if last_size != 0:
+                result.append((last_base, 0, last_size))
+
+        # little endian: need to slice in reverse and also concatenate in reverse
+        # if load endness and storage endness don't match, reverse whole data value before store/after load
+        if self.endness == "Iend_LE":
+            result = [(addr, self.width - offset - size, size) for addr, offset, size in reversed(result)]
+
+        return result
+
+    def _single_load(self, addr, offset, size, **kwargs):
+        """
+        Performs a single load.
+        """
+        try:
+            d = self.contents[addr]
+        except KeyError:
+            d = self._default_value(addr, self.width, key=(*self.variable_key_prefix, addr), **kwargs)
+            self.contents[addr] = d
+
+        if offset == 0 and size == self.width:
+            return d
+        return d.get_bytes(offset, size)
+
+    def _single_store(self, addr, offset, size, data):
+        """
+        Performs a single store.
+        """
+
+        if offset == 0 and size == self.width:
+            self.contents[addr] = data
+        elif offset == 0:
+            cur = self._single_load(addr, size, self.width - size)
+            self.contents[addr] = data.concat(cur)
+        elif offset + size == self.width:
+            cur = self._single_load(addr, 0, offset)
+            self.contents[addr] = cur.concat(data)
+        else:
+            cur = self._single_load(addr, 0, self.width)
+            start = cur.get_bytes(0, offset)
+            end = cur.get_bytes(offset + size, self.width - offset - size)
+            self.contents[addr] = start.concat(data, end)
+
+    def load(self, addr, size=None, *, endness=None, **kwargs):
+        accesses = self._resolve_access(addr, size)
+
+        value = claripy.Concat(*(self._single_load(addr, offset, size) for addr, offset, size in accesses))
+        if endness != self.endness:
+            value = value.reversed
+
+        return value
+
+    def store(self, addr, data, size=None, *, endness=None, **kwargs):
+        if endness != self.endness:
+            data = data.reversed
+
+        accesses = self._resolve_access(addr, size)
+        cur_offset = 0
+        for addr, offset, size in accesses:
+            piece = data.get_bytes(cur_offset, size)
+            self._single_store(addr, offset, size, piece)
+            cur_offset += size
+
+    def changed_bytes(self, other):
+        changes = set()
+
+        for addr, v in self.contents.items():
+            for i in range(self.width):
+                other_byte = other.load(addr + i, 1)
+                our_byte = v.get_byte(i)
+                if other_byte is our_byte:
+                    changes.add(addr + i)
+
+        return changes

angr/storage/memory_mixins/smart_find_mixin.py

@@ -0,0 +1,161 @@
+from __future__ import annotations
+import claripy
+
+from angr.errors import SimSegfaultException
+from angr.storage.memory_mixins.memory_mixin import MemoryMixin
+
+
+class SmartFindMixin(MemoryMixin):
+    """
+    Memory mixin providing basic searching over concrete and symbolic data.
+    """
+
+    def find(
+        self,
+        addr,
+        data,
+        max_search,
+        *,
+        default=None,
+        endness=None,
+        chunk_size=None,
+        max_symbolic_bytes=None,
+        condition=None,
+        char_size=1,
+        **kwargs,
+    ):
+        if endness is None:
+            endness = self.endness
+            if endness is None:
+                endness = "Iend_BE"
+
+        needle = data
+        char_num = self._calc_char_num(needle, char_size)
+
+        # chunk_size is the number of bytes to cache in memory for comparison
+        if chunk_size is None:
+            chunk_size = min(max_search, max(0x80, char_num))
+
+        cases = []
+        match_indices = []
+        constraints = []
+
+        try:
+            for i, (subaddr, element) in enumerate(
+                self._find_iter_items(
+                    addr, char_num, char_size, chunk_size, max_search, endness, condition, max_symbolic_bytes, **kwargs
+                )
+            ):
+                comparison, concrete_comparison = self._find_compare(element, needle)
+
+                if concrete_comparison is False:
+                    continue
+
+                match_indices.append(i)
+                if isinstance(subaddr, int):
+                    subaddr = claripy.BVV(subaddr, size=self.state.arch.bits)
+                cases.append((comparison, subaddr))
+
+                if concrete_comparison is True:
+                    break
+
+            else:
+                # the loop terminated, meaning we exhausted some sort of limit instead of finding a concrete answer.
+                if default is None:
+                    constraints.append(claripy.Or(*(c for c, _ in cases)))
+        except SimSegfaultException:
+            if chunk_size > 1:
+                return self.find(
+                    addr,
+                    needle,
+                    max_search,
+                    default=default,
+                    endness=endness,
+                    chunk_size=1,
+                    max_symbolic_bytes=max_symbolic_bytes,
+                    condition=condition,
+                    **kwargs,
+                )
+            raise
+
+        return self._find_process_cases(cases, match_indices, constraints, default, **kwargs)
+
+    def _calc_char_num(self, needle, char_size):
+        """
+        calculate the number of chars in needle
+        char can be of multiple bytes here
+        """
+        if type(needle) is bytes:
+            return len(needle)
+        bytelen = len(needle) // self.state.arch.byte_width
+        if bytelen % char_size != 0:
+            bytelen += char_size - (bytelen % char_size)
+        return bytelen // char_size
+
+    def _find_iter_items(
+        self, addr, char_num, char_size, chunk_size, max_search, endness, condition, max_symbolic_bytes, **kwargs
+    ):
+        """
+        generate comparison items by iterating through the string
+        able to handle wide characters
+        """
+        if condition is None:
+            condition = claripy.true()
+        chunk = None
+        chunk_progress = chunk_size
+
+        # iterate through the string by the unit of chars
+        for i in range(0, max_search, char_size):
+            subaddr = addr + i
+            if chunk_progress == chunk_size:
+                # need to prefetch a little bit more chars
+                chunk = self.load(
+                    subaddr,
+                    size=char_size * (chunk_size + char_num),
+                    endness=endness,
+                    condition=condition & self._find_condition(addr + i),
+                    **kwargs,
+                )
+                chunk_progress = 0
+
+            chunk_idx = chunk_progress if endness == "Iend_BE" else chunk_size - 1 - chunk_progress
+            chunk_progress += 1
+            substr = chunk.get_bytes(chunk_idx * char_size, char_num * char_size)
+
+            # only check the first character or each symbolic character will be recorded many times
+            # FIXME: this actually keeps track of "max_symbolic_chars"
+            if self._find_are_bytes_symbolic(substr.get_bytes(0, char_size)) and max_symbolic_bytes is not None:
+                if max_symbolic_bytes:
+                    max_symbolic_bytes -= 1
+                else:
+                    return
+            yield subaddr, substr
+
+    def _find_are_bytes_symbolic(self, b):
+        if not b.symbolic:
+            return False
+        if b.has_annotation_type(claripy.annotation.UninitializedAnnotation):
+            return True
+        return len(self.state.solver.eval_upto(b, 2)) > 1
+
+    def _find_condition(self, target_addr):  # pylint:disable=unused-argument,no-self-use
+        # TODO: fill this in in order to make each load have the correct condition associated with it
+        return claripy.true()
+
+    def _find_compare(self, element, target):
+        comparison = element == target
+        if self.state.solver.is_true(comparison):
+            concrete_comparison = True
+        elif self.state.solver.is_false(comparison):
+            concrete_comparison = False
+        else:
+            concrete_comparison = None
+        return comparison, concrete_comparison
+
+    def _find_process_cases(self, cases, match_indices, constraints, default):
+        if default is None:
+            default = claripy.BVV(0, self.state.arch.bits)
+        if cases and cases[-1][0].is_true():
+            default = cases.pop(-1)[1]
+        result = claripy.ite_cases(cases, default)
+        return result, constraints, match_indices

angr/storage/memory_mixins/symbolic_merger_mixin.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+
+from collections.abc import Iterable
+from typing import Any
+
+import claripy
+
+from angr.storage.memory_mixins.memory_mixin import MemoryMixin
+
+
+class SymbolicMergerMixin(MemoryMixin):
+    def _merge_values(self, values: Iterable[tuple[Any, Any]], merged_size: int, **kwargs):
+        merged_val = claripy.BVV(0, merged_size * self.state.arch.byte_width)
+        for tm, fv in values:
+            merged_val = claripy.If(fv, tm, merged_val)
+        return merged_val

angr/storage/memory_mixins/top_merger_mixin.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+
+from collections.abc import Iterable, Callable
+from typing import Any
+
+from angr.storage.memory_mixins.memory_mixin import MemoryMixin
+
+
+class TopMergerMixin(MemoryMixin):
+    """
+    A memory mixin for merging values in memory to TOP.
+    """
+
+    def __init__(self, *args, top_func=None, **kwargs):
+        self._top_func: Callable = top_func
+
+        super().__init__(*args, **kwargs)
+
+    def _merge_values(self, values: Iterable[tuple[Any, Any]], merged_size: int, **kwargs):
+        return self._top_func(merged_size * self.state.arch.byte_width)
+
+    def copy(self, memo=None):
+        copied = super().copy(memo)
+        copied._top_func = self._top_func
+        return copied

angr/storage/memory_mixins/underconstrained_mixin.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+import logging
+
+import claripy
+
+from angr import sim_options as o
+from angr.storage.memory_mixins.memory_mixin import MemoryMixin
+
+l = logging.getLogger(__name__)
+
+
+class UnderconstrainedMixin(MemoryMixin):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+
+        self._unconstrained_range = 1024
+
+    @MemoryMixin.memo
+    def copy(self, memo):
+        out = super().copy(memo)
+        out._unconstrained_range = self._unconstrained_range
+        return out
+
+    def load(self, addr, size=None, **kwargs):
+        self._constrain_underconstrained_index(addr)
+        return super().load(addr, size, **kwargs)
+
+    def store(self, addr, data, size=None, **kwargs):
+        self._constrain_underconstrained_index(addr)
+        super().store(addr, data, size, **kwargs)
+
+    def _default_value(self, addr, size, *, name=None, key=None, inspect=True, events=True, **kwargs):
+        if o.UNDER_CONSTRAINED_SYMEXEC in self.state.options and type(addr) is int:
+            if self.category == "mem":
+                alloc_depth = self.state.uc_manager.get_alloc_depth(addr)
+                uc_alloc_depth = 0 if alloc_depth is None else alloc_depth + 1
+            else:
+                uc_alloc_depth = 0
+
+            if name is None:
+                name = f"mem_{addr:x}"
+
+            bits = size * self.state.arch.byte_width
+            return self.state.solver.Unconstrained(
+                name, bits, key=key, inspect=inspect, events=events, uc_alloc_depth=uc_alloc_depth
+            )
+
+        return super()._default_value(addr, size, name=name, key=key, inspect=inspect, events=events, **kwargs)
+
+    def _constrain_underconstrained_index(self, addr):
+        if (
+            o.UNDER_CONSTRAINED_SYMEXEC in self.state.options
+            and isinstance(addr, claripy.ast.Base)
+            and addr.has_annotation_type(claripy.annotation.UninitializedAnnotation)
+            and self.state.uc_manager.get_alloc_depth(addr) is not None
+        ) and (
+            not self.state.uc_manager.is_bounded(addr)
+            or self.state.solver.max_int(addr) - self.state.solver.min_int(addr) >= self._unconstrained_range
+        ):
+            # in under-constrained symbolic execution, we'll assign a new memory region for this address
+            mem_region = self.state.uc_manager.assign(addr)
+
+            # ... but only if it's not already been constrained to something!
+            if self.state.solver.solution(addr, mem_region):
+                self.state.add_constraints(addr == mem_region)
+            l.debug("Under-constrained symbolic execution: assigned a new memory region @ %s to %s", mem_region, addr)

angr/storage/memory_mixins/unwrapper_mixin.py

@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+from angr.state_plugins.sim_action_object import _raw_ast
+from angr.storage.memory_mixins.memory_mixin import MemoryMixin
+
+
+class UnwrapperMixin(MemoryMixin):
+    """
+    This mixin processes SimActionObjects by passing on their .ast field.
+    """
+
+    def store(self, addr, data, size=None, *, condition=None, **kwargs):
+        return super().store(
+            _raw_ast(addr), _raw_ast(data), size=_raw_ast(size), condition=_raw_ast(condition), **kwargs
+        )
+
+    def load(self, addr, size=None, *, condition=None, fallback=None, **kwargs):
+        return super().load(
+            _raw_ast(addr), size=_raw_ast(size), condition=_raw_ast(condition), fallback=_raw_ast(fallback), **kwargs
+        )
+
+    def find(self, addr, data, max_search, *, default=None, **kwargs):
+        return super().find(_raw_ast(addr), _raw_ast(data), max_search, default=_raw_ast(default), **kwargs)
+
+    def copy_contents(self, dst, src, size, condition=None, **kwargs):
+        return super().copy_contents(_raw_ast(dst), _raw_ast(src), _raw_ast(size), _raw_ast(condition), **kwargs)