angr 9.2.87__py3-none-manylinux2014_x86_64.whl → 9.2.89__py3-none-manylinux2014_x86_64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +4 -1
- angr/analyses/decompiler/clinic.py +16 -0
- angr/analyses/decompiler/decompiler.py +3 -0
- angr/analyses/decompiler/optimization_passes/__init__.py +5 -0
- angr/analyses/decompiler/optimization_passes/cross_jump_reverter.py +108 -0
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +17 -4
- angr/analyses/decompiler/optimization_passes/return_duplicator.py +4 -32
- angr/analyses/decompiler/structured_codegen/c.py +12 -2
- angr/analyses/decompiler/utils.py +13 -0
- angr/analyses/typehoon/dfa.py +108 -0
- angr/analyses/typehoon/lifter.py +34 -2
- angr/analyses/typehoon/simple_solver.py +1043 -503
- angr/analyses/typehoon/translator.py +13 -4
- angr/analyses/typehoon/typeconsts.py +117 -36
- angr/analyses/typehoon/typehoon.py +31 -11
- angr/analyses/typehoon/typevars.py +88 -21
- angr/analyses/typehoon/variance.py +10 -0
- angr/analyses/variable_recovery/engine_ail.py +28 -9
- angr/analyses/variable_recovery/engine_base.py +50 -43
- angr/analyses/variable_recovery/variable_recovery_base.py +16 -3
- angr/analyses/variable_recovery/variable_recovery_fast.py +14 -5
- angr/exploration_techniques/tracer.py +2 -0
- angr/misc/autoimport.py +26 -0
- angr/procedures/definitions/__init__.py +32 -3
- angr/utils/constants.py +1 -0
- angr/utils/graph.py +20 -1
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/METADATA +7 -6
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/RECORD +32 -244
- angr-9.2.89.dist-info/top_level.txt +1 -0
- angr/procedures/definitions/ntdll.py +0 -12
- angr-9.2.87.dist-info/top_level.txt +0 -2
- tests/__init__.py +0 -0
- tests/analyses/__init__.py +0 -0
- tests/analyses/cfg/__init__.py +0 -0
- tests/analyses/cfg/test_cfg_clflush.py +0 -43
- tests/analyses/cfg/test_cfg_get_any_node.py +0 -34
- tests/analyses/cfg/test_cfg_manager.py +0 -32
- tests/analyses/cfg/test_cfg_model.py +0 -55
- tests/analyses/cfg/test_cfg_patching.py +0 -378
- tests/analyses/cfg/test_cfg_rust_got_resolution.py +0 -36
- tests/analyses/cfg/test_cfg_thumb_firmware.py +0 -50
- tests/analyses/cfg/test_cfg_vex_postprocessor.py +0 -27
- tests/analyses/cfg/test_cfgemulated.py +0 -634
- tests/analyses/cfg/test_cfgfast.py +0 -1123
- tests/analyses/cfg/test_cfgfast_soot.py +0 -38
- tests/analyses/cfg/test_const_resolver.py +0 -38
- tests/analyses/cfg/test_iat_resolver.py +0 -37
- tests/analyses/cfg/test_jumptables.py +0 -3008
- tests/analyses/cfg/test_noop_blocks.py +0 -54
- tests/analyses/cfg_slice_to_sink/__init__.py +0 -0
- tests/analyses/cfg_slice_to_sink/test_cfg_slice_to_sink.py +0 -93
- tests/analyses/cfg_slice_to_sink/test_graph.py +0 -114
- tests/analyses/cfg_slice_to_sink/test_transitions.py +0 -28
- tests/analyses/decompiler/__init__.py +0 -0
- tests/analyses/decompiler/test_baseptr_save_simplifier.py +0 -80
- tests/analyses/decompiler/test_decompiler.py +0 -3336
- tests/analyses/decompiler/test_peephole_optimizations.py +0 -48
- tests/analyses/decompiler/test_propagator_loops.py +0 -101
- tests/analyses/decompiler/test_structurer.py +0 -275
- tests/analyses/reaching_definitions/__init__.py +0 -0
- tests/analyses/reaching_definitions/test_dep_graph.py +0 -432
- tests/analyses/reaching_definitions/test_function_handler.py +0 -131
- tests/analyses/reaching_definitions/test_heap_allocator.py +0 -46
- tests/analyses/reaching_definitions/test_rd_state.py +0 -78
- tests/analyses/reaching_definitions/test_reachingdefinitions.py +0 -463
- tests/analyses/reaching_definitions/test_subject.py +0 -76
- tests/analyses/test_bindiff.py +0 -52
- tests/analyses/test_block_simplifier.py +0 -112
- tests/analyses/test_boyscout.py +0 -104
- tests/analyses/test_calling_convention_analysis.py +0 -352
- tests/analyses/test_callsite_maker.py +0 -60
- tests/analyses/test_cdg.py +0 -165
- tests/analyses/test_cfb.py +0 -37
- tests/analyses/test_class_identifier.py +0 -46
- tests/analyses/test_clinic.py +0 -30
- tests/analyses/test_codetagging.py +0 -32
- tests/analyses/test_constantpropagation.py +0 -88
- tests/analyses/test_ddg.py +0 -95
- tests/analyses/test_ddg_global_var_dependencies.py +0 -83
- tests/analyses/test_ddg_memvar_addresses.py +0 -40
- tests/analyses/test_disassembly.py +0 -121
- tests/analyses/test_find_objects_static.py +0 -35
- tests/analyses/test_flirt.py +0 -49
- tests/analyses/test_identifier.py +0 -33
- tests/analyses/test_init_finder.py +0 -38
- tests/analyses/test_proximitygraph.py +0 -31
- tests/analyses/test_reassembler.py +0 -295
- tests/analyses/test_regionidentifier.py +0 -27
- tests/analyses/test_slicing.py +0 -164
- tests/analyses/test_stack_pointer_tracker.py +0 -74
- tests/analyses/test_static_hooker.py +0 -28
- tests/analyses/test_typehoon.py +0 -55
- tests/analyses/test_variablerecovery.py +0 -464
- tests/analyses/test_vfg.py +0 -221
- tests/analyses/test_vtable.py +0 -31
- tests/analyses/test_xrefs.py +0 -77
- tests/common.py +0 -128
- tests/engines/__init__.py +0 -0
- tests/engines/light/__init__.py +0 -0
- tests/engines/light/test_data.py +0 -17
- tests/engines/pcode/__init__.py +0 -0
- tests/engines/pcode/test_emulate.py +0 -607
- tests/engines/pcode/test_pcode.py +0 -84
- tests/engines/test_actions.py +0 -27
- tests/engines/test_hook.py +0 -112
- tests/engines/test_java.py +0 -697
- tests/engines/test_unicorn.py +0 -518
- tests/engines/vex/__init__.py +0 -0
- tests/engines/vex/test_lifter.py +0 -124
- tests/engines/vex/test_vex.py +0 -574
- tests/exploration_techniques/__init__.py +0 -0
- tests/exploration_techniques/test_cacher.py +0 -45
- tests/exploration_techniques/test_director.py +0 -67
- tests/exploration_techniques/test_driller_core.py +0 -48
- tests/exploration_techniques/test_loop_seer.py +0 -158
- tests/exploration_techniques/test_memory_watcher.py +0 -46
- tests/exploration_techniques/test_oppologist.py +0 -65
- tests/exploration_techniques/test_spiller.py +0 -82
- tests/exploration_techniques/test_stochastic.py +0 -40
- tests/exploration_techniques/test_tech_builder.py +0 -61
- tests/exploration_techniques/test_tracer.py +0 -856
- tests/exploration_techniques/test_unique.py +0 -40
- tests/exploration_techniques/test_veritesting.py +0 -120
- tests/factory/__init__.py +0 -0
- tests/factory/block/__init__.py +0 -0
- tests/factory/block/test_block_cache.py +0 -33
- tests/factory/block/test_keystone.py +0 -106
- tests/factory/test_argc.py +0 -101
- tests/factory/test_argc_sym.py +0 -110
- tests/factory/test_argv.py +0 -158
- tests/factory/test_callable.py +0 -266
- tests/factory/test_windows_args.py +0 -36
- tests/knowledge_plugins/__init__.py +0 -0
- tests/knowledge_plugins/cfg/__init__.py +0 -0
- tests/knowledge_plugins/cfg/test_cfg_manager.py +0 -36
- tests/knowledge_plugins/functions/__init__.py +0 -0
- tests/knowledge_plugins/functions/test_function.py +0 -91
- tests/knowledge_plugins/functions/test_function2.py +0 -79
- tests/knowledge_plugins/functions/test_function_manager.py +0 -139
- tests/knowledge_plugins/functions/test_prototypes.py +0 -53
- tests/knowledge_plugins/key_definitions/__init__.py +0 -0
- tests/knowledge_plugins/key_definitions/test_atoms.py +0 -24
- tests/knowledge_plugins/key_definitions/test_environment.py +0 -126
- tests/knowledge_plugins/key_definitions/test_heap_address.py +0 -27
- tests/knowledge_plugins/key_definitions/test_live_definitions.py +0 -72
- tests/knowledge_plugins/test_dwarf_variables.py +0 -240
- tests/knowledge_plugins/test_kb_plugins.py +0 -91
- tests/knowledge_plugins/test_kb_plugins_dwarf.py +0 -36
- tests/knowledge_plugins/test_patches.py +0 -48
- tests/misc/__init__.py +0 -0
- tests/misc/test_hookset.py +0 -57
- tests/perf/__init__.py +0 -0
- tests/perf/perf_cfgemulated.py +0 -19
- tests/perf/perf_cfgfast.py +0 -18
- tests/perf/perf_concrete_execution.py +0 -41
- tests/perf/perf_siminspect_nop.py +0 -36
- tests/perf/perf_state_copy.py +0 -33
- tests/perf/perf_unicorn_0.py +0 -27
- tests/perf/perf_unicorn_1.py +0 -23
- tests/procedures/__init__.py +0 -0
- tests/procedures/glibc/__init__.py +0 -0
- tests/procedures/glibc/test_ctype_locale.py +0 -164
- tests/procedures/libc/__init__.py +0 -0
- tests/procedures/libc/test_fgets.py +0 -53
- tests/procedures/libc/test_scanf.py +0 -205
- tests/procedures/libc/test_sprintf.py +0 -44
- tests/procedures/libc/test_sscanf.py +0 -63
- tests/procedures/libc/test_strcasecmp.py +0 -37
- tests/procedures/libc/test_string.py +0 -1102
- tests/procedures/libc/test_strtol.py +0 -78
- tests/procedures/linux_kernel/__init__.py +0 -0
- tests/procedures/linux_kernel/test_lseek.py +0 -174
- tests/procedures/posix/__init__.py +0 -0
- tests/procedures/posix/test_chroot.py +0 -33
- tests/procedures/posix/test_getenv.py +0 -78
- tests/procedures/posix/test_pwrite_pread.py +0 -57
- tests/procedures/posix/test_sim_time.py +0 -46
- tests/procedures/posix/test_unlink.py +0 -46
- tests/procedures/test_project_resolve_simproc.py +0 -43
- tests/procedures/test_sim_procedure.py +0 -117
- tests/procedures/test_stub_procedure_args.py +0 -53
- tests/serialization/__init__.py +0 -0
- tests/serialization/test_db.py +0 -197
- tests/serialization/test_pickle.py +0 -95
- tests/serialization/test_serialization.py +0 -132
- tests/serialization/test_vault.py +0 -169
- tests/sim/__init__.py +0 -3
- tests/sim/exec_func/__init__.py +0 -0
- tests/sim/exec_func/test_mem_funcs.py +0 -55
- tests/sim/exec_func/test_str_funcs.py +0 -93
- tests/sim/exec_func/test_syscall_result.py +0 -39
- tests/sim/exec_insn/__init__.py +0 -0
- tests/sim/exec_insn/test_adc.py +0 -44
- tests/sim/exec_insn/test_ops.py +0 -83
- tests/sim/exec_insn/test_rcr.py +0 -26
- tests/sim/exec_insn/test_rol.py +0 -51
- tests/sim/exec_insn/test_signed_div.py +0 -34
- tests/sim/exec_insn/test_sqrt.py +0 -56
- tests/sim/options/__init__.py +0 -0
- tests/sim/options/test_0div.py +0 -54
- tests/sim/options/test_symbolic_fd.py +0 -59
- tests/sim/options/test_unsupported.py +0 -34
- tests/sim/test_accuracy.py +0 -137
- tests/sim/test_checkbyte.py +0 -53
- tests/sim/test_echo.py +0 -36
- tests/sim/test_fauxware.py +0 -202
- tests/sim/test_self_modifying_code.py +0 -65
- tests/sim/test_simple_api.py +0 -36
- tests/sim/test_simulation_manager.py +0 -147
- tests/sim/test_stack_alignment.py +0 -65
- tests/sim/test_state.py +0 -303
- tests/sim/test_state_customization.py +0 -54
- tests/sim/test_symbol_hooked_by.py +0 -49
- tests/simos/__init__.py +0 -0
- tests/simos/windows/__init__.py +0 -0
- tests/simos/windows/test_windows_stack_cookie.py +0 -58
- tests/state_plugins/__init__.py +0 -0
- tests/state_plugins/inspect/__init__.py +0 -0
- tests/state_plugins/inspect/test_inspect.py +0 -310
- tests/state_plugins/inspect/test_syscall_override.py +0 -90
- tests/state_plugins/posix/__init__.py +0 -0
- tests/state_plugins/posix/test_file_struct_funcs.py +0 -56
- tests/state_plugins/posix/test_files.py +0 -69
- tests/state_plugins/posix/test_posix.py +0 -72
- tests/state_plugins/solver/__init__.py +0 -0
- tests/state_plugins/solver/test_simsolver.py +0 -58
- tests/state_plugins/solver/test_symbolic.py +0 -153
- tests/state_plugins/solver/test_variable_registration.py +0 -46
- tests/state_plugins/test_callstack.py +0 -54
- tests/state_plugins/test_gdb_plugin.py +0 -35
- tests/state_plugins/test_multi_open_file.py +0 -47
- tests/state_plugins/test_symbolization.py +0 -38
- tests/storage/__init__.py +0 -0
- tests/storage/test_memory.py +0 -960
- tests/storage/test_memory_merge.py +0 -114
- tests/storage/test_memview.py +0 -205
- tests/storage/test_mmap.py +0 -26
- tests/storage/test_multivalues.py +0 -44
- tests/storage/test_permissions.py +0 -32
- tests/storage/test_ptmalloc.py +0 -291
- tests/storage/test_relro_perm.py +0 -49
- tests/test_calling_conventions.py +0 -86
- tests/test_types.py +0 -329
- tests/utils/__init__.py +0 -0
- tests/utils/test_graph.py +0 -41
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/LICENSE +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/WHEEL +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/entry_points.txt +0 -0
|
@@ -1,114 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint:disable=isinstance-second-argument-not-valid-type,missing-class-docstring,no-self-use
|
|
3
|
-
import unittest
|
|
4
|
-
from unittest import TestCase
|
|
5
|
-
|
|
6
|
-
import claripy
|
|
7
|
-
|
|
8
|
-
from angr.storage.memory_mixins.paged_memory.pages.history_tracking_mixin import MAX_HISTORY_DEPTH
|
|
9
|
-
from angr.storage.memory_mixins import (
|
|
10
|
-
DataNormalizationMixin,
|
|
11
|
-
SizeNormalizationMixin,
|
|
12
|
-
AddressConcretizationMixin,
|
|
13
|
-
UltraPagesMixin,
|
|
14
|
-
ListPagesMixin,
|
|
15
|
-
PagedMemoryMixin,
|
|
16
|
-
SymbolicMergerMixin,
|
|
17
|
-
ConvenientMappingsMixin,
|
|
18
|
-
)
|
|
19
|
-
from angr import SimState
|
|
20
|
-
from angr.storage.memory_mixins import UltraPage
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
class UltraPageMemory(
|
|
24
|
-
DataNormalizationMixin,
|
|
25
|
-
SizeNormalizationMixin,
|
|
26
|
-
AddressConcretizationMixin,
|
|
27
|
-
SymbolicMergerMixin,
|
|
28
|
-
ConvenientMappingsMixin,
|
|
29
|
-
UltraPagesMixin,
|
|
30
|
-
PagedMemoryMixin,
|
|
31
|
-
):
|
|
32
|
-
pass
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
class ListPageMemory(
|
|
36
|
-
DataNormalizationMixin,
|
|
37
|
-
SizeNormalizationMixin,
|
|
38
|
-
AddressConcretizationMixin,
|
|
39
|
-
SymbolicMergerMixin,
|
|
40
|
-
ConvenientMappingsMixin,
|
|
41
|
-
ListPagesMixin,
|
|
42
|
-
PagedMemoryMixin,
|
|
43
|
-
):
|
|
44
|
-
pass
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
class TestMemoryMerge(TestCase):
|
|
48
|
-
def test_merge_memory_object_endness(self):
|
|
49
|
-
for memcls in [UltraPageMemory, ListPageMemory]:
|
|
50
|
-
state0 = SimState(arch="AMD64", mode="symbolic", plugins={"memory": memcls()})
|
|
51
|
-
state0.memory.store(0x20000, claripy.BVS("x", 64), endness="Iend_LE")
|
|
52
|
-
|
|
53
|
-
state1 = SimState(arch="AMD64", mode="symbolic", plugins={"memory": memcls()})
|
|
54
|
-
state1.memory.store(0x20000, claripy.BVS("y", 64), endness="Iend_LE")
|
|
55
|
-
|
|
56
|
-
state, _, _ = state0.merge(state1)
|
|
57
|
-
obj = state.memory.load(0x20000, size=8, endness="Iend_LE")
|
|
58
|
-
assert isinstance(obj, claripy.ast.Base)
|
|
59
|
-
# the original endness should be respected, and obj.op should not be Reverse
|
|
60
|
-
assert obj.op == "If"
|
|
61
|
-
|
|
62
|
-
def test_merge_seq(self):
|
|
63
|
-
state1 = SimState(arch="AMD64", mode="symbolic", plugins={"memory": UltraPageMemory()})
|
|
64
|
-
state2 = SimState(arch="AMD64", mode="symbolic", plugins={"memory": UltraPageMemory()})
|
|
65
|
-
|
|
66
|
-
state1.regs.rsp = 0x80000000
|
|
67
|
-
state2.regs.rsp = 0x80000000
|
|
68
|
-
|
|
69
|
-
state1.memory.store(state1.regs.rsp, 0x11, 1)
|
|
70
|
-
state1.memory.store(state1.regs.rsp + 1, 0x22, 1)
|
|
71
|
-
state2.memory.store(state2.regs.rsp, 0xAA, 1)
|
|
72
|
-
state2.memory.store(state2.regs.rsp + 1, 0xBB, 1)
|
|
73
|
-
|
|
74
|
-
state3, _, __ = state1.merge(state2)
|
|
75
|
-
vals = (v for v in state3.solver.eval_upto(state3.memory.load(state3.regs.rsp, 2), 10))
|
|
76
|
-
assert {0x1122, 0xAABB} == set(vals)
|
|
77
|
-
|
|
78
|
-
def test_history_tracking(self):
|
|
79
|
-
state = SimState(arch="AMD64", mode="symbolic", plugins={"memory": UltraPageMemory()})
|
|
80
|
-
|
|
81
|
-
states = [state]
|
|
82
|
-
|
|
83
|
-
for i in range(25):
|
|
84
|
-
state = state.copy()
|
|
85
|
-
states.append(state) # keep references
|
|
86
|
-
state.memory.store(i, claripy.BVV(i, 8))
|
|
87
|
-
|
|
88
|
-
assert len(state.memory._pages) == 1
|
|
89
|
-
page: UltraPage = next(iter(state.memory._pages.values()))
|
|
90
|
-
|
|
91
|
-
parents = list(page.parents())
|
|
92
|
-
assert len(parents) == 24
|
|
93
|
-
|
|
94
|
-
def test_history_tracking_collapse(self):
|
|
95
|
-
state = SimState(arch="AMD64", mode="symbolic", plugins={"memory": UltraPageMemory()})
|
|
96
|
-
state.memory.store(1000, claripy.BVV(1, 8))
|
|
97
|
-
|
|
98
|
-
states = [state]
|
|
99
|
-
|
|
100
|
-
for i in range(MAX_HISTORY_DEPTH + 4):
|
|
101
|
-
state = state.copy()
|
|
102
|
-
states.append(state) # keep references
|
|
103
|
-
state.memory.store(i, claripy.BVV(i, 8))
|
|
104
|
-
assert next(iter(state.memory._pages.values()))._history_depth == (i + 1) % (MAX_HISTORY_DEPTH + 1)
|
|
105
|
-
|
|
106
|
-
assert len(state.memory._pages) == 1
|
|
107
|
-
page: UltraPage = next(iter(state.memory._pages.values()))
|
|
108
|
-
|
|
109
|
-
parents = list(page.parents())
|
|
110
|
-
assert len(parents) == 3
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
if __name__ == "__main__":
|
|
114
|
-
unittest.main()
|
tests/storage/test_memview.py
DELETED
|
@@ -1,205 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
|
|
4
|
-
from collections import OrderedDict
|
|
5
|
-
import ctypes
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
from archinfo import Endness
|
|
9
|
-
import claripy
|
|
10
|
-
|
|
11
|
-
import angr
|
|
12
|
-
from angr import SimState
|
|
13
|
-
from angr.sim_type import register_types, parse_types, SimStruct, SimTypeNumOffset
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
class TestMemView(unittest.TestCase):
|
|
17
|
-
def test_simple_concrete(self):
|
|
18
|
-
s = SimState(arch="AMD64")
|
|
19
|
-
addr = 0xBA5E0
|
|
20
|
-
|
|
21
|
-
def check_read(val):
|
|
22
|
-
assert s.solver.eval(s.memory.load(addr, 8, endness=Endness.LE), cast_to=int) == val
|
|
23
|
-
|
|
24
|
-
assert s.mem[addr].char.concrete == chr(val & 0xFF).encode()
|
|
25
|
-
assert s.mem[addr].byte.concrete == val & 0xFF
|
|
26
|
-
|
|
27
|
-
assert s.mem[addr].int16_t.concrete == ctypes.c_int16(val & 0xFFFF).value
|
|
28
|
-
assert s.mem[addr].uint16_t.concrete == val & 0xFFFF
|
|
29
|
-
|
|
30
|
-
assert s.mem[addr].qword.concrete == val
|
|
31
|
-
|
|
32
|
-
s.memory.store(addr, claripy.BVV(0x11223344AABBCC7D, 64), endness=Endness.LE)
|
|
33
|
-
check_read(0x11223344AABBCC7D)
|
|
34
|
-
|
|
35
|
-
# test storing
|
|
36
|
-
s.mem[addr].uint16_t = 0xEF6D
|
|
37
|
-
check_read(0x11223344AABBEF6D)
|
|
38
|
-
|
|
39
|
-
def test_string_concrete(self):
|
|
40
|
-
s = SimState(arch="AMD64")
|
|
41
|
-
addr = 0xBA5E0
|
|
42
|
-
|
|
43
|
-
def check_read(val):
|
|
44
|
-
assert s.solver.eval(s.memory.load(addr, len(val)), cast_to=bytes) == val
|
|
45
|
-
assert s.solver.eval(s.memory.load(addr + len(val), 1), cast_to=int) == 0
|
|
46
|
-
|
|
47
|
-
assert s.mem[addr].string.concrete == val
|
|
48
|
-
|
|
49
|
-
s.memory.store(addr, b"a string!\0")
|
|
50
|
-
check_read(b"a string!")
|
|
51
|
-
|
|
52
|
-
# not supported yet
|
|
53
|
-
# s.mem[addr].string = "shorter"
|
|
54
|
-
# check_read(b"shorter")
|
|
55
|
-
|
|
56
|
-
# s.mem[addr].string = "a longer string"
|
|
57
|
-
# check_read(b"a longer string")
|
|
58
|
-
|
|
59
|
-
def test_array_concrete(self):
|
|
60
|
-
s = SimState(arch="AMD64")
|
|
61
|
-
addr = 0xBA5E0
|
|
62
|
-
|
|
63
|
-
s.memory.store(addr, claripy.BVV(0x1, 32), endness=Endness.LE)
|
|
64
|
-
s.memory.store(addr + 4, claripy.BVV(0x2, 32), endness=Endness.LE)
|
|
65
|
-
s.memory.store(addr + 8, claripy.BVV(0x3, 32), endness=Endness.LE)
|
|
66
|
-
s.memory.store(addr + 12, claripy.BVV(0x4, 32), endness=Endness.LE)
|
|
67
|
-
s.memory.store(addr + 16, claripy.BVV(0x5, 32), endness=Endness.LE)
|
|
68
|
-
|
|
69
|
-
assert s.mem[addr].dword.array(5).concrete == [0x1, 0x2, 0x3, 0x4, 0x5]
|
|
70
|
-
assert s.mem[addr].dword.array(5)[2].concrete == 0x3
|
|
71
|
-
assert s.mem[addr].qword.array(2).concrete == [
|
|
72
|
-
0x0000000200000001,
|
|
73
|
-
0x0000000400000003,
|
|
74
|
-
]
|
|
75
|
-
assert s.mem[addr].dword.array(2).array(2).concrete == [[0x1, 0x2], [0x3, 0x4]]
|
|
76
|
-
|
|
77
|
-
s.mem[addr].dword.array(5)[3] = 10
|
|
78
|
-
assert s.solver.eval(s.memory.load(addr + 12, 4, endness=Endness.LE), cast_to=int) == 10
|
|
79
|
-
|
|
80
|
-
s.mem[addr].dword.array(5).store([20, 2, 3, 4, 5])
|
|
81
|
-
assert s.mem[addr].dword.array(4).concrete == [20, 2, 3, 4]
|
|
82
|
-
|
|
83
|
-
s.mem[addr].dword.array(2).array(2).store([[1, 2], [4, 3]])
|
|
84
|
-
assert s.mem[addr].dword.array(4).concrete == [1, 2, 4, 3]
|
|
85
|
-
|
|
86
|
-
def test_pointer_concrete(self):
|
|
87
|
-
s = SimState(arch="AMD64")
|
|
88
|
-
addr = 0xBA5E0
|
|
89
|
-
ptraddr = 0xCD0
|
|
90
|
-
|
|
91
|
-
s.memory.store(ptraddr, claripy.BVV(addr, 64), endness=Endness.LE)
|
|
92
|
-
s.memory.store(addr, b"abcdef\0")
|
|
93
|
-
|
|
94
|
-
assert s.mem[ptraddr].deref.string.concrete == b"abcdef"
|
|
95
|
-
s.mem[ptraddr].deref.dword = 123954
|
|
96
|
-
assert s.solver.eval(s.memory.load(addr, 4, endness=Endness.LE), cast_to=int) == 123954
|
|
97
|
-
assert s.mem[ptraddr].deref.dword.concrete == 123954
|
|
98
|
-
|
|
99
|
-
def test_structs(self):
|
|
100
|
-
s = SimState(arch="AMD64")
|
|
101
|
-
|
|
102
|
-
register_types(
|
|
103
|
-
parse_types(
|
|
104
|
-
"""
|
|
105
|
-
struct test_structs {
|
|
106
|
-
int a;
|
|
107
|
-
long b;
|
|
108
|
-
};
|
|
109
|
-
"""
|
|
110
|
-
)
|
|
111
|
-
)
|
|
112
|
-
|
|
113
|
-
s.memory.store(0x8000, bytes(16))
|
|
114
|
-
s.mem[0x8000].struct.test_structs = {"a": 10, "b": 20}
|
|
115
|
-
assert s.mem[0x8000].struct.test_structs.a.concrete == 10
|
|
116
|
-
assert s.solver.eval(s.memory.load(0x8000, 16), cast_to=bytes) == bytes.fromhex(
|
|
117
|
-
"0a000000000000001400000000000000"
|
|
118
|
-
)
|
|
119
|
-
|
|
120
|
-
def test_struct_bitfield_simple(self):
|
|
121
|
-
"""
|
|
122
|
-
Tests if a struct with bitfields like
|
|
123
|
-
struct {
|
|
124
|
-
uint32_t a:8, b:1, c:23;
|
|
125
|
-
}
|
|
126
|
-
can be used with a memview
|
|
127
|
-
:return:
|
|
128
|
-
"""
|
|
129
|
-
state = SimState(arch="AMD64")
|
|
130
|
-
register_types(
|
|
131
|
-
SimStruct(
|
|
132
|
-
name="bitfield_struct",
|
|
133
|
-
pack=True,
|
|
134
|
-
fields=OrderedDict(
|
|
135
|
-
[
|
|
136
|
-
("a", SimTypeNumOffset(8, signed=False)),
|
|
137
|
-
("b", SimTypeNumOffset(1, signed=False)),
|
|
138
|
-
("c", SimTypeNumOffset(23, signed=False)),
|
|
139
|
-
]
|
|
140
|
-
),
|
|
141
|
-
)
|
|
142
|
-
)
|
|
143
|
-
|
|
144
|
-
data = [
|
|
145
|
-
(b"\x0e\x02\x00\x00", (14, 0, 1)),
|
|
146
|
-
(b"\x14T\x00\x00", (20, 0, 42)),
|
|
147
|
-
(b"\x04\n\x01\x00", (4, 0, 133)),
|
|
148
|
-
(b"\x04j\x01\x00", (4, 0, 181)),
|
|
149
|
-
(b"\x04\xa2\x01\x00", (4, 0, 209)),
|
|
150
|
-
(b"\x04\xf4\x01\x00", (4, 0, 250)),
|
|
151
|
-
(b"\x04\\\x02\x00", (4, 0, 302)),
|
|
152
|
-
(b"\x04\x98\x02\x00", (4, 0, 332)),
|
|
153
|
-
(b"\x04\xe0\x02\x00", (4, 0, 368)),
|
|
154
|
-
(b"\x04\x1e\x03\x00", (4, 0, 399)),
|
|
155
|
-
]
|
|
156
|
-
state.memory.store(
|
|
157
|
-
0x8000,
|
|
158
|
-
b"\x0e\x02\x00\x00"
|
|
159
|
-
b"\x14T\x00\x00"
|
|
160
|
-
b"\x04\n\x01\x00"
|
|
161
|
-
b"\x04j\x01\x00"
|
|
162
|
-
b"\x04\xa2\x01\x00"
|
|
163
|
-
b"\x04\xf4\x01\x00"
|
|
164
|
-
b"\x04\\\x02\x00"
|
|
165
|
-
b"\x04\x98\x02\x00"
|
|
166
|
-
b"\x04\xe0\x02\x00"
|
|
167
|
-
b"\x04\x1e\x03\x00",
|
|
168
|
-
)
|
|
169
|
-
view = state.mem[0x8000].struct.bitfield_struct.array(5)
|
|
170
|
-
for idx, (b, result) in enumerate(data):
|
|
171
|
-
v = view[idx]
|
|
172
|
-
s = v.concrete
|
|
173
|
-
assert s.a == result[0], f"Field a was {s.a}, expected {result[0]}, from bytes {b}"
|
|
174
|
-
assert v.a.concrete == result[0], f"Field a was {v.a.concrete}, expected {result[0]}, from bytes {b}"
|
|
175
|
-
|
|
176
|
-
assert s.b == result[1], f"Field b was {s.b}, expected {result[1]}, from bytes {b}"
|
|
177
|
-
assert v.b.concrete == result[1], f"Field b was {s.b}, expected {result[1]}, from bytes {b}"
|
|
178
|
-
|
|
179
|
-
assert s.c == result[2], f"Field c was {s.c}, expected {result[2]}, from bytes {b}"
|
|
180
|
-
assert v.c.concrete == result[2], f"Field c was {v.c.concrete}, expected {result[2]}, from bytes {b}"
|
|
181
|
-
|
|
182
|
-
def test_struct_bitfield_complex(self):
|
|
183
|
-
bitfield_struct2 = angr.types.parse_type(
|
|
184
|
-
"""struct bitfield_struct2
|
|
185
|
-
{
|
|
186
|
-
uint64_t target : 36,
|
|
187
|
-
high8 : 8,
|
|
188
|
-
reserved : 7,
|
|
189
|
-
next : 12,
|
|
190
|
-
bind : 1;
|
|
191
|
-
}"""
|
|
192
|
-
)
|
|
193
|
-
|
|
194
|
-
angr.types.register_types(bitfield_struct2)
|
|
195
|
-
state = SimState(arch="AMD64")
|
|
196
|
-
state.memory.store(0x1000, b"\xb3\xc7\xe9|\xad\xd7\xee$") # store some random data
|
|
197
|
-
struct = state.mem[0x1000].struct.bitfield_struct2.concrete
|
|
198
|
-
assert struct.target == 0xD7CE9C7B3
|
|
199
|
-
assert struct.high8 == 0x7A
|
|
200
|
-
assert struct.next == 0x49D
|
|
201
|
-
assert struct.bind == 0
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
if __name__ == "__main__":
|
|
205
|
-
unittest.main()
|
tests/storage/test_mmap.py
DELETED
|
@@ -1,26 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
|
|
4
|
-
import unittest
|
|
5
|
-
|
|
6
|
-
from angr import SimState
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
class TestMmap(unittest.TestCase):
|
|
10
|
-
def test_mmap_base_copy(self):
|
|
11
|
-
state = SimState(arch="AMD64", mode="symbolic")
|
|
12
|
-
|
|
13
|
-
mmap_base = 0x12345678
|
|
14
|
-
|
|
15
|
-
state.heap.mmap_base = mmap_base
|
|
16
|
-
|
|
17
|
-
# Sanity check
|
|
18
|
-
assert state.heap.mmap_base == mmap_base
|
|
19
|
-
|
|
20
|
-
state_copy = state.copy()
|
|
21
|
-
|
|
22
|
-
assert state_copy.heap.mmap_base == mmap_base
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
if __name__ == "__main__":
|
|
26
|
-
unittest.main()
|
|
@@ -1,44 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint:disable=missing-class-docstring,no-self-use
|
|
3
|
-
from unittest import TestCase, main
|
|
4
|
-
|
|
5
|
-
import claripy
|
|
6
|
-
from angr.storage.memory_mixins.paged_memory.pages.multi_values import MultiValues
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
class TestMultiValues(TestCase):
|
|
10
|
-
def test_multivalues_one_slot_has_multiple_sized_bvs(self):
|
|
11
|
-
mv = MultiValues(offset_to_values={0: {claripy.BVV(0, 32)}, 4: {claripy.BVV(1, 32)}, 8: {claripy.BVV(2, 32)}})
|
|
12
|
-
mv.add_value(4, claripy.BVV(0x1338133813371337, 64))
|
|
13
|
-
|
|
14
|
-
assert len(mv._values) == 3
|
|
15
|
-
assert len(mv._values[4]) == 2
|
|
16
|
-
assert mv._values[4] == {claripy.BVV(1, 32), claripy.BVV(0x13381338, 32)}
|
|
17
|
-
assert mv._values[8] == {claripy.BVV(2, 32), claripy.BVV(0x13371337, 32)}
|
|
18
|
-
|
|
19
|
-
mv.add_value(5, claripy.BVV(0xCC, 8))
|
|
20
|
-
assert len(mv._values) == 5 # 0, 4, 5, 6, 8
|
|
21
|
-
assert mv._values[5] == {claripy.BVV(0xCC, 8), claripy.BVV(0x38, 8), claripy.BVV(0, 8)}
|
|
22
|
-
assert mv._values[6] == {claripy.BVV(1, 16), claripy.BVV(0x1338, 16)}
|
|
23
|
-
|
|
24
|
-
def test_multivalues_empty(self):
|
|
25
|
-
mv = MultiValues()
|
|
26
|
-
assert mv._single_value is None
|
|
27
|
-
assert mv._values == {}
|
|
28
|
-
assert len(mv) == 0
|
|
29
|
-
|
|
30
|
-
def test_multivalues_single_value(self):
|
|
31
|
-
v = claripy.BVV(0x1338133813371337, 64)
|
|
32
|
-
mv = MultiValues(v)
|
|
33
|
-
assert mv._single_value is not None
|
|
34
|
-
assert v.concrete_value == mv._single_value.concrete_value
|
|
35
|
-
assert len(mv) == 64
|
|
36
|
-
|
|
37
|
-
mv2 = MultiValues(mv)
|
|
38
|
-
assert mv2._single_value is not None
|
|
39
|
-
assert v.concrete_value == mv2._single_value.concrete_value
|
|
40
|
-
assert len(mv2) == 64
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
if __name__ == "__main__":
|
|
44
|
-
main()
|
|
@@ -1,32 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
# pylint: disable=missing-class-docstring,no-self-use,line-too-long
|
|
3
|
-
__package__ = __package__ or "tests.storage" # pylint:disable=redefined-builtin
|
|
4
|
-
|
|
5
|
-
import os
|
|
6
|
-
import unittest
|
|
7
|
-
|
|
8
|
-
import angr
|
|
9
|
-
|
|
10
|
-
from ..common import bin_location
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
test_location = os.path.join(bin_location, "tests")
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
class TestPermissions(unittest.TestCase):
|
|
17
|
-
def test_nx(self):
|
|
18
|
-
nx_amd64 = angr.Project(os.path.join(test_location, "x86_64", "memmove"), auto_load_libs=False)
|
|
19
|
-
es = nx_amd64.factory.entry_state()
|
|
20
|
-
|
|
21
|
-
# .text should be PROT_READ|PROT_EXEC
|
|
22
|
-
assert es.solver.eval(es.memory.permissions(nx_amd64.entry)) == 5
|
|
23
|
-
|
|
24
|
-
# load stack to initialize page
|
|
25
|
-
es.memory.load(es.regs.sp, 4)
|
|
26
|
-
|
|
27
|
-
# stack should be PROT_READ|PROT_WRITE
|
|
28
|
-
assert es.solver.eval(es.memory.permissions(es.regs.sp)) == 3
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
if __name__ == "__main__":
|
|
32
|
-
unittest.main()
|