angr 9.2.87__py3-none-manylinux2014_x86_64.whl → 9.2.89__py3-none-manylinux2014_x86_64.whl

tests/analyses/test_variablerecovery.py

@@ -1,464 +0,0 @@
-#!/usr/bin/env python3
-__package__ = __package__ or "tests.analyses"  # pylint:disable=redefined-builtin
-
-import os
-import logging
-import unittest
-
-import angr
-from angr.sim_variable import SimStackVariable, SimRegisterVariable
-from angr.knowledge_plugins.variables import VariableType
-
-from ..common import bin_location
-
-
-test_location = os.path.join(bin_location, "tests")
-
-l = logging.getLogger("test_variablerecovery")
-
-
-#
-# Utility methods
-#
-
-
-class TestVariableRecovery(unittest.TestCase):
-    def _compare_memory_variable(self, variable, variable_info):
-        if variable_info["location"] == "stack":
-            if not isinstance(variable, SimStackVariable):
-                return False
-
-            # base
-            if "base" in variable_info:
-                base = variable_info["base"]
-                if variable.base != base:
-                    return False
-
-            # offset
-            if "offset" in variable_info:
-                offset = variable_info["offset"]
-                if variable.offset != offset:
-                    return False
-
-            # size
-            if "size" in variable_info:
-                size = variable_info["size"]
-                if variable.size != size:
-                    return False
-
-            return True
-
-        else:
-            if isinstance(variable, SimStackVariable):
-                # it is not a variable on the stack
-                return False
-
-            raise NotImplementedError()
-
-    def _compare_register_variable(self, variable, variable_info):  # pylint:disable=unused-argument
-        if not isinstance(variable, SimRegisterVariable):
-            return False
-
-        if "reg" in variable_info:
-            reg = variable_info["reg"]
-            if variable.reg != reg:
-                return False
-
-        if "size" in variable_info:
-            size = variable_info["size"]
-            if variable.size != size:
-                return False
-
-        return True
-
-    def _run_variable_recovery_analysis(self, func_name, groundtruth, is_fast):
-        binary_path = os.path.join(test_location, "x86_64", "fauxware")
-        project = angr.Project(binary_path, load_options={"auto_load_libs": False})
-        cfg = project.analyses.CFG(normalize=True)
-        func = cfg.kb.functions[func_name]
-
-        # Create a temporary KnowledgeBase instance
-        tmp_kb = angr.KnowledgeBase(project)
-
-        if is_fast:
-            l.debug("Running VariableRecoveryFast on function %r.", func)
-            vr = project.analyses.VariableRecoveryFast(func, kb=tmp_kb)
-        else:
-            l.debug("Running VariableRecovery on function %r.", func)
-            vr = project.analyses.VariableRecovery(func, kb=tmp_kb)
-
-        variable_manager = vr.variable_manager[func.addr]
-
-        for insn_addr, variables in groundtruth["variables_by_instruction"].items():
-            for var_info in variables:
-                var_sort = var_info["sort"]
-                vars_and_offset = variable_manager.find_variables_by_insn(insn_addr, var_sort)
-
-                # enumerate vars and find the variable that we want
-                if var_sort == VariableType.MEMORY:
-                    the_var = next(
-                        (var for var, _ in vars_and_offset if self._compare_memory_variable(var, var_info)),
-                        None,
-                    )
-                elif var_sort == VariableType.REGISTER:
-                    the_var = next(
-                        (var for var, _ in vars_and_offset if self._compare_register_variable(var, var_info)),
-                        None,
-                    )
-                else:
-                    l.error("Unsupported variable sort %s.", var_sort)
-                    assert False
-
-                assert (
-                    the_var is not None
-                ), "The variable {} in groundtruth at instruction {:#x} cannot be found in variable manager.".format(
-                    var_info,
-                    insn_addr,
-                )
-                l.debug("Found variable %s at %#x.", the_var, insn_addr)
-
-        for block_addr, variables in groundtruth["phi_variables_by_block"].items():
-            phi_variables = variable_manager.get_phi_variables(block_addr)
-            for var_info in variables:
-                var_sort = var_info["sort"]
-
-                # enumerate vars and find the variable that we want
-                if var_sort == VariableType.MEMORY:
-                    the_var = next(
-                        (var for var in phi_variables if self._compare_memory_variable(var, var_info)),
-                        None,
-                    )
-                elif var_sort == VariableType.REGISTER:
-                    the_var = next(
-                        (var for var in phi_variables if self._compare_register_variable(var, var_info)),
-                        None,
-                    )
-                else:
-                    l.error("Unsupported variable sort %s.", var_sort)
-                    assert False
-
-                assert (
-                    the_var is not None
-                ), "The phi variable {} in groundtruth at block {:#x} cannot be found in variable manager.".format(
-                    var_info,
-                    block_addr,
-                )
-                l.debug("Found phi variable %s at %#x.", the_var, block_addr)
-
-    def test_variable_recovery_fauxware_authenticate_true(self):
-        self._run_variable_recovery_analysis(
-            "authenticate",
-            {
-                "variables_by_instruction": {
-                    0x40066C: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x18,
-                            "size": 8,
-                        },
-                    ],
-                    0x400670: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x20,
-                            "size": 8,
-                        },
-                    ],
-                    0x400674: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x8,
-                            "size": 1,
-                        },
-                    ],
-                    0x40067F: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x20,
-                            "size": 8,
-                        },
-                    ],
-                    0x400699: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x18,
-                            "size": 8,
-                        },
-                    ],
-                    0x4006AF: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x4,
-                            "size": 4,
-                        },
-                    ],
-                    0x4006B2: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x10,
-                            "size": 1,
-                        },
-                    ],
-                },
-                "phi_variables_by_block": {
-                    0x4006EB: [
-                        {"sort": VariableType.REGISTER, "reg": 16, "size": 8},
-                        {"sort": VariableType.REGISTER, "reg": 32, "size": 8},
-                        {"sort": VariableType.REGISTER, "reg": 64, "size": 8},
-                        {"sort": VariableType.REGISTER, "reg": 72, "size": 8},
-                    ]
-                },
-            },
-            True,
-        )
-
-    def test_variable_recovery_fauxware_authenticate_false(self):
-        self._run_variable_recovery_analysis(
-            "authenticate",
-            {
-                "variables_by_instruction": {
-                    0x40066C: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x18,
-                            "size": 8,
-                        },
-                    ],
-                    0x400670: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x20,
-                            "size": 8,
-                        },
-                    ],
-                    0x400674: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x8,
-                            "size": 1,
-                        },
-                    ],
-                    0x40067F: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x20,
-                            "size": 8,
-                        },
-                    ],
-                    0x400699: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x18,
-                            "size": 8,
-                        },
-                    ],
-                    0x4006AF: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x4,
-                            "size": 4,
-                        },
-                    ],
-                    0x4006B2: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x10,
-                            "size": 1,
-                        },
-                    ],
-                },
-                "phi_variables_by_block": {
-                    0x4006EB: [
-                        {"sort": VariableType.REGISTER, "reg": 16, "size": 8},
-                        {"sort": VariableType.REGISTER, "reg": 32, "size": 8},
-                        {"sort": VariableType.REGISTER, "reg": 64, "size": 8},
-                        {"sort": VariableType.REGISTER, "reg": 72, "size": 8},
-                    ]
-                },
-            },
-            False,
-        )
-
-    def test_variable_recovery_fauxware_main_true(self):
-        self._run_variable_recovery_analysis(
-            "main",
-            {
-                "variables_by_instruction": {
-                    0x400725: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x34,
-                            "size": 4,
-                        },
-                    ],
-                    0x400728: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x40,
-                            "size": 8,
-                        },
-                    ],
-                    0x40072C: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x8,
-                            "size": 1,
-                        },
-                    ],
-                    0x400730: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x18,
-                            "size": 1,
-                        },
-                    ],
-                    0x40073E: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x10,
-                            "size": 1,
-                        },
-                    ],
-                    0x400754: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x24,
-                            "size": 1,
-                        },
-                    ],
-                    0x400774: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x20,
-                            "size": 1,
-                        },
-                    ],
-                },
-                "phi_variables_by_block": {},
-            },
-            True,
-        )
-
-    def test_variable_recovery_fauxware_main_false(self):
-        self._run_variable_recovery_analysis(
-            "main",
-            {
-                "variables_by_instruction": {
-                    0x400725: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x34,
-                            "size": 4,
-                        },
-                    ],
-                    0x400728: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x40,
-                            "size": 8,
-                        },
-                    ],
-                    0x40072C: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x8,
-                            "size": 1,
-                        },
-                    ],
-                    0x400730: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x18,
-                            "size": 1,
-                        },
-                    ],
-                    0x40073E: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x10,
-                            "size": 1,
-                        },
-                    ],
-                    0x400754: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x24,
-                            "size": 1,
-                        },
-                    ],
-                    0x400774: [
-                        {
-                            "sort": VariableType.MEMORY,
-                            "location": "stack",
-                            "base": "bp",
-                            "offset": -0x20,
-                            "size": 1,
-                        },
-                    ],
-                },
-                "phi_variables_by_block": {},
-            },
-            False,
-        )
-
-
-if __name__ == "__main__":
-    l.setLevel(logging.DEBUG)
-    logging.getLogger("angr.analyses.variable_recovery_fast").setLevel(logging.DEBUG)
-    logging.getLogger("angr.analyses.variable_recovery").setLevel(logging.DEBUG)
-
-    unittest.main()

tests/analyses/test_vfg.py

@@ -1,221 +0,0 @@
-#!/usr/bin/env python3
-__package__ = __package__ or "tests.analyses"  # pylint:disable=redefined-builtin
-
-import time
-import os
-import logging
-import unittest
-import claripy
-
-import angr
-
-from ..common import bin_location
-
-
-test_location = os.path.join(bin_location, "tests")
-l = logging.getLogger("angr_tests")
-
-vfg_buffer_overflow_addresses = {"x86_64": 0x40055C}
-
-vfg_1_addresses = {
-    "x86_64": {
-        0x40071D,  # main
-        0x400510,  # _puts
-        0x40073E,  # main
-        0x400530,  # _read
-        0x400754,  # main
-        0x40076A,  # main
-        0x400774,  # main
-        0x40078A,  # main
-        0x4007A0,  # main
-        0x400664,  # authenticate
-        0x400550,  # _strcmp
-        0x40068E,  # authenticate
-        0x400699,  # authenticate
-        0x400560,  # _open
-        0x4006AF,  # authenticate
-        0x4006C8,  # authenticate
-        0x4006DB,  # authenticate
-        0x400692,  # authenticate
-        0x4006DF,  # authenticate
-        0x4006E6,  # authenticate
-        0x4006EB,  # authenticate
-        0x4007BD,  # main
-        0x4006ED,  # accepted
-        0x4006FB,  # accepted
-        0x4007C7,  # main
-        0x4007C9,  # main
-        0x4006FD,  # rejected
-        0x400520,  # _printf
-        0x400713,  # rejected
-        0x400570,  # _exit
-    }
-}
-
-
-class TestVfg(unittest.TestCase):
-    def _run_vfg_buffer_overflow(self, arch):
-        # pylint: disable=no-member
-        proj = angr.Project(
-            os.path.join(test_location, arch, "basic_buffer_overflows"),
-            use_sim_procedures=True,
-            default_analysis_mode="symbolic",
-            auto_load_libs=False,
-        )
-
-        cfg = proj.analyses.CFGEmulated(context_sensitivity_level=1)
-
-        # For this test case, OPTIMIZE_IR does not work due to the way we are widening the states: an index variable
-        # directly goes to 0xffffffff, and when OPTIMIZE_IR is used, it does a signed comparison with 0x27, which
-        # eventually leads to the merged index variable covers all negative numbers and [0, 27]. This analysis result is
-        # correct but not accurate, and we suffer from it in this test case.
-        # The ultimate solution is to widen more carefully, or implement lookahead widening support.
-        # TODO: Solve this issue later
-
-        start = time.time()
-        function_start = vfg_buffer_overflow_addresses[arch]
-        vfg = proj.analyses.VFG(
-            cfg,
-            function_start=function_start,
-            context_sensitivity_level=2,
-            interfunction_level=4,
-            remove_options={angr.options.OPTIMIZE_IR},
-        )
-        end = time.time()
-        duration = end - start
-
-        l.info("VFG generation done in %f seconds.", duration)
-
-        # TODO: These are very weak conditions. Make them stronger!
-        assert len(vfg.final_states) > 0
-        states = vfg.final_states
-        assert len(states) == 2
-        stack_check_fail = proj._extern_obj.get_pseudo_addr("symbol hook: __stack_chk_fail")
-        assert {s.solver.eval_one(s.ip) for s in states} == {
-            stack_check_fail,
-            0x4005B4,
-        }
-
-        state = [s for s in states if s.solver.eval_one(s.ip) == 0x4005B4][0]
-        assert claripy.backends.vsa.is_true(state.stack_read(12, 4) >= 0x28)
-
-    def broken_vfg_buffer_overflow(self):
-        # Test for running VFG on a single function
-        self._run_vfg_buffer_overflow("x86_64")
-
-    #
-    # VFG test case 0
-    #
-
-    def test_vfg_0(self):
-        self._run_vfg_0("x86_64")
-
-    def _run_vfg_0(self, arch):
-        proj = angr.Project(
-            os.path.join(test_location, arch, "vfg_0"),
-            load_options={"auto_load_libs": False},
-        )
-
-        cfg = proj.analyses.CFG(normalize=True)
-        main = cfg.functions.function(name="main")
-        vfg = proj.analyses.VFG(
-            cfg,
-            start=main.addr,
-            context_sensitivity_level=1,
-            interfunction_level=3,
-            record_function_final_states=True,
-            max_iterations=80,
-        )
-
-        function_final_states = vfg._function_final_states
-        assert main.addr in function_final_states
-
-        final_state_main = next(iter(function_final_states[main.addr].values()))
-        stdout = final_state_main.posix.dumps(1)
-
-        assert stdout[:6] == b"i = 64"
-        # the following does not work without affine relation analysis
-        # assert stdout == "i = 64
-
-    #
-    # VFG test case 1
-    #
-
-    def _run_vfg_1(self, arch):
-        proj = angr.Project(
-            os.path.join(test_location, arch, "fauxware"), use_sim_procedures=True, auto_load_libs=False
-        )
-
-        cfg = proj.analyses.CFGEmulated()
-        vfg = proj.analyses.VFG(
-            cfg,
-            start=0x40071D,
-            context_sensitivity_level=10,
-            interfunction_level=10,
-            record_function_final_states=True,
-        )
-
-        all_block_addresses = {n.addr for n in vfg.graph.nodes()}
-        assert vfg_1_addresses[arch].issubset(all_block_addresses)
-
-        # return value for functions
-
-        # function authenticate has only two possible return values: 0 and 1
-        authenticate = cfg.functions.function(name="authenticate")
-        assert authenticate.addr in vfg.function_final_states
-        authenticate_final_states = vfg.function_final_states[authenticate.addr]
-        assert len(authenticate_final_states) == 1
-        authenticate_final_state = next(iter(authenticate_final_states.values()))
-        assert authenticate_final_state is not None
-        assert authenticate_final_state.solver.eval_upto(authenticate_final_state.regs.rax, 3) == [0, 1]
-
-        # optimal execution tests
-        # - the basic block after returning from `authenticate` should only be executed once
-        assert vfg._execution_counter[0x4007B3] == 1
-        # - the last basic block in `authenticate` should only be executed once (on a non-normalized CFG)
-        assert vfg._execution_counter[0x4006EB] == 1
-
-    def test_vfg_1(self):
-        # Test the code coverage of VFG
-        self._run_vfg_1("x86_64")
-
-    def test_vfg_resolving_indirect_calls(self):
-        # resolving indirect calls provided via a statically allocated list of function addresses
-        # the test binary is contributed by Luke Serné on angr Slack
-        proj = angr.Project(
-            os.path.join(test_location, "aarch64", "func-chain-aarch64"),
-            auto_load_libs=False,
-        )
-        cfg = proj.analyses.CFG(normalize=True)
-        vfg = proj.analyses.VFG(
-            cfg,
-            start=cfg.kb.functions["main"].addr,
-            context_sensitivity_level=1,
-            interfunction_level=1,
-            record_function_final_states=True,
-        )
-
-        # find the node with indirect call exits
-        expected_indirect_call_targets = {
-            (0x400808, 0x400754),  # init_0
-            (0x400808, 0x400770),  # init_1
-            (0x400808, 0x400790),  # init_2
-        }
-        indirect_call_targets = set()
-        for block_addr in cfg.kb.functions["main"].block_addrs_set:
-            cfg_node = cfg.get_any_node(block_addr)
-            succs_and_jumpkinds = cfg_node.successors_and_jumpkinds()
-            if len(succs_and_jumpkinds) == 1 and succs_and_jumpkinds[0][1] == "Ijk_Call":
-                # does it lead to an UnresolvedCall?
-                if succs_and_jumpkinds[0][0].name == "UnresolvableCallTarget":
-                    # found it!
-                    for vfg_node in vfg.get_all_nodes(cfg_node.addr):
-                        for successor_state in vfg_node.final_states:
-                            if successor_state.history.jumpkind == "Ijk_Call":
-                                indirect_call_targets.add((cfg_node.addr, successor_state.addr))
-
-        assert expected_indirect_call_targets == indirect_call_targets
-
-
-if __name__ == "__main__":
-    unittest.main()