angr 9.2.87__py3-none-manylinux2014_x86_64.whl → 9.2.89__py3-none-manylinux2014_x86_64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +4 -1
- angr/analyses/decompiler/clinic.py +16 -0
- angr/analyses/decompiler/decompiler.py +3 -0
- angr/analyses/decompiler/optimization_passes/__init__.py +5 -0
- angr/analyses/decompiler/optimization_passes/cross_jump_reverter.py +108 -0
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +17 -4
- angr/analyses/decompiler/optimization_passes/return_duplicator.py +4 -32
- angr/analyses/decompiler/structured_codegen/c.py +12 -2
- angr/analyses/decompiler/utils.py +13 -0
- angr/analyses/typehoon/dfa.py +108 -0
- angr/analyses/typehoon/lifter.py +34 -2
- angr/analyses/typehoon/simple_solver.py +1043 -503
- angr/analyses/typehoon/translator.py +13 -4
- angr/analyses/typehoon/typeconsts.py +117 -36
- angr/analyses/typehoon/typehoon.py +31 -11
- angr/analyses/typehoon/typevars.py +88 -21
- angr/analyses/typehoon/variance.py +10 -0
- angr/analyses/variable_recovery/engine_ail.py +28 -9
- angr/analyses/variable_recovery/engine_base.py +50 -43
- angr/analyses/variable_recovery/variable_recovery_base.py +16 -3
- angr/analyses/variable_recovery/variable_recovery_fast.py +14 -5
- angr/exploration_techniques/tracer.py +2 -0
- angr/misc/autoimport.py +26 -0
- angr/procedures/definitions/__init__.py +32 -3
- angr/utils/constants.py +1 -0
- angr/utils/graph.py +20 -1
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/METADATA +7 -6
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/RECORD +32 -244
- angr-9.2.89.dist-info/top_level.txt +1 -0
- angr/procedures/definitions/ntdll.py +0 -12
- angr-9.2.87.dist-info/top_level.txt +0 -2
- tests/__init__.py +0 -0
- tests/analyses/__init__.py +0 -0
- tests/analyses/cfg/__init__.py +0 -0
- tests/analyses/cfg/test_cfg_clflush.py +0 -43
- tests/analyses/cfg/test_cfg_get_any_node.py +0 -34
- tests/analyses/cfg/test_cfg_manager.py +0 -32
- tests/analyses/cfg/test_cfg_model.py +0 -55
- tests/analyses/cfg/test_cfg_patching.py +0 -378
- tests/analyses/cfg/test_cfg_rust_got_resolution.py +0 -36
- tests/analyses/cfg/test_cfg_thumb_firmware.py +0 -50
- tests/analyses/cfg/test_cfg_vex_postprocessor.py +0 -27
- tests/analyses/cfg/test_cfgemulated.py +0 -634
- tests/analyses/cfg/test_cfgfast.py +0 -1123
- tests/analyses/cfg/test_cfgfast_soot.py +0 -38
- tests/analyses/cfg/test_const_resolver.py +0 -38
- tests/analyses/cfg/test_iat_resolver.py +0 -37
- tests/analyses/cfg/test_jumptables.py +0 -3008
- tests/analyses/cfg/test_noop_blocks.py +0 -54
- tests/analyses/cfg_slice_to_sink/__init__.py +0 -0
- tests/analyses/cfg_slice_to_sink/test_cfg_slice_to_sink.py +0 -93
- tests/analyses/cfg_slice_to_sink/test_graph.py +0 -114
- tests/analyses/cfg_slice_to_sink/test_transitions.py +0 -28
- tests/analyses/decompiler/__init__.py +0 -0
- tests/analyses/decompiler/test_baseptr_save_simplifier.py +0 -80
- tests/analyses/decompiler/test_decompiler.py +0 -3336
- tests/analyses/decompiler/test_peephole_optimizations.py +0 -48
- tests/analyses/decompiler/test_propagator_loops.py +0 -101
- tests/analyses/decompiler/test_structurer.py +0 -275
- tests/analyses/reaching_definitions/__init__.py +0 -0
- tests/analyses/reaching_definitions/test_dep_graph.py +0 -432
- tests/analyses/reaching_definitions/test_function_handler.py +0 -131
- tests/analyses/reaching_definitions/test_heap_allocator.py +0 -46
- tests/analyses/reaching_definitions/test_rd_state.py +0 -78
- tests/analyses/reaching_definitions/test_reachingdefinitions.py +0 -463
- tests/analyses/reaching_definitions/test_subject.py +0 -76
- tests/analyses/test_bindiff.py +0 -52
- tests/analyses/test_block_simplifier.py +0 -112
- tests/analyses/test_boyscout.py +0 -104
- tests/analyses/test_calling_convention_analysis.py +0 -352
- tests/analyses/test_callsite_maker.py +0 -60
- tests/analyses/test_cdg.py +0 -165
- tests/analyses/test_cfb.py +0 -37
- tests/analyses/test_class_identifier.py +0 -46
- tests/analyses/test_clinic.py +0 -30
- tests/analyses/test_codetagging.py +0 -32
- tests/analyses/test_constantpropagation.py +0 -88
- tests/analyses/test_ddg.py +0 -95
- tests/analyses/test_ddg_global_var_dependencies.py +0 -83
- tests/analyses/test_ddg_memvar_addresses.py +0 -40
- tests/analyses/test_disassembly.py +0 -121
- tests/analyses/test_find_objects_static.py +0 -35
- tests/analyses/test_flirt.py +0 -49
- tests/analyses/test_identifier.py +0 -33
- tests/analyses/test_init_finder.py +0 -38
- tests/analyses/test_proximitygraph.py +0 -31
- tests/analyses/test_reassembler.py +0 -295
- tests/analyses/test_regionidentifier.py +0 -27
- tests/analyses/test_slicing.py +0 -164
- tests/analyses/test_stack_pointer_tracker.py +0 -74
- tests/analyses/test_static_hooker.py +0 -28
- tests/analyses/test_typehoon.py +0 -55
- tests/analyses/test_variablerecovery.py +0 -464
- tests/analyses/test_vfg.py +0 -221
- tests/analyses/test_vtable.py +0 -31
- tests/analyses/test_xrefs.py +0 -77
- tests/common.py +0 -128
- tests/engines/__init__.py +0 -0
- tests/engines/light/__init__.py +0 -0
- tests/engines/light/test_data.py +0 -17
- tests/engines/pcode/__init__.py +0 -0
- tests/engines/pcode/test_emulate.py +0 -607
- tests/engines/pcode/test_pcode.py +0 -84
- tests/engines/test_actions.py +0 -27
- tests/engines/test_hook.py +0 -112
- tests/engines/test_java.py +0 -697
- tests/engines/test_unicorn.py +0 -518
- tests/engines/vex/__init__.py +0 -0
- tests/engines/vex/test_lifter.py +0 -124
- tests/engines/vex/test_vex.py +0 -574
- tests/exploration_techniques/__init__.py +0 -0
- tests/exploration_techniques/test_cacher.py +0 -45
- tests/exploration_techniques/test_director.py +0 -67
- tests/exploration_techniques/test_driller_core.py +0 -48
- tests/exploration_techniques/test_loop_seer.py +0 -158
- tests/exploration_techniques/test_memory_watcher.py +0 -46
- tests/exploration_techniques/test_oppologist.py +0 -65
- tests/exploration_techniques/test_spiller.py +0 -82
- tests/exploration_techniques/test_stochastic.py +0 -40
- tests/exploration_techniques/test_tech_builder.py +0 -61
- tests/exploration_techniques/test_tracer.py +0 -856
- tests/exploration_techniques/test_unique.py +0 -40
- tests/exploration_techniques/test_veritesting.py +0 -120
- tests/factory/__init__.py +0 -0
- tests/factory/block/__init__.py +0 -0
- tests/factory/block/test_block_cache.py +0 -33
- tests/factory/block/test_keystone.py +0 -106
- tests/factory/test_argc.py +0 -101
- tests/factory/test_argc_sym.py +0 -110
- tests/factory/test_argv.py +0 -158
- tests/factory/test_callable.py +0 -266
- tests/factory/test_windows_args.py +0 -36
- tests/knowledge_plugins/__init__.py +0 -0
- tests/knowledge_plugins/cfg/__init__.py +0 -0
- tests/knowledge_plugins/cfg/test_cfg_manager.py +0 -36
- tests/knowledge_plugins/functions/__init__.py +0 -0
- tests/knowledge_plugins/functions/test_function.py +0 -91
- tests/knowledge_plugins/functions/test_function2.py +0 -79
- tests/knowledge_plugins/functions/test_function_manager.py +0 -139
- tests/knowledge_plugins/functions/test_prototypes.py +0 -53
- tests/knowledge_plugins/key_definitions/__init__.py +0 -0
- tests/knowledge_plugins/key_definitions/test_atoms.py +0 -24
- tests/knowledge_plugins/key_definitions/test_environment.py +0 -126
- tests/knowledge_plugins/key_definitions/test_heap_address.py +0 -27
- tests/knowledge_plugins/key_definitions/test_live_definitions.py +0 -72
- tests/knowledge_plugins/test_dwarf_variables.py +0 -240
- tests/knowledge_plugins/test_kb_plugins.py +0 -91
- tests/knowledge_plugins/test_kb_plugins_dwarf.py +0 -36
- tests/knowledge_plugins/test_patches.py +0 -48
- tests/misc/__init__.py +0 -0
- tests/misc/test_hookset.py +0 -57
- tests/perf/__init__.py +0 -0
- tests/perf/perf_cfgemulated.py +0 -19
- tests/perf/perf_cfgfast.py +0 -18
- tests/perf/perf_concrete_execution.py +0 -41
- tests/perf/perf_siminspect_nop.py +0 -36
- tests/perf/perf_state_copy.py +0 -33
- tests/perf/perf_unicorn_0.py +0 -27
- tests/perf/perf_unicorn_1.py +0 -23
- tests/procedures/__init__.py +0 -0
- tests/procedures/glibc/__init__.py +0 -0
- tests/procedures/glibc/test_ctype_locale.py +0 -164
- tests/procedures/libc/__init__.py +0 -0
- tests/procedures/libc/test_fgets.py +0 -53
- tests/procedures/libc/test_scanf.py +0 -205
- tests/procedures/libc/test_sprintf.py +0 -44
- tests/procedures/libc/test_sscanf.py +0 -63
- tests/procedures/libc/test_strcasecmp.py +0 -37
- tests/procedures/libc/test_string.py +0 -1102
- tests/procedures/libc/test_strtol.py +0 -78
- tests/procedures/linux_kernel/__init__.py +0 -0
- tests/procedures/linux_kernel/test_lseek.py +0 -174
- tests/procedures/posix/__init__.py +0 -0
- tests/procedures/posix/test_chroot.py +0 -33
- tests/procedures/posix/test_getenv.py +0 -78
- tests/procedures/posix/test_pwrite_pread.py +0 -57
- tests/procedures/posix/test_sim_time.py +0 -46
- tests/procedures/posix/test_unlink.py +0 -46
- tests/procedures/test_project_resolve_simproc.py +0 -43
- tests/procedures/test_sim_procedure.py +0 -117
- tests/procedures/test_stub_procedure_args.py +0 -53
- tests/serialization/__init__.py +0 -0
- tests/serialization/test_db.py +0 -197
- tests/serialization/test_pickle.py +0 -95
- tests/serialization/test_serialization.py +0 -132
- tests/serialization/test_vault.py +0 -169
- tests/sim/__init__.py +0 -3
- tests/sim/exec_func/__init__.py +0 -0
- tests/sim/exec_func/test_mem_funcs.py +0 -55
- tests/sim/exec_func/test_str_funcs.py +0 -93
- tests/sim/exec_func/test_syscall_result.py +0 -39
- tests/sim/exec_insn/__init__.py +0 -0
- tests/sim/exec_insn/test_adc.py +0 -44
- tests/sim/exec_insn/test_ops.py +0 -83
- tests/sim/exec_insn/test_rcr.py +0 -26
- tests/sim/exec_insn/test_rol.py +0 -51
- tests/sim/exec_insn/test_signed_div.py +0 -34
- tests/sim/exec_insn/test_sqrt.py +0 -56
- tests/sim/options/__init__.py +0 -0
- tests/sim/options/test_0div.py +0 -54
- tests/sim/options/test_symbolic_fd.py +0 -59
- tests/sim/options/test_unsupported.py +0 -34
- tests/sim/test_accuracy.py +0 -137
- tests/sim/test_checkbyte.py +0 -53
- tests/sim/test_echo.py +0 -36
- tests/sim/test_fauxware.py +0 -202
- tests/sim/test_self_modifying_code.py +0 -65
- tests/sim/test_simple_api.py +0 -36
- tests/sim/test_simulation_manager.py +0 -147
- tests/sim/test_stack_alignment.py +0 -65
- tests/sim/test_state.py +0 -303
- tests/sim/test_state_customization.py +0 -54
- tests/sim/test_symbol_hooked_by.py +0 -49
- tests/simos/__init__.py +0 -0
- tests/simos/windows/__init__.py +0 -0
- tests/simos/windows/test_windows_stack_cookie.py +0 -58
- tests/state_plugins/__init__.py +0 -0
- tests/state_plugins/inspect/__init__.py +0 -0
- tests/state_plugins/inspect/test_inspect.py +0 -310
- tests/state_plugins/inspect/test_syscall_override.py +0 -90
- tests/state_plugins/posix/__init__.py +0 -0
- tests/state_plugins/posix/test_file_struct_funcs.py +0 -56
- tests/state_plugins/posix/test_files.py +0 -69
- tests/state_plugins/posix/test_posix.py +0 -72
- tests/state_plugins/solver/__init__.py +0 -0
- tests/state_plugins/solver/test_simsolver.py +0 -58
- tests/state_plugins/solver/test_symbolic.py +0 -153
- tests/state_plugins/solver/test_variable_registration.py +0 -46
- tests/state_plugins/test_callstack.py +0 -54
- tests/state_plugins/test_gdb_plugin.py +0 -35
- tests/state_plugins/test_multi_open_file.py +0 -47
- tests/state_plugins/test_symbolization.py +0 -38
- tests/storage/__init__.py +0 -0
- tests/storage/test_memory.py +0 -960
- tests/storage/test_memory_merge.py +0 -114
- tests/storage/test_memview.py +0 -205
- tests/storage/test_mmap.py +0 -26
- tests/storage/test_multivalues.py +0 -44
- tests/storage/test_permissions.py +0 -32
- tests/storage/test_ptmalloc.py +0 -291
- tests/storage/test_relro_perm.py +0 -49
- tests/test_calling_conventions.py +0 -86
- tests/test_types.py +0 -329
- tests/utils/__init__.py +0 -0
- tests/utils/test_graph.py +0 -41
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/LICENSE +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/WHEEL +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/entry_points.txt +0 -0
|
@@ -1,121 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint:disable=missing-class-docstring,no-self-use
|
|
3
|
-
from unittest import TestCase, main
|
|
4
|
-
|
|
5
|
-
import angr
|
|
6
|
-
from angr.analyses import Disassembly
|
|
7
|
-
from angr.analyses.disassembly import MemoryOperand, Instruction
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
class TestDisassembly(TestCase):
|
|
11
|
-
def test_arm64_dissect_instructions(self):
|
|
12
|
-
proj = angr.load_shellcode(
|
|
13
|
-
b"\x00\xe4\x00\x6f"
|
|
14
|
-
b"\x43\x3c\x0b\x0e"
|
|
15
|
-
b"\x54\x9a\xb7\x72"
|
|
16
|
-
b"\xfc\x6f\xba\xa9"
|
|
17
|
-
b"\x88\x03\x98\x1a"
|
|
18
|
-
b"\x00\x60\x01\x4e",
|
|
19
|
-
"AARCH64",
|
|
20
|
-
0,
|
|
21
|
-
)
|
|
22
|
-
# movi v0.2d, #0000000000000000' ; SIMD register
|
|
23
|
-
# umov w3, v2.b[5] ; SIMD register index
|
|
24
|
-
# movk w20, #0xbcd2, lsl #16 ; ARM64 shifter
|
|
25
|
-
# stp x28, x27, [sp, #-0x60]! ; ARM64 pre-indexed operand
|
|
26
|
-
# csel w8, w28, w24, eq ; Condition code at the end
|
|
27
|
-
# tbl v0.16b, {v0.16b, v1.16b, v2.16b, v3.16b}, v1.16b ; Multiple SIMD regs in table
|
|
28
|
-
block = proj.factory.block(0)
|
|
29
|
-
disasm = proj.analyses[Disassembly].prep()(ranges=[(block.addr, block.addr + block.size)])
|
|
30
|
-
|
|
31
|
-
insns = [r for r in disasm.raw_result if isinstance(r, Instruction)]
|
|
32
|
-
rendered_insns = [i.render()[0].lower() for i in insns]
|
|
33
|
-
assert "v0.2d" in rendered_insns[0]
|
|
34
|
-
assert "v2.b[5]" in rendered_insns[1]
|
|
35
|
-
assert "lsl#16" in rendered_insns[2].replace(" ", "")
|
|
36
|
-
assert rendered_insns[3].endswith("]!")
|
|
37
|
-
assert rendered_insns[4].endswith("eq")
|
|
38
|
-
insn = rendered_insns[5]
|
|
39
|
-
regs_table = insn[insn.index("{") + 1 : insn.index("}")].replace(" ", "").split(",")
|
|
40
|
-
assert ["v0.16b", "v1.16b", "v2.16b", "v3.16b"] == regs_table
|
|
41
|
-
|
|
42
|
-
def test_arm32_dissect_instructions(self):
|
|
43
|
-
proj = angr.load_shellcode(
|
|
44
|
-
b"\x00\xc0\x2d\xe9\x10\xf9\xf9\xe9",
|
|
45
|
-
"ARM",
|
|
46
|
-
0,
|
|
47
|
-
)
|
|
48
|
-
# push {lr, pc}
|
|
49
|
-
# ldmib sb!, {r4, r8, fp, ip, sp, lr, pc}^
|
|
50
|
-
|
|
51
|
-
block = proj.factory.block(0)
|
|
52
|
-
disasm = proj.analyses[Disassembly].prep()(ranges=[(block.addr, block.addr + block.size)])
|
|
53
|
-
insns = [r for r in disasm.raw_result if isinstance(r, Instruction)]
|
|
54
|
-
rendered_insns = [i.render()[0].lower() for i in insns]
|
|
55
|
-
assert all(i in rendered_insns[0] for i in ("{", "}", "lr", "pc"))
|
|
56
|
-
assert "sb!" in rendered_insns[1]
|
|
57
|
-
assert rendered_insns[1].endswith("^")
|
|
58
|
-
|
|
59
|
-
def test_arm32_thumb_dissect_instructions(self):
|
|
60
|
-
proj = angr.load_shellcode(b"\x00\xf9\x01\x1a", "ARM", 0, thumb=True)
|
|
61
|
-
# vst1.8 {d1, d2}, [r0], r1
|
|
62
|
-
|
|
63
|
-
block = proj.factory.block(0, thumb=True)
|
|
64
|
-
disasm = proj.analyses[Disassembly].prep()(ranges=[(block.addr, block.addr + block.size)], thumb=True)
|
|
65
|
-
insns = [r for r in disasm.raw_result if isinstance(r, Instruction)]
|
|
66
|
-
|
|
67
|
-
disassembly_operands = insns[0].operands
|
|
68
|
-
capstone_operands = insns[0].insn.operands
|
|
69
|
-
assert len(disassembly_operands) == len(capstone_operands)
|
|
70
|
-
|
|
71
|
-
def test_mips32_missing_offset_in_instructions(self):
|
|
72
|
-
proj = angr.load_shellcode(
|
|
73
|
-
b"\x8f\xbc\x00\x10"
|
|
74
|
-
b"\x02\x20\x30\x21"
|
|
75
|
-
b"\x8F\x85\x80\x28"
|
|
76
|
-
b"\x8F\x99\x81\x20"
|
|
77
|
-
b"\x02\x40\x38\x21"
|
|
78
|
-
b"\x24\xA5\x5E\x38"
|
|
79
|
-
b"\x03\x20\xF8\x09"
|
|
80
|
-
b"\x24\x04\x00\x02",
|
|
81
|
-
"MIPS32",
|
|
82
|
-
0,
|
|
83
|
-
)
|
|
84
|
-
# 0x0: lw $gp, 0x10($sp)
|
|
85
|
-
# 0x4: move $a2, $s1
|
|
86
|
-
# 0x8: lw $a1, -0x7fd8($gp)
|
|
87
|
-
# 0xc: lw $t9, -0x7ee0($gp)
|
|
88
|
-
# 0x10: move $a3, $s2
|
|
89
|
-
# 0x14: addiu $a1, $a1, 0x5e38
|
|
90
|
-
# 0x18: jalr $t9
|
|
91
|
-
# 0x1c: addiu $a0, $zero, 2
|
|
92
|
-
|
|
93
|
-
block = proj.factory.block(0)
|
|
94
|
-
disass = proj.analyses[Disassembly].prep()(ranges=[(block.addr, block.addr + block.size)])
|
|
95
|
-
result = disass.raw_result
|
|
96
|
-
assert len(result) == 10, f"Incorrect number of instructions ({len(result)})"
|
|
97
|
-
|
|
98
|
-
ins = result[4]
|
|
99
|
-
operand_1 = ins.operands[1]
|
|
100
|
-
assert isinstance(operand_1, MemoryOperand)
|
|
101
|
-
assert len(operand_1.children) == 4
|
|
102
|
-
assert len(operand_1.values) == 1
|
|
103
|
-
assert len(operand_1.offset) == 1
|
|
104
|
-
assert operand_1.offset_location == "prefix"
|
|
105
|
-
rendered = disass.render(color=False)
|
|
106
|
-
assert (
|
|
107
|
-
rendered
|
|
108
|
-
== """ _start:
|
|
109
|
-
0 lw $gp, 0x10($sp)
|
|
110
|
-
4 move $a2, $s1
|
|
111
|
-
8 lw $a1, -0x7fd8($gp)
|
|
112
|
-
c lw $t9, -0x7ee0($gp)
|
|
113
|
-
10 move $a3, $s2
|
|
114
|
-
14 addiu $a1, $a1, 0x5e38
|
|
115
|
-
18 jalr $t9
|
|
116
|
-
1c addiu $a0, $zero, 0x2"""
|
|
117
|
-
)
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
if __name__ == "__main__":
|
|
121
|
-
main()
|
|
@@ -1,35 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,disable=no-self-use
|
|
3
|
-
__package__ = __package__ or "tests.analyses" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ..common import bin_location
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
test_location = os.path.join(bin_location, "tests")
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
class TestFindObjectsStatic(unittest.TestCase):
|
|
17
|
-
def test_object_identification_x86_64(self):
|
|
18
|
-
p = angr.Project(os.path.join(test_location, "x86_64", "cpp_classes"), auto_load_libs=False)
|
|
19
|
-
object_identifier_analysis = p.analyses.StaticObjectFinder()
|
|
20
|
-
possible_objects_dict = object_identifier_analysis.possible_objects
|
|
21
|
-
possible_constructors = object_identifier_analysis.possible_constructors
|
|
22
|
-
class_labels = []
|
|
23
|
-
|
|
24
|
-
for possible_object in possible_objects_dict.values():
|
|
25
|
-
class_labels.append(possible_object.class_name)
|
|
26
|
-
|
|
27
|
-
assert "C" in class_labels
|
|
28
|
-
assert len(possible_objects_dict) == 2
|
|
29
|
-
assert len(possible_constructors) == 1
|
|
30
|
-
assert 0x401512 in possible_constructors
|
|
31
|
-
assert len(possible_constructors[0x401512]) == 2
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
if __name__ == "__main__":
|
|
35
|
-
unittest.main()
|
tests/analyses/test_flirt.py
DELETED
|
@@ -1,49 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,disable=no-self-use
|
|
3
|
-
__package__ = __package__ or "tests.analyses" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os.path
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ..common import bin_location, slow_test
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
class TestFlirt(unittest.TestCase):
|
|
14
|
-
@slow_test
|
|
15
|
-
def test_amd64_elf_static_libc_ubuntu_2004(self):
|
|
16
|
-
binary_path = os.path.join(bin_location, "tests", "x86_64", "elf_with_static_libc_ubuntu_2004_stripped")
|
|
17
|
-
proj = angr.Project(binary_path, auto_load_libs=False, load_debug_info=False)
|
|
18
|
-
cfg = proj.analyses.CFGFast(show_progressbar=False) # , detect_tail_calls=True)
|
|
19
|
-
flirt_path = os.path.join(bin_location, "tests", "x86_64", "libc_ubuntu_2004.sig")
|
|
20
|
-
proj.analyses.Flirt(flirt_path)
|
|
21
|
-
|
|
22
|
-
assert cfg.functions[0x415CC0].name == "_IO_file_open"
|
|
23
|
-
assert cfg.functions[0x415CC0].is_default_name is False
|
|
24
|
-
assert cfg.functions[0x415CC0].from_signature == "flirt"
|
|
25
|
-
assert cfg.functions[0x436980].name == "__mempcpy_chk_avx512_no_vzeroupper"
|
|
26
|
-
assert cfg.functions[0x436980].is_default_name is False
|
|
27
|
-
assert cfg.functions[0x436980].from_signature == "flirt"
|
|
28
|
-
|
|
29
|
-
@slow_test
|
|
30
|
-
def test_armhf_elf_static_using_armel_libc(self):
|
|
31
|
-
binary_path = os.path.join(bin_location, "tests", "armhf", "amp_challenge_07.gcc")
|
|
32
|
-
proj = angr.Project(binary_path, auto_load_libs=False, load_debug_info=False)
|
|
33
|
-
proj.analyses.CFGFast(show_progressbar=False)
|
|
34
|
-
flirt_path = os.path.join(bin_location, "tests", "armhf", "debian_10.3_libc.sig")
|
|
35
|
-
flirt = proj.analyses.Flirt(flirt_path)
|
|
36
|
-
|
|
37
|
-
assert len(flirt.matched_suggestions) == 1
|
|
38
|
-
|
|
39
|
-
assert proj.kb.functions[0x1004C9].name == "strstr"
|
|
40
|
-
assert proj.kb.functions[0x1004C9].prototype is not None
|
|
41
|
-
assert proj.kb.functions[0x1004C9].calling_convention is not None
|
|
42
|
-
|
|
43
|
-
assert proj.kb.functions[0xF38D9].name == "__printf"
|
|
44
|
-
assert proj.kb.functions[0xF38D9].prototype is not None
|
|
45
|
-
assert proj.kb.functions[0xF38D9].calling_convention is not None
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
if __name__ == "__main__":
|
|
49
|
-
unittest.main()
|
|
@@ -1,33 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,disable=no-self-use
|
|
3
|
-
__package__ = __package__ or "tests.analyses" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import logging
|
|
6
|
-
import os
|
|
7
|
-
import sys
|
|
8
|
-
import unittest
|
|
9
|
-
|
|
10
|
-
import angr
|
|
11
|
-
|
|
12
|
-
from ..common import bin_location
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
@unittest.skipIf(sys.platform == "win32", "broken on windows")
|
|
16
|
-
class TestIdentifier(unittest.TestCase):
|
|
17
|
-
def test_comparison_identification(self):
|
|
18
|
-
true_symbols = {0x804A3D0: "strncmp", 0x804A0F0: "strcmp", 0x8048E60: "memcmp", 0x8049F40: "strcasecmp"}
|
|
19
|
-
|
|
20
|
-
p = angr.Project(os.path.join(bin_location, "tests", "i386", "identifiable"))
|
|
21
|
-
idfer = p.analyses.Identifier(require_predecessors=False)
|
|
22
|
-
|
|
23
|
-
seen = {}
|
|
24
|
-
for addr, symbol in idfer.run():
|
|
25
|
-
seen[addr] = symbol
|
|
26
|
-
|
|
27
|
-
for addr, symbol in true_symbols.items():
|
|
28
|
-
assert symbol == seen[addr]
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
if __name__ == "__main__":
|
|
32
|
-
logging.getLogger("identifier").setLevel("DEBUG")
|
|
33
|
-
unittest.main()
|
|
@@ -1,38 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,disable=no-self-use
|
|
3
|
-
__package__ = __package__ or "tests.analyses" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ..common import bin_location
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
test_location = os.path.join(bin_location, "tests")
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
class TestInitFinder(unittest.TestCase):
|
|
17
|
-
def test_p2im_drone(self):
|
|
18
|
-
bin_path = os.path.join(test_location, "armel", "p2im_drone.elf")
|
|
19
|
-
proj = angr.Project(bin_path, auto_load_libs=False)
|
|
20
|
-
cfg = proj.analyses.CFG(data_references=True)
|
|
21
|
-
|
|
22
|
-
func = cfg.functions["Peripherals_Init"]
|
|
23
|
-
state = proj.factory.blank_state()
|
|
24
|
-
prop = proj.analyses.Propagator(func=func, base_state=state)
|
|
25
|
-
|
|
26
|
-
init_finder = proj.analyses.InitializationFinder(func=func, replacements=prop.replacements)
|
|
27
|
-
overlay = init_finder.overlay
|
|
28
|
-
|
|
29
|
-
# h12c1.Instance
|
|
30
|
-
assert state.solver.eval_one(overlay.load(0x20001500, 4, endness="Iend_LE")) == 0x40005400
|
|
31
|
-
# hi2c1.Init.AddressingMode
|
|
32
|
-
assert state.solver.eval_one(overlay.load(0x20001500 + 4 + 0xC, 4, endness="Iend_LE")) == 0x4000
|
|
33
|
-
# h12c1.Init.NoStretchMode
|
|
34
|
-
assert state.solver.eval_one(overlay.load(0x20001500 + 4 + 0x1C, 4, endness="Iend_LE")) == 0
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
if __name__ == "__main__":
|
|
38
|
-
unittest.main()
|
|
@@ -1,31 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
__package__ = __package__ or "tests.analyses" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ..common import bin_location
|
|
11
|
-
|
|
12
|
-
test_location = os.path.join(bin_location, "tests")
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
class TestProximityGraph(unittest.TestCase):
|
|
16
|
-
def test_fauxware(self):
|
|
17
|
-
bin_path = os.path.join(test_location, "x86_64", "fauxware")
|
|
18
|
-
proj = angr.Project(bin_path, auto_load_libs=False)
|
|
19
|
-
|
|
20
|
-
cfg = proj.analyses.CFG(data_references=True, cross_references=True, normalize=True)
|
|
21
|
-
func = cfg.kb.functions["main"]
|
|
22
|
-
|
|
23
|
-
proj.analyses.Proximity(func, cfg.model, cfg.kb.xrefs)
|
|
24
|
-
|
|
25
|
-
# once we have decompiled code, things are different...
|
|
26
|
-
dec = proj.analyses.Decompiler(func, cfg=cfg.model)
|
|
27
|
-
proj.analyses.Proximity(func, cfg.model, cfg.kb.xrefs, decompilation=dec)
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
if __name__ == "__main__":
|
|
31
|
-
unittest.main()
|
|
@@ -1,295 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
__package__ = __package__ or "tests.analyses" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import sys
|
|
6
|
-
import platform
|
|
7
|
-
import os
|
|
8
|
-
import tempfile
|
|
9
|
-
import subprocess
|
|
10
|
-
import shutil
|
|
11
|
-
import unittest
|
|
12
|
-
|
|
13
|
-
import angr
|
|
14
|
-
|
|
15
|
-
from ..common import bin_location, has_32_bit_compiler_support
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
test_location = os.path.join(bin_location, "tests")
|
|
19
|
-
|
|
20
|
-
# Note: Reassembler is intensively tested by Patcherex test cases on CGC binaries.
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
def is_linux_x64():
|
|
24
|
-
return sys.platform.startswith("linux") and platform.machine().endswith("64")
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
def is_linux():
|
|
28
|
-
return sys.platform.startswith("linux")
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
class TestReassembler(unittest.TestCase):
|
|
32
|
-
def test_data_reference_collection_in_add(self):
|
|
33
|
-
# Issue reported and test binary provided by Antonio F. Montoya
|
|
34
|
-
# Fixed in https://github.com/angr/pyvex/pull/192
|
|
35
|
-
|
|
36
|
-
p = angr.Project(os.path.join(test_location, "x86_64", "df_gcc_-O1"), auto_load_libs=False)
|
|
37
|
-
vexblock_opt0 = p.factory.block(0x402431, opt_level=0).vex
|
|
38
|
-
vexblock_opt1 = p.factory.block(0x402431, opt_level=1).vex
|
|
39
|
-
vexblock_opt1_nostmt = p.factory.block(0x402431, opt_level=1, collect_data_refs=True).vex_nostmt
|
|
40
|
-
|
|
41
|
-
cfg = p.analyses.CFG()
|
|
42
|
-
|
|
43
|
-
cfg._model.memory_data = {}
|
|
44
|
-
cfg._collect_data_references(vexblock_opt0, 0x402431)
|
|
45
|
-
memory_data_opt0 = cfg._model.memory_data
|
|
46
|
-
|
|
47
|
-
cfg._model.memory_data = {}
|
|
48
|
-
# bypass the IRSB unoptimization step
|
|
49
|
-
cfg._collect_data_references_by_scanning_stmts(vexblock_opt1, 0x402431)
|
|
50
|
-
memory_data_opt1 = cfg._model.memory_data
|
|
51
|
-
|
|
52
|
-
cfg._model.memory_data = {}
|
|
53
|
-
cfg._collect_data_references(vexblock_opt1_nostmt, 0x402431)
|
|
54
|
-
memory_data_opt1_nostmt = cfg._model.memory_data
|
|
55
|
-
|
|
56
|
-
assert memory_data_opt0.keys() == memory_data_opt1.keys()
|
|
57
|
-
assert memory_data_opt0.keys() == memory_data_opt1_nostmt.keys()
|
|
58
|
-
|
|
59
|
-
def test_ln_gcc_O2(self):
|
|
60
|
-
# Issue reported and test binary provided by Antonio F. Montoya
|
|
61
|
-
|
|
62
|
-
p = angr.Project(os.path.join(test_location, "x86_64", "ln_gcc_-O2"), auto_load_libs=False)
|
|
63
|
-
r = p.analyses.Reassembler(syntax="at&t")
|
|
64
|
-
r.symbolize()
|
|
65
|
-
r.remove_unnecessary_stuff()
|
|
66
|
-
assembly = r.assembly(comments=True, symbolized=True)
|
|
67
|
-
|
|
68
|
-
# There should be two symbols with the same name: file_name. Reassembler renames the second one to file_name_0.
|
|
69
|
-
# Test their existence.
|
|
70
|
-
assert "\nfile_name:" in assembly and "\nfile_name_0:" in assembly
|
|
71
|
-
|
|
72
|
-
if is_linux_x64():
|
|
73
|
-
# we should be able to compile it and run it ... if we are running on x64 Linux
|
|
74
|
-
tempdir = tempfile.mkdtemp(prefix="angr_test_reassembler_")
|
|
75
|
-
asm_filename = "ln_gcc-O2.s"
|
|
76
|
-
bin_filename = "ln_gcc-O2"
|
|
77
|
-
asm_filepath = os.path.join(tempdir, asm_filename)
|
|
78
|
-
bin_filepath = os.path.join(tempdir, bin_filename)
|
|
79
|
-
with open(asm_filepath, "w", encoding="ascii") as f:
|
|
80
|
-
f.write(assembly)
|
|
81
|
-
# Call out to GCC, and it should return 0. Otherwise check_call() will raise an exception.
|
|
82
|
-
subprocess.check_call(
|
|
83
|
-
["gcc", "-no-pie", asm_filepath, "-o", bin_filepath],
|
|
84
|
-
stdout=subprocess.DEVNULL,
|
|
85
|
-
stderr=subprocess.DEVNULL,
|
|
86
|
-
)
|
|
87
|
-
# Run the generated binary file, and it should not crash (which is a pretty basic requirement, I know)
|
|
88
|
-
subprocess.check_call([bin_filepath, "--help"], stdout=subprocess.DEVNULL)
|
|
89
|
-
# Pick up after ourselves
|
|
90
|
-
shutil.rmtree(tempdir)
|
|
91
|
-
|
|
92
|
-
def test_chmod_gcc_O1(self):
|
|
93
|
-
# Issue reported and test binary provided by Antonio F. Montoya
|
|
94
|
-
|
|
95
|
-
p = angr.Project(os.path.join(test_location, "x86_64", "chmod_gcc_-O1"), auto_load_libs=False)
|
|
96
|
-
r = p.analyses.Reassembler(syntax="at&t")
|
|
97
|
-
r.symbolize()
|
|
98
|
-
r.remove_unnecessary_stuff()
|
|
99
|
-
assembly = r.assembly(comments=True, symbolized=True)
|
|
100
|
-
|
|
101
|
-
if is_linux_x64():
|
|
102
|
-
# we should be able to compile it and run it ... if we are running on x64 Linux
|
|
103
|
-
tempdir = tempfile.mkdtemp(prefix="angr_test_reassembler_")
|
|
104
|
-
asm_filename = "chmod_gcc-O1.s"
|
|
105
|
-
bin_filename = "chmod_gcc-O1"
|
|
106
|
-
asm_filepath = os.path.join(tempdir, asm_filename)
|
|
107
|
-
bin_filepath = os.path.join(tempdir, bin_filename)
|
|
108
|
-
with open(asm_filepath, "w", encoding="ascii") as f:
|
|
109
|
-
f.write(assembly)
|
|
110
|
-
# Call out to GCC, and it should return 0. Otherwise check_call() will raise an exception.
|
|
111
|
-
subprocess.check_call(
|
|
112
|
-
["gcc", "-no-pie", asm_filepath, "-o", bin_filepath],
|
|
113
|
-
stdout=subprocess.DEVNULL,
|
|
114
|
-
stderr=subprocess.DEVNULL,
|
|
115
|
-
)
|
|
116
|
-
# Run the generated binary file, and it should not crash (which is a pretty basic requirement, I know)
|
|
117
|
-
subprocess.check_call([bin_filepath, "--help"], stdout=subprocess.DEVNULL)
|
|
118
|
-
# Pick up after ourselves
|
|
119
|
-
shutil.rmtree(tempdir)
|
|
120
|
-
|
|
121
|
-
def test_ex_gpp(self):
|
|
122
|
-
# Issue reported and test binary provided by Antonio F. Montoya
|
|
123
|
-
|
|
124
|
-
p = angr.Project(os.path.join(test_location, "x86_64", "ex_g++"), auto_load_libs=False)
|
|
125
|
-
r = p.analyses.Reassembler(syntax="at&t")
|
|
126
|
-
r.symbolize()
|
|
127
|
-
r.remove_unnecessary_stuff()
|
|
128
|
-
assembly = r.assembly(comments=True, symbolized=True)
|
|
129
|
-
|
|
130
|
-
if is_linux_x64():
|
|
131
|
-
# we should be able to compile it and run it ... if we are running on x64 Linux
|
|
132
|
-
tempdir = tempfile.mkdtemp(prefix="angr_test_reassembler_")
|
|
133
|
-
asm_filename = "ex_g++.s"
|
|
134
|
-
bin_filename = "ex_g++"
|
|
135
|
-
asm_filepath = os.path.join(tempdir, asm_filename)
|
|
136
|
-
bin_filepath = os.path.join(tempdir, bin_filename)
|
|
137
|
-
with open(asm_filepath, "w", encoding="ascii") as f:
|
|
138
|
-
f.write(assembly)
|
|
139
|
-
# Call out to GCC, and it should return 0. Otherwise check_call() will raise an exception.
|
|
140
|
-
subprocess.check_call(
|
|
141
|
-
["g++", "-no-pie", asm_filepath, "-o", bin_filepath],
|
|
142
|
-
stdout=subprocess.DEVNULL,
|
|
143
|
-
stderr=subprocess.DEVNULL,
|
|
144
|
-
)
|
|
145
|
-
# Run the generated binary file and check the output
|
|
146
|
-
output = subprocess.check_output([bin_filepath])
|
|
147
|
-
assert output == b"A1\nA2\n"
|
|
148
|
-
# Pick up after ourselves
|
|
149
|
-
shutil.rmtree(tempdir)
|
|
150
|
-
|
|
151
|
-
def test_df_gcc_O1(self):
|
|
152
|
-
# Issue reported and test binary provided by Antonio F. Montoya
|
|
153
|
-
|
|
154
|
-
p = angr.Project(os.path.join(test_location, "x86_64", "df_gcc_-O1"), auto_load_libs=False)
|
|
155
|
-
r = p.analyses.Reassembler(syntax="at&t")
|
|
156
|
-
r.symbolize()
|
|
157
|
-
r.remove_unnecessary_stuff()
|
|
158
|
-
assembly = r.assembly(comments=True, symbolized=True)
|
|
159
|
-
|
|
160
|
-
if is_linux_x64():
|
|
161
|
-
# we should be able to compile it and run it ... if we are running on x64 Linux
|
|
162
|
-
tempdir = tempfile.mkdtemp(prefix="angr_test_reassembler_")
|
|
163
|
-
asm_filename = "df_gcc-O1.s"
|
|
164
|
-
bin_filename = "df_gcc-O1"
|
|
165
|
-
asm_filepath = os.path.join(tempdir, asm_filename)
|
|
166
|
-
bin_filepath = os.path.join(tempdir, bin_filename)
|
|
167
|
-
with open(asm_filepath, "w", encoding="ascii") as f:
|
|
168
|
-
f.write(assembly)
|
|
169
|
-
# Call out to GCC, and it should return 0. Otherwise check_call() will raise an exception.
|
|
170
|
-
subprocess.check_call(
|
|
171
|
-
["gcc", "-no-pie", asm_filepath, "-o", bin_filepath],
|
|
172
|
-
stdout=subprocess.DEVNULL,
|
|
173
|
-
stderr=subprocess.DEVNULL,
|
|
174
|
-
)
|
|
175
|
-
# Run the generated binary file, and it should not crash (which is a pretty basic requirement, I know)
|
|
176
|
-
subprocess.check_call([bin_filepath, "--help"], stdout=subprocess.DEVNULL)
|
|
177
|
-
# Pick up after ourselves
|
|
178
|
-
shutil.rmtree(tempdir)
|
|
179
|
-
|
|
180
|
-
def test_dir_gcc_O0(self):
|
|
181
|
-
# Issue reported and test binary provided by Antonio F. Montoya
|
|
182
|
-
|
|
183
|
-
p = angr.Project(os.path.join(test_location, "x86_64", "dir_gcc_-O0"), auto_load_libs=False)
|
|
184
|
-
r = p.analyses.Reassembler(syntax="at&t")
|
|
185
|
-
r.symbolize()
|
|
186
|
-
r.remove_unnecessary_stuff()
|
|
187
|
-
assembly = r.assembly(comments=True, symbolized=True)
|
|
188
|
-
|
|
189
|
-
if is_linux_x64():
|
|
190
|
-
# we should be able to compile it and run it ... if we are running on x64 Linux
|
|
191
|
-
tempdir = tempfile.mkdtemp(prefix="angr_test_reassembler_")
|
|
192
|
-
asm_filename = "dir_gcc-O0.s"
|
|
193
|
-
bin_filename = "dir_gcc-O0"
|
|
194
|
-
asm_filepath = os.path.join(tempdir, asm_filename)
|
|
195
|
-
bin_filepath = os.path.join(tempdir, bin_filename)
|
|
196
|
-
with open(asm_filepath, "w", encoding="ascii") as f:
|
|
197
|
-
f.write(assembly)
|
|
198
|
-
# Call out to GCC, and it should return 0. Otherwise check_call() will raise an exception.
|
|
199
|
-
subprocess.check_call(
|
|
200
|
-
["gcc", "-no-pie", asm_filepath, "-o", bin_filepath],
|
|
201
|
-
stdout=subprocess.DEVNULL,
|
|
202
|
-
stderr=subprocess.DEVNULL,
|
|
203
|
-
)
|
|
204
|
-
# Run the generated binary file, and it should not crash (which is a pretty basic requirement, I know)
|
|
205
|
-
subprocess.check_call([bin_filepath, "--help"], stdout=subprocess.DEVNULL)
|
|
206
|
-
subprocess.check_call([bin_filepath, "-la", "/"], stdout=subprocess.DEVNULL)
|
|
207
|
-
# Pick up after ourselves
|
|
208
|
-
shutil.rmtree(tempdir)
|
|
209
|
-
|
|
210
|
-
def test_helloworld(self):
|
|
211
|
-
# Reassembler complains about TYPE_OTHER symbols, which is because it's trying to classify bytes inside the ELF
|
|
212
|
-
# header as pointers. We identify the ELF header in CFGFast to workaround this problem.
|
|
213
|
-
# https://github.com/angr/angr/issues/1630
|
|
214
|
-
|
|
215
|
-
p = angr.Project(os.path.join(test_location, "x86_64", "hello_world"), auto_load_libs=False)
|
|
216
|
-
r = p.analyses.Reassembler(syntax="at&t")
|
|
217
|
-
r.symbolize()
|
|
218
|
-
r.remove_unnecessary_stuff()
|
|
219
|
-
_ = r.assembly(comments=True, symbolized=True)
|
|
220
|
-
|
|
221
|
-
# No exception should have been raised
|
|
222
|
-
|
|
223
|
-
def test_helloworld_gcc9(self):
|
|
224
|
-
# New versions of GCC changed the names of init and fini sections.
|
|
225
|
-
# https://github.com/angr/patcherex/issues/39
|
|
226
|
-
|
|
227
|
-
p = angr.Project(os.path.join(test_location, "x86_64", "hello_gcc9_reassembler"), auto_load_libs=False)
|
|
228
|
-
r = p.analyses.Reassembler(syntax="at&t")
|
|
229
|
-
r.symbolize()
|
|
230
|
-
r.remove_unnecessary_stuff()
|
|
231
|
-
assembly = r.assembly(comments=True, symbolized=True)
|
|
232
|
-
|
|
233
|
-
if is_linux_x64():
|
|
234
|
-
# we should be able to compile it and run it ... if we are running on x64 Linux
|
|
235
|
-
tempdir = tempfile.mkdtemp(prefix="angr_test_reassembler_")
|
|
236
|
-
asm_filename = "hello.s"
|
|
237
|
-
bin_filename = "hello"
|
|
238
|
-
asm_filepath = os.path.join(tempdir, asm_filename)
|
|
239
|
-
bin_filepath = os.path.join(tempdir, bin_filename)
|
|
240
|
-
with open(asm_filepath, "w", encoding="ascii") as f:
|
|
241
|
-
f.write(assembly)
|
|
242
|
-
# Call out to GCC, and it should return 0. Otherwise check_call() will raise an exception.
|
|
243
|
-
subprocess.check_call(
|
|
244
|
-
["gcc", "-no-pie", asm_filepath, "-o", bin_filepath],
|
|
245
|
-
stdout=subprocess.DEVNULL,
|
|
246
|
-
stderr=subprocess.DEVNULL,
|
|
247
|
-
)
|
|
248
|
-
# Run the generated binary file, and it should not crash
|
|
249
|
-
subprocess.check_call([bin_filepath], stdout=subprocess.DEVNULL)
|
|
250
|
-
# Pick up after ourselves
|
|
251
|
-
shutil.rmtree(tempdir)
|
|
252
|
-
|
|
253
|
-
def test_partial_pie_ls_x86(self):
|
|
254
|
-
# https://github.com/angr/patcherex/issues/39
|
|
255
|
-
# a GCC-generated X86 binary with a few functions somehow being PIE
|
|
256
|
-
|
|
257
|
-
p = angr.Project(os.path.join(test_location, "i386", "ls_gcc_7.5_reassembler"), auto_load_libs=False)
|
|
258
|
-
r = p.analyses.Reassembler(syntax="at&t")
|
|
259
|
-
r.symbolize()
|
|
260
|
-
r.remove_unnecessary_stuff()
|
|
261
|
-
assembly = r.assembly(comments=True, symbolized=True)
|
|
262
|
-
|
|
263
|
-
if is_linux() and has_32_bit_compiler_support():
|
|
264
|
-
# we should be able to compile it and run it ... if we are running on x64 Linux
|
|
265
|
-
tempdir = tempfile.mkdtemp(prefix="angr_test_reassembler_")
|
|
266
|
-
asm_filename = "ls.s"
|
|
267
|
-
bin_filename = "ls"
|
|
268
|
-
asm_filepath = os.path.join(tempdir, asm_filename)
|
|
269
|
-
bin_filepath = os.path.join(tempdir, bin_filename)
|
|
270
|
-
with open(asm_filepath, "w", encoding="ascii") as f:
|
|
271
|
-
f.write(assembly)
|
|
272
|
-
# Call out to GCC, and it should return 0. Otherwise check_call() will raise an exception.
|
|
273
|
-
subprocess.check_call(
|
|
274
|
-
["gcc", "-m32", "-no-pie", asm_filepath, "-o", bin_filepath],
|
|
275
|
-
stdout=subprocess.DEVNULL,
|
|
276
|
-
stderr=subprocess.DEVNULL,
|
|
277
|
-
)
|
|
278
|
-
# Run the generated binary file, and it should not crash
|
|
279
|
-
subprocess.check_call([bin_filepath], stdout=subprocess.DEVNULL)
|
|
280
|
-
# We can also run it with "-h"
|
|
281
|
-
o = subprocess.check_output([bin_filepath, "--version"])
|
|
282
|
-
assert (
|
|
283
|
-
o == b"ls (GNU coreutils) 8.30\n"
|
|
284
|
-
b"Copyright (C) 2018 Free Software Foundation, Inc.\n"
|
|
285
|
-
b"License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.\n"
|
|
286
|
-
b"This is free software: you are free to change and redistribute it.\n"
|
|
287
|
-
b"There is NO WARRANTY, to the extent permitted by law.\n\n"
|
|
288
|
-
b"Written by Richard M. Stallman and David MacKenzie.\n"
|
|
289
|
-
)
|
|
290
|
-
# Pick up after ourselves
|
|
291
|
-
shutil.rmtree(tempdir)
|
|
292
|
-
|
|
293
|
-
|
|
294
|
-
if __name__ == "__main__":
|
|
295
|
-
unittest.main()
|
|
@@ -1,27 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
__package__ = __package__ or "tests.analyses" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ..common import bin_location
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
test_location = os.path.join(bin_location, "tests")
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
class TestRegionIdentifier(unittest.TestCase):
|
|
17
|
-
def test_smoketest(self):
|
|
18
|
-
p = angr.Project(os.path.join(test_location, "x86_64", "all"), auto_load_libs=False)
|
|
19
|
-
cfg = p.analyses.CFG(normalize=True)
|
|
20
|
-
|
|
21
|
-
main_func = cfg.kb.functions["main"]
|
|
22
|
-
|
|
23
|
-
_ = p.analyses.RegionIdentifier(main_func)
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
if __name__ == "__main__":
|
|
27
|
-
unittest.main()
|