angr 9.2.87__py3-none-manylinux2014_x86_64.whl → 9.2.89__py3-none-manylinux2014_x86_64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +4 -1
- angr/analyses/decompiler/clinic.py +16 -0
- angr/analyses/decompiler/decompiler.py +3 -0
- angr/analyses/decompiler/optimization_passes/__init__.py +5 -0
- angr/analyses/decompiler/optimization_passes/cross_jump_reverter.py +108 -0
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +17 -4
- angr/analyses/decompiler/optimization_passes/return_duplicator.py +4 -32
- angr/analyses/decompiler/structured_codegen/c.py +12 -2
- angr/analyses/decompiler/utils.py +13 -0
- angr/analyses/typehoon/dfa.py +108 -0
- angr/analyses/typehoon/lifter.py +34 -2
- angr/analyses/typehoon/simple_solver.py +1043 -503
- angr/analyses/typehoon/translator.py +13 -4
- angr/analyses/typehoon/typeconsts.py +117 -36
- angr/analyses/typehoon/typehoon.py +31 -11
- angr/analyses/typehoon/typevars.py +88 -21
- angr/analyses/typehoon/variance.py +10 -0
- angr/analyses/variable_recovery/engine_ail.py +28 -9
- angr/analyses/variable_recovery/engine_base.py +50 -43
- angr/analyses/variable_recovery/variable_recovery_base.py +16 -3
- angr/analyses/variable_recovery/variable_recovery_fast.py +14 -5
- angr/exploration_techniques/tracer.py +2 -0
- angr/misc/autoimport.py +26 -0
- angr/procedures/definitions/__init__.py +32 -3
- angr/utils/constants.py +1 -0
- angr/utils/graph.py +20 -1
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/METADATA +7 -6
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/RECORD +32 -244
- angr-9.2.89.dist-info/top_level.txt +1 -0
- angr/procedures/definitions/ntdll.py +0 -12
- angr-9.2.87.dist-info/top_level.txt +0 -2
- tests/__init__.py +0 -0
- tests/analyses/__init__.py +0 -0
- tests/analyses/cfg/__init__.py +0 -0
- tests/analyses/cfg/test_cfg_clflush.py +0 -43
- tests/analyses/cfg/test_cfg_get_any_node.py +0 -34
- tests/analyses/cfg/test_cfg_manager.py +0 -32
- tests/analyses/cfg/test_cfg_model.py +0 -55
- tests/analyses/cfg/test_cfg_patching.py +0 -378
- tests/analyses/cfg/test_cfg_rust_got_resolution.py +0 -36
- tests/analyses/cfg/test_cfg_thumb_firmware.py +0 -50
- tests/analyses/cfg/test_cfg_vex_postprocessor.py +0 -27
- tests/analyses/cfg/test_cfgemulated.py +0 -634
- tests/analyses/cfg/test_cfgfast.py +0 -1123
- tests/analyses/cfg/test_cfgfast_soot.py +0 -38
- tests/analyses/cfg/test_const_resolver.py +0 -38
- tests/analyses/cfg/test_iat_resolver.py +0 -37
- tests/analyses/cfg/test_jumptables.py +0 -3008
- tests/analyses/cfg/test_noop_blocks.py +0 -54
- tests/analyses/cfg_slice_to_sink/__init__.py +0 -0
- tests/analyses/cfg_slice_to_sink/test_cfg_slice_to_sink.py +0 -93
- tests/analyses/cfg_slice_to_sink/test_graph.py +0 -114
- tests/analyses/cfg_slice_to_sink/test_transitions.py +0 -28
- tests/analyses/decompiler/__init__.py +0 -0
- tests/analyses/decompiler/test_baseptr_save_simplifier.py +0 -80
- tests/analyses/decompiler/test_decompiler.py +0 -3336
- tests/analyses/decompiler/test_peephole_optimizations.py +0 -48
- tests/analyses/decompiler/test_propagator_loops.py +0 -101
- tests/analyses/decompiler/test_structurer.py +0 -275
- tests/analyses/reaching_definitions/__init__.py +0 -0
- tests/analyses/reaching_definitions/test_dep_graph.py +0 -432
- tests/analyses/reaching_definitions/test_function_handler.py +0 -131
- tests/analyses/reaching_definitions/test_heap_allocator.py +0 -46
- tests/analyses/reaching_definitions/test_rd_state.py +0 -78
- tests/analyses/reaching_definitions/test_reachingdefinitions.py +0 -463
- tests/analyses/reaching_definitions/test_subject.py +0 -76
- tests/analyses/test_bindiff.py +0 -52
- tests/analyses/test_block_simplifier.py +0 -112
- tests/analyses/test_boyscout.py +0 -104
- tests/analyses/test_calling_convention_analysis.py +0 -352
- tests/analyses/test_callsite_maker.py +0 -60
- tests/analyses/test_cdg.py +0 -165
- tests/analyses/test_cfb.py +0 -37
- tests/analyses/test_class_identifier.py +0 -46
- tests/analyses/test_clinic.py +0 -30
- tests/analyses/test_codetagging.py +0 -32
- tests/analyses/test_constantpropagation.py +0 -88
- tests/analyses/test_ddg.py +0 -95
- tests/analyses/test_ddg_global_var_dependencies.py +0 -83
- tests/analyses/test_ddg_memvar_addresses.py +0 -40
- tests/analyses/test_disassembly.py +0 -121
- tests/analyses/test_find_objects_static.py +0 -35
- tests/analyses/test_flirt.py +0 -49
- tests/analyses/test_identifier.py +0 -33
- tests/analyses/test_init_finder.py +0 -38
- tests/analyses/test_proximitygraph.py +0 -31
- tests/analyses/test_reassembler.py +0 -295
- tests/analyses/test_regionidentifier.py +0 -27
- tests/analyses/test_slicing.py +0 -164
- tests/analyses/test_stack_pointer_tracker.py +0 -74
- tests/analyses/test_static_hooker.py +0 -28
- tests/analyses/test_typehoon.py +0 -55
- tests/analyses/test_variablerecovery.py +0 -464
- tests/analyses/test_vfg.py +0 -221
- tests/analyses/test_vtable.py +0 -31
- tests/analyses/test_xrefs.py +0 -77
- tests/common.py +0 -128
- tests/engines/__init__.py +0 -0
- tests/engines/light/__init__.py +0 -0
- tests/engines/light/test_data.py +0 -17
- tests/engines/pcode/__init__.py +0 -0
- tests/engines/pcode/test_emulate.py +0 -607
- tests/engines/pcode/test_pcode.py +0 -84
- tests/engines/test_actions.py +0 -27
- tests/engines/test_hook.py +0 -112
- tests/engines/test_java.py +0 -697
- tests/engines/test_unicorn.py +0 -518
- tests/engines/vex/__init__.py +0 -0
- tests/engines/vex/test_lifter.py +0 -124
- tests/engines/vex/test_vex.py +0 -574
- tests/exploration_techniques/__init__.py +0 -0
- tests/exploration_techniques/test_cacher.py +0 -45
- tests/exploration_techniques/test_director.py +0 -67
- tests/exploration_techniques/test_driller_core.py +0 -48
- tests/exploration_techniques/test_loop_seer.py +0 -158
- tests/exploration_techniques/test_memory_watcher.py +0 -46
- tests/exploration_techniques/test_oppologist.py +0 -65
- tests/exploration_techniques/test_spiller.py +0 -82
- tests/exploration_techniques/test_stochastic.py +0 -40
- tests/exploration_techniques/test_tech_builder.py +0 -61
- tests/exploration_techniques/test_tracer.py +0 -856
- tests/exploration_techniques/test_unique.py +0 -40
- tests/exploration_techniques/test_veritesting.py +0 -120
- tests/factory/__init__.py +0 -0
- tests/factory/block/__init__.py +0 -0
- tests/factory/block/test_block_cache.py +0 -33
- tests/factory/block/test_keystone.py +0 -106
- tests/factory/test_argc.py +0 -101
- tests/factory/test_argc_sym.py +0 -110
- tests/factory/test_argv.py +0 -158
- tests/factory/test_callable.py +0 -266
- tests/factory/test_windows_args.py +0 -36
- tests/knowledge_plugins/__init__.py +0 -0
- tests/knowledge_plugins/cfg/__init__.py +0 -0
- tests/knowledge_plugins/cfg/test_cfg_manager.py +0 -36
- tests/knowledge_plugins/functions/__init__.py +0 -0
- tests/knowledge_plugins/functions/test_function.py +0 -91
- tests/knowledge_plugins/functions/test_function2.py +0 -79
- tests/knowledge_plugins/functions/test_function_manager.py +0 -139
- tests/knowledge_plugins/functions/test_prototypes.py +0 -53
- tests/knowledge_plugins/key_definitions/__init__.py +0 -0
- tests/knowledge_plugins/key_definitions/test_atoms.py +0 -24
- tests/knowledge_plugins/key_definitions/test_environment.py +0 -126
- tests/knowledge_plugins/key_definitions/test_heap_address.py +0 -27
- tests/knowledge_plugins/key_definitions/test_live_definitions.py +0 -72
- tests/knowledge_plugins/test_dwarf_variables.py +0 -240
- tests/knowledge_plugins/test_kb_plugins.py +0 -91
- tests/knowledge_plugins/test_kb_plugins_dwarf.py +0 -36
- tests/knowledge_plugins/test_patches.py +0 -48
- tests/misc/__init__.py +0 -0
- tests/misc/test_hookset.py +0 -57
- tests/perf/__init__.py +0 -0
- tests/perf/perf_cfgemulated.py +0 -19
- tests/perf/perf_cfgfast.py +0 -18
- tests/perf/perf_concrete_execution.py +0 -41
- tests/perf/perf_siminspect_nop.py +0 -36
- tests/perf/perf_state_copy.py +0 -33
- tests/perf/perf_unicorn_0.py +0 -27
- tests/perf/perf_unicorn_1.py +0 -23
- tests/procedures/__init__.py +0 -0
- tests/procedures/glibc/__init__.py +0 -0
- tests/procedures/glibc/test_ctype_locale.py +0 -164
- tests/procedures/libc/__init__.py +0 -0
- tests/procedures/libc/test_fgets.py +0 -53
- tests/procedures/libc/test_scanf.py +0 -205
- tests/procedures/libc/test_sprintf.py +0 -44
- tests/procedures/libc/test_sscanf.py +0 -63
- tests/procedures/libc/test_strcasecmp.py +0 -37
- tests/procedures/libc/test_string.py +0 -1102
- tests/procedures/libc/test_strtol.py +0 -78
- tests/procedures/linux_kernel/__init__.py +0 -0
- tests/procedures/linux_kernel/test_lseek.py +0 -174
- tests/procedures/posix/__init__.py +0 -0
- tests/procedures/posix/test_chroot.py +0 -33
- tests/procedures/posix/test_getenv.py +0 -78
- tests/procedures/posix/test_pwrite_pread.py +0 -57
- tests/procedures/posix/test_sim_time.py +0 -46
- tests/procedures/posix/test_unlink.py +0 -46
- tests/procedures/test_project_resolve_simproc.py +0 -43
- tests/procedures/test_sim_procedure.py +0 -117
- tests/procedures/test_stub_procedure_args.py +0 -53
- tests/serialization/__init__.py +0 -0
- tests/serialization/test_db.py +0 -197
- tests/serialization/test_pickle.py +0 -95
- tests/serialization/test_serialization.py +0 -132
- tests/serialization/test_vault.py +0 -169
- tests/sim/__init__.py +0 -3
- tests/sim/exec_func/__init__.py +0 -0
- tests/sim/exec_func/test_mem_funcs.py +0 -55
- tests/sim/exec_func/test_str_funcs.py +0 -93
- tests/sim/exec_func/test_syscall_result.py +0 -39
- tests/sim/exec_insn/__init__.py +0 -0
- tests/sim/exec_insn/test_adc.py +0 -44
- tests/sim/exec_insn/test_ops.py +0 -83
- tests/sim/exec_insn/test_rcr.py +0 -26
- tests/sim/exec_insn/test_rol.py +0 -51
- tests/sim/exec_insn/test_signed_div.py +0 -34
- tests/sim/exec_insn/test_sqrt.py +0 -56
- tests/sim/options/__init__.py +0 -0
- tests/sim/options/test_0div.py +0 -54
- tests/sim/options/test_symbolic_fd.py +0 -59
- tests/sim/options/test_unsupported.py +0 -34
- tests/sim/test_accuracy.py +0 -137
- tests/sim/test_checkbyte.py +0 -53
- tests/sim/test_echo.py +0 -36
- tests/sim/test_fauxware.py +0 -202
- tests/sim/test_self_modifying_code.py +0 -65
- tests/sim/test_simple_api.py +0 -36
- tests/sim/test_simulation_manager.py +0 -147
- tests/sim/test_stack_alignment.py +0 -65
- tests/sim/test_state.py +0 -303
- tests/sim/test_state_customization.py +0 -54
- tests/sim/test_symbol_hooked_by.py +0 -49
- tests/simos/__init__.py +0 -0
- tests/simos/windows/__init__.py +0 -0
- tests/simos/windows/test_windows_stack_cookie.py +0 -58
- tests/state_plugins/__init__.py +0 -0
- tests/state_plugins/inspect/__init__.py +0 -0
- tests/state_plugins/inspect/test_inspect.py +0 -310
- tests/state_plugins/inspect/test_syscall_override.py +0 -90
- tests/state_plugins/posix/__init__.py +0 -0
- tests/state_plugins/posix/test_file_struct_funcs.py +0 -56
- tests/state_plugins/posix/test_files.py +0 -69
- tests/state_plugins/posix/test_posix.py +0 -72
- tests/state_plugins/solver/__init__.py +0 -0
- tests/state_plugins/solver/test_simsolver.py +0 -58
- tests/state_plugins/solver/test_symbolic.py +0 -153
- tests/state_plugins/solver/test_variable_registration.py +0 -46
- tests/state_plugins/test_callstack.py +0 -54
- tests/state_plugins/test_gdb_plugin.py +0 -35
- tests/state_plugins/test_multi_open_file.py +0 -47
- tests/state_plugins/test_symbolization.py +0 -38
- tests/storage/__init__.py +0 -0
- tests/storage/test_memory.py +0 -960
- tests/storage/test_memory_merge.py +0 -114
- tests/storage/test_memview.py +0 -205
- tests/storage/test_mmap.py +0 -26
- tests/storage/test_multivalues.py +0 -44
- tests/storage/test_permissions.py +0 -32
- tests/storage/test_ptmalloc.py +0 -291
- tests/storage/test_relro_perm.py +0 -49
- tests/test_calling_conventions.py +0 -86
- tests/test_types.py +0 -329
- tests/utils/__init__.py +0 -0
- tests/utils/test_graph.py +0 -41
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/LICENSE +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/WHEEL +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/entry_points.txt +0 -0
|
@@ -1,205 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests.procedures.libc" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import os
|
|
5
|
-
import string
|
|
6
|
-
|
|
7
|
-
import unittest
|
|
8
|
-
|
|
9
|
-
import angr
|
|
10
|
-
import claripy
|
|
11
|
-
|
|
12
|
-
from ...common import bin_location
|
|
13
|
-
|
|
14
|
-
test_location = os.path.join(bin_location, "tests")
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
class Checker:
|
|
18
|
-
def __init__(
|
|
19
|
-
self, check_func, length=None, base=10, dummy: bool = False, multi: bool = False, delimiter: str = None
|
|
20
|
-
):
|
|
21
|
-
self._check_func = check_func
|
|
22
|
-
self._length = length
|
|
23
|
-
self._base = base
|
|
24
|
-
self._dummy = dummy
|
|
25
|
-
self._multi = multi
|
|
26
|
-
self._delimiter = delimiter
|
|
27
|
-
|
|
28
|
-
if multi:
|
|
29
|
-
if not delimiter:
|
|
30
|
-
raise ValueError("Delimiter is required when multi is True.")
|
|
31
|
-
if not isinstance(check_func, list):
|
|
32
|
-
raise TypeError("You must provide a list of check functions when multi is True.")
|
|
33
|
-
self._parts = len(check_func)
|
|
34
|
-
|
|
35
|
-
def _extract_integer(self, s):
|
|
36
|
-
charset = string.digits if self._base == 10 else string.digits + "abcdefABCDEF"
|
|
37
|
-
|
|
38
|
-
component = ""
|
|
39
|
-
|
|
40
|
-
digit_start_pos = None
|
|
41
|
-
|
|
42
|
-
for i, c in enumerate(s):
|
|
43
|
-
if digit_start_pos is not None:
|
|
44
|
-
if c not in charset:
|
|
45
|
-
component = s[:i]
|
|
46
|
-
break
|
|
47
|
-
else:
|
|
48
|
-
if c in charset and s[i : i + 2] not in ("0x", "0X"):
|
|
49
|
-
digit_start_pos = c
|
|
50
|
-
|
|
51
|
-
if not component:
|
|
52
|
-
component = s
|
|
53
|
-
|
|
54
|
-
return component
|
|
55
|
-
|
|
56
|
-
def check(self, path):
|
|
57
|
-
if self._dummy:
|
|
58
|
-
return True
|
|
59
|
-
|
|
60
|
-
if not isinstance(path.posix.stdin, angr.storage.file.SimPacketsStream):
|
|
61
|
-
raise TypeError("This test case only supports SimPacketsStream-type of stdin.")
|
|
62
|
-
|
|
63
|
-
if not self._multi:
|
|
64
|
-
stdin_input = path.posix.stdin.content[1][0] # skip the first char used in switch
|
|
65
|
-
else:
|
|
66
|
-
stdin_input = claripy.Concat(*[part[0] for part in path.posix.stdin.content[1:]])
|
|
67
|
-
some_strings = path.solver.eval_upto(stdin_input, 1000, cast_to=bytes)
|
|
68
|
-
some_strings = [x.decode() for x in some_strings]
|
|
69
|
-
|
|
70
|
-
check_passes = False
|
|
71
|
-
|
|
72
|
-
for s in some_strings:
|
|
73
|
-
if self._length is not None:
|
|
74
|
-
s = s[: self._length]
|
|
75
|
-
|
|
76
|
-
if not self._multi:
|
|
77
|
-
# single part
|
|
78
|
-
component = self._extract_integer(s)
|
|
79
|
-
if self._check_func(component):
|
|
80
|
-
check_passes = True
|
|
81
|
-
break
|
|
82
|
-
else:
|
|
83
|
-
# multiple parts
|
|
84
|
-
substrs = s.split(self._delimiter)
|
|
85
|
-
if len(substrs) != len(self._check_func):
|
|
86
|
-
continue
|
|
87
|
-
|
|
88
|
-
components = [self._extract_integer(substr) for substr in substrs]
|
|
89
|
-
|
|
90
|
-
if all(func(component) for func, component in zip(self._check_func, components)):
|
|
91
|
-
check_passes = True
|
|
92
|
-
break
|
|
93
|
-
|
|
94
|
-
return check_passes
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
class TestScanf(unittest.TestCase):
|
|
98
|
-
def test_scanf(self):
|
|
99
|
-
test_bin = os.path.join(test_location, "x86_64", "scanf_test")
|
|
100
|
-
b = angr.Project(test_bin, auto_load_libs=False)
|
|
101
|
-
|
|
102
|
-
pg = b.factory.simulation_manager()
|
|
103
|
-
|
|
104
|
-
# find the end of main
|
|
105
|
-
expected_outputs = {
|
|
106
|
-
b"%%07x\n": Checker(lambda s: int(s, 16) == 0xAAAA, length=7, base=16),
|
|
107
|
-
b"%%07x and negative numbers\n": Checker(lambda s: int(s, 16) == -0xCDCD, length=7, base=16),
|
|
108
|
-
b"nope 0\n": Checker(None, dummy=True),
|
|
109
|
-
b"%%d\n": Checker(lambda s: int(s) == 133337),
|
|
110
|
-
b"%%d and negative numbers\n": Checker(lambda s: int(s) == 2**32 - 1337),
|
|
111
|
-
b"nope 1\n": Checker(None, dummy=True),
|
|
112
|
-
b"%%u\n": Checker(lambda s: int(s) == 0xAAAA),
|
|
113
|
-
b"%%u and negative numbers\n": Checker(lambda s: int(s) == 2**32 - 0xCDCD),
|
|
114
|
-
b"nope 2\n": Checker(None, dummy=True),
|
|
115
|
-
b"Unsupported switch\n": Checker(None, dummy=True),
|
|
116
|
-
}
|
|
117
|
-
pg.explore(find=0x4007F3, num_find=len(expected_outputs))
|
|
118
|
-
|
|
119
|
-
# check the outputs
|
|
120
|
-
total_outputs = 0
|
|
121
|
-
for path in pg.found:
|
|
122
|
-
test_output = path.posix.dumps(1)
|
|
123
|
-
if test_output in expected_outputs:
|
|
124
|
-
assert expected_outputs[test_output].check(path), "Test case failed. Output is %s." % test_output
|
|
125
|
-
|
|
126
|
-
total_outputs += 1
|
|
127
|
-
|
|
128
|
-
# check that all of the outputs were seen
|
|
129
|
-
assert total_outputs == len(expected_outputs)
|
|
130
|
-
|
|
131
|
-
def test_scanf_multi(self):
|
|
132
|
-
test_bin = os.path.join(test_location, "x86_64", "scanf_multi_test")
|
|
133
|
-
b = angr.Project(test_bin, auto_load_libs=False)
|
|
134
|
-
|
|
135
|
-
pg = b.factory.simulation_manager()
|
|
136
|
-
|
|
137
|
-
expected_outputs = {
|
|
138
|
-
b"%%04x.%%04x.%%04x\n": Checker(
|
|
139
|
-
[
|
|
140
|
-
lambda x: int(x, 16) == 0xAAAA,
|
|
141
|
-
lambda x: int(x, 16) == 0xBBBB,
|
|
142
|
-
lambda x: int(x, 16) == 0xCCCC,
|
|
143
|
-
],
|
|
144
|
-
base=16,
|
|
145
|
-
multi=True,
|
|
146
|
-
delimiter=".",
|
|
147
|
-
),
|
|
148
|
-
b"%%04x.%%04x.%%04x and negative numbers\n": Checker(
|
|
149
|
-
[lambda x: int(x, 16) == -0xCD] * 3,
|
|
150
|
-
base=16,
|
|
151
|
-
multi=True,
|
|
152
|
-
delimiter=".",
|
|
153
|
-
),
|
|
154
|
-
b"%%d.%%d.%%d\n": Checker(
|
|
155
|
-
[lambda x: int(x, 10) == 133337, lambda x: int(x, 10) == 1337, lambda x: int(x, 10) == 13337],
|
|
156
|
-
base=10,
|
|
157
|
-
multi=True,
|
|
158
|
-
delimiter=".",
|
|
159
|
-
),
|
|
160
|
-
b"%%d.%%d.%%d and negative numbers\n": Checker(
|
|
161
|
-
[lambda x: int(x, 10) == 2**32 - 1337] * 3,
|
|
162
|
-
base=10,
|
|
163
|
-
multi=True,
|
|
164
|
-
delimiter=".",
|
|
165
|
-
),
|
|
166
|
-
b"%%u\n": Checker(
|
|
167
|
-
[lambda x: int(x) == 0xAAAA, lambda x: int(x) == 0xBBBB, lambda x: int(x) == 0xCCCC],
|
|
168
|
-
base=10,
|
|
169
|
-
multi=True,
|
|
170
|
-
delimiter=".",
|
|
171
|
-
),
|
|
172
|
-
b"%%u and negative numbers\n": Checker(
|
|
173
|
-
[lambda s: int(s) == 2**32 - 0xCDCD] * 3,
|
|
174
|
-
base=10,
|
|
175
|
-
multi=True,
|
|
176
|
-
delimiter=".",
|
|
177
|
-
),
|
|
178
|
-
b"Unsupported switch\n": Checker(None, dummy=True),
|
|
179
|
-
}
|
|
180
|
-
pg.explore(
|
|
181
|
-
find=0x40083E,
|
|
182
|
-
avoid=(
|
|
183
|
-
0x4006DB,
|
|
184
|
-
0x400776,
|
|
185
|
-
0x40080B,
|
|
186
|
-
), # avoid all "nope N" branches
|
|
187
|
-
num_find=len(expected_outputs),
|
|
188
|
-
)
|
|
189
|
-
|
|
190
|
-
# check the outputs
|
|
191
|
-
total_outputs = 0
|
|
192
|
-
for path in pg.found:
|
|
193
|
-
path.posix.dumps(0)
|
|
194
|
-
test_output = path.posix.dumps(1)
|
|
195
|
-
if test_output in expected_outputs:
|
|
196
|
-
assert expected_outputs[test_output].check(path), "Test case failed. Output is %s." % test_output
|
|
197
|
-
|
|
198
|
-
total_outputs += 1
|
|
199
|
-
|
|
200
|
-
# check that all of the outputs were seen
|
|
201
|
-
assert total_outputs == len(expected_outputs)
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
if __name__ == "__main__":
|
|
205
|
-
unittest.main()
|
|
@@ -1,44 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
__package__ = __package__ or "tests.procedures.libc" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ...common import bin_location
|
|
11
|
-
|
|
12
|
-
test_location = os.path.join(bin_location, "tests")
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
class TestSprintf(unittest.TestCase):
|
|
16
|
-
def test_sprintf(self):
|
|
17
|
-
p = angr.Project(
|
|
18
|
-
os.path.join(test_location, "x86_64", "sprintf_test"),
|
|
19
|
-
auto_load_libs=False,
|
|
20
|
-
)
|
|
21
|
-
a = p.factory.simulation_manager().explore(find=0x4005C0)
|
|
22
|
-
state = a.found[0]
|
|
23
|
-
|
|
24
|
-
str1 = state.solver.eval(state.memory.load(0x600AD0, 13), cast_to=bytes)
|
|
25
|
-
assert str1 == b"Immediate: 3\n"
|
|
26
|
-
|
|
27
|
-
str2 = state.solver.eval(state.memory.load(0x600A70, 7), cast_to=bytes)
|
|
28
|
-
assert str2 == b"Int: 3\n"
|
|
29
|
-
|
|
30
|
-
str3 = state.solver.eval(state.memory.load(0x600AB0, 8), cast_to=bytes)
|
|
31
|
-
assert str3 == b"Char: c\n"
|
|
32
|
-
|
|
33
|
-
str4 = state.solver.eval(state.memory.load(0x600A50, 14), cast_to=bytes)
|
|
34
|
-
assert str4 == b"Uninit int: 0\n"
|
|
35
|
-
|
|
36
|
-
str5 = state.solver.eval(state.memory.load(0x600A90, 24), cast_to=bytes)
|
|
37
|
-
assert str5 == b"Str on stack: A string.\n"
|
|
38
|
-
|
|
39
|
-
str6 = state.solver.eval(state.memory.load(0x600A30, 21), cast_to=bytes)
|
|
40
|
-
assert str6 == b"Global str: GLOB_STR\n"
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
if __name__ == "__main__":
|
|
44
|
-
unittest.main()
|
|
@@ -1,63 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests.procedures.libc" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import os
|
|
5
|
-
import subprocess
|
|
6
|
-
import sys
|
|
7
|
-
import unittest
|
|
8
|
-
|
|
9
|
-
import angr
|
|
10
|
-
|
|
11
|
-
from ...common import bin_location
|
|
12
|
-
|
|
13
|
-
test_location = os.path.join(bin_location, "tests")
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
class TestSscanf(unittest.TestCase):
|
|
17
|
-
@unittest.skipUnless(sys.platform.startswith("linux"), "linux only")
|
|
18
|
-
def test_sscanf(self):
|
|
19
|
-
test_bin = os.path.join(test_location, "x86_64", "sscanf_test")
|
|
20
|
-
b = angr.Project(test_bin, auto_load_libs=False)
|
|
21
|
-
pg = b.factory.simulation_manager()
|
|
22
|
-
# find the end of main
|
|
23
|
-
expected_outputs = {
|
|
24
|
-
b"0x worked\n",
|
|
25
|
-
b"+0x worked\n",
|
|
26
|
-
b"base +16 worked\n",
|
|
27
|
-
b"base 16 worked\n",
|
|
28
|
-
b"-0x worked\n",
|
|
29
|
-
b"base -16 worked\n",
|
|
30
|
-
b"base 16 length 2 worked\n",
|
|
31
|
-
b"Nope x\n",
|
|
32
|
-
b"base 8 worked\n",
|
|
33
|
-
b"base +8 worked\n",
|
|
34
|
-
b"base +10 worked\n",
|
|
35
|
-
b"base 10 worked\n",
|
|
36
|
-
b"base -8 worked\n",
|
|
37
|
-
b"base -10 worked\n",
|
|
38
|
-
b"Nope u\n",
|
|
39
|
-
b"No switch\n",
|
|
40
|
-
}
|
|
41
|
-
pg.run()
|
|
42
|
-
assert len(pg.deadended) == len(expected_outputs)
|
|
43
|
-
assert len(pg.active) == 0
|
|
44
|
-
assert len(pg.errored) == 0
|
|
45
|
-
|
|
46
|
-
# check the outputs
|
|
47
|
-
pipe = subprocess.PIPE
|
|
48
|
-
for f in pg.deadended:
|
|
49
|
-
test_input = f.posix.dumps(0)
|
|
50
|
-
test_output = f.posix.dumps(1)
|
|
51
|
-
expected_outputs.remove(test_output)
|
|
52
|
-
|
|
53
|
-
# check the output works as expected
|
|
54
|
-
p = subprocess.Popen(test_bin, stdout=pipe, stderr=pipe, stdin=pipe)
|
|
55
|
-
ret = p.communicate(test_input)[0]
|
|
56
|
-
assert ret == test_output
|
|
57
|
-
|
|
58
|
-
# check that all of the outputs were seen
|
|
59
|
-
assert len(expected_outputs) == 0
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
if __name__ == "__main__":
|
|
63
|
-
unittest.main()
|
|
@@ -1,37 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
__package__ = __package__ or "tests.procedures.libc" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import claripy
|
|
9
|
-
|
|
10
|
-
import angr
|
|
11
|
-
|
|
12
|
-
from ...common import bin_location
|
|
13
|
-
|
|
14
|
-
test_location = os.path.join(bin_location, "tests")
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
class TestStrCaseCmp(unittest.TestCase):
|
|
18
|
-
def test_i386(self):
|
|
19
|
-
p = angr.Project(os.path.join(test_location, "i386", "test_strcasecmp"), auto_load_libs=False)
|
|
20
|
-
arg1 = claripy.BVS("arg1", 20 * 8)
|
|
21
|
-
s = p.factory.entry_state(args=("test_strcasecmp", arg1))
|
|
22
|
-
sm = p.factory.simulation_manager(s)
|
|
23
|
-
sm.explore()
|
|
24
|
-
|
|
25
|
-
sm.move("deadended", "found", filter_func=lambda s: b"Welcome" in s.posix.dumps(1))
|
|
26
|
-
|
|
27
|
-
assert len(sm.found) == 1
|
|
28
|
-
|
|
29
|
-
f = sm.found[0]
|
|
30
|
-
sol = f.solver.eval(arg1, cast_to=bytes)
|
|
31
|
-
assert b"\x00" in sol
|
|
32
|
-
assert sol[: sol.index(b"\x00")].lower() == b"letmein"
|
|
33
|
-
assert b"wchar works" in f.posix.dumps(1)
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
if __name__ == "__main__":
|
|
37
|
-
unittest.main()
|