angr 9.2.87__py3-none-manylinux2014_x86_64.whl → 9.2.89__py3-none-manylinux2014_x86_64.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.


This version of angr might be problematic. Click here for more details.

Files changed (248) hide show
  1. angr/__init__.py +4 -1
  2. angr/analyses/decompiler/clinic.py +16 -0
  3. angr/analyses/decompiler/decompiler.py +3 -0
  4. angr/analyses/decompiler/optimization_passes/__init__.py +5 -0
  5. angr/analyses/decompiler/optimization_passes/cross_jump_reverter.py +108 -0
  6. angr/analyses/decompiler/optimization_passes/optimization_pass.py +17 -4
  7. angr/analyses/decompiler/optimization_passes/return_duplicator.py +4 -32
  8. angr/analyses/decompiler/structured_codegen/c.py +12 -2
  9. angr/analyses/decompiler/utils.py +13 -0
  10. angr/analyses/typehoon/dfa.py +108 -0
  11. angr/analyses/typehoon/lifter.py +34 -2
  12. angr/analyses/typehoon/simple_solver.py +1043 -503
  13. angr/analyses/typehoon/translator.py +13 -4
  14. angr/analyses/typehoon/typeconsts.py +117 -36
  15. angr/analyses/typehoon/typehoon.py +31 -11
  16. angr/analyses/typehoon/typevars.py +88 -21
  17. angr/analyses/typehoon/variance.py +10 -0
  18. angr/analyses/variable_recovery/engine_ail.py +28 -9
  19. angr/analyses/variable_recovery/engine_base.py +50 -43
  20. angr/analyses/variable_recovery/variable_recovery_base.py +16 -3
  21. angr/analyses/variable_recovery/variable_recovery_fast.py +14 -5
  22. angr/exploration_techniques/tracer.py +2 -0
  23. angr/misc/autoimport.py +26 -0
  24. angr/procedures/definitions/__init__.py +32 -3
  25. angr/utils/constants.py +1 -0
  26. angr/utils/graph.py +20 -1
  27. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/METADATA +7 -6
  28. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/RECORD +32 -244
  29. angr-9.2.89.dist-info/top_level.txt +1 -0
  30. angr/procedures/definitions/ntdll.py +0 -12
  31. angr-9.2.87.dist-info/top_level.txt +0 -2
  32. tests/__init__.py +0 -0
  33. tests/analyses/__init__.py +0 -0
  34. tests/analyses/cfg/__init__.py +0 -0
  35. tests/analyses/cfg/test_cfg_clflush.py +0 -43
  36. tests/analyses/cfg/test_cfg_get_any_node.py +0 -34
  37. tests/analyses/cfg/test_cfg_manager.py +0 -32
  38. tests/analyses/cfg/test_cfg_model.py +0 -55
  39. tests/analyses/cfg/test_cfg_patching.py +0 -378
  40. tests/analyses/cfg/test_cfg_rust_got_resolution.py +0 -36
  41. tests/analyses/cfg/test_cfg_thumb_firmware.py +0 -50
  42. tests/analyses/cfg/test_cfg_vex_postprocessor.py +0 -27
  43. tests/analyses/cfg/test_cfgemulated.py +0 -634
  44. tests/analyses/cfg/test_cfgfast.py +0 -1123
  45. tests/analyses/cfg/test_cfgfast_soot.py +0 -38
  46. tests/analyses/cfg/test_const_resolver.py +0 -38
  47. tests/analyses/cfg/test_iat_resolver.py +0 -37
  48. tests/analyses/cfg/test_jumptables.py +0 -3008
  49. tests/analyses/cfg/test_noop_blocks.py +0 -54
  50. tests/analyses/cfg_slice_to_sink/__init__.py +0 -0
  51. tests/analyses/cfg_slice_to_sink/test_cfg_slice_to_sink.py +0 -93
  52. tests/analyses/cfg_slice_to_sink/test_graph.py +0 -114
  53. tests/analyses/cfg_slice_to_sink/test_transitions.py +0 -28
  54. tests/analyses/decompiler/__init__.py +0 -0
  55. tests/analyses/decompiler/test_baseptr_save_simplifier.py +0 -80
  56. tests/analyses/decompiler/test_decompiler.py +0 -3336
  57. tests/analyses/decompiler/test_peephole_optimizations.py +0 -48
  58. tests/analyses/decompiler/test_propagator_loops.py +0 -101
  59. tests/analyses/decompiler/test_structurer.py +0 -275
  60. tests/analyses/reaching_definitions/__init__.py +0 -0
  61. tests/analyses/reaching_definitions/test_dep_graph.py +0 -432
  62. tests/analyses/reaching_definitions/test_function_handler.py +0 -131
  63. tests/analyses/reaching_definitions/test_heap_allocator.py +0 -46
  64. tests/analyses/reaching_definitions/test_rd_state.py +0 -78
  65. tests/analyses/reaching_definitions/test_reachingdefinitions.py +0 -463
  66. tests/analyses/reaching_definitions/test_subject.py +0 -76
  67. tests/analyses/test_bindiff.py +0 -52
  68. tests/analyses/test_block_simplifier.py +0 -112
  69. tests/analyses/test_boyscout.py +0 -104
  70. tests/analyses/test_calling_convention_analysis.py +0 -352
  71. tests/analyses/test_callsite_maker.py +0 -60
  72. tests/analyses/test_cdg.py +0 -165
  73. tests/analyses/test_cfb.py +0 -37
  74. tests/analyses/test_class_identifier.py +0 -46
  75. tests/analyses/test_clinic.py +0 -30
  76. tests/analyses/test_codetagging.py +0 -32
  77. tests/analyses/test_constantpropagation.py +0 -88
  78. tests/analyses/test_ddg.py +0 -95
  79. tests/analyses/test_ddg_global_var_dependencies.py +0 -83
  80. tests/analyses/test_ddg_memvar_addresses.py +0 -40
  81. tests/analyses/test_disassembly.py +0 -121
  82. tests/analyses/test_find_objects_static.py +0 -35
  83. tests/analyses/test_flirt.py +0 -49
  84. tests/analyses/test_identifier.py +0 -33
  85. tests/analyses/test_init_finder.py +0 -38
  86. tests/analyses/test_proximitygraph.py +0 -31
  87. tests/analyses/test_reassembler.py +0 -295
  88. tests/analyses/test_regionidentifier.py +0 -27
  89. tests/analyses/test_slicing.py +0 -164
  90. tests/analyses/test_stack_pointer_tracker.py +0 -74
  91. tests/analyses/test_static_hooker.py +0 -28
  92. tests/analyses/test_typehoon.py +0 -55
  93. tests/analyses/test_variablerecovery.py +0 -464
  94. tests/analyses/test_vfg.py +0 -221
  95. tests/analyses/test_vtable.py +0 -31
  96. tests/analyses/test_xrefs.py +0 -77
  97. tests/common.py +0 -128
  98. tests/engines/__init__.py +0 -0
  99. tests/engines/light/__init__.py +0 -0
  100. tests/engines/light/test_data.py +0 -17
  101. tests/engines/pcode/__init__.py +0 -0
  102. tests/engines/pcode/test_emulate.py +0 -607
  103. tests/engines/pcode/test_pcode.py +0 -84
  104. tests/engines/test_actions.py +0 -27
  105. tests/engines/test_hook.py +0 -112
  106. tests/engines/test_java.py +0 -697
  107. tests/engines/test_unicorn.py +0 -518
  108. tests/engines/vex/__init__.py +0 -0
  109. tests/engines/vex/test_lifter.py +0 -124
  110. tests/engines/vex/test_vex.py +0 -574
  111. tests/exploration_techniques/__init__.py +0 -0
  112. tests/exploration_techniques/test_cacher.py +0 -45
  113. tests/exploration_techniques/test_director.py +0 -67
  114. tests/exploration_techniques/test_driller_core.py +0 -48
  115. tests/exploration_techniques/test_loop_seer.py +0 -158
  116. tests/exploration_techniques/test_memory_watcher.py +0 -46
  117. tests/exploration_techniques/test_oppologist.py +0 -65
  118. tests/exploration_techniques/test_spiller.py +0 -82
  119. tests/exploration_techniques/test_stochastic.py +0 -40
  120. tests/exploration_techniques/test_tech_builder.py +0 -61
  121. tests/exploration_techniques/test_tracer.py +0 -856
  122. tests/exploration_techniques/test_unique.py +0 -40
  123. tests/exploration_techniques/test_veritesting.py +0 -120
  124. tests/factory/__init__.py +0 -0
  125. tests/factory/block/__init__.py +0 -0
  126. tests/factory/block/test_block_cache.py +0 -33
  127. tests/factory/block/test_keystone.py +0 -106
  128. tests/factory/test_argc.py +0 -101
  129. tests/factory/test_argc_sym.py +0 -110
  130. tests/factory/test_argv.py +0 -158
  131. tests/factory/test_callable.py +0 -266
  132. tests/factory/test_windows_args.py +0 -36
  133. tests/knowledge_plugins/__init__.py +0 -0
  134. tests/knowledge_plugins/cfg/__init__.py +0 -0
  135. tests/knowledge_plugins/cfg/test_cfg_manager.py +0 -36
  136. tests/knowledge_plugins/functions/__init__.py +0 -0
  137. tests/knowledge_plugins/functions/test_function.py +0 -91
  138. tests/knowledge_plugins/functions/test_function2.py +0 -79
  139. tests/knowledge_plugins/functions/test_function_manager.py +0 -139
  140. tests/knowledge_plugins/functions/test_prototypes.py +0 -53
  141. tests/knowledge_plugins/key_definitions/__init__.py +0 -0
  142. tests/knowledge_plugins/key_definitions/test_atoms.py +0 -24
  143. tests/knowledge_plugins/key_definitions/test_environment.py +0 -126
  144. tests/knowledge_plugins/key_definitions/test_heap_address.py +0 -27
  145. tests/knowledge_plugins/key_definitions/test_live_definitions.py +0 -72
  146. tests/knowledge_plugins/test_dwarf_variables.py +0 -240
  147. tests/knowledge_plugins/test_kb_plugins.py +0 -91
  148. tests/knowledge_plugins/test_kb_plugins_dwarf.py +0 -36
  149. tests/knowledge_plugins/test_patches.py +0 -48
  150. tests/misc/__init__.py +0 -0
  151. tests/misc/test_hookset.py +0 -57
  152. tests/perf/__init__.py +0 -0
  153. tests/perf/perf_cfgemulated.py +0 -19
  154. tests/perf/perf_cfgfast.py +0 -18
  155. tests/perf/perf_concrete_execution.py +0 -41
  156. tests/perf/perf_siminspect_nop.py +0 -36
  157. tests/perf/perf_state_copy.py +0 -33
  158. tests/perf/perf_unicorn_0.py +0 -27
  159. tests/perf/perf_unicorn_1.py +0 -23
  160. tests/procedures/__init__.py +0 -0
  161. tests/procedures/glibc/__init__.py +0 -0
  162. tests/procedures/glibc/test_ctype_locale.py +0 -164
  163. tests/procedures/libc/__init__.py +0 -0
  164. tests/procedures/libc/test_fgets.py +0 -53
  165. tests/procedures/libc/test_scanf.py +0 -205
  166. tests/procedures/libc/test_sprintf.py +0 -44
  167. tests/procedures/libc/test_sscanf.py +0 -63
  168. tests/procedures/libc/test_strcasecmp.py +0 -37
  169. tests/procedures/libc/test_string.py +0 -1102
  170. tests/procedures/libc/test_strtol.py +0 -78
  171. tests/procedures/linux_kernel/__init__.py +0 -0
  172. tests/procedures/linux_kernel/test_lseek.py +0 -174
  173. tests/procedures/posix/__init__.py +0 -0
  174. tests/procedures/posix/test_chroot.py +0 -33
  175. tests/procedures/posix/test_getenv.py +0 -78
  176. tests/procedures/posix/test_pwrite_pread.py +0 -57
  177. tests/procedures/posix/test_sim_time.py +0 -46
  178. tests/procedures/posix/test_unlink.py +0 -46
  179. tests/procedures/test_project_resolve_simproc.py +0 -43
  180. tests/procedures/test_sim_procedure.py +0 -117
  181. tests/procedures/test_stub_procedure_args.py +0 -53
  182. tests/serialization/__init__.py +0 -0
  183. tests/serialization/test_db.py +0 -197
  184. tests/serialization/test_pickle.py +0 -95
  185. tests/serialization/test_serialization.py +0 -132
  186. tests/serialization/test_vault.py +0 -169
  187. tests/sim/__init__.py +0 -3
  188. tests/sim/exec_func/__init__.py +0 -0
  189. tests/sim/exec_func/test_mem_funcs.py +0 -55
  190. tests/sim/exec_func/test_str_funcs.py +0 -93
  191. tests/sim/exec_func/test_syscall_result.py +0 -39
  192. tests/sim/exec_insn/__init__.py +0 -0
  193. tests/sim/exec_insn/test_adc.py +0 -44
  194. tests/sim/exec_insn/test_ops.py +0 -83
  195. tests/sim/exec_insn/test_rcr.py +0 -26
  196. tests/sim/exec_insn/test_rol.py +0 -51
  197. tests/sim/exec_insn/test_signed_div.py +0 -34
  198. tests/sim/exec_insn/test_sqrt.py +0 -56
  199. tests/sim/options/__init__.py +0 -0
  200. tests/sim/options/test_0div.py +0 -54
  201. tests/sim/options/test_symbolic_fd.py +0 -59
  202. tests/sim/options/test_unsupported.py +0 -34
  203. tests/sim/test_accuracy.py +0 -137
  204. tests/sim/test_checkbyte.py +0 -53
  205. tests/sim/test_echo.py +0 -36
  206. tests/sim/test_fauxware.py +0 -202
  207. tests/sim/test_self_modifying_code.py +0 -65
  208. tests/sim/test_simple_api.py +0 -36
  209. tests/sim/test_simulation_manager.py +0 -147
  210. tests/sim/test_stack_alignment.py +0 -65
  211. tests/sim/test_state.py +0 -303
  212. tests/sim/test_state_customization.py +0 -54
  213. tests/sim/test_symbol_hooked_by.py +0 -49
  214. tests/simos/__init__.py +0 -0
  215. tests/simos/windows/__init__.py +0 -0
  216. tests/simos/windows/test_windows_stack_cookie.py +0 -58
  217. tests/state_plugins/__init__.py +0 -0
  218. tests/state_plugins/inspect/__init__.py +0 -0
  219. tests/state_plugins/inspect/test_inspect.py +0 -310
  220. tests/state_plugins/inspect/test_syscall_override.py +0 -90
  221. tests/state_plugins/posix/__init__.py +0 -0
  222. tests/state_plugins/posix/test_file_struct_funcs.py +0 -56
  223. tests/state_plugins/posix/test_files.py +0 -69
  224. tests/state_plugins/posix/test_posix.py +0 -72
  225. tests/state_plugins/solver/__init__.py +0 -0
  226. tests/state_plugins/solver/test_simsolver.py +0 -58
  227. tests/state_plugins/solver/test_symbolic.py +0 -153
  228. tests/state_plugins/solver/test_variable_registration.py +0 -46
  229. tests/state_plugins/test_callstack.py +0 -54
  230. tests/state_plugins/test_gdb_plugin.py +0 -35
  231. tests/state_plugins/test_multi_open_file.py +0 -47
  232. tests/state_plugins/test_symbolization.py +0 -38
  233. tests/storage/__init__.py +0 -0
  234. tests/storage/test_memory.py +0 -960
  235. tests/storage/test_memory_merge.py +0 -114
  236. tests/storage/test_memview.py +0 -205
  237. tests/storage/test_mmap.py +0 -26
  238. tests/storage/test_multivalues.py +0 -44
  239. tests/storage/test_permissions.py +0 -32
  240. tests/storage/test_ptmalloc.py +0 -291
  241. tests/storage/test_relro_perm.py +0 -49
  242. tests/test_calling_conventions.py +0 -86
  243. tests/test_types.py +0 -329
  244. tests/utils/__init__.py +0 -0
  245. tests/utils/test_graph.py +0 -41
  246. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/LICENSE +0 -0
  247. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/WHEEL +0 -0
  248. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/entry_points.txt +0 -0
@@ -1,310 +0,0 @@
1
- #!/usr/bin/env python3
2
- # pylint: disable=missing-class-docstring,disable=no-self-use
3
- __package__ = __package__ or "tests.state_plugins.inspect" # pylint:disable=redefined-builtin
4
-
5
- import os
6
- import unittest
7
-
8
- import pyvex
9
- import claripy
10
- import archinfo
11
-
12
- import angr
13
- from angr import SimState, BP_AFTER, BP_BEFORE, SIM_PROCEDURES, concretization_strategies
14
- from angr.engines import ProcedureEngine, HeavyVEXMixin, SimInspectMixin
15
-
16
- from ...common import bin_location
17
-
18
-
19
- test_location = os.path.join(bin_location, "tests")
20
-
21
-
22
- class InspectEngine(SimInspectMixin, HeavyVEXMixin):
23
- pass
24
-
25
-
26
- class TestInspect(unittest.TestCase):
27
- def test_inspect(self):
28
- class counts: # pylint:disable=no-init
29
- mem_read = 0
30
- mem_write = 0
31
- reg_read = 0
32
- reg_write = 0
33
- tmp_read = 0
34
- tmp_write = 0
35
- expr = 0
36
- statement = 0
37
- instruction = 0
38
- constraints = 0
39
- variables = 0
40
-
41
- def act_mem_read(state): # pylint:disable=unused-argument
42
- counts.mem_read += 1
43
-
44
- def act_mem_write(state): # pylint:disable=unused-argument
45
- counts.mem_write += 1
46
-
47
- def act_reg_read(state): # pylint:disable=unused-argument
48
- counts.reg_read += 1
49
-
50
- def act_reg_write(state): # pylint:disable=unused-argument
51
- counts.reg_write += 1
52
-
53
- def act_tmp_read(state): # pylint:disable=unused-argument
54
- counts.tmp_read += 1
55
-
56
- def act_tmp_write(state): # pylint:disable=unused-argument
57
- counts.tmp_write += 1
58
-
59
- def act_expr(state): # pylint:disable=unused-argument
60
- counts.expr += 1
61
-
62
- def act_statement(state): # pylint:disable=unused-argument
63
- counts.statement += 1
64
-
65
- def act_instruction(state): # pylint:disable=unused-argument
66
- counts.instruction += 1
67
-
68
- def act_variables(state): # pylint:disable=unused-argument
69
- # print "CREATING:", state.inspect.symbolic_name
70
- counts.variables += 1
71
-
72
- # def act_constraints(state): #pylint:disable=unused-argument
73
- # counts.constraints += 1
74
-
75
- s = SimState(arch="AMD64", mode="symbolic")
76
-
77
- s.inspect.b("mem_write", when=BP_AFTER, action=act_mem_write)
78
- assert counts.mem_write == 0
79
- s.memory.store(100, s.solver.BVV(10, 32))
80
- assert counts.mem_write == 1
81
-
82
- s.inspect.b("mem_read", when=BP_AFTER, action=act_mem_read)
83
- s.inspect.b("mem_read", when=BP_AFTER, action=act_mem_read, mem_read_address=100)
84
- s.inspect.b("mem_read", when=BP_AFTER, action=act_mem_read, mem_read_address=123)
85
- s.inspect.b("mem_read", when=BP_BEFORE, action=act_mem_read, mem_read_length=3)
86
- assert counts.mem_read == 0
87
- s.memory.load(123, 4)
88
- s.memory.load(223, 3)
89
- assert counts.mem_read == 4
90
-
91
- s.inspect.b("reg_read", when=BP_AFTER, action=act_reg_read)
92
- assert counts.reg_read == 0
93
- s.registers.load(16, size=8)
94
- assert counts.reg_read == 1
95
-
96
- s.inspect.b("reg_write", when=BP_AFTER, action=act_reg_write)
97
- assert counts.reg_write == 0
98
- s.registers.store(16, s.solver.BVV(10, 32))
99
- assert counts.reg_write == 1
100
- assert counts.mem_write == 1
101
- assert counts.mem_read == 4
102
- assert counts.reg_read == 1
103
-
104
- s.inspect.b("tmp_read", when=BP_AFTER, action=act_tmp_read, tmp_read_num=0)
105
- s.inspect.b("tmp_write", when=BP_AFTER, action=act_tmp_write, tmp_write_num=0)
106
- s.inspect.b("expr", when=BP_AFTER, action=act_expr, expr_result=1016)
107
- s.inspect.b("statement", when=BP_AFTER, action=act_statement)
108
- s.inspect.b("instruction", when=BP_AFTER, action=act_instruction, instruction=1001)
109
- s.inspect.b("instruction", when=BP_AFTER, action=act_instruction, instruction=1000)
110
- irsb = pyvex.IRSB(b"\x90\x90\x90\x90\xeb\x0a", mem_addr=1000, arch=archinfo.ArchAMD64(), opt_level=0)
111
- irsb.pp()
112
- InspectEngine(None).process(s, irsb=irsb)
113
- assert counts.reg_write == 7
114
- assert counts.reg_read == 2
115
- assert counts.tmp_write == 1
116
- assert counts.tmp_read == 1
117
- assert counts.expr == 3
118
- assert counts.statement == 11
119
- assert counts.instruction == 2
120
- assert counts.constraints == 0
121
- assert counts.mem_write == 1
122
- assert counts.mem_read == 4
123
-
124
- s = SimState(arch="AMD64", mode="symbolic")
125
- s.inspect.b("symbolic_variable", when=BP_AFTER, action=act_variables)
126
- s.memory.load(0, 10)
127
- assert counts.variables == 1
128
-
129
- def test_inspect_exit(self):
130
- class counts: # pylint:disable=no-init
131
- exit_before = 0
132
- exit_after = 0
133
-
134
- def handle_exit_before(state):
135
- counts.exit_before += 1
136
- exit_target = state.inspect.exit_target
137
- assert state.solver.eval(exit_target) == 0x3F8
138
- # change exit target
139
- state.inspect.exit_target = 0x41414141
140
- assert state.inspect.exit_jumpkind == "Ijk_Boring"
141
- assert state.inspect.exit_guard.is_true()
142
-
143
- def handle_exit_after(state): # pylint:disable=unused-argument
144
- counts.exit_after += 1
145
-
146
- s = SimState(arch="AMD64", mode="symbolic")
147
- irsb = pyvex.IRSB(b"\x90\x90\x90\x90\xeb\x0a", mem_addr=1000, arch=archinfo.ArchAMD64())
148
-
149
- # break on exit
150
- s.inspect.b("exit", BP_BEFORE, action=handle_exit_before)
151
- s.inspect.b("exit", BP_AFTER, action=handle_exit_after)
152
-
153
- # step it
154
- succ = HeavyVEXMixin(None).process(s, irsb=irsb).flat_successors
155
-
156
- # check
157
- assert succ[0].solver.eval(succ[0].ip) == 0x41414141
158
- assert counts.exit_before == 1
159
- assert counts.exit_after == 1
160
-
161
- def test_inspect_syscall(self):
162
- class counts: # pylint:disable=no-init
163
- exit_before = 0
164
- exit_after = 0
165
-
166
- def handle_syscall_before(state):
167
- counts.exit_before += 1
168
- syscall_name = state.inspect.syscall_name
169
- assert syscall_name == "close"
170
-
171
- def handle_syscall_after(state):
172
- counts.exit_after += 1
173
- syscall_name = state.inspect.syscall_name
174
- assert syscall_name == "close"
175
-
176
- s = SimState(arch="AMD64", mode="symbolic")
177
- # set up to call so syscall close
178
- s.regs.rax = 3
179
- s.regs.rdi = 2
180
-
181
- # break on syscall
182
- s.inspect.b("syscall", BP_BEFORE, action=handle_syscall_before)
183
- s.inspect.b("syscall", BP_AFTER, action=handle_syscall_after)
184
-
185
- # step it
186
- proc = SIM_PROCEDURES["posix"]["close"](is_syscall=True)
187
- ProcedureEngine(None).process(s, procedure=proc, ret_to=s.ip)
188
-
189
- # check counts
190
- assert counts.exit_before == 1
191
- assert counts.exit_after == 1
192
-
193
- def test_inspect_concretization(self):
194
- # some values for the test
195
- x = claripy.BVS("x", 64)
196
- y = claripy.BVS("y", 64)
197
-
198
- #
199
- # This tests concretization-time address redirection.
200
- #
201
-
202
- def change_symbolic_target(state):
203
- if state.inspect.address_concretization_action == "store":
204
- state.inspect.address_concretization_expr = claripy.BVV(0x1000, state.arch.bits)
205
-
206
- s = SimState(arch="AMD64")
207
- s.inspect.b("address_concretization", BP_BEFORE, action=change_symbolic_target)
208
- s.memory.store(x, "A")
209
- assert list(s.solver.eval_upto(x, 10)) == [0x1000]
210
- assert list(s.solver.eval_upto(s.memory.load(0x1000, 1), 10)) == [0x41]
211
-
212
- #
213
- # This tests disabling constraint adding through siminspect -- the write still happens
214
- #
215
-
216
- def dont_add_constraints(state):
217
- state.inspect.address_concretization_add_constraints = False
218
-
219
- s = SimState(arch="AMD64")
220
- s.inspect.b("address_concretization", BP_BEFORE, action=dont_add_constraints)
221
- s.memory.store(x, "A")
222
- assert len(s.solver.eval_upto(x, 10)) == 10
223
-
224
- #
225
- # This tests raising an exception if symbolic concretization fails (i.e., if the address
226
- # is too unconstrained). The write aborts.
227
- #
228
-
229
- class UnconstrainedAbort(Exception):
230
- def __init__(self, message, state):
231
- Exception.__init__(self, message)
232
- self.state = state
233
-
234
- def abort_unconstrained(state):
235
- print(state.inspect.address_concretization_strategy, state.inspect.address_concretization_result)
236
- if (
237
- isinstance(
238
- state.inspect.address_concretization_strategy,
239
- concretization_strategies.SimConcretizationStrategyRange,
240
- )
241
- and state.inspect.address_concretization_result is None
242
- ):
243
- raise UnconstrainedAbort("uh oh", state)
244
-
245
- s = SimState(arch="AMD64")
246
- s.memory.write_strategies.insert(0, concretization_strategies.SimConcretizationStrategyRange(128))
247
- s.memory._write_address_range = 1
248
- s.memory._write_address_range_approx = 1
249
- s.add_constraints(y == 10)
250
- s.inspect.b("address_concretization", BP_AFTER, action=abort_unconstrained)
251
- s.memory.store(y, "A")
252
- assert list(s.solver.eval_upto(s.memory.load(y, 1), 10)) == [0x41]
253
-
254
- try:
255
- s.memory.store(x, "A")
256
- print("THIS SHOULD NOT BE REACHED")
257
- assert False
258
- except UnconstrainedAbort as e:
259
- assert e.state.memory is s.memory
260
-
261
- def test_inspect_engine_process(self):
262
- p = angr.Project(os.path.join(test_location, "x86_64", "fauxware"), auto_load_libs=False)
263
-
264
- def check_first_symbolic_fork(state):
265
- succs = state.inspect.sim_successors.successors
266
- succ_addr = [hex(s.addr) for s in succs]
267
- assert len(succ_addr) == 2
268
- assert "0x400692L" in succ_addr
269
- assert "0x400699L" in succ_addr
270
- print("Fork after:", hex(state.addr))
271
- print("Successors:", succ_addr)
272
-
273
- def check_second_symbolic_fork(state):
274
- succs = state.inspect.sim_successors.successors
275
- succ_addr = [hex(s.addr) for s in succs]
276
- assert len(succ_addr) == 2
277
- assert "0x4006dfL" in succ_addr
278
- assert "0x4006e6L" in succ_addr
279
- print("Fork after:", hex(state.addr))
280
- print("Successors:", succ_addr)
281
-
282
- def first_symbolic_fork(state):
283
- return hex(state.addr) == "0x40068eL" and isinstance(state.inspect.sim_engine, HeavyVEXMixin)
284
- # TODO: I think this latter check is meaningless with the eleventh hour refactor
285
-
286
- def second_symbolic_fork(state):
287
- return hex(state.addr) == "0x4006dbL" and isinstance(state.inspect.sim_engine, HeavyVEXMixin)
288
-
289
- def check_state(state):
290
- assert hex(state.inspect.sim_successors.addr) in ("0x40068eL", "0x4006dbL")
291
-
292
- state = p.factory.entry_state(addr=p.loader.find_symbol("main").rebased_addr)
293
- pg = p.factory.simulation_manager(state)
294
- state.inspect.b("engine_process", when=BP_BEFORE, action=check_state, condition=first_symbolic_fork)
295
- state.inspect.b(
296
- "engine_process", when=BP_AFTER, action=check_first_symbolic_fork, condition=first_symbolic_fork
297
- )
298
- pg.run()
299
-
300
- state = p.factory.entry_state(addr=p.loader.find_symbol("main").rebased_addr)
301
- pg = p.factory.simulation_manager(state)
302
- state.inspect.b("engine_process", when=BP_BEFORE, action=check_state, condition=second_symbolic_fork)
303
- state.inspect.b(
304
- "engine_process", when=BP_AFTER, action=check_second_symbolic_fork, condition=second_symbolic_fork
305
- )
306
- pg.run()
307
-
308
-
309
- if __name__ == "__main__":
310
- unittest.main()
@@ -1,90 +0,0 @@
1
- #!/usr/bin/env python3
2
- __package__ = __package__ or "tests.state_plugins.inspect" # pylint:disable=redefined-builtin
3
-
4
- import os
5
- import unittest
6
-
7
- import angr
8
-
9
- from ...common import bin_location, broken
10
-
11
-
12
- test_location = os.path.join(bin_location, "tests")
13
-
14
- target_addrs = {"i386": [0x080485C9], "x86_64": [0x4006ED], "ppc": [0x1000060C], "armel": [0x85F0], "mips": [0x4009FC]}
15
-
16
- avoid_addrs = {
17
- "i386": [0x080485DD, 0x08048564],
18
- "x86_64": [0x4006AA, 0x4006FD],
19
- "ppc": [0x10000644, 0x1000059C],
20
- "armel": [0x86F8, 0x857C],
21
- "mips": [0x400A10, 0x400774],
22
- }
23
-
24
- corrupt_addrs = {
25
- "i386": [0x80486B6, b"bO\xcc", lambda s: s.memory.store(s.regs.esp, s.regs.eax)],
26
- "x86_64": [0x400742, b"\xd4&\xb0[\x41", lambda s: s.registers.store("rdx", 8)],
27
- "ppc": [0x100006B8, b"\x05\xad\xc2\xea", lambda s: s.registers.store("r5", 8)],
28
- "armel": [0x8678, b"\xbdM\xec3", lambda s: s.registers.store("r2", 8)],
29
- "mips": [0x400918, b"[\xf8\x96@"[::-1], lambda s: s.registers.store("a2", 8)],
30
- }
31
-
32
-
33
- class TestSyscallOverride(unittest.TestCase):
34
- def _run_fauxware_override(self, arch):
35
- # auto_load_libs can't be disabled as the test fails
36
- p = angr.Project(os.path.join(test_location, arch, "fauxware"), use_sim_procedures=False)
37
- s = p.factory.full_init_state()
38
-
39
- def overwrite_str(state):
40
- state.posix.get_fd(1).write_data(b"HAHA\0")
41
-
42
- queued_syscall_returns = []
43
- queued_syscall_returns.append(None) # let the mmap run
44
- queued_syscall_returns.append(overwrite_str) # prompt for username
45
- queued_syscall_returns.append(0) # username read
46
- queued_syscall_returns.append(0) # newline read
47
- # queued_syscall_returns.append(0) # prompt for password -- why isn't this called?
48
- queued_syscall_returns.append(None) # password input
49
- queued_syscall_returns.append(0) # password \n input
50
-
51
- def syscall_hook(state):
52
- if not state.inspect.simprocedure.is_syscall:
53
- return
54
- try:
55
- f = queued_syscall_returns.pop(0)
56
- if f is None:
57
- return
58
- state.inspect.simprocedure_result = f(state) if callable(f) else f
59
- except IndexError:
60
- return
61
-
62
- s.inspect.make_breakpoint("simprocedure", s.inspect.BP_BEFORE, action=syscall_hook)
63
-
64
- results = p.factory.simulation_manager(thing=s).explore(find=target_addrs[arch], avoid=avoid_addrs[arch])
65
- stdin = results.found[0].posix.dumps(0)
66
- assert b"SOSNEAKY" == stdin
67
- stdout = results.found[0].posix.dumps(1)
68
- assert b"HAHA\0" == stdout
69
-
70
- def test_fauxware_override_x86_64(self):
71
- self._run_fauxware_override("x86_64")
72
-
73
- def test_fauxware_override_i386(self):
74
- self._run_fauxware_override("i386")
75
-
76
- @broken
77
- def test_fauxware_override_ppc(self):
78
- self._run_fauxware_override("ppc")
79
-
80
- @broken
81
- def test_fauxware_override_armel(self):
82
- self._run_fauxware_override("armel")
83
-
84
- @broken
85
- def test_fauxware_override_mips(self):
86
- self._run_fauxware_override("mips")
87
-
88
-
89
- if __name__ == "__main__":
90
- unittest.main()
File without changes
@@ -1,56 +0,0 @@
1
- #!/usr/bin/env python3
2
- # pylint: disable=missing-class-docstring,disable=no-self-use
3
- __package__ = __package__ or "tests.state_plugins.posix" # pylint:disable=redefined-builtin
4
-
5
- import os
6
- import unittest
7
-
8
- import angr
9
-
10
- from ...common import bin_location
11
-
12
-
13
- test_location = os.path.join(bin_location, "tests")
14
-
15
-
16
- class TestFileStructFuncs(unittest.TestCase):
17
- def check_state_1(self, state):
18
- # Need to dump file.txt by path because program closes it
19
- return (
20
- state.posix.dump_file_by_path("file.txt") == b"testing abcdef"
21
- and state.posix.dumps(0)[:4] == b"xyz\n"
22
- and state.posix.dumps(1) == b"good1\n"
23
- and state.posix.dumps(2) == b""
24
- )
25
-
26
- def check_state_2(self, state):
27
- return (
28
- state.posix.dump_file_by_path("file.txt") == b"testing abcdef"
29
- and state.posix.dumps(0)[:4] == b"wxyz"
30
- and state.posix.dumps(1) == b""
31
- and state.posix.dumps(2) == b"good2\n"
32
- )
33
-
34
- def check_state_3(self, state):
35
- return (
36
- state.posix.dump_file_by_path("file.txt") == b"testing abcdef"
37
- and state.posix.dumps(1) == b""
38
- and state.posix.dumps(2) == b""
39
- )
40
-
41
- def test_file_struct_funcs(self):
42
- test_bin = os.path.join(test_location, "x86_64", "file_func_test")
43
- b = angr.Project(test_bin, auto_load_libs=False)
44
-
45
- pg = b.factory.simulation_manager()
46
- pg.active[0].options.discard("LAZY_SOLVES")
47
- pg.explore()
48
-
49
- assert len(pg.deadended) == 3
50
-
51
- for p in pg.deadended:
52
- assert self.check_state_1(p) or self.check_state_2(p) or self.check_state_3(p)
53
-
54
-
55
- if __name__ == "__main__":
56
- unittest.main()
@@ -1,69 +0,0 @@
1
- #!/usr/bin/env python3
2
- # pylint: disable=missing-class-docstring,disable=no-self-use
3
- __package__ = __package__ or "tests.state_plugins.posix" # pylint:disable=redefined-builtin
4
-
5
- import os
6
- import sys
7
- import unittest
8
-
9
- import angr
10
- from angr.state_plugins.posix import Flags
11
-
12
- from ...common import bin_location
13
-
14
-
15
- test_location = os.path.join(bin_location, "tests")
16
-
17
-
18
- class TestFile(unittest.TestCase):
19
- def test_files(self):
20
- s = angr.SimState(arch="AMD64")
21
- s.posix.get_fd(1).write_data(b"HELLO")
22
- s.posix.get_fd(1).write_data(b"WORLD")
23
- assert s.posix.dumps(1) == b"HELLOWORLD"
24
- assert s.posix.stdout.concretize() == [b"HELLO", b"WORLD"]
25
-
26
- s = angr.SimState(arch="AMD64")
27
- s.posix.get_fd(1).write_data(b"A" * 0x1000, 0x800)
28
- assert s.posix.dumps(1) == b"A" * 0x800
29
-
30
- def test_file_read_missing_content(self):
31
- # test in tracing mode since the Reverse operator will not be optimized away
32
- s = angr.SimState(arch="AMD64", mode="tracing")
33
- fd = s.posix.open(b"/tmp/oops", Flags.O_RDWR)
34
- length = s.posix.get_fd(fd).read(0xC00000, 100)
35
-
36
- data = s.memory.load(0xC00000, length, endness="Iend_BE")
37
- assert data.op != "Reverse", "Byte strings read directly out of a file should not have Reverse operators."
38
- assert data.op == "BVS"
39
- assert len(data.variables) == 1
40
- assert "oops" in next(iter(data.variables))
41
-
42
- @unittest.skipIf(sys.platform == "win32", "broken on windows")
43
- def test_concrete_fs_resolution(self):
44
- bin_path = os.path.join(test_location, "i386", "fauxware")
45
- proj = angr.Project(bin_path, auto_load_libs=False)
46
- state = proj.factory.entry_state(concrete_fs=True)
47
- fd = state.posix.open(bin_path, Flags.O_RDONLY)
48
- stat = state.posix.fstat(fd)
49
- size = stat.st_size
50
- int_size = state.solver.eval(size)
51
-
52
- assert stat
53
- assert int_size != 0
54
- assert not state.solver.symbolic(size)
55
-
56
- def test_sim_fs_resolution(self):
57
- bin_path = os.path.join(test_location, "i386", "fauxware")
58
- proj = angr.Project(bin_path, auto_load_libs=False)
59
- state = proj.factory.entry_state()
60
- fd = state.posix.open(bin_path, Flags.O_RDONLY)
61
- stat = state.posix.fstat(fd)
62
- size = stat.st_size
63
-
64
- assert stat
65
- assert state.solver.symbolic(size)
66
-
67
-
68
- if __name__ == "__main__":
69
- unittest.main()
@@ -1,72 +0,0 @@
1
- #!/usr/bin/env python3
2
- # pylint: disable=missing-class-docstring,no-self-use,line-too-long
3
-
4
- import unittest
5
-
6
- from angr import SimState, SimFile
7
-
8
-
9
- class TestPosix(unittest.TestCase):
10
- def test_file_create(self):
11
- # Create a state first
12
- state = SimState(arch="AMD64", mode="symbolic")
13
-
14
- # Create a file
15
- fd = state.posix.open(b"test", 1)
16
-
17
- assert fd == 3
18
-
19
- def test_file_read(self):
20
- state = SimState(arch="AMD64", mode="symbolic")
21
-
22
- content = state.solver.BVV(0xBADF00D, 32)
23
- content_size = content.size() // 8
24
-
25
- fd = state.posix.open(b"test", 1)
26
- simfd = state.posix.get_fd(fd)
27
- simfd.write_data(content)
28
- simfd.seek(0)
29
- simfd.read(0xC0000000, content_size)
30
-
31
- data = state.memory.load(0xC0000000, content_size)
32
-
33
- assert data is content
34
-
35
- def test_file_seek(self):
36
- # TODO: Make this test more complete
37
-
38
- state = SimState(arch="AMD64", mode="symbolic")
39
-
40
- # Normal seeking
41
- fd = state.posix.open(b"test1", 1)
42
- simfd = state.posix.get_fd(fd)
43
- simfd.seek(0, "start")
44
- assert state.solver.is_true(simfd.tell() == 0)
45
- state.posix.close(fd)
46
-
47
- # TODO: test case: seek cannot go beyond the file size or current file pos
48
-
49
- # seek should not work for stdin/stdout/stderr
50
- assert state.solver.is_false(state.posix.get_fd(0).seek(0))
51
- assert state.solver.is_false(state.posix.get_fd(1).seek(0))
52
- assert state.solver.is_false(state.posix.get_fd(2).seek(0))
53
-
54
- # Seek from the end
55
- state.fs.insert("test2", SimFile(name="qwer", size=20))
56
- fd = state.posix.open(b"test2", 1)
57
- simfd = state.posix.get_fd(fd)
58
- simfd.seek(0, "end")
59
- assert state.solver.is_true(simfd.tell() == 20)
60
- state.posix.close(fd)
61
-
62
- # seek to a symbolic position (whence symbolic end)
63
- fd = state.posix.open(b"unknown_size", 1)
64
- simfd = state.posix.get_fd(fd)
65
- real_end = state.fs.get("unknown_size").size
66
- simfd.seek(0, "end")
67
- assert real_end is simfd.tell()
68
- state.posix.close(fd)
69
-
70
-
71
- if __name__ == "__main__":
72
- unittest.main()
File without changes
@@ -1,58 +0,0 @@
1
- #!/usr/bin/env python3
2
- # pylint:disable=no-self-use
3
-
4
- import struct
5
- import unittest
6
-
7
- import claripy
8
-
9
- import angr
10
-
11
-
12
- class TestSolverEvalCasting(unittest.TestCase):
13
- """
14
- Basic test cases of SimSolver::eval's `cast_to` function.
15
- """
16
-
17
- def test_eval_cast_bvv_to_bytes(self):
18
- s = angr.SimState(arch="AMD64", mode="symbolic")
19
- assert s.solver.eval(claripy.BVV(0, 0), cast_to=bytes) == b""
20
- assert s.solver.eval(claripy.BVV(0, 8), cast_to=bytes) == b"\x00"
21
- assert s.solver.eval(claripy.BVV(0x12345678, 32), cast_to=bytes) == b"\x12\x34\x56\x78"
22
-
23
- def test_eval_cast_bvv_to_bytes__non_8bit_length_multiple(self):
24
- s = angr.SimState(arch="AMD64", mode="symbolic")
25
- for nbits in [1, 2, 7]:
26
- with self.subTest(nbits=nbits):
27
- with self.assertRaises(ValueError):
28
- s.solver.eval(claripy.BVV(0, nbits), cast_to=bytes)
29
-
30
- def test_eval_cast_fpv_to_bytes(self):
31
- s = angr.SimState(arch="AMD64", mode="symbolic")
32
- value = 1.23456
33
- fpv = claripy.FPV(value, claripy.FSORT_FLOAT)
34
- assert s.solver.eval(fpv, cast_to=bytes) == struct.pack(">f", value)
35
- fpv = claripy.FPV(value, claripy.FSORT_DOUBLE)
36
- assert s.solver.eval(fpv, cast_to=bytes) == struct.pack(">d", value)
37
-
38
- def test_eval_cast_fpv_to_int(self):
39
- s = angr.SimState(arch="AMD64", mode="symbolic")
40
- value = 1.23456
41
- fpv = claripy.FPV(value, claripy.FSORT_FLOAT)
42
- assert s.solver.eval(fpv, cast_to=int) == int.from_bytes(struct.pack(">f", value), "big")
43
- fpv = claripy.FPV(value, claripy.FSORT_DOUBLE)
44
- assert s.solver.eval(fpv, cast_to=int) == int.from_bytes(struct.pack(">d", value), "big")
45
-
46
- def test_eval_cast_bool_to_bytes(self):
47
- s = angr.SimState(arch="AMD64", mode="symbolic")
48
- assert s.solver.eval(claripy.BoolV(False), cast_to=bytes) == b"\x00"
49
- assert s.solver.eval(claripy.BoolV(True), cast_to=bytes) == b"\x01"
50
-
51
- def test_eval_cast_bool_to_int(self):
52
- s = angr.SimState(arch="AMD64", mode="symbolic")
53
- assert s.solver.eval(claripy.BoolV(False), cast_to=int) == 0
54
- assert s.solver.eval(claripy.BoolV(True), cast_to=int) == 1
55
-
56
-
57
- if __name__ == "__main__":
58
- unittest.main()