angr 9.2.87__py3-none-manylinux2014_x86_64.whl → 9.2.89__py3-none-manylinux2014_x86_64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +4 -1
- angr/analyses/decompiler/clinic.py +16 -0
- angr/analyses/decompiler/decompiler.py +3 -0
- angr/analyses/decompiler/optimization_passes/__init__.py +5 -0
- angr/analyses/decompiler/optimization_passes/cross_jump_reverter.py +108 -0
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +17 -4
- angr/analyses/decompiler/optimization_passes/return_duplicator.py +4 -32
- angr/analyses/decompiler/structured_codegen/c.py +12 -2
- angr/analyses/decompiler/utils.py +13 -0
- angr/analyses/typehoon/dfa.py +108 -0
- angr/analyses/typehoon/lifter.py +34 -2
- angr/analyses/typehoon/simple_solver.py +1043 -503
- angr/analyses/typehoon/translator.py +13 -4
- angr/analyses/typehoon/typeconsts.py +117 -36
- angr/analyses/typehoon/typehoon.py +31 -11
- angr/analyses/typehoon/typevars.py +88 -21
- angr/analyses/typehoon/variance.py +10 -0
- angr/analyses/variable_recovery/engine_ail.py +28 -9
- angr/analyses/variable_recovery/engine_base.py +50 -43
- angr/analyses/variable_recovery/variable_recovery_base.py +16 -3
- angr/analyses/variable_recovery/variable_recovery_fast.py +14 -5
- angr/exploration_techniques/tracer.py +2 -0
- angr/misc/autoimport.py +26 -0
- angr/procedures/definitions/__init__.py +32 -3
- angr/utils/constants.py +1 -0
- angr/utils/graph.py +20 -1
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/METADATA +7 -6
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/RECORD +32 -244
- angr-9.2.89.dist-info/top_level.txt +1 -0
- angr/procedures/definitions/ntdll.py +0 -12
- angr-9.2.87.dist-info/top_level.txt +0 -2
- tests/__init__.py +0 -0
- tests/analyses/__init__.py +0 -0
- tests/analyses/cfg/__init__.py +0 -0
- tests/analyses/cfg/test_cfg_clflush.py +0 -43
- tests/analyses/cfg/test_cfg_get_any_node.py +0 -34
- tests/analyses/cfg/test_cfg_manager.py +0 -32
- tests/analyses/cfg/test_cfg_model.py +0 -55
- tests/analyses/cfg/test_cfg_patching.py +0 -378
- tests/analyses/cfg/test_cfg_rust_got_resolution.py +0 -36
- tests/analyses/cfg/test_cfg_thumb_firmware.py +0 -50
- tests/analyses/cfg/test_cfg_vex_postprocessor.py +0 -27
- tests/analyses/cfg/test_cfgemulated.py +0 -634
- tests/analyses/cfg/test_cfgfast.py +0 -1123
- tests/analyses/cfg/test_cfgfast_soot.py +0 -38
- tests/analyses/cfg/test_const_resolver.py +0 -38
- tests/analyses/cfg/test_iat_resolver.py +0 -37
- tests/analyses/cfg/test_jumptables.py +0 -3008
- tests/analyses/cfg/test_noop_blocks.py +0 -54
- tests/analyses/cfg_slice_to_sink/__init__.py +0 -0
- tests/analyses/cfg_slice_to_sink/test_cfg_slice_to_sink.py +0 -93
- tests/analyses/cfg_slice_to_sink/test_graph.py +0 -114
- tests/analyses/cfg_slice_to_sink/test_transitions.py +0 -28
- tests/analyses/decompiler/__init__.py +0 -0
- tests/analyses/decompiler/test_baseptr_save_simplifier.py +0 -80
- tests/analyses/decompiler/test_decompiler.py +0 -3336
- tests/analyses/decompiler/test_peephole_optimizations.py +0 -48
- tests/analyses/decompiler/test_propagator_loops.py +0 -101
- tests/analyses/decompiler/test_structurer.py +0 -275
- tests/analyses/reaching_definitions/__init__.py +0 -0
- tests/analyses/reaching_definitions/test_dep_graph.py +0 -432
- tests/analyses/reaching_definitions/test_function_handler.py +0 -131
- tests/analyses/reaching_definitions/test_heap_allocator.py +0 -46
- tests/analyses/reaching_definitions/test_rd_state.py +0 -78
- tests/analyses/reaching_definitions/test_reachingdefinitions.py +0 -463
- tests/analyses/reaching_definitions/test_subject.py +0 -76
- tests/analyses/test_bindiff.py +0 -52
- tests/analyses/test_block_simplifier.py +0 -112
- tests/analyses/test_boyscout.py +0 -104
- tests/analyses/test_calling_convention_analysis.py +0 -352
- tests/analyses/test_callsite_maker.py +0 -60
- tests/analyses/test_cdg.py +0 -165
- tests/analyses/test_cfb.py +0 -37
- tests/analyses/test_class_identifier.py +0 -46
- tests/analyses/test_clinic.py +0 -30
- tests/analyses/test_codetagging.py +0 -32
- tests/analyses/test_constantpropagation.py +0 -88
- tests/analyses/test_ddg.py +0 -95
- tests/analyses/test_ddg_global_var_dependencies.py +0 -83
- tests/analyses/test_ddg_memvar_addresses.py +0 -40
- tests/analyses/test_disassembly.py +0 -121
- tests/analyses/test_find_objects_static.py +0 -35
- tests/analyses/test_flirt.py +0 -49
- tests/analyses/test_identifier.py +0 -33
- tests/analyses/test_init_finder.py +0 -38
- tests/analyses/test_proximitygraph.py +0 -31
- tests/analyses/test_reassembler.py +0 -295
- tests/analyses/test_regionidentifier.py +0 -27
- tests/analyses/test_slicing.py +0 -164
- tests/analyses/test_stack_pointer_tracker.py +0 -74
- tests/analyses/test_static_hooker.py +0 -28
- tests/analyses/test_typehoon.py +0 -55
- tests/analyses/test_variablerecovery.py +0 -464
- tests/analyses/test_vfg.py +0 -221
- tests/analyses/test_vtable.py +0 -31
- tests/analyses/test_xrefs.py +0 -77
- tests/common.py +0 -128
- tests/engines/__init__.py +0 -0
- tests/engines/light/__init__.py +0 -0
- tests/engines/light/test_data.py +0 -17
- tests/engines/pcode/__init__.py +0 -0
- tests/engines/pcode/test_emulate.py +0 -607
- tests/engines/pcode/test_pcode.py +0 -84
- tests/engines/test_actions.py +0 -27
- tests/engines/test_hook.py +0 -112
- tests/engines/test_java.py +0 -697
- tests/engines/test_unicorn.py +0 -518
- tests/engines/vex/__init__.py +0 -0
- tests/engines/vex/test_lifter.py +0 -124
- tests/engines/vex/test_vex.py +0 -574
- tests/exploration_techniques/__init__.py +0 -0
- tests/exploration_techniques/test_cacher.py +0 -45
- tests/exploration_techniques/test_director.py +0 -67
- tests/exploration_techniques/test_driller_core.py +0 -48
- tests/exploration_techniques/test_loop_seer.py +0 -158
- tests/exploration_techniques/test_memory_watcher.py +0 -46
- tests/exploration_techniques/test_oppologist.py +0 -65
- tests/exploration_techniques/test_spiller.py +0 -82
- tests/exploration_techniques/test_stochastic.py +0 -40
- tests/exploration_techniques/test_tech_builder.py +0 -61
- tests/exploration_techniques/test_tracer.py +0 -856
- tests/exploration_techniques/test_unique.py +0 -40
- tests/exploration_techniques/test_veritesting.py +0 -120
- tests/factory/__init__.py +0 -0
- tests/factory/block/__init__.py +0 -0
- tests/factory/block/test_block_cache.py +0 -33
- tests/factory/block/test_keystone.py +0 -106
- tests/factory/test_argc.py +0 -101
- tests/factory/test_argc_sym.py +0 -110
- tests/factory/test_argv.py +0 -158
- tests/factory/test_callable.py +0 -266
- tests/factory/test_windows_args.py +0 -36
- tests/knowledge_plugins/__init__.py +0 -0
- tests/knowledge_plugins/cfg/__init__.py +0 -0
- tests/knowledge_plugins/cfg/test_cfg_manager.py +0 -36
- tests/knowledge_plugins/functions/__init__.py +0 -0
- tests/knowledge_plugins/functions/test_function.py +0 -91
- tests/knowledge_plugins/functions/test_function2.py +0 -79
- tests/knowledge_plugins/functions/test_function_manager.py +0 -139
- tests/knowledge_plugins/functions/test_prototypes.py +0 -53
- tests/knowledge_plugins/key_definitions/__init__.py +0 -0
- tests/knowledge_plugins/key_definitions/test_atoms.py +0 -24
- tests/knowledge_plugins/key_definitions/test_environment.py +0 -126
- tests/knowledge_plugins/key_definitions/test_heap_address.py +0 -27
- tests/knowledge_plugins/key_definitions/test_live_definitions.py +0 -72
- tests/knowledge_plugins/test_dwarf_variables.py +0 -240
- tests/knowledge_plugins/test_kb_plugins.py +0 -91
- tests/knowledge_plugins/test_kb_plugins_dwarf.py +0 -36
- tests/knowledge_plugins/test_patches.py +0 -48
- tests/misc/__init__.py +0 -0
- tests/misc/test_hookset.py +0 -57
- tests/perf/__init__.py +0 -0
- tests/perf/perf_cfgemulated.py +0 -19
- tests/perf/perf_cfgfast.py +0 -18
- tests/perf/perf_concrete_execution.py +0 -41
- tests/perf/perf_siminspect_nop.py +0 -36
- tests/perf/perf_state_copy.py +0 -33
- tests/perf/perf_unicorn_0.py +0 -27
- tests/perf/perf_unicorn_1.py +0 -23
- tests/procedures/__init__.py +0 -0
- tests/procedures/glibc/__init__.py +0 -0
- tests/procedures/glibc/test_ctype_locale.py +0 -164
- tests/procedures/libc/__init__.py +0 -0
- tests/procedures/libc/test_fgets.py +0 -53
- tests/procedures/libc/test_scanf.py +0 -205
- tests/procedures/libc/test_sprintf.py +0 -44
- tests/procedures/libc/test_sscanf.py +0 -63
- tests/procedures/libc/test_strcasecmp.py +0 -37
- tests/procedures/libc/test_string.py +0 -1102
- tests/procedures/libc/test_strtol.py +0 -78
- tests/procedures/linux_kernel/__init__.py +0 -0
- tests/procedures/linux_kernel/test_lseek.py +0 -174
- tests/procedures/posix/__init__.py +0 -0
- tests/procedures/posix/test_chroot.py +0 -33
- tests/procedures/posix/test_getenv.py +0 -78
- tests/procedures/posix/test_pwrite_pread.py +0 -57
- tests/procedures/posix/test_sim_time.py +0 -46
- tests/procedures/posix/test_unlink.py +0 -46
- tests/procedures/test_project_resolve_simproc.py +0 -43
- tests/procedures/test_sim_procedure.py +0 -117
- tests/procedures/test_stub_procedure_args.py +0 -53
- tests/serialization/__init__.py +0 -0
- tests/serialization/test_db.py +0 -197
- tests/serialization/test_pickle.py +0 -95
- tests/serialization/test_serialization.py +0 -132
- tests/serialization/test_vault.py +0 -169
- tests/sim/__init__.py +0 -3
- tests/sim/exec_func/__init__.py +0 -0
- tests/sim/exec_func/test_mem_funcs.py +0 -55
- tests/sim/exec_func/test_str_funcs.py +0 -93
- tests/sim/exec_func/test_syscall_result.py +0 -39
- tests/sim/exec_insn/__init__.py +0 -0
- tests/sim/exec_insn/test_adc.py +0 -44
- tests/sim/exec_insn/test_ops.py +0 -83
- tests/sim/exec_insn/test_rcr.py +0 -26
- tests/sim/exec_insn/test_rol.py +0 -51
- tests/sim/exec_insn/test_signed_div.py +0 -34
- tests/sim/exec_insn/test_sqrt.py +0 -56
- tests/sim/options/__init__.py +0 -0
- tests/sim/options/test_0div.py +0 -54
- tests/sim/options/test_symbolic_fd.py +0 -59
- tests/sim/options/test_unsupported.py +0 -34
- tests/sim/test_accuracy.py +0 -137
- tests/sim/test_checkbyte.py +0 -53
- tests/sim/test_echo.py +0 -36
- tests/sim/test_fauxware.py +0 -202
- tests/sim/test_self_modifying_code.py +0 -65
- tests/sim/test_simple_api.py +0 -36
- tests/sim/test_simulation_manager.py +0 -147
- tests/sim/test_stack_alignment.py +0 -65
- tests/sim/test_state.py +0 -303
- tests/sim/test_state_customization.py +0 -54
- tests/sim/test_symbol_hooked_by.py +0 -49
- tests/simos/__init__.py +0 -0
- tests/simos/windows/__init__.py +0 -0
- tests/simos/windows/test_windows_stack_cookie.py +0 -58
- tests/state_plugins/__init__.py +0 -0
- tests/state_plugins/inspect/__init__.py +0 -0
- tests/state_plugins/inspect/test_inspect.py +0 -310
- tests/state_plugins/inspect/test_syscall_override.py +0 -90
- tests/state_plugins/posix/__init__.py +0 -0
- tests/state_plugins/posix/test_file_struct_funcs.py +0 -56
- tests/state_plugins/posix/test_files.py +0 -69
- tests/state_plugins/posix/test_posix.py +0 -72
- tests/state_plugins/solver/__init__.py +0 -0
- tests/state_plugins/solver/test_simsolver.py +0 -58
- tests/state_plugins/solver/test_symbolic.py +0 -153
- tests/state_plugins/solver/test_variable_registration.py +0 -46
- tests/state_plugins/test_callstack.py +0 -54
- tests/state_plugins/test_gdb_plugin.py +0 -35
- tests/state_plugins/test_multi_open_file.py +0 -47
- tests/state_plugins/test_symbolization.py +0 -38
- tests/storage/__init__.py +0 -0
- tests/storage/test_memory.py +0 -960
- tests/storage/test_memory_merge.py +0 -114
- tests/storage/test_memview.py +0 -205
- tests/storage/test_mmap.py +0 -26
- tests/storage/test_multivalues.py +0 -44
- tests/storage/test_permissions.py +0 -32
- tests/storage/test_ptmalloc.py +0 -291
- tests/storage/test_relro_perm.py +0 -49
- tests/test_calling_conventions.py +0 -86
- tests/test_types.py +0 -329
- tests/utils/__init__.py +0 -0
- tests/utils/test_graph.py +0 -41
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/LICENSE +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/WHEEL +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/entry_points.txt +0 -0
|
@@ -1,310 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,disable=no-self-use
|
|
3
|
-
__package__ = __package__ or "tests.state_plugins.inspect" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import pyvex
|
|
9
|
-
import claripy
|
|
10
|
-
import archinfo
|
|
11
|
-
|
|
12
|
-
import angr
|
|
13
|
-
from angr import SimState, BP_AFTER, BP_BEFORE, SIM_PROCEDURES, concretization_strategies
|
|
14
|
-
from angr.engines import ProcedureEngine, HeavyVEXMixin, SimInspectMixin
|
|
15
|
-
|
|
16
|
-
from ...common import bin_location
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
test_location = os.path.join(bin_location, "tests")
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
class InspectEngine(SimInspectMixin, HeavyVEXMixin):
|
|
23
|
-
pass
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
class TestInspect(unittest.TestCase):
|
|
27
|
-
def test_inspect(self):
|
|
28
|
-
class counts: # pylint:disable=no-init
|
|
29
|
-
mem_read = 0
|
|
30
|
-
mem_write = 0
|
|
31
|
-
reg_read = 0
|
|
32
|
-
reg_write = 0
|
|
33
|
-
tmp_read = 0
|
|
34
|
-
tmp_write = 0
|
|
35
|
-
expr = 0
|
|
36
|
-
statement = 0
|
|
37
|
-
instruction = 0
|
|
38
|
-
constraints = 0
|
|
39
|
-
variables = 0
|
|
40
|
-
|
|
41
|
-
def act_mem_read(state): # pylint:disable=unused-argument
|
|
42
|
-
counts.mem_read += 1
|
|
43
|
-
|
|
44
|
-
def act_mem_write(state): # pylint:disable=unused-argument
|
|
45
|
-
counts.mem_write += 1
|
|
46
|
-
|
|
47
|
-
def act_reg_read(state): # pylint:disable=unused-argument
|
|
48
|
-
counts.reg_read += 1
|
|
49
|
-
|
|
50
|
-
def act_reg_write(state): # pylint:disable=unused-argument
|
|
51
|
-
counts.reg_write += 1
|
|
52
|
-
|
|
53
|
-
def act_tmp_read(state): # pylint:disable=unused-argument
|
|
54
|
-
counts.tmp_read += 1
|
|
55
|
-
|
|
56
|
-
def act_tmp_write(state): # pylint:disable=unused-argument
|
|
57
|
-
counts.tmp_write += 1
|
|
58
|
-
|
|
59
|
-
def act_expr(state): # pylint:disable=unused-argument
|
|
60
|
-
counts.expr += 1
|
|
61
|
-
|
|
62
|
-
def act_statement(state): # pylint:disable=unused-argument
|
|
63
|
-
counts.statement += 1
|
|
64
|
-
|
|
65
|
-
def act_instruction(state): # pylint:disable=unused-argument
|
|
66
|
-
counts.instruction += 1
|
|
67
|
-
|
|
68
|
-
def act_variables(state): # pylint:disable=unused-argument
|
|
69
|
-
# print "CREATING:", state.inspect.symbolic_name
|
|
70
|
-
counts.variables += 1
|
|
71
|
-
|
|
72
|
-
# def act_constraints(state): #pylint:disable=unused-argument
|
|
73
|
-
# counts.constraints += 1
|
|
74
|
-
|
|
75
|
-
s = SimState(arch="AMD64", mode="symbolic")
|
|
76
|
-
|
|
77
|
-
s.inspect.b("mem_write", when=BP_AFTER, action=act_mem_write)
|
|
78
|
-
assert counts.mem_write == 0
|
|
79
|
-
s.memory.store(100, s.solver.BVV(10, 32))
|
|
80
|
-
assert counts.mem_write == 1
|
|
81
|
-
|
|
82
|
-
s.inspect.b("mem_read", when=BP_AFTER, action=act_mem_read)
|
|
83
|
-
s.inspect.b("mem_read", when=BP_AFTER, action=act_mem_read, mem_read_address=100)
|
|
84
|
-
s.inspect.b("mem_read", when=BP_AFTER, action=act_mem_read, mem_read_address=123)
|
|
85
|
-
s.inspect.b("mem_read", when=BP_BEFORE, action=act_mem_read, mem_read_length=3)
|
|
86
|
-
assert counts.mem_read == 0
|
|
87
|
-
s.memory.load(123, 4)
|
|
88
|
-
s.memory.load(223, 3)
|
|
89
|
-
assert counts.mem_read == 4
|
|
90
|
-
|
|
91
|
-
s.inspect.b("reg_read", when=BP_AFTER, action=act_reg_read)
|
|
92
|
-
assert counts.reg_read == 0
|
|
93
|
-
s.registers.load(16, size=8)
|
|
94
|
-
assert counts.reg_read == 1
|
|
95
|
-
|
|
96
|
-
s.inspect.b("reg_write", when=BP_AFTER, action=act_reg_write)
|
|
97
|
-
assert counts.reg_write == 0
|
|
98
|
-
s.registers.store(16, s.solver.BVV(10, 32))
|
|
99
|
-
assert counts.reg_write == 1
|
|
100
|
-
assert counts.mem_write == 1
|
|
101
|
-
assert counts.mem_read == 4
|
|
102
|
-
assert counts.reg_read == 1
|
|
103
|
-
|
|
104
|
-
s.inspect.b("tmp_read", when=BP_AFTER, action=act_tmp_read, tmp_read_num=0)
|
|
105
|
-
s.inspect.b("tmp_write", when=BP_AFTER, action=act_tmp_write, tmp_write_num=0)
|
|
106
|
-
s.inspect.b("expr", when=BP_AFTER, action=act_expr, expr_result=1016)
|
|
107
|
-
s.inspect.b("statement", when=BP_AFTER, action=act_statement)
|
|
108
|
-
s.inspect.b("instruction", when=BP_AFTER, action=act_instruction, instruction=1001)
|
|
109
|
-
s.inspect.b("instruction", when=BP_AFTER, action=act_instruction, instruction=1000)
|
|
110
|
-
irsb = pyvex.IRSB(b"\x90\x90\x90\x90\xeb\x0a", mem_addr=1000, arch=archinfo.ArchAMD64(), opt_level=0)
|
|
111
|
-
irsb.pp()
|
|
112
|
-
InspectEngine(None).process(s, irsb=irsb)
|
|
113
|
-
assert counts.reg_write == 7
|
|
114
|
-
assert counts.reg_read == 2
|
|
115
|
-
assert counts.tmp_write == 1
|
|
116
|
-
assert counts.tmp_read == 1
|
|
117
|
-
assert counts.expr == 3
|
|
118
|
-
assert counts.statement == 11
|
|
119
|
-
assert counts.instruction == 2
|
|
120
|
-
assert counts.constraints == 0
|
|
121
|
-
assert counts.mem_write == 1
|
|
122
|
-
assert counts.mem_read == 4
|
|
123
|
-
|
|
124
|
-
s = SimState(arch="AMD64", mode="symbolic")
|
|
125
|
-
s.inspect.b("symbolic_variable", when=BP_AFTER, action=act_variables)
|
|
126
|
-
s.memory.load(0, 10)
|
|
127
|
-
assert counts.variables == 1
|
|
128
|
-
|
|
129
|
-
def test_inspect_exit(self):
|
|
130
|
-
class counts: # pylint:disable=no-init
|
|
131
|
-
exit_before = 0
|
|
132
|
-
exit_after = 0
|
|
133
|
-
|
|
134
|
-
def handle_exit_before(state):
|
|
135
|
-
counts.exit_before += 1
|
|
136
|
-
exit_target = state.inspect.exit_target
|
|
137
|
-
assert state.solver.eval(exit_target) == 0x3F8
|
|
138
|
-
# change exit target
|
|
139
|
-
state.inspect.exit_target = 0x41414141
|
|
140
|
-
assert state.inspect.exit_jumpkind == "Ijk_Boring"
|
|
141
|
-
assert state.inspect.exit_guard.is_true()
|
|
142
|
-
|
|
143
|
-
def handle_exit_after(state): # pylint:disable=unused-argument
|
|
144
|
-
counts.exit_after += 1
|
|
145
|
-
|
|
146
|
-
s = SimState(arch="AMD64", mode="symbolic")
|
|
147
|
-
irsb = pyvex.IRSB(b"\x90\x90\x90\x90\xeb\x0a", mem_addr=1000, arch=archinfo.ArchAMD64())
|
|
148
|
-
|
|
149
|
-
# break on exit
|
|
150
|
-
s.inspect.b("exit", BP_BEFORE, action=handle_exit_before)
|
|
151
|
-
s.inspect.b("exit", BP_AFTER, action=handle_exit_after)
|
|
152
|
-
|
|
153
|
-
# step it
|
|
154
|
-
succ = HeavyVEXMixin(None).process(s, irsb=irsb).flat_successors
|
|
155
|
-
|
|
156
|
-
# check
|
|
157
|
-
assert succ[0].solver.eval(succ[0].ip) == 0x41414141
|
|
158
|
-
assert counts.exit_before == 1
|
|
159
|
-
assert counts.exit_after == 1
|
|
160
|
-
|
|
161
|
-
def test_inspect_syscall(self):
|
|
162
|
-
class counts: # pylint:disable=no-init
|
|
163
|
-
exit_before = 0
|
|
164
|
-
exit_after = 0
|
|
165
|
-
|
|
166
|
-
def handle_syscall_before(state):
|
|
167
|
-
counts.exit_before += 1
|
|
168
|
-
syscall_name = state.inspect.syscall_name
|
|
169
|
-
assert syscall_name == "close"
|
|
170
|
-
|
|
171
|
-
def handle_syscall_after(state):
|
|
172
|
-
counts.exit_after += 1
|
|
173
|
-
syscall_name = state.inspect.syscall_name
|
|
174
|
-
assert syscall_name == "close"
|
|
175
|
-
|
|
176
|
-
s = SimState(arch="AMD64", mode="symbolic")
|
|
177
|
-
# set up to call so syscall close
|
|
178
|
-
s.regs.rax = 3
|
|
179
|
-
s.regs.rdi = 2
|
|
180
|
-
|
|
181
|
-
# break on syscall
|
|
182
|
-
s.inspect.b("syscall", BP_BEFORE, action=handle_syscall_before)
|
|
183
|
-
s.inspect.b("syscall", BP_AFTER, action=handle_syscall_after)
|
|
184
|
-
|
|
185
|
-
# step it
|
|
186
|
-
proc = SIM_PROCEDURES["posix"]["close"](is_syscall=True)
|
|
187
|
-
ProcedureEngine(None).process(s, procedure=proc, ret_to=s.ip)
|
|
188
|
-
|
|
189
|
-
# check counts
|
|
190
|
-
assert counts.exit_before == 1
|
|
191
|
-
assert counts.exit_after == 1
|
|
192
|
-
|
|
193
|
-
def test_inspect_concretization(self):
|
|
194
|
-
# some values for the test
|
|
195
|
-
x = claripy.BVS("x", 64)
|
|
196
|
-
y = claripy.BVS("y", 64)
|
|
197
|
-
|
|
198
|
-
#
|
|
199
|
-
# This tests concretization-time address redirection.
|
|
200
|
-
#
|
|
201
|
-
|
|
202
|
-
def change_symbolic_target(state):
|
|
203
|
-
if state.inspect.address_concretization_action == "store":
|
|
204
|
-
state.inspect.address_concretization_expr = claripy.BVV(0x1000, state.arch.bits)
|
|
205
|
-
|
|
206
|
-
s = SimState(arch="AMD64")
|
|
207
|
-
s.inspect.b("address_concretization", BP_BEFORE, action=change_symbolic_target)
|
|
208
|
-
s.memory.store(x, "A")
|
|
209
|
-
assert list(s.solver.eval_upto(x, 10)) == [0x1000]
|
|
210
|
-
assert list(s.solver.eval_upto(s.memory.load(0x1000, 1), 10)) == [0x41]
|
|
211
|
-
|
|
212
|
-
#
|
|
213
|
-
# This tests disabling constraint adding through siminspect -- the write still happens
|
|
214
|
-
#
|
|
215
|
-
|
|
216
|
-
def dont_add_constraints(state):
|
|
217
|
-
state.inspect.address_concretization_add_constraints = False
|
|
218
|
-
|
|
219
|
-
s = SimState(arch="AMD64")
|
|
220
|
-
s.inspect.b("address_concretization", BP_BEFORE, action=dont_add_constraints)
|
|
221
|
-
s.memory.store(x, "A")
|
|
222
|
-
assert len(s.solver.eval_upto(x, 10)) == 10
|
|
223
|
-
|
|
224
|
-
#
|
|
225
|
-
# This tests raising an exception if symbolic concretization fails (i.e., if the address
|
|
226
|
-
# is too unconstrained). The write aborts.
|
|
227
|
-
#
|
|
228
|
-
|
|
229
|
-
class UnconstrainedAbort(Exception):
|
|
230
|
-
def __init__(self, message, state):
|
|
231
|
-
Exception.__init__(self, message)
|
|
232
|
-
self.state = state
|
|
233
|
-
|
|
234
|
-
def abort_unconstrained(state):
|
|
235
|
-
print(state.inspect.address_concretization_strategy, state.inspect.address_concretization_result)
|
|
236
|
-
if (
|
|
237
|
-
isinstance(
|
|
238
|
-
state.inspect.address_concretization_strategy,
|
|
239
|
-
concretization_strategies.SimConcretizationStrategyRange,
|
|
240
|
-
)
|
|
241
|
-
and state.inspect.address_concretization_result is None
|
|
242
|
-
):
|
|
243
|
-
raise UnconstrainedAbort("uh oh", state)
|
|
244
|
-
|
|
245
|
-
s = SimState(arch="AMD64")
|
|
246
|
-
s.memory.write_strategies.insert(0, concretization_strategies.SimConcretizationStrategyRange(128))
|
|
247
|
-
s.memory._write_address_range = 1
|
|
248
|
-
s.memory._write_address_range_approx = 1
|
|
249
|
-
s.add_constraints(y == 10)
|
|
250
|
-
s.inspect.b("address_concretization", BP_AFTER, action=abort_unconstrained)
|
|
251
|
-
s.memory.store(y, "A")
|
|
252
|
-
assert list(s.solver.eval_upto(s.memory.load(y, 1), 10)) == [0x41]
|
|
253
|
-
|
|
254
|
-
try:
|
|
255
|
-
s.memory.store(x, "A")
|
|
256
|
-
print("THIS SHOULD NOT BE REACHED")
|
|
257
|
-
assert False
|
|
258
|
-
except UnconstrainedAbort as e:
|
|
259
|
-
assert e.state.memory is s.memory
|
|
260
|
-
|
|
261
|
-
def test_inspect_engine_process(self):
|
|
262
|
-
p = angr.Project(os.path.join(test_location, "x86_64", "fauxware"), auto_load_libs=False)
|
|
263
|
-
|
|
264
|
-
def check_first_symbolic_fork(state):
|
|
265
|
-
succs = state.inspect.sim_successors.successors
|
|
266
|
-
succ_addr = [hex(s.addr) for s in succs]
|
|
267
|
-
assert len(succ_addr) == 2
|
|
268
|
-
assert "0x400692L" in succ_addr
|
|
269
|
-
assert "0x400699L" in succ_addr
|
|
270
|
-
print("Fork after:", hex(state.addr))
|
|
271
|
-
print("Successors:", succ_addr)
|
|
272
|
-
|
|
273
|
-
def check_second_symbolic_fork(state):
|
|
274
|
-
succs = state.inspect.sim_successors.successors
|
|
275
|
-
succ_addr = [hex(s.addr) for s in succs]
|
|
276
|
-
assert len(succ_addr) == 2
|
|
277
|
-
assert "0x4006dfL" in succ_addr
|
|
278
|
-
assert "0x4006e6L" in succ_addr
|
|
279
|
-
print("Fork after:", hex(state.addr))
|
|
280
|
-
print("Successors:", succ_addr)
|
|
281
|
-
|
|
282
|
-
def first_symbolic_fork(state):
|
|
283
|
-
return hex(state.addr) == "0x40068eL" and isinstance(state.inspect.sim_engine, HeavyVEXMixin)
|
|
284
|
-
# TODO: I think this latter check is meaningless with the eleventh hour refactor
|
|
285
|
-
|
|
286
|
-
def second_symbolic_fork(state):
|
|
287
|
-
return hex(state.addr) == "0x4006dbL" and isinstance(state.inspect.sim_engine, HeavyVEXMixin)
|
|
288
|
-
|
|
289
|
-
def check_state(state):
|
|
290
|
-
assert hex(state.inspect.sim_successors.addr) in ("0x40068eL", "0x4006dbL")
|
|
291
|
-
|
|
292
|
-
state = p.factory.entry_state(addr=p.loader.find_symbol("main").rebased_addr)
|
|
293
|
-
pg = p.factory.simulation_manager(state)
|
|
294
|
-
state.inspect.b("engine_process", when=BP_BEFORE, action=check_state, condition=first_symbolic_fork)
|
|
295
|
-
state.inspect.b(
|
|
296
|
-
"engine_process", when=BP_AFTER, action=check_first_symbolic_fork, condition=first_symbolic_fork
|
|
297
|
-
)
|
|
298
|
-
pg.run()
|
|
299
|
-
|
|
300
|
-
state = p.factory.entry_state(addr=p.loader.find_symbol("main").rebased_addr)
|
|
301
|
-
pg = p.factory.simulation_manager(state)
|
|
302
|
-
state.inspect.b("engine_process", when=BP_BEFORE, action=check_state, condition=second_symbolic_fork)
|
|
303
|
-
state.inspect.b(
|
|
304
|
-
"engine_process", when=BP_AFTER, action=check_second_symbolic_fork, condition=second_symbolic_fork
|
|
305
|
-
)
|
|
306
|
-
pg.run()
|
|
307
|
-
|
|
308
|
-
|
|
309
|
-
if __name__ == "__main__":
|
|
310
|
-
unittest.main()
|
|
@@ -1,90 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests.state_plugins.inspect" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import os
|
|
5
|
-
import unittest
|
|
6
|
-
|
|
7
|
-
import angr
|
|
8
|
-
|
|
9
|
-
from ...common import bin_location, broken
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
test_location = os.path.join(bin_location, "tests")
|
|
13
|
-
|
|
14
|
-
target_addrs = {"i386": [0x080485C9], "x86_64": [0x4006ED], "ppc": [0x1000060C], "armel": [0x85F0], "mips": [0x4009FC]}
|
|
15
|
-
|
|
16
|
-
avoid_addrs = {
|
|
17
|
-
"i386": [0x080485DD, 0x08048564],
|
|
18
|
-
"x86_64": [0x4006AA, 0x4006FD],
|
|
19
|
-
"ppc": [0x10000644, 0x1000059C],
|
|
20
|
-
"armel": [0x86F8, 0x857C],
|
|
21
|
-
"mips": [0x400A10, 0x400774],
|
|
22
|
-
}
|
|
23
|
-
|
|
24
|
-
corrupt_addrs = {
|
|
25
|
-
"i386": [0x80486B6, b"bO\xcc", lambda s: s.memory.store(s.regs.esp, s.regs.eax)],
|
|
26
|
-
"x86_64": [0x400742, b"\xd4&\xb0[\x41", lambda s: s.registers.store("rdx", 8)],
|
|
27
|
-
"ppc": [0x100006B8, b"\x05\xad\xc2\xea", lambda s: s.registers.store("r5", 8)],
|
|
28
|
-
"armel": [0x8678, b"\xbdM\xec3", lambda s: s.registers.store("r2", 8)],
|
|
29
|
-
"mips": [0x400918, b"[\xf8\x96@"[::-1], lambda s: s.registers.store("a2", 8)],
|
|
30
|
-
}
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
class TestSyscallOverride(unittest.TestCase):
|
|
34
|
-
def _run_fauxware_override(self, arch):
|
|
35
|
-
# auto_load_libs can't be disabled as the test fails
|
|
36
|
-
p = angr.Project(os.path.join(test_location, arch, "fauxware"), use_sim_procedures=False)
|
|
37
|
-
s = p.factory.full_init_state()
|
|
38
|
-
|
|
39
|
-
def overwrite_str(state):
|
|
40
|
-
state.posix.get_fd(1).write_data(b"HAHA\0")
|
|
41
|
-
|
|
42
|
-
queued_syscall_returns = []
|
|
43
|
-
queued_syscall_returns.append(None) # let the mmap run
|
|
44
|
-
queued_syscall_returns.append(overwrite_str) # prompt for username
|
|
45
|
-
queued_syscall_returns.append(0) # username read
|
|
46
|
-
queued_syscall_returns.append(0) # newline read
|
|
47
|
-
# queued_syscall_returns.append(0) # prompt for password -- why isn't this called?
|
|
48
|
-
queued_syscall_returns.append(None) # password input
|
|
49
|
-
queued_syscall_returns.append(0) # password \n input
|
|
50
|
-
|
|
51
|
-
def syscall_hook(state):
|
|
52
|
-
if not state.inspect.simprocedure.is_syscall:
|
|
53
|
-
return
|
|
54
|
-
try:
|
|
55
|
-
f = queued_syscall_returns.pop(0)
|
|
56
|
-
if f is None:
|
|
57
|
-
return
|
|
58
|
-
state.inspect.simprocedure_result = f(state) if callable(f) else f
|
|
59
|
-
except IndexError:
|
|
60
|
-
return
|
|
61
|
-
|
|
62
|
-
s.inspect.make_breakpoint("simprocedure", s.inspect.BP_BEFORE, action=syscall_hook)
|
|
63
|
-
|
|
64
|
-
results = p.factory.simulation_manager(thing=s).explore(find=target_addrs[arch], avoid=avoid_addrs[arch])
|
|
65
|
-
stdin = results.found[0].posix.dumps(0)
|
|
66
|
-
assert b"SOSNEAKY" == stdin
|
|
67
|
-
stdout = results.found[0].posix.dumps(1)
|
|
68
|
-
assert b"HAHA\0" == stdout
|
|
69
|
-
|
|
70
|
-
def test_fauxware_override_x86_64(self):
|
|
71
|
-
self._run_fauxware_override("x86_64")
|
|
72
|
-
|
|
73
|
-
def test_fauxware_override_i386(self):
|
|
74
|
-
self._run_fauxware_override("i386")
|
|
75
|
-
|
|
76
|
-
@broken
|
|
77
|
-
def test_fauxware_override_ppc(self):
|
|
78
|
-
self._run_fauxware_override("ppc")
|
|
79
|
-
|
|
80
|
-
@broken
|
|
81
|
-
def test_fauxware_override_armel(self):
|
|
82
|
-
self._run_fauxware_override("armel")
|
|
83
|
-
|
|
84
|
-
@broken
|
|
85
|
-
def test_fauxware_override_mips(self):
|
|
86
|
-
self._run_fauxware_override("mips")
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
if __name__ == "__main__":
|
|
90
|
-
unittest.main()
|
|
File without changes
|
|
@@ -1,56 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,disable=no-self-use
|
|
3
|
-
__package__ = __package__ or "tests.state_plugins.posix" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ...common import bin_location
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
test_location = os.path.join(bin_location, "tests")
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
class TestFileStructFuncs(unittest.TestCase):
|
|
17
|
-
def check_state_1(self, state):
|
|
18
|
-
# Need to dump file.txt by path because program closes it
|
|
19
|
-
return (
|
|
20
|
-
state.posix.dump_file_by_path("file.txt") == b"testing abcdef"
|
|
21
|
-
and state.posix.dumps(0)[:4] == b"xyz\n"
|
|
22
|
-
and state.posix.dumps(1) == b"good1\n"
|
|
23
|
-
and state.posix.dumps(2) == b""
|
|
24
|
-
)
|
|
25
|
-
|
|
26
|
-
def check_state_2(self, state):
|
|
27
|
-
return (
|
|
28
|
-
state.posix.dump_file_by_path("file.txt") == b"testing abcdef"
|
|
29
|
-
and state.posix.dumps(0)[:4] == b"wxyz"
|
|
30
|
-
and state.posix.dumps(1) == b""
|
|
31
|
-
and state.posix.dumps(2) == b"good2\n"
|
|
32
|
-
)
|
|
33
|
-
|
|
34
|
-
def check_state_3(self, state):
|
|
35
|
-
return (
|
|
36
|
-
state.posix.dump_file_by_path("file.txt") == b"testing abcdef"
|
|
37
|
-
and state.posix.dumps(1) == b""
|
|
38
|
-
and state.posix.dumps(2) == b""
|
|
39
|
-
)
|
|
40
|
-
|
|
41
|
-
def test_file_struct_funcs(self):
|
|
42
|
-
test_bin = os.path.join(test_location, "x86_64", "file_func_test")
|
|
43
|
-
b = angr.Project(test_bin, auto_load_libs=False)
|
|
44
|
-
|
|
45
|
-
pg = b.factory.simulation_manager()
|
|
46
|
-
pg.active[0].options.discard("LAZY_SOLVES")
|
|
47
|
-
pg.explore()
|
|
48
|
-
|
|
49
|
-
assert len(pg.deadended) == 3
|
|
50
|
-
|
|
51
|
-
for p in pg.deadended:
|
|
52
|
-
assert self.check_state_1(p) or self.check_state_2(p) or self.check_state_3(p)
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
if __name__ == "__main__":
|
|
56
|
-
unittest.main()
|
|
@@ -1,69 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,disable=no-self-use
|
|
3
|
-
__package__ = __package__ or "tests.state_plugins.posix" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import sys
|
|
7
|
-
import unittest
|
|
8
|
-
|
|
9
|
-
import angr
|
|
10
|
-
from angr.state_plugins.posix import Flags
|
|
11
|
-
|
|
12
|
-
from ...common import bin_location
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
test_location = os.path.join(bin_location, "tests")
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
class TestFile(unittest.TestCase):
|
|
19
|
-
def test_files(self):
|
|
20
|
-
s = angr.SimState(arch="AMD64")
|
|
21
|
-
s.posix.get_fd(1).write_data(b"HELLO")
|
|
22
|
-
s.posix.get_fd(1).write_data(b"WORLD")
|
|
23
|
-
assert s.posix.dumps(1) == b"HELLOWORLD"
|
|
24
|
-
assert s.posix.stdout.concretize() == [b"HELLO", b"WORLD"]
|
|
25
|
-
|
|
26
|
-
s = angr.SimState(arch="AMD64")
|
|
27
|
-
s.posix.get_fd(1).write_data(b"A" * 0x1000, 0x800)
|
|
28
|
-
assert s.posix.dumps(1) == b"A" * 0x800
|
|
29
|
-
|
|
30
|
-
def test_file_read_missing_content(self):
|
|
31
|
-
# test in tracing mode since the Reverse operator will not be optimized away
|
|
32
|
-
s = angr.SimState(arch="AMD64", mode="tracing")
|
|
33
|
-
fd = s.posix.open(b"/tmp/oops", Flags.O_RDWR)
|
|
34
|
-
length = s.posix.get_fd(fd).read(0xC00000, 100)
|
|
35
|
-
|
|
36
|
-
data = s.memory.load(0xC00000, length, endness="Iend_BE")
|
|
37
|
-
assert data.op != "Reverse", "Byte strings read directly out of a file should not have Reverse operators."
|
|
38
|
-
assert data.op == "BVS"
|
|
39
|
-
assert len(data.variables) == 1
|
|
40
|
-
assert "oops" in next(iter(data.variables))
|
|
41
|
-
|
|
42
|
-
@unittest.skipIf(sys.platform == "win32", "broken on windows")
|
|
43
|
-
def test_concrete_fs_resolution(self):
|
|
44
|
-
bin_path = os.path.join(test_location, "i386", "fauxware")
|
|
45
|
-
proj = angr.Project(bin_path, auto_load_libs=False)
|
|
46
|
-
state = proj.factory.entry_state(concrete_fs=True)
|
|
47
|
-
fd = state.posix.open(bin_path, Flags.O_RDONLY)
|
|
48
|
-
stat = state.posix.fstat(fd)
|
|
49
|
-
size = stat.st_size
|
|
50
|
-
int_size = state.solver.eval(size)
|
|
51
|
-
|
|
52
|
-
assert stat
|
|
53
|
-
assert int_size != 0
|
|
54
|
-
assert not state.solver.symbolic(size)
|
|
55
|
-
|
|
56
|
-
def test_sim_fs_resolution(self):
|
|
57
|
-
bin_path = os.path.join(test_location, "i386", "fauxware")
|
|
58
|
-
proj = angr.Project(bin_path, auto_load_libs=False)
|
|
59
|
-
state = proj.factory.entry_state()
|
|
60
|
-
fd = state.posix.open(bin_path, Flags.O_RDONLY)
|
|
61
|
-
stat = state.posix.fstat(fd)
|
|
62
|
-
size = stat.st_size
|
|
63
|
-
|
|
64
|
-
assert stat
|
|
65
|
-
assert state.solver.symbolic(size)
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
if __name__ == "__main__":
|
|
69
|
-
unittest.main()
|
|
@@ -1,72 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
|
|
4
|
-
import unittest
|
|
5
|
-
|
|
6
|
-
from angr import SimState, SimFile
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
class TestPosix(unittest.TestCase):
|
|
10
|
-
def test_file_create(self):
|
|
11
|
-
# Create a state first
|
|
12
|
-
state = SimState(arch="AMD64", mode="symbolic")
|
|
13
|
-
|
|
14
|
-
# Create a file
|
|
15
|
-
fd = state.posix.open(b"test", 1)
|
|
16
|
-
|
|
17
|
-
assert fd == 3
|
|
18
|
-
|
|
19
|
-
def test_file_read(self):
|
|
20
|
-
state = SimState(arch="AMD64", mode="symbolic")
|
|
21
|
-
|
|
22
|
-
content = state.solver.BVV(0xBADF00D, 32)
|
|
23
|
-
content_size = content.size() // 8
|
|
24
|
-
|
|
25
|
-
fd = state.posix.open(b"test", 1)
|
|
26
|
-
simfd = state.posix.get_fd(fd)
|
|
27
|
-
simfd.write_data(content)
|
|
28
|
-
simfd.seek(0)
|
|
29
|
-
simfd.read(0xC0000000, content_size)
|
|
30
|
-
|
|
31
|
-
data = state.memory.load(0xC0000000, content_size)
|
|
32
|
-
|
|
33
|
-
assert data is content
|
|
34
|
-
|
|
35
|
-
def test_file_seek(self):
|
|
36
|
-
# TODO: Make this test more complete
|
|
37
|
-
|
|
38
|
-
state = SimState(arch="AMD64", mode="symbolic")
|
|
39
|
-
|
|
40
|
-
# Normal seeking
|
|
41
|
-
fd = state.posix.open(b"test1", 1)
|
|
42
|
-
simfd = state.posix.get_fd(fd)
|
|
43
|
-
simfd.seek(0, "start")
|
|
44
|
-
assert state.solver.is_true(simfd.tell() == 0)
|
|
45
|
-
state.posix.close(fd)
|
|
46
|
-
|
|
47
|
-
# TODO: test case: seek cannot go beyond the file size or current file pos
|
|
48
|
-
|
|
49
|
-
# seek should not work for stdin/stdout/stderr
|
|
50
|
-
assert state.solver.is_false(state.posix.get_fd(0).seek(0))
|
|
51
|
-
assert state.solver.is_false(state.posix.get_fd(1).seek(0))
|
|
52
|
-
assert state.solver.is_false(state.posix.get_fd(2).seek(0))
|
|
53
|
-
|
|
54
|
-
# Seek from the end
|
|
55
|
-
state.fs.insert("test2", SimFile(name="qwer", size=20))
|
|
56
|
-
fd = state.posix.open(b"test2", 1)
|
|
57
|
-
simfd = state.posix.get_fd(fd)
|
|
58
|
-
simfd.seek(0, "end")
|
|
59
|
-
assert state.solver.is_true(simfd.tell() == 20)
|
|
60
|
-
state.posix.close(fd)
|
|
61
|
-
|
|
62
|
-
# seek to a symbolic position (whence symbolic end)
|
|
63
|
-
fd = state.posix.open(b"unknown_size", 1)
|
|
64
|
-
simfd = state.posix.get_fd(fd)
|
|
65
|
-
real_end = state.fs.get("unknown_size").size
|
|
66
|
-
simfd.seek(0, "end")
|
|
67
|
-
assert real_end is simfd.tell()
|
|
68
|
-
state.posix.close(fd)
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
if __name__ == "__main__":
|
|
72
|
-
unittest.main()
|
|
File without changes
|
|
@@ -1,58 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint:disable=no-self-use
|
|
3
|
-
|
|
4
|
-
import struct
|
|
5
|
-
import unittest
|
|
6
|
-
|
|
7
|
-
import claripy
|
|
8
|
-
|
|
9
|
-
import angr
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
class TestSolverEvalCasting(unittest.TestCase):
|
|
13
|
-
"""
|
|
14
|
-
Basic test cases of SimSolver::eval's `cast_to` function.
|
|
15
|
-
"""
|
|
16
|
-
|
|
17
|
-
def test_eval_cast_bvv_to_bytes(self):
|
|
18
|
-
s = angr.SimState(arch="AMD64", mode="symbolic")
|
|
19
|
-
assert s.solver.eval(claripy.BVV(0, 0), cast_to=bytes) == b""
|
|
20
|
-
assert s.solver.eval(claripy.BVV(0, 8), cast_to=bytes) == b"\x00"
|
|
21
|
-
assert s.solver.eval(claripy.BVV(0x12345678, 32), cast_to=bytes) == b"\x12\x34\x56\x78"
|
|
22
|
-
|
|
23
|
-
def test_eval_cast_bvv_to_bytes__non_8bit_length_multiple(self):
|
|
24
|
-
s = angr.SimState(arch="AMD64", mode="symbolic")
|
|
25
|
-
for nbits in [1, 2, 7]:
|
|
26
|
-
with self.subTest(nbits=nbits):
|
|
27
|
-
with self.assertRaises(ValueError):
|
|
28
|
-
s.solver.eval(claripy.BVV(0, nbits), cast_to=bytes)
|
|
29
|
-
|
|
30
|
-
def test_eval_cast_fpv_to_bytes(self):
|
|
31
|
-
s = angr.SimState(arch="AMD64", mode="symbolic")
|
|
32
|
-
value = 1.23456
|
|
33
|
-
fpv = claripy.FPV(value, claripy.FSORT_FLOAT)
|
|
34
|
-
assert s.solver.eval(fpv, cast_to=bytes) == struct.pack(">f", value)
|
|
35
|
-
fpv = claripy.FPV(value, claripy.FSORT_DOUBLE)
|
|
36
|
-
assert s.solver.eval(fpv, cast_to=bytes) == struct.pack(">d", value)
|
|
37
|
-
|
|
38
|
-
def test_eval_cast_fpv_to_int(self):
|
|
39
|
-
s = angr.SimState(arch="AMD64", mode="symbolic")
|
|
40
|
-
value = 1.23456
|
|
41
|
-
fpv = claripy.FPV(value, claripy.FSORT_FLOAT)
|
|
42
|
-
assert s.solver.eval(fpv, cast_to=int) == int.from_bytes(struct.pack(">f", value), "big")
|
|
43
|
-
fpv = claripy.FPV(value, claripy.FSORT_DOUBLE)
|
|
44
|
-
assert s.solver.eval(fpv, cast_to=int) == int.from_bytes(struct.pack(">d", value), "big")
|
|
45
|
-
|
|
46
|
-
def test_eval_cast_bool_to_bytes(self):
|
|
47
|
-
s = angr.SimState(arch="AMD64", mode="symbolic")
|
|
48
|
-
assert s.solver.eval(claripy.BoolV(False), cast_to=bytes) == b"\x00"
|
|
49
|
-
assert s.solver.eval(claripy.BoolV(True), cast_to=bytes) == b"\x01"
|
|
50
|
-
|
|
51
|
-
def test_eval_cast_bool_to_int(self):
|
|
52
|
-
s = angr.SimState(arch="AMD64", mode="symbolic")
|
|
53
|
-
assert s.solver.eval(claripy.BoolV(False), cast_to=int) == 0
|
|
54
|
-
assert s.solver.eval(claripy.BoolV(True), cast_to=int) == 1
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
if __name__ == "__main__":
|
|
58
|
-
unittest.main()
|