angr 9.2.87__py3-none-manylinux2014_x86_64.whl → 9.2.89__py3-none-manylinux2014_x86_64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +4 -1
- angr/analyses/decompiler/clinic.py +16 -0
- angr/analyses/decompiler/decompiler.py +3 -0
- angr/analyses/decompiler/optimization_passes/__init__.py +5 -0
- angr/analyses/decompiler/optimization_passes/cross_jump_reverter.py +108 -0
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +17 -4
- angr/analyses/decompiler/optimization_passes/return_duplicator.py +4 -32
- angr/analyses/decompiler/structured_codegen/c.py +12 -2
- angr/analyses/decompiler/utils.py +13 -0
- angr/analyses/typehoon/dfa.py +108 -0
- angr/analyses/typehoon/lifter.py +34 -2
- angr/analyses/typehoon/simple_solver.py +1043 -503
- angr/analyses/typehoon/translator.py +13 -4
- angr/analyses/typehoon/typeconsts.py +117 -36
- angr/analyses/typehoon/typehoon.py +31 -11
- angr/analyses/typehoon/typevars.py +88 -21
- angr/analyses/typehoon/variance.py +10 -0
- angr/analyses/variable_recovery/engine_ail.py +28 -9
- angr/analyses/variable_recovery/engine_base.py +50 -43
- angr/analyses/variable_recovery/variable_recovery_base.py +16 -3
- angr/analyses/variable_recovery/variable_recovery_fast.py +14 -5
- angr/exploration_techniques/tracer.py +2 -0
- angr/misc/autoimport.py +26 -0
- angr/procedures/definitions/__init__.py +32 -3
- angr/utils/constants.py +1 -0
- angr/utils/graph.py +20 -1
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/METADATA +7 -6
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/RECORD +32 -244
- angr-9.2.89.dist-info/top_level.txt +1 -0
- angr/procedures/definitions/ntdll.py +0 -12
- angr-9.2.87.dist-info/top_level.txt +0 -2
- tests/__init__.py +0 -0
- tests/analyses/__init__.py +0 -0
- tests/analyses/cfg/__init__.py +0 -0
- tests/analyses/cfg/test_cfg_clflush.py +0 -43
- tests/analyses/cfg/test_cfg_get_any_node.py +0 -34
- tests/analyses/cfg/test_cfg_manager.py +0 -32
- tests/analyses/cfg/test_cfg_model.py +0 -55
- tests/analyses/cfg/test_cfg_patching.py +0 -378
- tests/analyses/cfg/test_cfg_rust_got_resolution.py +0 -36
- tests/analyses/cfg/test_cfg_thumb_firmware.py +0 -50
- tests/analyses/cfg/test_cfg_vex_postprocessor.py +0 -27
- tests/analyses/cfg/test_cfgemulated.py +0 -634
- tests/analyses/cfg/test_cfgfast.py +0 -1123
- tests/analyses/cfg/test_cfgfast_soot.py +0 -38
- tests/analyses/cfg/test_const_resolver.py +0 -38
- tests/analyses/cfg/test_iat_resolver.py +0 -37
- tests/analyses/cfg/test_jumptables.py +0 -3008
- tests/analyses/cfg/test_noop_blocks.py +0 -54
- tests/analyses/cfg_slice_to_sink/__init__.py +0 -0
- tests/analyses/cfg_slice_to_sink/test_cfg_slice_to_sink.py +0 -93
- tests/analyses/cfg_slice_to_sink/test_graph.py +0 -114
- tests/analyses/cfg_slice_to_sink/test_transitions.py +0 -28
- tests/analyses/decompiler/__init__.py +0 -0
- tests/analyses/decompiler/test_baseptr_save_simplifier.py +0 -80
- tests/analyses/decompiler/test_decompiler.py +0 -3336
- tests/analyses/decompiler/test_peephole_optimizations.py +0 -48
- tests/analyses/decompiler/test_propagator_loops.py +0 -101
- tests/analyses/decompiler/test_structurer.py +0 -275
- tests/analyses/reaching_definitions/__init__.py +0 -0
- tests/analyses/reaching_definitions/test_dep_graph.py +0 -432
- tests/analyses/reaching_definitions/test_function_handler.py +0 -131
- tests/analyses/reaching_definitions/test_heap_allocator.py +0 -46
- tests/analyses/reaching_definitions/test_rd_state.py +0 -78
- tests/analyses/reaching_definitions/test_reachingdefinitions.py +0 -463
- tests/analyses/reaching_definitions/test_subject.py +0 -76
- tests/analyses/test_bindiff.py +0 -52
- tests/analyses/test_block_simplifier.py +0 -112
- tests/analyses/test_boyscout.py +0 -104
- tests/analyses/test_calling_convention_analysis.py +0 -352
- tests/analyses/test_callsite_maker.py +0 -60
- tests/analyses/test_cdg.py +0 -165
- tests/analyses/test_cfb.py +0 -37
- tests/analyses/test_class_identifier.py +0 -46
- tests/analyses/test_clinic.py +0 -30
- tests/analyses/test_codetagging.py +0 -32
- tests/analyses/test_constantpropagation.py +0 -88
- tests/analyses/test_ddg.py +0 -95
- tests/analyses/test_ddg_global_var_dependencies.py +0 -83
- tests/analyses/test_ddg_memvar_addresses.py +0 -40
- tests/analyses/test_disassembly.py +0 -121
- tests/analyses/test_find_objects_static.py +0 -35
- tests/analyses/test_flirt.py +0 -49
- tests/analyses/test_identifier.py +0 -33
- tests/analyses/test_init_finder.py +0 -38
- tests/analyses/test_proximitygraph.py +0 -31
- tests/analyses/test_reassembler.py +0 -295
- tests/analyses/test_regionidentifier.py +0 -27
- tests/analyses/test_slicing.py +0 -164
- tests/analyses/test_stack_pointer_tracker.py +0 -74
- tests/analyses/test_static_hooker.py +0 -28
- tests/analyses/test_typehoon.py +0 -55
- tests/analyses/test_variablerecovery.py +0 -464
- tests/analyses/test_vfg.py +0 -221
- tests/analyses/test_vtable.py +0 -31
- tests/analyses/test_xrefs.py +0 -77
- tests/common.py +0 -128
- tests/engines/__init__.py +0 -0
- tests/engines/light/__init__.py +0 -0
- tests/engines/light/test_data.py +0 -17
- tests/engines/pcode/__init__.py +0 -0
- tests/engines/pcode/test_emulate.py +0 -607
- tests/engines/pcode/test_pcode.py +0 -84
- tests/engines/test_actions.py +0 -27
- tests/engines/test_hook.py +0 -112
- tests/engines/test_java.py +0 -697
- tests/engines/test_unicorn.py +0 -518
- tests/engines/vex/__init__.py +0 -0
- tests/engines/vex/test_lifter.py +0 -124
- tests/engines/vex/test_vex.py +0 -574
- tests/exploration_techniques/__init__.py +0 -0
- tests/exploration_techniques/test_cacher.py +0 -45
- tests/exploration_techniques/test_director.py +0 -67
- tests/exploration_techniques/test_driller_core.py +0 -48
- tests/exploration_techniques/test_loop_seer.py +0 -158
- tests/exploration_techniques/test_memory_watcher.py +0 -46
- tests/exploration_techniques/test_oppologist.py +0 -65
- tests/exploration_techniques/test_spiller.py +0 -82
- tests/exploration_techniques/test_stochastic.py +0 -40
- tests/exploration_techniques/test_tech_builder.py +0 -61
- tests/exploration_techniques/test_tracer.py +0 -856
- tests/exploration_techniques/test_unique.py +0 -40
- tests/exploration_techniques/test_veritesting.py +0 -120
- tests/factory/__init__.py +0 -0
- tests/factory/block/__init__.py +0 -0
- tests/factory/block/test_block_cache.py +0 -33
- tests/factory/block/test_keystone.py +0 -106
- tests/factory/test_argc.py +0 -101
- tests/factory/test_argc_sym.py +0 -110
- tests/factory/test_argv.py +0 -158
- tests/factory/test_callable.py +0 -266
- tests/factory/test_windows_args.py +0 -36
- tests/knowledge_plugins/__init__.py +0 -0
- tests/knowledge_plugins/cfg/__init__.py +0 -0
- tests/knowledge_plugins/cfg/test_cfg_manager.py +0 -36
- tests/knowledge_plugins/functions/__init__.py +0 -0
- tests/knowledge_plugins/functions/test_function.py +0 -91
- tests/knowledge_plugins/functions/test_function2.py +0 -79
- tests/knowledge_plugins/functions/test_function_manager.py +0 -139
- tests/knowledge_plugins/functions/test_prototypes.py +0 -53
- tests/knowledge_plugins/key_definitions/__init__.py +0 -0
- tests/knowledge_plugins/key_definitions/test_atoms.py +0 -24
- tests/knowledge_plugins/key_definitions/test_environment.py +0 -126
- tests/knowledge_plugins/key_definitions/test_heap_address.py +0 -27
- tests/knowledge_plugins/key_definitions/test_live_definitions.py +0 -72
- tests/knowledge_plugins/test_dwarf_variables.py +0 -240
- tests/knowledge_plugins/test_kb_plugins.py +0 -91
- tests/knowledge_plugins/test_kb_plugins_dwarf.py +0 -36
- tests/knowledge_plugins/test_patches.py +0 -48
- tests/misc/__init__.py +0 -0
- tests/misc/test_hookset.py +0 -57
- tests/perf/__init__.py +0 -0
- tests/perf/perf_cfgemulated.py +0 -19
- tests/perf/perf_cfgfast.py +0 -18
- tests/perf/perf_concrete_execution.py +0 -41
- tests/perf/perf_siminspect_nop.py +0 -36
- tests/perf/perf_state_copy.py +0 -33
- tests/perf/perf_unicorn_0.py +0 -27
- tests/perf/perf_unicorn_1.py +0 -23
- tests/procedures/__init__.py +0 -0
- tests/procedures/glibc/__init__.py +0 -0
- tests/procedures/glibc/test_ctype_locale.py +0 -164
- tests/procedures/libc/__init__.py +0 -0
- tests/procedures/libc/test_fgets.py +0 -53
- tests/procedures/libc/test_scanf.py +0 -205
- tests/procedures/libc/test_sprintf.py +0 -44
- tests/procedures/libc/test_sscanf.py +0 -63
- tests/procedures/libc/test_strcasecmp.py +0 -37
- tests/procedures/libc/test_string.py +0 -1102
- tests/procedures/libc/test_strtol.py +0 -78
- tests/procedures/linux_kernel/__init__.py +0 -0
- tests/procedures/linux_kernel/test_lseek.py +0 -174
- tests/procedures/posix/__init__.py +0 -0
- tests/procedures/posix/test_chroot.py +0 -33
- tests/procedures/posix/test_getenv.py +0 -78
- tests/procedures/posix/test_pwrite_pread.py +0 -57
- tests/procedures/posix/test_sim_time.py +0 -46
- tests/procedures/posix/test_unlink.py +0 -46
- tests/procedures/test_project_resolve_simproc.py +0 -43
- tests/procedures/test_sim_procedure.py +0 -117
- tests/procedures/test_stub_procedure_args.py +0 -53
- tests/serialization/__init__.py +0 -0
- tests/serialization/test_db.py +0 -197
- tests/serialization/test_pickle.py +0 -95
- tests/serialization/test_serialization.py +0 -132
- tests/serialization/test_vault.py +0 -169
- tests/sim/__init__.py +0 -3
- tests/sim/exec_func/__init__.py +0 -0
- tests/sim/exec_func/test_mem_funcs.py +0 -55
- tests/sim/exec_func/test_str_funcs.py +0 -93
- tests/sim/exec_func/test_syscall_result.py +0 -39
- tests/sim/exec_insn/__init__.py +0 -0
- tests/sim/exec_insn/test_adc.py +0 -44
- tests/sim/exec_insn/test_ops.py +0 -83
- tests/sim/exec_insn/test_rcr.py +0 -26
- tests/sim/exec_insn/test_rol.py +0 -51
- tests/sim/exec_insn/test_signed_div.py +0 -34
- tests/sim/exec_insn/test_sqrt.py +0 -56
- tests/sim/options/__init__.py +0 -0
- tests/sim/options/test_0div.py +0 -54
- tests/sim/options/test_symbolic_fd.py +0 -59
- tests/sim/options/test_unsupported.py +0 -34
- tests/sim/test_accuracy.py +0 -137
- tests/sim/test_checkbyte.py +0 -53
- tests/sim/test_echo.py +0 -36
- tests/sim/test_fauxware.py +0 -202
- tests/sim/test_self_modifying_code.py +0 -65
- tests/sim/test_simple_api.py +0 -36
- tests/sim/test_simulation_manager.py +0 -147
- tests/sim/test_stack_alignment.py +0 -65
- tests/sim/test_state.py +0 -303
- tests/sim/test_state_customization.py +0 -54
- tests/sim/test_symbol_hooked_by.py +0 -49
- tests/simos/__init__.py +0 -0
- tests/simos/windows/__init__.py +0 -0
- tests/simos/windows/test_windows_stack_cookie.py +0 -58
- tests/state_plugins/__init__.py +0 -0
- tests/state_plugins/inspect/__init__.py +0 -0
- tests/state_plugins/inspect/test_inspect.py +0 -310
- tests/state_plugins/inspect/test_syscall_override.py +0 -90
- tests/state_plugins/posix/__init__.py +0 -0
- tests/state_plugins/posix/test_file_struct_funcs.py +0 -56
- tests/state_plugins/posix/test_files.py +0 -69
- tests/state_plugins/posix/test_posix.py +0 -72
- tests/state_plugins/solver/__init__.py +0 -0
- tests/state_plugins/solver/test_simsolver.py +0 -58
- tests/state_plugins/solver/test_symbolic.py +0 -153
- tests/state_plugins/solver/test_variable_registration.py +0 -46
- tests/state_plugins/test_callstack.py +0 -54
- tests/state_plugins/test_gdb_plugin.py +0 -35
- tests/state_plugins/test_multi_open_file.py +0 -47
- tests/state_plugins/test_symbolization.py +0 -38
- tests/storage/__init__.py +0 -0
- tests/storage/test_memory.py +0 -960
- tests/storage/test_memory_merge.py +0 -114
- tests/storage/test_memview.py +0 -205
- tests/storage/test_mmap.py +0 -26
- tests/storage/test_multivalues.py +0 -44
- tests/storage/test_permissions.py +0 -32
- tests/storage/test_ptmalloc.py +0 -291
- tests/storage/test_relro_perm.py +0 -49
- tests/test_calling_conventions.py +0 -86
- tests/test_types.py +0 -329
- tests/utils/__init__.py +0 -0
- tests/utils/test_graph.py +0 -41
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/LICENSE +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/WHEEL +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/entry_points.txt +0 -0
|
@@ -1,40 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests.exploration_techniques" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import os
|
|
5
|
-
import unittest
|
|
6
|
-
|
|
7
|
-
import angr
|
|
8
|
-
|
|
9
|
-
from ..common import bin_location
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
test_location = os.path.join(bin_location, "tests")
|
|
13
|
-
|
|
14
|
-
find = {"veritesting_a": {"x86_64": 0x40066A}}
|
|
15
|
-
|
|
16
|
-
criteria = {"veritesting_a": lambda input_found: input_found.count(b"B") == 10}
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
class TestRunUnique(unittest.TestCase):
|
|
20
|
-
def _run_unique(self, binary, arch):
|
|
21
|
-
proj = angr.Project(os.path.join(test_location, arch, binary), auto_load_libs=False)
|
|
22
|
-
simgr = proj.factory.simulation_manager()
|
|
23
|
-
technique = angr.exploration_techniques.UniqueSearch()
|
|
24
|
-
simgr.use_technique(technique)
|
|
25
|
-
|
|
26
|
-
def found(simgr):
|
|
27
|
-
return simgr.active[0].addr == find[binary][arch]
|
|
28
|
-
|
|
29
|
-
simgr.run(until=found)
|
|
30
|
-
assert simgr.active[0].addr == find[binary][arch]
|
|
31
|
-
|
|
32
|
-
input_found = simgr.active[0].posix.dumps(0)
|
|
33
|
-
assert criteria[binary](input_found)
|
|
34
|
-
|
|
35
|
-
def test_unique(self):
|
|
36
|
-
self._run_unique("veritesting_a", "x86_64")
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
if __name__ == "__main__":
|
|
40
|
-
unittest.main()
|
|
@@ -1,120 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests.exploration_techniques" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import os
|
|
5
|
-
import unittest
|
|
6
|
-
import logging
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
import claripy
|
|
10
|
-
|
|
11
|
-
from ..common import bin_location
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
test_location = os.path.join(bin_location, "tests")
|
|
15
|
-
|
|
16
|
-
l = logging.getLogger("angr_tests.veritesting")
|
|
17
|
-
|
|
18
|
-
addresses_veritesting_a = {"x86_64": 0x400674}
|
|
19
|
-
addresses_veritesting_b = {"x86_64": 0x4006AF}
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
class TestVeritesting(unittest.TestCase):
|
|
23
|
-
def _run_veritesting_a(self, arch):
|
|
24
|
-
# TODO: Added timeout control, since a failed state merging will result in running for a long time
|
|
25
|
-
|
|
26
|
-
# logging.getLogger('angr.analyses.sse').setLevel(logging.DEBUG)
|
|
27
|
-
|
|
28
|
-
proj = angr.Project(
|
|
29
|
-
os.path.join(test_location, arch, "veritesting_a"),
|
|
30
|
-
load_options={"auto_load_libs": False},
|
|
31
|
-
use_sim_procedures=True,
|
|
32
|
-
)
|
|
33
|
-
ex = proj.factory.simulation_manager(veritesting=True)
|
|
34
|
-
ex.explore(find=addresses_veritesting_a[arch])
|
|
35
|
-
assert len(ex.found) != 0
|
|
36
|
-
|
|
37
|
-
# Make sure the input makes sense
|
|
38
|
-
for f in ex.found:
|
|
39
|
-
input_str = f.plugins["posix"].dumps(0)
|
|
40
|
-
assert input_str.count(b"B") == 10
|
|
41
|
-
|
|
42
|
-
# make sure the solution is actually found by veritesting
|
|
43
|
-
assert len(ex.found) == 1
|
|
44
|
-
state = ex.found[0]
|
|
45
|
-
for var in state.solver._solver.variables:
|
|
46
|
-
assert "state_merge" not in var
|
|
47
|
-
|
|
48
|
-
def _run_veritesting_b(self, arch):
|
|
49
|
-
# logging.getLogger('angr.analyses.sse').setLevel(logging.DEBUG)
|
|
50
|
-
|
|
51
|
-
proj = angr.Project(
|
|
52
|
-
os.path.join(test_location, arch, "veritesting_b"),
|
|
53
|
-
load_options={"auto_load_libs": False},
|
|
54
|
-
use_sim_procedures=True,
|
|
55
|
-
)
|
|
56
|
-
ex = proj.factory.simulation_manager()
|
|
57
|
-
ex.use_technique(angr.exploration_techniques.Veritesting(enable_function_inlining=True))
|
|
58
|
-
ex.explore(find=addresses_veritesting_b[arch])
|
|
59
|
-
assert len(ex.found) != 0
|
|
60
|
-
|
|
61
|
-
# Make sure the input makes sense
|
|
62
|
-
for f in ex.found:
|
|
63
|
-
input_str = f.plugins["posix"].dumps(0)
|
|
64
|
-
assert input_str.count(b"B") == 35
|
|
65
|
-
|
|
66
|
-
# make sure the solution is actually found by veritesting
|
|
67
|
-
assert len(ex.found) == 1
|
|
68
|
-
state = ex.found[0]
|
|
69
|
-
for var in state.solver._solver.variables:
|
|
70
|
-
assert "state_merge" not in var
|
|
71
|
-
|
|
72
|
-
def _run_veritesting_skm(self, arch):
|
|
73
|
-
proj = angr.Project(os.path.join(test_location, arch, "veritesting_skm"))
|
|
74
|
-
|
|
75
|
-
# start the analysis after the call to lexer_read_line
|
|
76
|
-
state = proj.factory.blank_state(addr=0x4024AE, remove_options={angr.sim_options.UNICORN})
|
|
77
|
-
|
|
78
|
-
# set up the structures for the user_input
|
|
79
|
-
byte = claripy.BVS("user_byte", 8) # Symbolic variable for user_input
|
|
80
|
-
SPACE = claripy.Or((byte == 32), (byte == 9))
|
|
81
|
-
NUM = claripy.And(byte >= 48, byte <= 57)
|
|
82
|
-
NL = byte == 10
|
|
83
|
-
MULOP = claripy.Or(byte == 42, byte == 47)
|
|
84
|
-
ADDOP = claripy.Or(byte == 43, byte == 45)
|
|
85
|
-
constraint = claripy.Or(NUM, ADDOP, MULOP, NL, SPACE)
|
|
86
|
-
state.add_constraints(constraint)
|
|
87
|
-
|
|
88
|
-
# set up memory
|
|
89
|
-
LINEPTR = 0xCAFEBABE # fake addr
|
|
90
|
-
state.memory.store(LINEPTR, byte)
|
|
91
|
-
state.memory.store(LINEPTR + 1, 0) # NULL term the string!
|
|
92
|
-
|
|
93
|
-
# stack
|
|
94
|
-
state.regs.rax = LINEPTR
|
|
95
|
-
state.regs.rbp = 0xDEADBEEF # STACK
|
|
96
|
-
state.regs.rdi = LINEPTR # 64 bit Intel calling convention - RDI gets arg0
|
|
97
|
-
|
|
98
|
-
simgr = proj.factory.simgr(state, veritesting=True)
|
|
99
|
-
is_successful = 0x402517
|
|
100
|
-
should_abort = 0x402521
|
|
101
|
-
simgr.explore(find=is_successful, avoid=should_abort)
|
|
102
|
-
assert simgr.found
|
|
103
|
-
|
|
104
|
-
def test_veritesting_a(self):
|
|
105
|
-
# This is the most basic test
|
|
106
|
-
self._run_veritesting_a("x86_64")
|
|
107
|
-
|
|
108
|
-
def test_veritesting_b(self):
|
|
109
|
-
# Advanced stuff - it tests for the ability to inline simple functions
|
|
110
|
-
# as well as simple syscalls like read/write
|
|
111
|
-
self._run_veritesting_b("x86_64")
|
|
112
|
-
|
|
113
|
-
def test_veritesting_skm(self):
|
|
114
|
-
# More advanced stuff, this binary will do double state merging,
|
|
115
|
-
# which requires merged states to be correct
|
|
116
|
-
self._run_veritesting_skm("x86_64")
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
if __name__ == "__main__":
|
|
120
|
-
unittest.main()
|
tests/factory/__init__.py
DELETED
|
File without changes
|
tests/factory/block/__init__.py
DELETED
|
File without changes
|
|
@@ -1,33 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests.factory.block" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import logging
|
|
5
|
-
import unittest
|
|
6
|
-
import os
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ...common import bin_location
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
test_location = os.path.join(bin_location, "tests")
|
|
14
|
-
l = logging.getLogger("angr.tests")
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
# pylint: disable=missing-class-docstring
|
|
18
|
-
# pylint: disable=no-self-use
|
|
19
|
-
class TestBlockCache(unittest.TestCase):
|
|
20
|
-
def test_block_cache(self):
|
|
21
|
-
p = angr.Project(
|
|
22
|
-
os.path.join(test_location, "x86_64", "fauxware"), translation_cache=True, auto_load_libs=False
|
|
23
|
-
)
|
|
24
|
-
b = p.factory.block(p.entry)
|
|
25
|
-
assert p.factory.block(p.entry).vex is b.vex
|
|
26
|
-
|
|
27
|
-
p = angr.Project(os.path.join(test_location, "x86_64", "fauxware"), translation_cache=False)
|
|
28
|
-
b = p.factory.block(p.entry)
|
|
29
|
-
assert p.factory.block(p.entry).vex is not b.vex
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
if __name__ == "__main__":
|
|
33
|
-
unittest.main()
|
|
@@ -1,106 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests.factory.block" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import os
|
|
5
|
-
import logging
|
|
6
|
-
import sys
|
|
7
|
-
import unittest
|
|
8
|
-
|
|
9
|
-
import angr
|
|
10
|
-
|
|
11
|
-
from ...common import bin_location
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
test_location = os.path.join(bin_location, "tests")
|
|
15
|
-
l = logging.getLogger("angr.tests")
|
|
16
|
-
|
|
17
|
-
insn_texts = {
|
|
18
|
-
"i386": b"add eax, 0xf",
|
|
19
|
-
"x86_64": b"add rax, 0xf",
|
|
20
|
-
"ppc": b"addi %r1, %r1, 0xf",
|
|
21
|
-
"armel": b"add r1, r1, 0xf",
|
|
22
|
-
"armel_thumb": b"add.w r1, r1, #0xf",
|
|
23
|
-
"mips": b"addi $1, $1, 0xf",
|
|
24
|
-
}
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
class TestKeyStone(unittest.TestCase):
|
|
28
|
-
def _run_keystone(self, arch):
|
|
29
|
-
proj_arch = arch
|
|
30
|
-
is_thumb = False
|
|
31
|
-
if arch == "armel_thumb":
|
|
32
|
-
is_thumb = True
|
|
33
|
-
proj_arch = "armel"
|
|
34
|
-
p = angr.Project(os.path.join(test_location, proj_arch, "fauxware"), auto_load_libs=False)
|
|
35
|
-
addr = p.loader.main_object.get_symbol("authenticate").rebased_addr
|
|
36
|
-
|
|
37
|
-
sm = p.factory.simulation_manager()
|
|
38
|
-
if arch in ["i386", "x86_64"]:
|
|
39
|
-
sm.one_active.regs.eax = 3
|
|
40
|
-
else:
|
|
41
|
-
sm.one_active.regs.r1 = 3
|
|
42
|
-
|
|
43
|
-
if is_thumb:
|
|
44
|
-
addr |= 1
|
|
45
|
-
block = p.factory.block(addr, insn_text=insn_texts[arch], thumb=is_thumb).vex
|
|
46
|
-
|
|
47
|
-
assert block.instructions == 1
|
|
48
|
-
|
|
49
|
-
sm.step(force_addr=addr, insn_text=insn_texts[arch], thumb=is_thumb)
|
|
50
|
-
|
|
51
|
-
if arch in ["i386", "x86_64"]:
|
|
52
|
-
assert sm.one_active.solver.eval(sm.one_active.regs.eax) == 0x12
|
|
53
|
-
else:
|
|
54
|
-
assert sm.one_active.solver.eval(sm.one_active.regs.r1) == 0x12
|
|
55
|
-
|
|
56
|
-
def test_i386(self):
|
|
57
|
-
# Installing keystone on Windows is currently a pain. Fix the installation first (may it pip installable) before
|
|
58
|
-
# re-enabling this test on Windows.
|
|
59
|
-
if not sys.platform.startswith("linux"):
|
|
60
|
-
return
|
|
61
|
-
|
|
62
|
-
self._run_keystone("i386")
|
|
63
|
-
|
|
64
|
-
def test_x86_64(self):
|
|
65
|
-
# Installing keystone on Windows is currently a pain. Fix the installation first (may it pip installable) before
|
|
66
|
-
# re-enabling this test on Windows.
|
|
67
|
-
if not sys.platform.startswith("linux"):
|
|
68
|
-
return
|
|
69
|
-
|
|
70
|
-
self._run_keystone("x86_64")
|
|
71
|
-
|
|
72
|
-
def test_ppc(self):
|
|
73
|
-
# Installing keystone on Windows is currently a pain. Fix the installation first (may it pip installable) before
|
|
74
|
-
# re-enabling this test on Windows.
|
|
75
|
-
if not sys.platform.startswith("linux"):
|
|
76
|
-
return
|
|
77
|
-
|
|
78
|
-
self._run_keystone("ppc")
|
|
79
|
-
|
|
80
|
-
def test_armel(self):
|
|
81
|
-
# Installing keystone on Windows is currently a pain. Fix the installation first (may it pip installable) before
|
|
82
|
-
# re-enabling this test on Windows.
|
|
83
|
-
if not sys.platform.startswith("linux"):
|
|
84
|
-
return
|
|
85
|
-
|
|
86
|
-
self._run_keystone("armel")
|
|
87
|
-
|
|
88
|
-
def test_armel_thumb(self):
|
|
89
|
-
# Installing keystone on Windows is currently a pain. Fix the installation first (may it pip installable) before
|
|
90
|
-
# re-enabling this test on Windows.
|
|
91
|
-
if not sys.platform.startswith("linux"):
|
|
92
|
-
return
|
|
93
|
-
|
|
94
|
-
self._run_keystone("armel_thumb")
|
|
95
|
-
|
|
96
|
-
def test_mips(self):
|
|
97
|
-
# Installing keystone on Windows is currently a pain. Fix the installation first (may it pip installable) before
|
|
98
|
-
# re-enabling this test on Windows.
|
|
99
|
-
if not sys.platform.startswith("linux"):
|
|
100
|
-
return
|
|
101
|
-
|
|
102
|
-
self._run_keystone("mips")
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
if __name__ == "__main__":
|
|
106
|
-
unittest.main()
|
tests/factory/test_argc.py
DELETED
|
@@ -1,101 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests.factory" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import os
|
|
5
|
-
import unittest
|
|
6
|
-
|
|
7
|
-
import angr
|
|
8
|
-
|
|
9
|
-
from ..common import bin_location
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
test_location = os.path.join(bin_location, "tests")
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
# pylint: disable=missing-class-docstring
|
|
16
|
-
# pylint: disable=no-self-use
|
|
17
|
-
class TestArgc(unittest.TestCase):
|
|
18
|
-
def test_mips(self):
|
|
19
|
-
proj = angr.Project(os.path.join(test_location, "mips", "argc_decide"), auto_load_libs=False)
|
|
20
|
-
r_addr = 0x4006F4
|
|
21
|
-
|
|
22
|
-
s = proj.factory.entry_state(args=["aaa"], env={"HOME": "/home/angr"})
|
|
23
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
24
|
-
|
|
25
|
-
assert len(xpl.found) == 1
|
|
26
|
-
|
|
27
|
-
s = proj.factory.entry_state(args=["aaa", "bbb"], env={"HOME": "/home/angr"})
|
|
28
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
29
|
-
|
|
30
|
-
assert len(xpl.found) == 0
|
|
31
|
-
|
|
32
|
-
def test_mipsel(self):
|
|
33
|
-
proj = angr.Project(os.path.join(test_location, "mipsel", "argc_decide"), auto_load_libs=False)
|
|
34
|
-
r_addr = 0x400708
|
|
35
|
-
s = proj.factory.entry_state(args=["aaa", "bbb"], env={"HOME": "/home/angr"})
|
|
36
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
37
|
-
|
|
38
|
-
assert len(xpl.found) == 1
|
|
39
|
-
|
|
40
|
-
s = proj.factory.entry_state(args=["aaa"], env={"HOME": "/home/angr"})
|
|
41
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
42
|
-
|
|
43
|
-
assert len(xpl.found) == 0
|
|
44
|
-
|
|
45
|
-
def test_i386(self):
|
|
46
|
-
proj = angr.Project(os.path.join(test_location, "i386", "argc_decide"), auto_load_libs=False)
|
|
47
|
-
r_addr = 0x80483D4
|
|
48
|
-
s = proj.factory.entry_state(args=["aaa"], env={"HOME": "/home/angr"})
|
|
49
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
50
|
-
|
|
51
|
-
assert len(xpl.found) == 1
|
|
52
|
-
|
|
53
|
-
s = proj.factory.entry_state(args=["aaa", "bbb"], env={"HOME": "/home/angr"})
|
|
54
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
55
|
-
|
|
56
|
-
assert len(xpl.found) == 0
|
|
57
|
-
|
|
58
|
-
def test_amd64(self):
|
|
59
|
-
proj = angr.Project(os.path.join(test_location, "x86_64", "argc_decide"), auto_load_libs=False)
|
|
60
|
-
r_addr = 0x4004C7
|
|
61
|
-
s = proj.factory.entry_state(args=["aaa"], env={"HOME": "/home/angr"})
|
|
62
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
63
|
-
|
|
64
|
-
assert len(xpl.found) == 1
|
|
65
|
-
|
|
66
|
-
s = proj.factory.entry_state(args=["aaa", "bbb"], env={"HOME": "/home/angr"})
|
|
67
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
68
|
-
|
|
69
|
-
assert len(xpl.found) == 0
|
|
70
|
-
|
|
71
|
-
def test_arm(self):
|
|
72
|
-
proj = angr.Project(os.path.join(test_location, "armel", "argc_decide"), auto_load_libs=False)
|
|
73
|
-
r_addr = 0x1040C
|
|
74
|
-
|
|
75
|
-
s = proj.factory.entry_state(args=["aaa"], env={"HOME": "/home/angr"})
|
|
76
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
77
|
-
|
|
78
|
-
assert len(xpl.found) == 1
|
|
79
|
-
|
|
80
|
-
s = proj.factory.entry_state(args=["aaa", "bbb"], env={"HOME": "/home/angr"})
|
|
81
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
82
|
-
|
|
83
|
-
assert len(xpl.found) == 0
|
|
84
|
-
|
|
85
|
-
def test_ppc32(self):
|
|
86
|
-
proj = angr.Project(os.path.join(test_location, "ppc", "argc_decide"), auto_load_libs=False)
|
|
87
|
-
r_addr = 0x10000404
|
|
88
|
-
|
|
89
|
-
s = proj.factory.entry_state(args=["aaa"], env={"HOME": "/home/angr"})
|
|
90
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
91
|
-
|
|
92
|
-
assert len(xpl.found) == 1
|
|
93
|
-
|
|
94
|
-
s = proj.factory.entry_state(args=["aaa", "bbb"], env={"HOME": "/home/angr"})
|
|
95
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
96
|
-
|
|
97
|
-
assert len(xpl.found) == 0
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
if __name__ == "__main__":
|
|
101
|
-
unittest.main()
|
tests/factory/test_argc_sym.py
DELETED
|
@@ -1,110 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests.factory" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import os
|
|
5
|
-
import unittest
|
|
6
|
-
|
|
7
|
-
import claripy
|
|
8
|
-
|
|
9
|
-
import angr
|
|
10
|
-
|
|
11
|
-
from ..common import bin_location
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
test_location = os.path.join(bin_location, "tests")
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
# pylint: disable=missing-class-docstring
|
|
18
|
-
# pylint: disable=no-self-use
|
|
19
|
-
class TestArgcSym(unittest.TestCase):
|
|
20
|
-
def _verify_results(self, pg, sargc, length=400):
|
|
21
|
-
argcs = pg.mp_found.solver.eval(sargc)
|
|
22
|
-
strs = pg.mp_found.solver.eval(pg.mp_found.memory.load(pg.mp_found.regs.sp, length), cast_to=bytes)
|
|
23
|
-
|
|
24
|
-
for a, s in zip(argcs.mp_items, strs.mp_items):
|
|
25
|
-
assert a in (0, 1, 2)
|
|
26
|
-
assert b"Good man" in s if a == 1 else b"Very Good man" if a == 2 else True
|
|
27
|
-
|
|
28
|
-
def test_mips(self):
|
|
29
|
-
arger_mips = angr.Project(os.path.join(test_location, "mips", "argc_symbol"), auto_load_libs=False)
|
|
30
|
-
r_addr = [0x400720, 0x40076C, 0x4007BC]
|
|
31
|
-
|
|
32
|
-
sargc = claripy.BVS("argc", 32)
|
|
33
|
-
s = arger_mips.factory.entry_state(
|
|
34
|
-
args=[claripy.BVS("arg_0", 40 * 8), claripy.BVS("arg_1", 40 * 8), claripy.BVS("arg_2", 40 * 8)],
|
|
35
|
-
env={"HOME": "/home/angr"},
|
|
36
|
-
argc=sargc,
|
|
37
|
-
)
|
|
38
|
-
pg = arger_mips.factory.simulation_manager(s).explore(find=r_addr, num_find=100)
|
|
39
|
-
self._verify_results(pg, sargc)
|
|
40
|
-
|
|
41
|
-
def test_mipsel(self):
|
|
42
|
-
arger_mipsel = angr.Project(os.path.join(test_location, "mipsel", "argc_symbol"), auto_load_libs=False)
|
|
43
|
-
r_addr = [0x400720, 0x40076C, 0x4007BC]
|
|
44
|
-
|
|
45
|
-
sargc = claripy.BVS("argc", 32)
|
|
46
|
-
s = arger_mipsel.factory.entry_state(
|
|
47
|
-
args=[claripy.BVS("arg_0", 40 * 8), claripy.BVS("arg_1", 40 * 8), claripy.BVS("arg_2", 40 * 8)],
|
|
48
|
-
env={"HOME": "/home/angr"},
|
|
49
|
-
argc=sargc,
|
|
50
|
-
)
|
|
51
|
-
pg = arger_mipsel.factory.simulation_manager(s).explore(find=r_addr, num_find=100)
|
|
52
|
-
self._verify_results(pg, sargc)
|
|
53
|
-
|
|
54
|
-
def test_i386(self):
|
|
55
|
-
arger_i386 = angr.Project(os.path.join(test_location, "i386", "argc_symbol"), auto_load_libs=False)
|
|
56
|
-
r_addr = [0x08048411, 0x08048437, 0x08048460]
|
|
57
|
-
|
|
58
|
-
sargc = claripy.BVS("argc", 32)
|
|
59
|
-
s = arger_i386.factory.entry_state(
|
|
60
|
-
args=[claripy.BVS("arg_0", 40 * 8), claripy.BVS("arg_1", 40 * 8), claripy.BVS("arg_2", 40 * 8)],
|
|
61
|
-
env={"HOME": "/home/angr"},
|
|
62
|
-
argc=sargc,
|
|
63
|
-
)
|
|
64
|
-
pg = arger_i386.factory.simulation_manager(s).explore(find=r_addr, num_find=100)
|
|
65
|
-
self._verify_results(pg, sargc)
|
|
66
|
-
|
|
67
|
-
def test_amd64(self):
|
|
68
|
-
arger_amd64 = angr.Project(
|
|
69
|
-
os.path.join(test_location, "x86_64", "argc_symbol"), load_options={"auto_load_libs": False}
|
|
70
|
-
)
|
|
71
|
-
r_addr = [0x40051B, 0x400540, 0x400569]
|
|
72
|
-
|
|
73
|
-
sargc = claripy.BVS("argc", 64)
|
|
74
|
-
s = arger_amd64.factory.entry_state(
|
|
75
|
-
args=[claripy.BVS("arg_0", 40 * 8), claripy.BVS("arg_1", 40 * 8), claripy.BVS("arg_2", 40 * 8)],
|
|
76
|
-
env={"HOME": "/home/angr"},
|
|
77
|
-
argc=sargc,
|
|
78
|
-
)
|
|
79
|
-
pg = arger_amd64.factory.simulation_manager(s).explore(find=r_addr, num_find=100)
|
|
80
|
-
self._verify_results(pg, sargc, length=800)
|
|
81
|
-
|
|
82
|
-
def test_arm(self):
|
|
83
|
-
arger_arm = angr.Project(os.path.join(test_location, "armel", "argc_symbol"), auto_load_libs=False)
|
|
84
|
-
r_addr = [0x00010444, 0x00010478, 0x000104B0]
|
|
85
|
-
|
|
86
|
-
sargc = claripy.BVS("argc", 32)
|
|
87
|
-
s = arger_arm.factory.entry_state(
|
|
88
|
-
args=[claripy.BVS("arg_0", 40 * 8), claripy.BVS("arg_1", 40 * 8), claripy.BVS("arg_2", 40 * 8)],
|
|
89
|
-
env={"HOME": "/home/angr"},
|
|
90
|
-
argc=sargc,
|
|
91
|
-
)
|
|
92
|
-
pg = arger_arm.factory.simulation_manager(s).explore(find=r_addr, num_find=100)
|
|
93
|
-
self._verify_results(pg, sargc)
|
|
94
|
-
|
|
95
|
-
def test_ppc32(self):
|
|
96
|
-
arger_ppc32 = angr.Project(os.path.join(test_location, "ppc", "argc_symbol"), auto_load_libs=False)
|
|
97
|
-
r_addr = [0x1000043C, 0x10000474, 0x100004B0]
|
|
98
|
-
|
|
99
|
-
sargc = claripy.BVS("argc", 32)
|
|
100
|
-
s = arger_ppc32.factory.entry_state(
|
|
101
|
-
args=[claripy.BVS("arg_0", 40 * 8), claripy.BVS("arg_1", 40 * 8), claripy.BVS("arg_2", 40 * 8)],
|
|
102
|
-
env={"HOME": "/home/angr"},
|
|
103
|
-
argc=sargc,
|
|
104
|
-
)
|
|
105
|
-
pg = arger_ppc32.factory.simulation_manager(s).explore(find=r_addr, num_find=100)
|
|
106
|
-
self._verify_results(pg, sargc)
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
if __name__ == "__main__":
|
|
110
|
-
unittest.main()
|
tests/factory/test_argv.py
DELETED
|
@@ -1,158 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests.factory" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import os
|
|
5
|
-
import unittest
|
|
6
|
-
|
|
7
|
-
import claripy
|
|
8
|
-
|
|
9
|
-
import angr
|
|
10
|
-
|
|
11
|
-
from ..common import bin_location
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
test_location = os.path.join(bin_location, "tests")
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
# pylint: disable=missing-class-docstring
|
|
18
|
-
# pylint: disable=no-self-use
|
|
19
|
-
class TestArgv(unittest.TestCase):
|
|
20
|
-
def test_mips(self):
|
|
21
|
-
proj = angr.Project(os.path.join(test_location, "mips", "argv_test"), auto_load_libs=False)
|
|
22
|
-
r_addr = 0x400768
|
|
23
|
-
|
|
24
|
-
s = proj.factory.entry_state(args=["aaa", "Yan is a noob"], env={"HOME": "/home/angr"})
|
|
25
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
26
|
-
|
|
27
|
-
assert len(xpl.found) == 1
|
|
28
|
-
|
|
29
|
-
s = proj.factory.entry_state(args=["aaa", "Yan is not a noob"], env={"HOME": "/home/angr"})
|
|
30
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
31
|
-
|
|
32
|
-
assert len(xpl.found) == 0
|
|
33
|
-
|
|
34
|
-
# symbolic command line argument
|
|
35
|
-
arg = claripy.BVS("arg_2", 50 * 8)
|
|
36
|
-
s = proj.factory.entry_state(args=["aaa", arg], env={"HOME": "/home/angr"})
|
|
37
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
38
|
-
|
|
39
|
-
found = xpl.found[0]
|
|
40
|
-
conc = found.solver.eval(found.memory.load(found.registers.load("sp"), 400), cast_to=bytes)
|
|
41
|
-
|
|
42
|
-
assert b"Yan is a noob" in conc
|
|
43
|
-
|
|
44
|
-
def test_mipsel(self):
|
|
45
|
-
proj = angr.Project(os.path.join(test_location, "mipsel", "argv_test"), auto_load_libs=False)
|
|
46
|
-
r_addr = 0x400768
|
|
47
|
-
s = proj.factory.entry_state(args=["aaa", "Yan is a noob"], env={"HOME": "/home/angr"})
|
|
48
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
49
|
-
|
|
50
|
-
assert len(xpl.found) == 1
|
|
51
|
-
|
|
52
|
-
s = proj.factory.entry_state(args=["aaa", "Yan is not a noob"], env={"HOME": "/home/angr"})
|
|
53
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
54
|
-
|
|
55
|
-
assert len(xpl.found) == 0
|
|
56
|
-
|
|
57
|
-
# symbolic args
|
|
58
|
-
s = proj.factory.entry_state(args=["aaa", claripy.BVS("arg_2", 50 * 8)], env={"HOME": "/home/angr"})
|
|
59
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
60
|
-
|
|
61
|
-
found = xpl.found[0]
|
|
62
|
-
conc = found.solver.eval(found.memory.load(found.registers.load("sp"), 400), cast_to=bytes)
|
|
63
|
-
|
|
64
|
-
assert b"Yan is a noob" in conc
|
|
65
|
-
|
|
66
|
-
def test_i386(self):
|
|
67
|
-
proj = angr.Project(os.path.join(test_location, "i386", "argv_test"), auto_load_libs=False)
|
|
68
|
-
r_addr = 0x804845B
|
|
69
|
-
s = proj.factory.entry_state(args=["aaa", "Yan is a noob"], env={"HOME": "/home/angr"})
|
|
70
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
71
|
-
|
|
72
|
-
assert len(xpl.found) == 1
|
|
73
|
-
|
|
74
|
-
s = proj.factory.entry_state(args=["aaa", "Yan is not a noob"], env={"HOME": "/home/angr"})
|
|
75
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
76
|
-
|
|
77
|
-
assert len(xpl.found) == 0
|
|
78
|
-
|
|
79
|
-
# symbolic args
|
|
80
|
-
s = proj.factory.entry_state(args=["aaa", claripy.BVS("arg_2", 50 * 8)], env={"HOME": "/home/angr"})
|
|
81
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
82
|
-
|
|
83
|
-
found = xpl.found[0]
|
|
84
|
-
conc = found.solver.eval(found.memory.load(found.registers.load("sp"), 400), cast_to=bytes)
|
|
85
|
-
|
|
86
|
-
assert b"Yan is a noob" in conc
|
|
87
|
-
|
|
88
|
-
def test_amd64(self):
|
|
89
|
-
proj = angr.Project(os.path.join(test_location, "x86_64", "argv_test"), auto_load_libs=False)
|
|
90
|
-
r_addr = 0x400571
|
|
91
|
-
s = proj.factory.entry_state(args=["aaa", "Yan is a noob"], env={"HOME": "/home/angr"})
|
|
92
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
93
|
-
|
|
94
|
-
assert len(xpl.found) == 1
|
|
95
|
-
|
|
96
|
-
s = proj.factory.entry_state(args=["aaa", "Yan is not a noob"], env={"HOME": "/home/angr"})
|
|
97
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
98
|
-
|
|
99
|
-
assert len(xpl.found) == 0
|
|
100
|
-
|
|
101
|
-
# symbolic args
|
|
102
|
-
s = proj.factory.entry_state(args=["aaa", claripy.BVS("arg_2", 50 * 8)], env={"HOME": "/home/angr"})
|
|
103
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
104
|
-
|
|
105
|
-
found = xpl.found[0]
|
|
106
|
-
conc = found.solver.eval(found.memory.load(found.registers.load("sp"), 400), cast_to=bytes)
|
|
107
|
-
|
|
108
|
-
assert b"Yan is a noob" in conc
|
|
109
|
-
|
|
110
|
-
def test_arm(self):
|
|
111
|
-
proj = angr.Project(os.path.join(test_location, "armel", "argv_test"), auto_load_libs=False)
|
|
112
|
-
r_addr = 0x1048C
|
|
113
|
-
|
|
114
|
-
s = proj.factory.entry_state(args=["aaa", "Yan is a noob"], env={"HOME": "/home/angr"})
|
|
115
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
116
|
-
|
|
117
|
-
assert len(xpl.found) == 1
|
|
118
|
-
|
|
119
|
-
s = proj.factory.entry_state(args=["aaa", "Yan is not a noob"], env={"HOME": "/home/angr"})
|
|
120
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
121
|
-
|
|
122
|
-
assert len(xpl.found) == 0
|
|
123
|
-
|
|
124
|
-
# symbolic args
|
|
125
|
-
s = proj.factory.entry_state(args=["aaa", claripy.BVS("arg_2", 50 * 8)], env={"HOME": "/home/angr"})
|
|
126
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
127
|
-
|
|
128
|
-
found = xpl.found[0]
|
|
129
|
-
conc = found.solver.eval(found.memory.load(found.registers.load("sp"), 400), cast_to=bytes)
|
|
130
|
-
|
|
131
|
-
assert b"Yan is a noob" in conc
|
|
132
|
-
|
|
133
|
-
def test_ppc32(self):
|
|
134
|
-
proj = angr.Project(os.path.join(test_location, "ppc", "argv_test"), auto_load_libs=False)
|
|
135
|
-
r_addr = 0x10000498
|
|
136
|
-
|
|
137
|
-
s = proj.factory.entry_state(args=["aaa", "Yan is a noob"], env={"HOME": "/home/angr"})
|
|
138
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
139
|
-
|
|
140
|
-
assert len(xpl.found) == 1
|
|
141
|
-
|
|
142
|
-
s = proj.factory.entry_state(args=["aaa", "Yan is not a noob"], env={"HOME": "/home/angr"})
|
|
143
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
144
|
-
|
|
145
|
-
assert len(xpl.found) == 0
|
|
146
|
-
|
|
147
|
-
# symbolic args
|
|
148
|
-
s = proj.factory.entry_state(args=["aaa", claripy.BVS("arg_2", 50 * 8)], env={"HOME": "/home/angr"})
|
|
149
|
-
xpl = proj.factory.simulation_manager(s).explore(find=r_addr)
|
|
150
|
-
|
|
151
|
-
found = xpl.found[0]
|
|
152
|
-
conc = found.solver.eval(found.memory.load(found.registers.load("sp"), 400), cast_to=bytes)
|
|
153
|
-
|
|
154
|
-
assert b"Yan is a noob" in conc
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
if __name__ == "__main__":
|
|
158
|
-
unittest.main()
|