angr 9.2.87__py3-none-manylinux2014_x86_64.whl → 9.2.89__py3-none-manylinux2014_x86_64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +4 -1
- angr/analyses/decompiler/clinic.py +16 -0
- angr/analyses/decompiler/decompiler.py +3 -0
- angr/analyses/decompiler/optimization_passes/__init__.py +5 -0
- angr/analyses/decompiler/optimization_passes/cross_jump_reverter.py +108 -0
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +17 -4
- angr/analyses/decompiler/optimization_passes/return_duplicator.py +4 -32
- angr/analyses/decompiler/structured_codegen/c.py +12 -2
- angr/analyses/decompiler/utils.py +13 -0
- angr/analyses/typehoon/dfa.py +108 -0
- angr/analyses/typehoon/lifter.py +34 -2
- angr/analyses/typehoon/simple_solver.py +1043 -503
- angr/analyses/typehoon/translator.py +13 -4
- angr/analyses/typehoon/typeconsts.py +117 -36
- angr/analyses/typehoon/typehoon.py +31 -11
- angr/analyses/typehoon/typevars.py +88 -21
- angr/analyses/typehoon/variance.py +10 -0
- angr/analyses/variable_recovery/engine_ail.py +28 -9
- angr/analyses/variable_recovery/engine_base.py +50 -43
- angr/analyses/variable_recovery/variable_recovery_base.py +16 -3
- angr/analyses/variable_recovery/variable_recovery_fast.py +14 -5
- angr/exploration_techniques/tracer.py +2 -0
- angr/misc/autoimport.py +26 -0
- angr/procedures/definitions/__init__.py +32 -3
- angr/utils/constants.py +1 -0
- angr/utils/graph.py +20 -1
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/METADATA +7 -6
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/RECORD +32 -244
- angr-9.2.89.dist-info/top_level.txt +1 -0
- angr/procedures/definitions/ntdll.py +0 -12
- angr-9.2.87.dist-info/top_level.txt +0 -2
- tests/__init__.py +0 -0
- tests/analyses/__init__.py +0 -0
- tests/analyses/cfg/__init__.py +0 -0
- tests/analyses/cfg/test_cfg_clflush.py +0 -43
- tests/analyses/cfg/test_cfg_get_any_node.py +0 -34
- tests/analyses/cfg/test_cfg_manager.py +0 -32
- tests/analyses/cfg/test_cfg_model.py +0 -55
- tests/analyses/cfg/test_cfg_patching.py +0 -378
- tests/analyses/cfg/test_cfg_rust_got_resolution.py +0 -36
- tests/analyses/cfg/test_cfg_thumb_firmware.py +0 -50
- tests/analyses/cfg/test_cfg_vex_postprocessor.py +0 -27
- tests/analyses/cfg/test_cfgemulated.py +0 -634
- tests/analyses/cfg/test_cfgfast.py +0 -1123
- tests/analyses/cfg/test_cfgfast_soot.py +0 -38
- tests/analyses/cfg/test_const_resolver.py +0 -38
- tests/analyses/cfg/test_iat_resolver.py +0 -37
- tests/analyses/cfg/test_jumptables.py +0 -3008
- tests/analyses/cfg/test_noop_blocks.py +0 -54
- tests/analyses/cfg_slice_to_sink/__init__.py +0 -0
- tests/analyses/cfg_slice_to_sink/test_cfg_slice_to_sink.py +0 -93
- tests/analyses/cfg_slice_to_sink/test_graph.py +0 -114
- tests/analyses/cfg_slice_to_sink/test_transitions.py +0 -28
- tests/analyses/decompiler/__init__.py +0 -0
- tests/analyses/decompiler/test_baseptr_save_simplifier.py +0 -80
- tests/analyses/decompiler/test_decompiler.py +0 -3336
- tests/analyses/decompiler/test_peephole_optimizations.py +0 -48
- tests/analyses/decompiler/test_propagator_loops.py +0 -101
- tests/analyses/decompiler/test_structurer.py +0 -275
- tests/analyses/reaching_definitions/__init__.py +0 -0
- tests/analyses/reaching_definitions/test_dep_graph.py +0 -432
- tests/analyses/reaching_definitions/test_function_handler.py +0 -131
- tests/analyses/reaching_definitions/test_heap_allocator.py +0 -46
- tests/analyses/reaching_definitions/test_rd_state.py +0 -78
- tests/analyses/reaching_definitions/test_reachingdefinitions.py +0 -463
- tests/analyses/reaching_definitions/test_subject.py +0 -76
- tests/analyses/test_bindiff.py +0 -52
- tests/analyses/test_block_simplifier.py +0 -112
- tests/analyses/test_boyscout.py +0 -104
- tests/analyses/test_calling_convention_analysis.py +0 -352
- tests/analyses/test_callsite_maker.py +0 -60
- tests/analyses/test_cdg.py +0 -165
- tests/analyses/test_cfb.py +0 -37
- tests/analyses/test_class_identifier.py +0 -46
- tests/analyses/test_clinic.py +0 -30
- tests/analyses/test_codetagging.py +0 -32
- tests/analyses/test_constantpropagation.py +0 -88
- tests/analyses/test_ddg.py +0 -95
- tests/analyses/test_ddg_global_var_dependencies.py +0 -83
- tests/analyses/test_ddg_memvar_addresses.py +0 -40
- tests/analyses/test_disassembly.py +0 -121
- tests/analyses/test_find_objects_static.py +0 -35
- tests/analyses/test_flirt.py +0 -49
- tests/analyses/test_identifier.py +0 -33
- tests/analyses/test_init_finder.py +0 -38
- tests/analyses/test_proximitygraph.py +0 -31
- tests/analyses/test_reassembler.py +0 -295
- tests/analyses/test_regionidentifier.py +0 -27
- tests/analyses/test_slicing.py +0 -164
- tests/analyses/test_stack_pointer_tracker.py +0 -74
- tests/analyses/test_static_hooker.py +0 -28
- tests/analyses/test_typehoon.py +0 -55
- tests/analyses/test_variablerecovery.py +0 -464
- tests/analyses/test_vfg.py +0 -221
- tests/analyses/test_vtable.py +0 -31
- tests/analyses/test_xrefs.py +0 -77
- tests/common.py +0 -128
- tests/engines/__init__.py +0 -0
- tests/engines/light/__init__.py +0 -0
- tests/engines/light/test_data.py +0 -17
- tests/engines/pcode/__init__.py +0 -0
- tests/engines/pcode/test_emulate.py +0 -607
- tests/engines/pcode/test_pcode.py +0 -84
- tests/engines/test_actions.py +0 -27
- tests/engines/test_hook.py +0 -112
- tests/engines/test_java.py +0 -697
- tests/engines/test_unicorn.py +0 -518
- tests/engines/vex/__init__.py +0 -0
- tests/engines/vex/test_lifter.py +0 -124
- tests/engines/vex/test_vex.py +0 -574
- tests/exploration_techniques/__init__.py +0 -0
- tests/exploration_techniques/test_cacher.py +0 -45
- tests/exploration_techniques/test_director.py +0 -67
- tests/exploration_techniques/test_driller_core.py +0 -48
- tests/exploration_techniques/test_loop_seer.py +0 -158
- tests/exploration_techniques/test_memory_watcher.py +0 -46
- tests/exploration_techniques/test_oppologist.py +0 -65
- tests/exploration_techniques/test_spiller.py +0 -82
- tests/exploration_techniques/test_stochastic.py +0 -40
- tests/exploration_techniques/test_tech_builder.py +0 -61
- tests/exploration_techniques/test_tracer.py +0 -856
- tests/exploration_techniques/test_unique.py +0 -40
- tests/exploration_techniques/test_veritesting.py +0 -120
- tests/factory/__init__.py +0 -0
- tests/factory/block/__init__.py +0 -0
- tests/factory/block/test_block_cache.py +0 -33
- tests/factory/block/test_keystone.py +0 -106
- tests/factory/test_argc.py +0 -101
- tests/factory/test_argc_sym.py +0 -110
- tests/factory/test_argv.py +0 -158
- tests/factory/test_callable.py +0 -266
- tests/factory/test_windows_args.py +0 -36
- tests/knowledge_plugins/__init__.py +0 -0
- tests/knowledge_plugins/cfg/__init__.py +0 -0
- tests/knowledge_plugins/cfg/test_cfg_manager.py +0 -36
- tests/knowledge_plugins/functions/__init__.py +0 -0
- tests/knowledge_plugins/functions/test_function.py +0 -91
- tests/knowledge_plugins/functions/test_function2.py +0 -79
- tests/knowledge_plugins/functions/test_function_manager.py +0 -139
- tests/knowledge_plugins/functions/test_prototypes.py +0 -53
- tests/knowledge_plugins/key_definitions/__init__.py +0 -0
- tests/knowledge_plugins/key_definitions/test_atoms.py +0 -24
- tests/knowledge_plugins/key_definitions/test_environment.py +0 -126
- tests/knowledge_plugins/key_definitions/test_heap_address.py +0 -27
- tests/knowledge_plugins/key_definitions/test_live_definitions.py +0 -72
- tests/knowledge_plugins/test_dwarf_variables.py +0 -240
- tests/knowledge_plugins/test_kb_plugins.py +0 -91
- tests/knowledge_plugins/test_kb_plugins_dwarf.py +0 -36
- tests/knowledge_plugins/test_patches.py +0 -48
- tests/misc/__init__.py +0 -0
- tests/misc/test_hookset.py +0 -57
- tests/perf/__init__.py +0 -0
- tests/perf/perf_cfgemulated.py +0 -19
- tests/perf/perf_cfgfast.py +0 -18
- tests/perf/perf_concrete_execution.py +0 -41
- tests/perf/perf_siminspect_nop.py +0 -36
- tests/perf/perf_state_copy.py +0 -33
- tests/perf/perf_unicorn_0.py +0 -27
- tests/perf/perf_unicorn_1.py +0 -23
- tests/procedures/__init__.py +0 -0
- tests/procedures/glibc/__init__.py +0 -0
- tests/procedures/glibc/test_ctype_locale.py +0 -164
- tests/procedures/libc/__init__.py +0 -0
- tests/procedures/libc/test_fgets.py +0 -53
- tests/procedures/libc/test_scanf.py +0 -205
- tests/procedures/libc/test_sprintf.py +0 -44
- tests/procedures/libc/test_sscanf.py +0 -63
- tests/procedures/libc/test_strcasecmp.py +0 -37
- tests/procedures/libc/test_string.py +0 -1102
- tests/procedures/libc/test_strtol.py +0 -78
- tests/procedures/linux_kernel/__init__.py +0 -0
- tests/procedures/linux_kernel/test_lseek.py +0 -174
- tests/procedures/posix/__init__.py +0 -0
- tests/procedures/posix/test_chroot.py +0 -33
- tests/procedures/posix/test_getenv.py +0 -78
- tests/procedures/posix/test_pwrite_pread.py +0 -57
- tests/procedures/posix/test_sim_time.py +0 -46
- tests/procedures/posix/test_unlink.py +0 -46
- tests/procedures/test_project_resolve_simproc.py +0 -43
- tests/procedures/test_sim_procedure.py +0 -117
- tests/procedures/test_stub_procedure_args.py +0 -53
- tests/serialization/__init__.py +0 -0
- tests/serialization/test_db.py +0 -197
- tests/serialization/test_pickle.py +0 -95
- tests/serialization/test_serialization.py +0 -132
- tests/serialization/test_vault.py +0 -169
- tests/sim/__init__.py +0 -3
- tests/sim/exec_func/__init__.py +0 -0
- tests/sim/exec_func/test_mem_funcs.py +0 -55
- tests/sim/exec_func/test_str_funcs.py +0 -93
- tests/sim/exec_func/test_syscall_result.py +0 -39
- tests/sim/exec_insn/__init__.py +0 -0
- tests/sim/exec_insn/test_adc.py +0 -44
- tests/sim/exec_insn/test_ops.py +0 -83
- tests/sim/exec_insn/test_rcr.py +0 -26
- tests/sim/exec_insn/test_rol.py +0 -51
- tests/sim/exec_insn/test_signed_div.py +0 -34
- tests/sim/exec_insn/test_sqrt.py +0 -56
- tests/sim/options/__init__.py +0 -0
- tests/sim/options/test_0div.py +0 -54
- tests/sim/options/test_symbolic_fd.py +0 -59
- tests/sim/options/test_unsupported.py +0 -34
- tests/sim/test_accuracy.py +0 -137
- tests/sim/test_checkbyte.py +0 -53
- tests/sim/test_echo.py +0 -36
- tests/sim/test_fauxware.py +0 -202
- tests/sim/test_self_modifying_code.py +0 -65
- tests/sim/test_simple_api.py +0 -36
- tests/sim/test_simulation_manager.py +0 -147
- tests/sim/test_stack_alignment.py +0 -65
- tests/sim/test_state.py +0 -303
- tests/sim/test_state_customization.py +0 -54
- tests/sim/test_symbol_hooked_by.py +0 -49
- tests/simos/__init__.py +0 -0
- tests/simos/windows/__init__.py +0 -0
- tests/simos/windows/test_windows_stack_cookie.py +0 -58
- tests/state_plugins/__init__.py +0 -0
- tests/state_plugins/inspect/__init__.py +0 -0
- tests/state_plugins/inspect/test_inspect.py +0 -310
- tests/state_plugins/inspect/test_syscall_override.py +0 -90
- tests/state_plugins/posix/__init__.py +0 -0
- tests/state_plugins/posix/test_file_struct_funcs.py +0 -56
- tests/state_plugins/posix/test_files.py +0 -69
- tests/state_plugins/posix/test_posix.py +0 -72
- tests/state_plugins/solver/__init__.py +0 -0
- tests/state_plugins/solver/test_simsolver.py +0 -58
- tests/state_plugins/solver/test_symbolic.py +0 -153
- tests/state_plugins/solver/test_variable_registration.py +0 -46
- tests/state_plugins/test_callstack.py +0 -54
- tests/state_plugins/test_gdb_plugin.py +0 -35
- tests/state_plugins/test_multi_open_file.py +0 -47
- tests/state_plugins/test_symbolization.py +0 -38
- tests/storage/__init__.py +0 -0
- tests/storage/test_memory.py +0 -960
- tests/storage/test_memory_merge.py +0 -114
- tests/storage/test_memview.py +0 -205
- tests/storage/test_mmap.py +0 -26
- tests/storage/test_multivalues.py +0 -44
- tests/storage/test_permissions.py +0 -32
- tests/storage/test_ptmalloc.py +0 -291
- tests/storage/test_relro_perm.py +0 -49
- tests/test_calling_conventions.py +0 -86
- tests/test_types.py +0 -329
- tests/utils/__init__.py +0 -0
- tests/utils/test_graph.py +0 -41
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/LICENSE +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/WHEEL +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/entry_points.txt +0 -0
|
@@ -1,55 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
__package__ = __package__ or "tests.sim.exec_func" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ...common import bin_location
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
test_location = os.path.join(bin_location, "tests")
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
class TestMemFuncs(unittest.TestCase):
|
|
17
|
-
def test_memmove(self):
|
|
18
|
-
# auto_load_libs can't be disabled as the testcase fails
|
|
19
|
-
proj = angr.Project(
|
|
20
|
-
os.path.join(test_location, "x86_64", "memmove"),
|
|
21
|
-
load_options={"auto_load_libs": True},
|
|
22
|
-
exclude_sim_procedures_list=["memmove"],
|
|
23
|
-
)
|
|
24
|
-
explorer = proj.factory.simulation_manager().explore(find=[0x4005D7])
|
|
25
|
-
s = explorer.found[0]
|
|
26
|
-
result = s.solver.eval(s.memory.load(s.registers.load(16, 8), 13), cast_to=bytes)
|
|
27
|
-
assert result == b"very useful.\x00"
|
|
28
|
-
|
|
29
|
-
def test_memcpy(self):
|
|
30
|
-
# auto_load_libs can't be disabled as the testcase fails
|
|
31
|
-
proj = angr.Project(
|
|
32
|
-
os.path.join(test_location, "x86_64", "memcpy"),
|
|
33
|
-
load_options={"auto_load_libs": True},
|
|
34
|
-
exclude_sim_procedures_list=["memcpy"],
|
|
35
|
-
)
|
|
36
|
-
explorer = proj.factory.simulation_manager().explore(find=[0x40065A])
|
|
37
|
-
s = explorer.found[0]
|
|
38
|
-
result = s.solver.eval(s.memory.load(s.registers.load(16, 8), 19), cast_to=bytes)
|
|
39
|
-
assert result == b"let's test memcpy!\x00"
|
|
40
|
-
|
|
41
|
-
def test_memset(self):
|
|
42
|
-
# auto_load_libs can't be disabled as the testcase fails
|
|
43
|
-
proj = angr.Project(
|
|
44
|
-
os.path.join(test_location, "x86_64", "memset"),
|
|
45
|
-
load_options={"auto_load_libs": True},
|
|
46
|
-
exclude_sim_procedures_list=["memset"],
|
|
47
|
-
)
|
|
48
|
-
explorer = proj.factory.simulation_manager().explore(find=[0x400608])
|
|
49
|
-
s = explorer.found[0]
|
|
50
|
-
result = s.solver.eval(s.memory.load(s.registers.load(16, 8), 50), cast_to=bytes)
|
|
51
|
-
assert result == b"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB\x00"
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
if __name__ == "__main__":
|
|
55
|
-
unittest.main()
|
|
@@ -1,93 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
__package__ = __package__ or "tests.sim.exec_func" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ...common import bin_location
|
|
11
|
-
|
|
12
|
-
test_location = os.path.join(bin_location, "tests")
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
class TestStrFuncs(unittest.TestCase):
|
|
16
|
-
def test_strncpy(self):
|
|
17
|
-
# auto_load_libs can't be disabled as the test cases failed.
|
|
18
|
-
strncpy_amd64 = angr.Project(
|
|
19
|
-
os.path.join(test_location, "x86_64", "strncpy"),
|
|
20
|
-
load_options={"auto_load_libs": True},
|
|
21
|
-
exclude_sim_procedures_list=["strncpy"],
|
|
22
|
-
)
|
|
23
|
-
explorer = strncpy_amd64.factory.simulation_manager()
|
|
24
|
-
explorer.explore(find=[0x4005FF])
|
|
25
|
-
s = explorer.found[0]
|
|
26
|
-
result = s.solver.eval(s.memory.load(s.regs.rax, 16), cast_to=bytes)
|
|
27
|
-
assert result == b"why hello there\0"
|
|
28
|
-
|
|
29
|
-
def test_strncpy_size(self):
|
|
30
|
-
# auto_load_libs can't be disabled as the test cases failed.
|
|
31
|
-
strncpy_size_amd64 = angr.Project(
|
|
32
|
-
os.path.join(test_location, "x86_64", "strncpy-size"),
|
|
33
|
-
load_options={"auto_load_libs": True},
|
|
34
|
-
exclude_sim_procedures_list=["strncpy"],
|
|
35
|
-
)
|
|
36
|
-
explorer = strncpy_size_amd64.factory.simulation_manager()
|
|
37
|
-
cfg = strncpy_size_amd64.analyses.CFG(objects=[strncpy_size_amd64.loader.main_object], normalize=True)
|
|
38
|
-
explorer.use_technique(angr.exploration_techniques.LoopSeer(cfg=cfg, bound=50))
|
|
39
|
-
explorer.explore(find=[0x40064C])
|
|
40
|
-
s = explorer.found[0]
|
|
41
|
-
result = s.solver.eval(s.memory.load(s.regs.rax, 40), cast_to=bytes)
|
|
42
|
-
assert result == b"just testing things\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
|
|
43
|
-
|
|
44
|
-
def test_strncpy_verify_null(self):
|
|
45
|
-
# auto_load_libs can't be disabled as the test cases failed.
|
|
46
|
-
strncpy_verify_null_amd64 = angr.Project(
|
|
47
|
-
os.path.join(test_location, "x86_64", "strncpy-verify-null"),
|
|
48
|
-
load_options={"auto_load_libs": True},
|
|
49
|
-
exclude_sim_procedures_list=["strncpy"],
|
|
50
|
-
)
|
|
51
|
-
explorer = strncpy_verify_null_amd64.factory.simulation_manager()
|
|
52
|
-
cfg = strncpy_verify_null_amd64.analyses.CFG(
|
|
53
|
-
objects=[strncpy_verify_null_amd64.loader.main_object], normalize=True
|
|
54
|
-
)
|
|
55
|
-
explorer.use_technique(angr.exploration_techniques.LoopSeer(cfg=cfg, bound=50))
|
|
56
|
-
explorer.explore(find=[0x40064C])
|
|
57
|
-
s = explorer.found[0]
|
|
58
|
-
result = s.solver.eval(s.memory.load(s.regs.rax, 40), cast_to=bytes)
|
|
59
|
-
assert result == b"just testing things\0\0\0\0\0\0\0\0\0\0\0\0\0\0AAAAAA\0"
|
|
60
|
-
|
|
61
|
-
def test_strstr_and_strncpy(self):
|
|
62
|
-
# auto_load_libs can't be disabled as the test cases failed.
|
|
63
|
-
strstr_and_strncpy_amd64 = angr.Project(
|
|
64
|
-
os.path.join(test_location, "x86_64", "strstr_and_strncpy"),
|
|
65
|
-
load_options={"auto_load_libs": True},
|
|
66
|
-
exclude_sim_procedures_list=["strstr"],
|
|
67
|
-
)
|
|
68
|
-
explorer = strstr_and_strncpy_amd64.factory.simulation_manager()
|
|
69
|
-
cfg = strstr_and_strncpy_amd64.analyses.CFG(
|
|
70
|
-
objects=[strstr_and_strncpy_amd64.loader.main_object], normalize=True
|
|
71
|
-
)
|
|
72
|
-
explorer.use_technique(angr.exploration_techniques.LoopSeer(cfg=cfg, bound=50))
|
|
73
|
-
explorer.explore(find=[0x400657])
|
|
74
|
-
s = explorer.found[0]
|
|
75
|
-
result = s.solver.eval(s.memory.load(s.regs.rax, 15), cast_to=bytes)
|
|
76
|
-
assert result == b"hi th hi there\0"
|
|
77
|
-
|
|
78
|
-
def test_strstr(self):
|
|
79
|
-
# auto_load_libs can't be disabled as the test cases failed.
|
|
80
|
-
strstr_amd64 = angr.Project(
|
|
81
|
-
os.path.join(test_location, "x86_64", "strstr"),
|
|
82
|
-
load_options={"auto_load_libs": True},
|
|
83
|
-
exclude_sim_procedures_list=["strstr"],
|
|
84
|
-
)
|
|
85
|
-
explorer = strstr_amd64.factory.simulation_manager()
|
|
86
|
-
explorer.explore(find=[0x4005FB])
|
|
87
|
-
s = explorer.found[0]
|
|
88
|
-
result = s.solver.eval(s.memory.load(s.regs.rax, 9), cast_to=bytes)
|
|
89
|
-
assert result == b"hi there\0"
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
if __name__ == "__main__":
|
|
93
|
-
unittest.main()
|
|
@@ -1,39 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
__package__ = __package__ or "tests.sim.exec_func" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ...common import bin_location
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
test_location = os.path.join(bin_location, "tests")
|
|
14
|
-
|
|
15
|
-
arches = {"mips", "mipsel", "mips64", "x86_64", "ppc", "ppc64"}
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
class TestSyscallResult(unittest.TestCase):
|
|
19
|
-
@staticmethod
|
|
20
|
-
def run_test_syscalls(arch):
|
|
21
|
-
p = angr.Project(os.path.join(test_location, arch, "test_ioctl"), exclude_sim_procedures_list=["ioctl"])
|
|
22
|
-
p.simos.syscall_library.procedures.pop("ioctl", None)
|
|
23
|
-
|
|
24
|
-
s = p.factory.entry_state()
|
|
25
|
-
|
|
26
|
-
simgr = p.factory.simulation_manager(thing=s)
|
|
27
|
-
simgr.run()
|
|
28
|
-
assert (
|
|
29
|
-
len(simgr.deadended) == 2
|
|
30
|
-
), "for these architectures, libc checks if the bit is set. make sure it branches"
|
|
31
|
-
|
|
32
|
-
def test_syscalls(self):
|
|
33
|
-
for arch in arches:
|
|
34
|
-
with self.subTest(arch=arch):
|
|
35
|
-
self.run_test_syscalls(arch)
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
if __name__ == "__main__":
|
|
39
|
-
unittest.main()
|
tests/sim/exec_insn/__init__.py
DELETED
|
File without changes
|
tests/sim/exec_insn/test_adc.py
DELETED
|
@@ -1,44 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests.sim.exec_insn" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import os
|
|
5
|
-
import unittest
|
|
6
|
-
|
|
7
|
-
import angr
|
|
8
|
-
|
|
9
|
-
from ...common import bin_location
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
test_location = os.path.join(bin_location, "tests")
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
# pylint: disable=missing-class-docstring
|
|
16
|
-
# pylint: disable=no-self-use
|
|
17
|
-
class TestAdc(unittest.TestCase):
|
|
18
|
-
def test_adc_i386(self):
|
|
19
|
-
proj = angr.Project(os.path.join(test_location, "i386", "test_adc"), load_options={"auto_load_libs": False})
|
|
20
|
-
|
|
21
|
-
start = 0x804840B
|
|
22
|
-
end = 0x804842E
|
|
23
|
-
|
|
24
|
-
state = proj.factory.blank_state(
|
|
25
|
-
addr=start,
|
|
26
|
-
remove_options={
|
|
27
|
-
angr.options.LAZY_SOLVES,
|
|
28
|
-
},
|
|
29
|
-
add_options={angr.options.SYMBOLIC_WRITE_ADDRESSES},
|
|
30
|
-
)
|
|
31
|
-
|
|
32
|
-
pg = proj.factory.simulation_manager(state, veritesting=False)
|
|
33
|
-
pg.explore(find=end)
|
|
34
|
-
|
|
35
|
-
found_state = pg.found[0]
|
|
36
|
-
result = found_state.solver.eval(found_state.regs.eax)
|
|
37
|
-
assert result == 0x1
|
|
38
|
-
|
|
39
|
-
def test_all(self):
|
|
40
|
-
self.test_adc_i386()
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
if __name__ == "__main__":
|
|
44
|
-
unittest.main()
|
tests/sim/exec_insn/test_ops.py
DELETED
|
@@ -1,83 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
|
|
4
|
-
import unittest
|
|
5
|
-
|
|
6
|
-
import claripy
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
# all the input values were generated via
|
|
11
|
-
# [random.randrange(256) for _ in range(16)]
|
|
12
|
-
# then set into the input registers via gdb
|
|
13
|
-
# set $xmm0.v16_int8 = {...}
|
|
14
|
-
# then read out as uint128s
|
|
15
|
-
# p/x $xmm0.uint128
|
|
16
|
-
# then single stepped and the result read out
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
class TestOps(unittest.TestCase):
|
|
20
|
-
def test_irop_perm(self):
|
|
21
|
-
p = angr.load_shellcode("vpshufb xmm0,xmm1,xmm2", "amd64")
|
|
22
|
-
|
|
23
|
-
# concrete test
|
|
24
|
-
s1 = p.factory.blank_state()
|
|
25
|
-
s1.regs.xmm1 = 0x3C899A56814EE9B84C7B5D8394C85881
|
|
26
|
-
s1.regs.xmm2 = 0xA55C66A2CDEF1CBCD72B42078D1B7F8B
|
|
27
|
-
s2 = s1.step(num_inst=1).successors[0]
|
|
28
|
-
assert (s2.regs.xmm0 == 0x00567B00000056000081C84C00813C00).is_true()
|
|
29
|
-
|
|
30
|
-
# symbolic test
|
|
31
|
-
s3 = p.factory.blank_state()
|
|
32
|
-
s3.regs.xmm1 = claripy.BVS("xmm1", 128)
|
|
33
|
-
s3.regs.xmm2 = claripy.BVS("xmm2", 128)
|
|
34
|
-
s4 = s3.step(num_inst=1).successors[0]
|
|
35
|
-
s4.solver.add(s4.regs.xmm2 == 0xA55C66A2CDEF1CBCD72B42078D1B7F8B)
|
|
36
|
-
s4.solver.add(s4.regs.xmm0 == 0x00567B00000056000081C84C00813C00)
|
|
37
|
-
assert s4.solver.solution(s4.regs.xmm1, 0x3C899A56814EE9B84C7B5D8394C85881)
|
|
38
|
-
|
|
39
|
-
def test_irop_mulhi(self):
|
|
40
|
-
p = angr.load_shellcode("vpmulhw xmm0,xmm1,xmm2", "amd64")
|
|
41
|
-
|
|
42
|
-
# concrete test
|
|
43
|
-
s1 = p.factory.blank_state()
|
|
44
|
-
s1.regs.xmm1 = 0x3ACA92553C2526D4F20987AEAB250255
|
|
45
|
-
s1.regs.xmm2 = 0x1AEBCB281463274EC3CE6473619A8541
|
|
46
|
-
s2 = s1.step(num_inst=1).successors[0]
|
|
47
|
-
assert (s2.regs.xmm0 == 0x62E16A304CA05F60348D0C9DFA5FEE1).is_true()
|
|
48
|
-
|
|
49
|
-
def test_irop_catevenlanes(self):
|
|
50
|
-
p = angr.load_shellcode("pmulhrsw xmm0, xmm1", "amd64")
|
|
51
|
-
|
|
52
|
-
# concrete test
|
|
53
|
-
s1 = p.factory.blank_state()
|
|
54
|
-
s1.regs.xmm0 = 0x4713E06BF3235E97CA8CFDE0647D65FD
|
|
55
|
-
s1.regs.xmm1 = 0x31F1F86DA1DCE7DE252ADC78160E1016
|
|
56
|
-
s2 = s1.step(num_inst=1).successors[0]
|
|
57
|
-
assert (s2.regs.xmm0 == 0x1BBB01DE0976EE2BF07B009711500CD1).is_true()
|
|
58
|
-
|
|
59
|
-
def test_saturating_packing(self):
|
|
60
|
-
# SaturateSignedWordToUnsignedByte
|
|
61
|
-
p = angr.load_shellcode("vpackuswb xmm1, xmm0, xmm0", arch="amd64")
|
|
62
|
-
s = p.factory.blank_state()
|
|
63
|
-
s.regs.xmm0 = 0x0000_0001_7FFE_7FFF_8000_8001_FFFE_FFFF
|
|
64
|
-
s = s.step(num_inst=1).successors[0]
|
|
65
|
-
assert (s.regs.xmm1 == 0x00_01_FF_FF_00_00_00_00_0001FFFF00000000).is_true()
|
|
66
|
-
|
|
67
|
-
# "Pack with unsigned saturation"
|
|
68
|
-
p = angr.load_shellcode("vpackusdw xmm1, xmm0, xmm0", arch="amd64")
|
|
69
|
-
s = p.factory.blank_state()
|
|
70
|
-
s.regs.xmm0 = 0x00000001_7FFFFFFE_80000001_FFFFFFFE
|
|
71
|
-
s = s.step(num_inst=1).successors[0]
|
|
72
|
-
assert (s.regs.xmm1 == 0x0001_FFFF_0000_0000_0001FFFF00000000).is_true()
|
|
73
|
-
|
|
74
|
-
# SaturateSignedWordToSignedByte
|
|
75
|
-
p = angr.load_shellcode("vpacksswb xmm1, xmm0, xmm0", arch="amd64")
|
|
76
|
-
s = p.factory.blank_state()
|
|
77
|
-
s.regs.xmm0 = 0x0000_0001_7FFE_7FFF_8000_8001_FFFE_FFFF
|
|
78
|
-
s = s.step(num_inst=1).successors[0]
|
|
79
|
-
assert (s.regs.xmm1 == 0x00_01_7F_7F_80_80_FE_FF_00017F7F8080FEFF).is_true()
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
if __name__ == "__main__":
|
|
83
|
-
unittest.main()
|
tests/sim/exec_insn/test_rcr.py
DELETED
|
@@ -1,26 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
__package__ = __package__ or "tests.sim.exec_insn" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import claripy
|
|
9
|
-
|
|
10
|
-
import angr
|
|
11
|
-
|
|
12
|
-
from ...common import bin_location
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
test_location = os.path.join(bin_location, "tests")
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
class TestRcr(unittest.TestCase):
|
|
19
|
-
def test_rcr(self):
|
|
20
|
-
p = angr.Project(os.path.join(test_location, "i386", "rcr_test"), auto_load_libs=False)
|
|
21
|
-
result = p.factory.successors(p.factory.entry_state()).successors[0]
|
|
22
|
-
assert claripy.is_true(result.regs.cl == 8)
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
if __name__ == "__main__":
|
|
26
|
-
unittest.main()
|
tests/sim/exec_insn/test_rol.py
DELETED
|
@@ -1,51 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
__package__ = __package__ or "tests.sim.exec_insn" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ...common import bin_location
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
test_location = os.path.join(bin_location, "tests")
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
class TestRol(unittest.TestCase):
|
|
17
|
-
def test_rol_x86_64(self):
|
|
18
|
-
binary_path = os.path.join(test_location, "x86_64", "test_rol.exe")
|
|
19
|
-
|
|
20
|
-
proj = angr.Project(binary_path, auto_load_libs=False)
|
|
21
|
-
|
|
22
|
-
initial_state = proj.factory.blank_state(addr=0x401000)
|
|
23
|
-
r_rax = initial_state.solver.BVS("rax", 64)
|
|
24
|
-
initial_state.regs.rax = r_rax
|
|
25
|
-
|
|
26
|
-
pg = proj.factory.simulation_manager(initial_state)
|
|
27
|
-
pg.explore(find=0x401013, avoid=0x401010)
|
|
28
|
-
found_state = pg.found[0]
|
|
29
|
-
|
|
30
|
-
result = found_state.solver.eval(r_rax)
|
|
31
|
-
assert result == 0x37B7AB70
|
|
32
|
-
|
|
33
|
-
def test_rol_i386(self):
|
|
34
|
-
binary_path = os.path.join(test_location, "i386", "test_rol.exe")
|
|
35
|
-
|
|
36
|
-
proj = angr.Project(binary_path, auto_load_libs=False)
|
|
37
|
-
|
|
38
|
-
initial_state = proj.factory.blank_state(addr=0x401000)
|
|
39
|
-
r_eax = initial_state.solver.BVS("eax", 32)
|
|
40
|
-
initial_state.regs.eax = r_eax
|
|
41
|
-
|
|
42
|
-
pg = proj.factory.simulation_manager(initial_state)
|
|
43
|
-
pg.explore(find=0x401013, avoid=0x401010)
|
|
44
|
-
found_state = pg.found[0]
|
|
45
|
-
|
|
46
|
-
result = found_state.solver.eval(r_eax)
|
|
47
|
-
assert result == 0x37B7AB70
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
if __name__ == "__main__":
|
|
51
|
-
unittest.main()
|
|
@@ -1,34 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
__package__ = __package__ or "tests.sim.exec_insn" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import subprocess
|
|
7
|
-
import sys
|
|
8
|
-
from unittest import main, skipUnless, TestCase
|
|
9
|
-
|
|
10
|
-
import angr
|
|
11
|
-
|
|
12
|
-
from ...common import bin_location
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
test_location = os.path.join(bin_location, "tests")
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
class TestSignedDiv(TestCase):
|
|
19
|
-
@skipUnless(sys.platform.startswith("linux"), "linux only")
|
|
20
|
-
def test_signed_div(self):
|
|
21
|
-
test_bin = os.path.join(test_location, "x86_64", "test_signed_div")
|
|
22
|
-
b = angr.Project(test_bin, auto_load_libs=False)
|
|
23
|
-
|
|
24
|
-
pg = b.factory.simulation_manager()
|
|
25
|
-
pg.explore()
|
|
26
|
-
out_angr = pg.deadended[0].posix.dumps(1)
|
|
27
|
-
with subprocess.Popen(test_bin, stdout=subprocess.PIPE) as proc:
|
|
28
|
-
stdout_real, _ = proc.communicate()
|
|
29
|
-
|
|
30
|
-
assert out_angr == stdout_real
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
if __name__ == "__main__":
|
|
34
|
-
main()
|
tests/sim/exec_insn/test_sqrt.py
DELETED
|
@@ -1,56 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint:disable=missing-class-docstring,no-self-use
|
|
3
|
-
import math
|
|
4
|
-
from unittest import TestCase, main
|
|
5
|
-
|
|
6
|
-
import claripy
|
|
7
|
-
import angr
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
class TestSqrt(TestCase):
|
|
11
|
-
def test_sqrt_symbolic(self):
|
|
12
|
-
ins_bytes = b"\xf3\x0f\x51\xc9" # sqrtss xmm1, xmm1
|
|
13
|
-
proj = angr.load_shellcode(ins_bytes, "amd64", load_address=0)
|
|
14
|
-
state = proj.factory.blank_state(addr=0)
|
|
15
|
-
|
|
16
|
-
xmm1 = claripy.FPS("v", claripy.FSORT_FLOAT)
|
|
17
|
-
state.regs.xmm1 = xmm1.to_bv()
|
|
18
|
-
simgr = proj.factory.simgr(state)
|
|
19
|
-
|
|
20
|
-
simgr.step(num_inst=1)
|
|
21
|
-
assert len(simgr.active) == 1
|
|
22
|
-
|
|
23
|
-
final = simgr.active[0]
|
|
24
|
-
result = final.regs.xmm1[31:0].raw_to_fp()
|
|
25
|
-
|
|
26
|
-
a = int(final.solver.eval(xmm1, extra_constraints=(result == 2.0,)))
|
|
27
|
-
assert a == 4
|
|
28
|
-
b = int(final.solver.eval(xmm1, extra_constraints=(result == 4.0,)))
|
|
29
|
-
assert b == 16
|
|
30
|
-
|
|
31
|
-
def test_sqrt_concrete(self):
|
|
32
|
-
ins_bytes = b"\xf3\x0f\x51\xc9" # sqrtss xmm1, xmm1
|
|
33
|
-
proj = angr.load_shellcode(ins_bytes, "amd64", load_address=0)
|
|
34
|
-
state = proj.factory.blank_state(addr=0)
|
|
35
|
-
|
|
36
|
-
xmm1 = claripy.FPV(200000, claripy.FSORT_FLOAT)
|
|
37
|
-
state.regs.xmm1 = xmm1.to_bv()
|
|
38
|
-
simgr = proj.factory.simgr(state)
|
|
39
|
-
|
|
40
|
-
simgr.step(num_inst=1)
|
|
41
|
-
assert len(simgr.active) == 1
|
|
42
|
-
|
|
43
|
-
final = simgr.active[0]
|
|
44
|
-
result = final.regs.xmm1[31:0].raw_to_fp()
|
|
45
|
-
|
|
46
|
-
a = final.solver.eval(result)
|
|
47
|
-
assert abs(a - math.sqrt(200000)) < 0.001
|
|
48
|
-
|
|
49
|
-
def test_sqrt_concrete_eager_evaluation(self):
|
|
50
|
-
a = claripy.FPV(2.0, claripy.FSORT_DOUBLE)
|
|
51
|
-
b = claripy.fpSqrt(a)
|
|
52
|
-
assert abs(b.concrete_value - 1.414) < 0.001
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
if __name__ == "__main__":
|
|
56
|
-
main()
|
tests/sim/options/__init__.py
DELETED
|
File without changes
|
tests/sim/options/test_0div.py
DELETED
|
@@ -1,54 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests.sim.options" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import os
|
|
5
|
-
import sys
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ...common import bin_location
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
test_location = os.path.join(bin_location, "tests")
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
# pylint: disable=missing-class-docstring
|
|
17
|
-
# pylint: disable=no-self-use
|
|
18
|
-
@unittest.skipIf(sys.platform == "win32", "broken on windows")
|
|
19
|
-
class Test0Div(unittest.TestCase):
|
|
20
|
-
def _run_0div(self, arch):
|
|
21
|
-
# check that we run in unicorn up to the zero-div site, fall back, try again in angr, and error correctly.
|
|
22
|
-
p = angr.Project(os.path.join(test_location, arch, "test_0div"), auto_load_libs=False)
|
|
23
|
-
s = p.factory.entry_state(add_options=angr.options.unicorn)
|
|
24
|
-
simgr = p.factory.simulation_manager(s)
|
|
25
|
-
simgr.run(n=5)
|
|
26
|
-
assert len(simgr.active) == 1
|
|
27
|
-
simgr.step()
|
|
28
|
-
assert len(simgr.errored) == 1
|
|
29
|
-
assert isinstance(simgr.errored[0].error, angr.errors.SimZeroDivisionException)
|
|
30
|
-
|
|
31
|
-
def test_0div_i386(self):
|
|
32
|
-
self._run_0div("i386")
|
|
33
|
-
|
|
34
|
-
def test_0div_x86_64(self):
|
|
35
|
-
self._run_0div("x86_64")
|
|
36
|
-
|
|
37
|
-
def test_symbolic_0div(self):
|
|
38
|
-
p = angr.load_shellcode(b"X", arch="amd64")
|
|
39
|
-
s = p.factory.blank_state()
|
|
40
|
-
s.regs.rax = s.solver.BVS("rax", 64)
|
|
41
|
-
s.regs.rcx = s.solver.BVS("rcx", 64)
|
|
42
|
-
s.regs.rdx = s.solver.BVS("rdx", 64)
|
|
43
|
-
|
|
44
|
-
s.options.add(angr.options.PRODUCE_ZERODIV_SUCCESSORS)
|
|
45
|
-
successors = s.step(insn_bytes=b"\x48\xf7\xf1") # div rcx
|
|
46
|
-
assert len(successors.flat_successors) == 2
|
|
47
|
-
|
|
48
|
-
s.options.discard(angr.options.PRODUCE_ZERODIV_SUCCESSORS)
|
|
49
|
-
successors = s.step(insn_bytes=b"\x48\xf7\xf1") # div rcx
|
|
50
|
-
assert len(successors.flat_successors) == 1
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
if __name__ == "__main__":
|
|
54
|
-
unittest.main()
|
|
@@ -1,59 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint:disable=missing-class-docstring,no-self-use
|
|
3
|
-
__package__ = __package__ or "tests.sim.options" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ...common import bin_location
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
test_location = os.path.join(bin_location, "tests")
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
def find(s):
|
|
17
|
-
return s.posix.dumps(1) == b"c0de\n"
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
def avoid(s):
|
|
21
|
-
return s.posix.dumps(1) == b"nothing\n"
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
class TestSymbolicFd(unittest.TestCase):
|
|
25
|
-
def test_symbolic_fd(self):
|
|
26
|
-
project = angr.Project(os.path.join(test_location, "x86_64", "symbolic_fd"))
|
|
27
|
-
|
|
28
|
-
for method_name in ("stat_test", "fstat_test", "open_test", "fopen_test", "fdopen_test"):
|
|
29
|
-
addr = project.loader.find_symbol(method_name).rebased_addr
|
|
30
|
-
|
|
31
|
-
# all files exist
|
|
32
|
-
state = project.factory.blank_state(addr=addr)
|
|
33
|
-
state.options["ALL_FILES_EXIST"] = True
|
|
34
|
-
simgr = project.factory.simgr(state)
|
|
35
|
-
while simgr.active != []:
|
|
36
|
-
simgr.explore(find=find, avoid=avoid)
|
|
37
|
-
assert simgr.avoid != [] and simgr.found == [], f"{method_name}: got {simgr.avoid} and {simgr.found}"
|
|
38
|
-
|
|
39
|
-
# any file might exist
|
|
40
|
-
state = project.factory.blank_state(addr=addr)
|
|
41
|
-
state.options["ALL_FILES_EXIST"] = False
|
|
42
|
-
state.options["ANY_FILE_MIGHT_EXIST"] = True
|
|
43
|
-
simgr = project.factory.simgr(state)
|
|
44
|
-
while simgr.active != []:
|
|
45
|
-
simgr.explore(find=find, avoid=avoid)
|
|
46
|
-
assert simgr.avoid != [] and simgr.found != [], f"{method_name}: got {simgr.avoid} and {simgr.found}"
|
|
47
|
-
|
|
48
|
-
# no file exists
|
|
49
|
-
state = project.factory.blank_state(addr=addr)
|
|
50
|
-
state.options["ALL_FILES_EXIST"] = False
|
|
51
|
-
state.options["ANY_FILE_MIGHT_EXIST"] = False
|
|
52
|
-
simgr = project.factory.simgr(state)
|
|
53
|
-
while simgr.active != []:
|
|
54
|
-
simgr.explore(find=find, avoid=avoid)
|
|
55
|
-
assert simgr.avoid == [] and simgr.found != [], f"{method_name}: got {simgr.avoid} and {simgr.found}"
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
if __name__ == "__main__":
|
|
59
|
-
unittest.main()
|
|
@@ -1,34 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
|
|
4
|
-
import unittest
|
|
5
|
-
|
|
6
|
-
import angr
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
class TestUnsupported(unittest.TestCase):
|
|
10
|
-
def test_unsupported_syscall_simos(self):
|
|
11
|
-
p = angr.load_shellcode("int 0x80", "x86")
|
|
12
|
-
state = p.factory.entry_state()
|
|
13
|
-
state.regs.eax = 4
|
|
14
|
-
|
|
15
|
-
# test that by default trying to perform a syscall without SimUserspace causes the state to go errored
|
|
16
|
-
simgr = p.factory.simulation_manager(state)
|
|
17
|
-
simgr.step()
|
|
18
|
-
assert len(simgr.active) == 1
|
|
19
|
-
simgr.step()
|
|
20
|
-
assert len(simgr.active) == 0
|
|
21
|
-
assert len(simgr.errored) == 1
|
|
22
|
-
|
|
23
|
-
# test that when we set BYPASS_UNSUPPORTED_SYSCALLS, we get a syscall stub instead
|
|
24
|
-
state.options.add(angr.options.BYPASS_UNSUPPORTED_SYSCALL)
|
|
25
|
-
simgr = p.factory.simulation_manager(state)
|
|
26
|
-
simgr.step()
|
|
27
|
-
assert len(simgr.active) == 1
|
|
28
|
-
simgr.step()
|
|
29
|
-
assert len(simgr.active) == 1
|
|
30
|
-
assert len(simgr.errored) == 0
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
if __name__ == "__main__":
|
|
34
|
-
unittest.main()
|