angr 9.2.87__py3-none-manylinux2014_x86_64.whl → 9.2.89__py3-none-manylinux2014_x86_64.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of angr might be problematic. Click here for more details.
- angr/__init__.py +4 -1
- angr/analyses/decompiler/clinic.py +16 -0
- angr/analyses/decompiler/decompiler.py +3 -0
- angr/analyses/decompiler/optimization_passes/__init__.py +5 -0
- angr/analyses/decompiler/optimization_passes/cross_jump_reverter.py +108 -0
- angr/analyses/decompiler/optimization_passes/optimization_pass.py +17 -4
- angr/analyses/decompiler/optimization_passes/return_duplicator.py +4 -32
- angr/analyses/decompiler/structured_codegen/c.py +12 -2
- angr/analyses/decompiler/utils.py +13 -0
- angr/analyses/typehoon/dfa.py +108 -0
- angr/analyses/typehoon/lifter.py +34 -2
- angr/analyses/typehoon/simple_solver.py +1043 -503
- angr/analyses/typehoon/translator.py +13 -4
- angr/analyses/typehoon/typeconsts.py +117 -36
- angr/analyses/typehoon/typehoon.py +31 -11
- angr/analyses/typehoon/typevars.py +88 -21
- angr/analyses/typehoon/variance.py +10 -0
- angr/analyses/variable_recovery/engine_ail.py +28 -9
- angr/analyses/variable_recovery/engine_base.py +50 -43
- angr/analyses/variable_recovery/variable_recovery_base.py +16 -3
- angr/analyses/variable_recovery/variable_recovery_fast.py +14 -5
- angr/exploration_techniques/tracer.py +2 -0
- angr/misc/autoimport.py +26 -0
- angr/procedures/definitions/__init__.py +32 -3
- angr/utils/constants.py +1 -0
- angr/utils/graph.py +20 -1
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/METADATA +7 -6
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/RECORD +32 -244
- angr-9.2.89.dist-info/top_level.txt +1 -0
- angr/procedures/definitions/ntdll.py +0 -12
- angr-9.2.87.dist-info/top_level.txt +0 -2
- tests/__init__.py +0 -0
- tests/analyses/__init__.py +0 -0
- tests/analyses/cfg/__init__.py +0 -0
- tests/analyses/cfg/test_cfg_clflush.py +0 -43
- tests/analyses/cfg/test_cfg_get_any_node.py +0 -34
- tests/analyses/cfg/test_cfg_manager.py +0 -32
- tests/analyses/cfg/test_cfg_model.py +0 -55
- tests/analyses/cfg/test_cfg_patching.py +0 -378
- tests/analyses/cfg/test_cfg_rust_got_resolution.py +0 -36
- tests/analyses/cfg/test_cfg_thumb_firmware.py +0 -50
- tests/analyses/cfg/test_cfg_vex_postprocessor.py +0 -27
- tests/analyses/cfg/test_cfgemulated.py +0 -634
- tests/analyses/cfg/test_cfgfast.py +0 -1123
- tests/analyses/cfg/test_cfgfast_soot.py +0 -38
- tests/analyses/cfg/test_const_resolver.py +0 -38
- tests/analyses/cfg/test_iat_resolver.py +0 -37
- tests/analyses/cfg/test_jumptables.py +0 -3008
- tests/analyses/cfg/test_noop_blocks.py +0 -54
- tests/analyses/cfg_slice_to_sink/__init__.py +0 -0
- tests/analyses/cfg_slice_to_sink/test_cfg_slice_to_sink.py +0 -93
- tests/analyses/cfg_slice_to_sink/test_graph.py +0 -114
- tests/analyses/cfg_slice_to_sink/test_transitions.py +0 -28
- tests/analyses/decompiler/__init__.py +0 -0
- tests/analyses/decompiler/test_baseptr_save_simplifier.py +0 -80
- tests/analyses/decompiler/test_decompiler.py +0 -3336
- tests/analyses/decompiler/test_peephole_optimizations.py +0 -48
- tests/analyses/decompiler/test_propagator_loops.py +0 -101
- tests/analyses/decompiler/test_structurer.py +0 -275
- tests/analyses/reaching_definitions/__init__.py +0 -0
- tests/analyses/reaching_definitions/test_dep_graph.py +0 -432
- tests/analyses/reaching_definitions/test_function_handler.py +0 -131
- tests/analyses/reaching_definitions/test_heap_allocator.py +0 -46
- tests/analyses/reaching_definitions/test_rd_state.py +0 -78
- tests/analyses/reaching_definitions/test_reachingdefinitions.py +0 -463
- tests/analyses/reaching_definitions/test_subject.py +0 -76
- tests/analyses/test_bindiff.py +0 -52
- tests/analyses/test_block_simplifier.py +0 -112
- tests/analyses/test_boyscout.py +0 -104
- tests/analyses/test_calling_convention_analysis.py +0 -352
- tests/analyses/test_callsite_maker.py +0 -60
- tests/analyses/test_cdg.py +0 -165
- tests/analyses/test_cfb.py +0 -37
- tests/analyses/test_class_identifier.py +0 -46
- tests/analyses/test_clinic.py +0 -30
- tests/analyses/test_codetagging.py +0 -32
- tests/analyses/test_constantpropagation.py +0 -88
- tests/analyses/test_ddg.py +0 -95
- tests/analyses/test_ddg_global_var_dependencies.py +0 -83
- tests/analyses/test_ddg_memvar_addresses.py +0 -40
- tests/analyses/test_disassembly.py +0 -121
- tests/analyses/test_find_objects_static.py +0 -35
- tests/analyses/test_flirt.py +0 -49
- tests/analyses/test_identifier.py +0 -33
- tests/analyses/test_init_finder.py +0 -38
- tests/analyses/test_proximitygraph.py +0 -31
- tests/analyses/test_reassembler.py +0 -295
- tests/analyses/test_regionidentifier.py +0 -27
- tests/analyses/test_slicing.py +0 -164
- tests/analyses/test_stack_pointer_tracker.py +0 -74
- tests/analyses/test_static_hooker.py +0 -28
- tests/analyses/test_typehoon.py +0 -55
- tests/analyses/test_variablerecovery.py +0 -464
- tests/analyses/test_vfg.py +0 -221
- tests/analyses/test_vtable.py +0 -31
- tests/analyses/test_xrefs.py +0 -77
- tests/common.py +0 -128
- tests/engines/__init__.py +0 -0
- tests/engines/light/__init__.py +0 -0
- tests/engines/light/test_data.py +0 -17
- tests/engines/pcode/__init__.py +0 -0
- tests/engines/pcode/test_emulate.py +0 -607
- tests/engines/pcode/test_pcode.py +0 -84
- tests/engines/test_actions.py +0 -27
- tests/engines/test_hook.py +0 -112
- tests/engines/test_java.py +0 -697
- tests/engines/test_unicorn.py +0 -518
- tests/engines/vex/__init__.py +0 -0
- tests/engines/vex/test_lifter.py +0 -124
- tests/engines/vex/test_vex.py +0 -574
- tests/exploration_techniques/__init__.py +0 -0
- tests/exploration_techniques/test_cacher.py +0 -45
- tests/exploration_techniques/test_director.py +0 -67
- tests/exploration_techniques/test_driller_core.py +0 -48
- tests/exploration_techniques/test_loop_seer.py +0 -158
- tests/exploration_techniques/test_memory_watcher.py +0 -46
- tests/exploration_techniques/test_oppologist.py +0 -65
- tests/exploration_techniques/test_spiller.py +0 -82
- tests/exploration_techniques/test_stochastic.py +0 -40
- tests/exploration_techniques/test_tech_builder.py +0 -61
- tests/exploration_techniques/test_tracer.py +0 -856
- tests/exploration_techniques/test_unique.py +0 -40
- tests/exploration_techniques/test_veritesting.py +0 -120
- tests/factory/__init__.py +0 -0
- tests/factory/block/__init__.py +0 -0
- tests/factory/block/test_block_cache.py +0 -33
- tests/factory/block/test_keystone.py +0 -106
- tests/factory/test_argc.py +0 -101
- tests/factory/test_argc_sym.py +0 -110
- tests/factory/test_argv.py +0 -158
- tests/factory/test_callable.py +0 -266
- tests/factory/test_windows_args.py +0 -36
- tests/knowledge_plugins/__init__.py +0 -0
- tests/knowledge_plugins/cfg/__init__.py +0 -0
- tests/knowledge_plugins/cfg/test_cfg_manager.py +0 -36
- tests/knowledge_plugins/functions/__init__.py +0 -0
- tests/knowledge_plugins/functions/test_function.py +0 -91
- tests/knowledge_plugins/functions/test_function2.py +0 -79
- tests/knowledge_plugins/functions/test_function_manager.py +0 -139
- tests/knowledge_plugins/functions/test_prototypes.py +0 -53
- tests/knowledge_plugins/key_definitions/__init__.py +0 -0
- tests/knowledge_plugins/key_definitions/test_atoms.py +0 -24
- tests/knowledge_plugins/key_definitions/test_environment.py +0 -126
- tests/knowledge_plugins/key_definitions/test_heap_address.py +0 -27
- tests/knowledge_plugins/key_definitions/test_live_definitions.py +0 -72
- tests/knowledge_plugins/test_dwarf_variables.py +0 -240
- tests/knowledge_plugins/test_kb_plugins.py +0 -91
- tests/knowledge_plugins/test_kb_plugins_dwarf.py +0 -36
- tests/knowledge_plugins/test_patches.py +0 -48
- tests/misc/__init__.py +0 -0
- tests/misc/test_hookset.py +0 -57
- tests/perf/__init__.py +0 -0
- tests/perf/perf_cfgemulated.py +0 -19
- tests/perf/perf_cfgfast.py +0 -18
- tests/perf/perf_concrete_execution.py +0 -41
- tests/perf/perf_siminspect_nop.py +0 -36
- tests/perf/perf_state_copy.py +0 -33
- tests/perf/perf_unicorn_0.py +0 -27
- tests/perf/perf_unicorn_1.py +0 -23
- tests/procedures/__init__.py +0 -0
- tests/procedures/glibc/__init__.py +0 -0
- tests/procedures/glibc/test_ctype_locale.py +0 -164
- tests/procedures/libc/__init__.py +0 -0
- tests/procedures/libc/test_fgets.py +0 -53
- tests/procedures/libc/test_scanf.py +0 -205
- tests/procedures/libc/test_sprintf.py +0 -44
- tests/procedures/libc/test_sscanf.py +0 -63
- tests/procedures/libc/test_strcasecmp.py +0 -37
- tests/procedures/libc/test_string.py +0 -1102
- tests/procedures/libc/test_strtol.py +0 -78
- tests/procedures/linux_kernel/__init__.py +0 -0
- tests/procedures/linux_kernel/test_lseek.py +0 -174
- tests/procedures/posix/__init__.py +0 -0
- tests/procedures/posix/test_chroot.py +0 -33
- tests/procedures/posix/test_getenv.py +0 -78
- tests/procedures/posix/test_pwrite_pread.py +0 -57
- tests/procedures/posix/test_sim_time.py +0 -46
- tests/procedures/posix/test_unlink.py +0 -46
- tests/procedures/test_project_resolve_simproc.py +0 -43
- tests/procedures/test_sim_procedure.py +0 -117
- tests/procedures/test_stub_procedure_args.py +0 -53
- tests/serialization/__init__.py +0 -0
- tests/serialization/test_db.py +0 -197
- tests/serialization/test_pickle.py +0 -95
- tests/serialization/test_serialization.py +0 -132
- tests/serialization/test_vault.py +0 -169
- tests/sim/__init__.py +0 -3
- tests/sim/exec_func/__init__.py +0 -0
- tests/sim/exec_func/test_mem_funcs.py +0 -55
- tests/sim/exec_func/test_str_funcs.py +0 -93
- tests/sim/exec_func/test_syscall_result.py +0 -39
- tests/sim/exec_insn/__init__.py +0 -0
- tests/sim/exec_insn/test_adc.py +0 -44
- tests/sim/exec_insn/test_ops.py +0 -83
- tests/sim/exec_insn/test_rcr.py +0 -26
- tests/sim/exec_insn/test_rol.py +0 -51
- tests/sim/exec_insn/test_signed_div.py +0 -34
- tests/sim/exec_insn/test_sqrt.py +0 -56
- tests/sim/options/__init__.py +0 -0
- tests/sim/options/test_0div.py +0 -54
- tests/sim/options/test_symbolic_fd.py +0 -59
- tests/sim/options/test_unsupported.py +0 -34
- tests/sim/test_accuracy.py +0 -137
- tests/sim/test_checkbyte.py +0 -53
- tests/sim/test_echo.py +0 -36
- tests/sim/test_fauxware.py +0 -202
- tests/sim/test_self_modifying_code.py +0 -65
- tests/sim/test_simple_api.py +0 -36
- tests/sim/test_simulation_manager.py +0 -147
- tests/sim/test_stack_alignment.py +0 -65
- tests/sim/test_state.py +0 -303
- tests/sim/test_state_customization.py +0 -54
- tests/sim/test_symbol_hooked_by.py +0 -49
- tests/simos/__init__.py +0 -0
- tests/simos/windows/__init__.py +0 -0
- tests/simos/windows/test_windows_stack_cookie.py +0 -58
- tests/state_plugins/__init__.py +0 -0
- tests/state_plugins/inspect/__init__.py +0 -0
- tests/state_plugins/inspect/test_inspect.py +0 -310
- tests/state_plugins/inspect/test_syscall_override.py +0 -90
- tests/state_plugins/posix/__init__.py +0 -0
- tests/state_plugins/posix/test_file_struct_funcs.py +0 -56
- tests/state_plugins/posix/test_files.py +0 -69
- tests/state_plugins/posix/test_posix.py +0 -72
- tests/state_plugins/solver/__init__.py +0 -0
- tests/state_plugins/solver/test_simsolver.py +0 -58
- tests/state_plugins/solver/test_symbolic.py +0 -153
- tests/state_plugins/solver/test_variable_registration.py +0 -46
- tests/state_plugins/test_callstack.py +0 -54
- tests/state_plugins/test_gdb_plugin.py +0 -35
- tests/state_plugins/test_multi_open_file.py +0 -47
- tests/state_plugins/test_symbolization.py +0 -38
- tests/storage/__init__.py +0 -0
- tests/storage/test_memory.py +0 -960
- tests/storage/test_memory_merge.py +0 -114
- tests/storage/test_memview.py +0 -205
- tests/storage/test_mmap.py +0 -26
- tests/storage/test_multivalues.py +0 -44
- tests/storage/test_permissions.py +0 -32
- tests/storage/test_ptmalloc.py +0 -291
- tests/storage/test_relro_perm.py +0 -49
- tests/test_calling_conventions.py +0 -86
- tests/test_types.py +0 -329
- tests/utils/__init__.py +0 -0
- tests/utils/test_graph.py +0 -41
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/LICENSE +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/WHEEL +0 -0
- {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/entry_points.txt +0 -0
tests/storage/test_ptmalloc.py
DELETED
|
@@ -1,291 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
import unittest
|
|
3
|
-
|
|
4
|
-
from angr import SimState, SimHeapPTMalloc
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
# TODO: Make these tests more architecture-independent (note dependencies of some behavior on chunk metadata size)
|
|
8
|
-
class TestPtmalloc(unittest.TestCase):
|
|
9
|
-
def chunk_iterators_are_same(self, iterator1, iterator2):
|
|
10
|
-
for ck in iterator1:
|
|
11
|
-
ck2 = next(iterator2)
|
|
12
|
-
if ck.base != ck2.base:
|
|
13
|
-
return False
|
|
14
|
-
if ck.is_free() != ck2.is_free():
|
|
15
|
-
return False
|
|
16
|
-
try:
|
|
17
|
-
next(iterator2)
|
|
18
|
-
except StopIteration:
|
|
19
|
-
return True
|
|
20
|
-
return False
|
|
21
|
-
|
|
22
|
-
def same_heap_states(self, state1, state2):
|
|
23
|
-
return self.chunk_iterators_are_same(state1.heap.chunks(), state2.heap.chunks())
|
|
24
|
-
|
|
25
|
-
def max_sym_var_val(self, state):
|
|
26
|
-
return state.libc.max_variable_size
|
|
27
|
-
|
|
28
|
-
def _run_malloc_maximizes_sym_arg(self, arch):
|
|
29
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
30
|
-
sc = s.copy()
|
|
31
|
-
x = s.solver.BVS("x", 32)
|
|
32
|
-
s.solver.add(x.UGE(0))
|
|
33
|
-
s.solver.add(x.ULE(self.max_sym_var_val(s)))
|
|
34
|
-
s.heap.malloc(x)
|
|
35
|
-
sc.heap.malloc(self.max_sym_var_val(sc))
|
|
36
|
-
assert self.same_heap_states(s, sc)
|
|
37
|
-
|
|
38
|
-
def test_malloc_maximizes_sym_arg_X86(self):
|
|
39
|
-
self._run_free_maximizes_sym_arg("X86")
|
|
40
|
-
|
|
41
|
-
def test_malloc_maximizes_sym_arg_AMD64(self):
|
|
42
|
-
self._run_free_maximizes_sym_arg("AMD64")
|
|
43
|
-
|
|
44
|
-
def _run_free_maximizes_sym_arg(self, arch):
|
|
45
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
46
|
-
p = s.heap.malloc(50)
|
|
47
|
-
sc = s.copy()
|
|
48
|
-
x = s.solver.BVS("x", 32)
|
|
49
|
-
s.solver.add(x.UGE(0))
|
|
50
|
-
s.solver.add(x.ULE(p))
|
|
51
|
-
s.heap.free(x)
|
|
52
|
-
sc.heap.free(p)
|
|
53
|
-
assert self.same_heap_states(s, sc)
|
|
54
|
-
|
|
55
|
-
def test_free_maximizes_sym_arg_X86(self):
|
|
56
|
-
self._run_free_maximizes_sym_arg("X86")
|
|
57
|
-
|
|
58
|
-
def test_free_maximizes_sym_arg_AMD64(self):
|
|
59
|
-
self._run_free_maximizes_sym_arg("AMD64")
|
|
60
|
-
|
|
61
|
-
def _run_calloc_maximizes_sym_arg(self, arch):
|
|
62
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
63
|
-
sc = s.copy()
|
|
64
|
-
x = s.solver.BVS("x", 32)
|
|
65
|
-
s.solver.add(x.UGE(0))
|
|
66
|
-
s.solver.add(x.ULE(20))
|
|
67
|
-
y = s.solver.BVS("y", 32)
|
|
68
|
-
s.solver.add(y.UGE(0))
|
|
69
|
-
s.solver.add(y.ULE(6))
|
|
70
|
-
s.heap.calloc(x, y)
|
|
71
|
-
sc.heap.calloc(20, 6)
|
|
72
|
-
assert self.same_heap_states(s, sc)
|
|
73
|
-
|
|
74
|
-
def test_calloc_maximizes_sym_arg_X86(self):
|
|
75
|
-
self._run_calloc_maximizes_sym_arg("X86")
|
|
76
|
-
|
|
77
|
-
def test_calloc_maximizes_sym_arg_AMD64(self):
|
|
78
|
-
self._run_calloc_maximizes_sym_arg("AMD64")
|
|
79
|
-
|
|
80
|
-
def _run_realloc_maximizes_sym_arg(self, arch):
|
|
81
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
82
|
-
p = s.heap.malloc(50)
|
|
83
|
-
sc = s.copy()
|
|
84
|
-
x = s.solver.BVS("x", 32)
|
|
85
|
-
s.solver.add(x.UGE(0))
|
|
86
|
-
s.solver.add(x.ULE(p))
|
|
87
|
-
y = s.solver.BVS("y", 32)
|
|
88
|
-
s.solver.add(y.UGE(0))
|
|
89
|
-
s.solver.add(y.ULE(self.max_sym_var_val(s)))
|
|
90
|
-
s.heap.realloc(x, y)
|
|
91
|
-
sc.heap.realloc(p, self.max_sym_var_val(sc))
|
|
92
|
-
assert self.same_heap_states(s, sc)
|
|
93
|
-
|
|
94
|
-
def test_realloc_maximizes_sym_arg_X86(self):
|
|
95
|
-
self._run_realloc_maximizes_sym_arg("X86")
|
|
96
|
-
|
|
97
|
-
def test_realloc_maximizes_sym_arg_AMD64(self):
|
|
98
|
-
self._run_realloc_maximizes_sym_arg("AMD64")
|
|
99
|
-
|
|
100
|
-
def _run_malloc_no_space_returns_null(self, arch):
|
|
101
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
102
|
-
sc = s.copy()
|
|
103
|
-
p1 = s.heap.malloc(0x2000)
|
|
104
|
-
assert p1 == 0
|
|
105
|
-
assert self.same_heap_states(s, sc)
|
|
106
|
-
|
|
107
|
-
def test_malloc_no_space_returns_null_X86(self):
|
|
108
|
-
self._run_malloc_no_space_returns_null("X86")
|
|
109
|
-
|
|
110
|
-
def test_malloc_no_space_returns_null_AMD64(self):
|
|
111
|
-
self._run_malloc_no_space_returns_null("AMD64")
|
|
112
|
-
|
|
113
|
-
def _run_calloc_no_space_returns_null(self, arch):
|
|
114
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
115
|
-
sc = s.copy()
|
|
116
|
-
p1 = s.heap.calloc(0x500, 4)
|
|
117
|
-
assert p1 == 0
|
|
118
|
-
assert self.same_heap_states(s, sc)
|
|
119
|
-
|
|
120
|
-
def test_calloc_no_space_returns_null_X86(self):
|
|
121
|
-
self._run_calloc_no_space_returns_null("X86")
|
|
122
|
-
|
|
123
|
-
def test_calloc_no_space_returns_null_AMD64(self):
|
|
124
|
-
self._run_calloc_no_space_returns_null("AMD64")
|
|
125
|
-
|
|
126
|
-
def _run_realloc_no_space_returns_null(self, arch):
|
|
127
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
128
|
-
p1 = s.heap.malloc(20)
|
|
129
|
-
sc = s.copy()
|
|
130
|
-
p2 = s.heap.realloc(p1, 0x2000)
|
|
131
|
-
assert p2 == 0
|
|
132
|
-
assert self.same_heap_states(s, sc)
|
|
133
|
-
|
|
134
|
-
def test_realloc_no_space_returns_null_X86(self):
|
|
135
|
-
self._run_realloc_no_space_returns_null("X86")
|
|
136
|
-
|
|
137
|
-
def test_realloc_no_space_returns_null_AMD64(self):
|
|
138
|
-
self._run_realloc_no_space_returns_null("AMD64")
|
|
139
|
-
|
|
140
|
-
def _run_first_fit_and_free_malloced_makes_available(self, arch):
|
|
141
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
142
|
-
s.heap.malloc(20)
|
|
143
|
-
p1 = s.heap.malloc(50)
|
|
144
|
-
s.heap.free(p1)
|
|
145
|
-
p2 = s.heap.malloc(30)
|
|
146
|
-
assert p1 == p2
|
|
147
|
-
|
|
148
|
-
def test_first_fit_and_free_malloced_makes_available_X86(self):
|
|
149
|
-
self._run_first_fit_and_free_malloced_makes_available("X86")
|
|
150
|
-
|
|
151
|
-
def test_first_fit_and_free_malloced_makes_available_AMD64(self):
|
|
152
|
-
self._run_first_fit_and_free_malloced_makes_available("AMD64")
|
|
153
|
-
|
|
154
|
-
def _run_free_calloced_makes_available(self, arch):
|
|
155
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
156
|
-
s.heap.calloc(20, 5)
|
|
157
|
-
p1 = s.heap.calloc(30, 4)
|
|
158
|
-
s.heap.free(p1)
|
|
159
|
-
p2 = s.heap.calloc(15, 8)
|
|
160
|
-
assert p1 == p2
|
|
161
|
-
|
|
162
|
-
def test_free_calloced_makes_available_X86(self):
|
|
163
|
-
self._run_free_calloced_makes_available("X86")
|
|
164
|
-
|
|
165
|
-
def test_free_calloced_makes_available_AMD64(self):
|
|
166
|
-
self._run_free_calloced_makes_available("AMD64")
|
|
167
|
-
|
|
168
|
-
def _run_realloc_moves_and_frees(self, arch):
|
|
169
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
170
|
-
s.heap.malloc(20)
|
|
171
|
-
p1 = s.heap.malloc(60)
|
|
172
|
-
s.heap.malloc(200)
|
|
173
|
-
p2 = s.heap.realloc(p1, 300)
|
|
174
|
-
p3 = s.heap.malloc(30)
|
|
175
|
-
assert p1 == p3
|
|
176
|
-
assert p1 < p2
|
|
177
|
-
|
|
178
|
-
def test_realloc_moves_and_frees_X86(self):
|
|
179
|
-
self._run_realloc_moves_and_frees("X86")
|
|
180
|
-
|
|
181
|
-
def test_realloc_moves_and_frees_AMD64(self):
|
|
182
|
-
self._run_realloc_moves_and_frees("AMD64")
|
|
183
|
-
|
|
184
|
-
def _run_realloc_near_same_size(self, arch):
|
|
185
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
186
|
-
s.heap.malloc(20)
|
|
187
|
-
p1 = s.heap.malloc(61)
|
|
188
|
-
s.heap.malloc(80)
|
|
189
|
-
sc = s.copy()
|
|
190
|
-
p2 = s.heap.realloc(p1, 62)
|
|
191
|
-
assert p1 == p2
|
|
192
|
-
assert self.same_heap_states(s, sc)
|
|
193
|
-
|
|
194
|
-
def test_realloc_near_same_size_X86(self):
|
|
195
|
-
self._run_realloc_near_same_size("X86")
|
|
196
|
-
|
|
197
|
-
def test_realloc_near_same_size_AMD64(self):
|
|
198
|
-
self._run_realloc_near_same_size("AMD64")
|
|
199
|
-
|
|
200
|
-
def _run_needs_space_for_metadata(self, arch):
|
|
201
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
202
|
-
sc = s.copy()
|
|
203
|
-
p1 = s.heap.malloc(0x1000)
|
|
204
|
-
assert p1 == 0
|
|
205
|
-
assert self.same_heap_states(s, sc)
|
|
206
|
-
|
|
207
|
-
def test_needs_space_for_metadata_X86(self):
|
|
208
|
-
self._run_needs_space_for_metadata("X86")
|
|
209
|
-
|
|
210
|
-
def test_needs_space_for_metadata_AMD64(self):
|
|
211
|
-
self._run_needs_space_for_metadata("AMD64")
|
|
212
|
-
|
|
213
|
-
def _run_unusable_amount_returns_null(self, arch):
|
|
214
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
215
|
-
s.heap.malloc(0x1000 - 4 * s.heap._chunk_size_t_size)
|
|
216
|
-
sc = s.copy()
|
|
217
|
-
p = s.heap.malloc(1)
|
|
218
|
-
assert p == 0
|
|
219
|
-
assert self.same_heap_states(s, sc)
|
|
220
|
-
|
|
221
|
-
def test_unusable_amount_returns_null_X86(self):
|
|
222
|
-
self._run_unusable_amount_returns_null("X86")
|
|
223
|
-
|
|
224
|
-
def test_unusable_amount_returns_null_AMD64(self):
|
|
225
|
-
self._run_unusable_amount_returns_null("AMD64")
|
|
226
|
-
|
|
227
|
-
def _run_free_null_preserves_state(self, arch):
|
|
228
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
229
|
-
s.heap.malloc(30)
|
|
230
|
-
p = s.heap.malloc(40)
|
|
231
|
-
s.heap.malloc(50)
|
|
232
|
-
s.heap.free(p)
|
|
233
|
-
s2 = s.copy()
|
|
234
|
-
s2.heap.free(0)
|
|
235
|
-
assert self.same_heap_states(s, s2)
|
|
236
|
-
|
|
237
|
-
def test_free_null_preserves_state_X86(self):
|
|
238
|
-
self._run_free_null_preserves_state("X86")
|
|
239
|
-
|
|
240
|
-
def test_free_null_preserves_state_AMD64(self):
|
|
241
|
-
self._run_free_null_preserves_state("AMD64")
|
|
242
|
-
|
|
243
|
-
def _run_skips_chunks_too_small(self, arch):
|
|
244
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
245
|
-
s.heap.malloc(30)
|
|
246
|
-
p = s.heap.malloc(50)
|
|
247
|
-
s.heap.malloc(40)
|
|
248
|
-
s.heap.free(p)
|
|
249
|
-
p2 = s.heap.calloc(20, 5)
|
|
250
|
-
assert p < p2
|
|
251
|
-
|
|
252
|
-
def test_skips_chunks_too_small_X86(self):
|
|
253
|
-
self._run_skips_chunks_too_small("X86")
|
|
254
|
-
|
|
255
|
-
def test_skips_chunks_too_small_AMD64(self):
|
|
256
|
-
self._run_skips_chunks_too_small("AMD64")
|
|
257
|
-
|
|
258
|
-
def _run_calloc_multiplies(self, arch):
|
|
259
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
260
|
-
s.heap.malloc(30)
|
|
261
|
-
sc = s.copy()
|
|
262
|
-
s.heap.malloc(100)
|
|
263
|
-
sc.heap.calloc(4, 25)
|
|
264
|
-
assert self.same_heap_states(s, sc)
|
|
265
|
-
|
|
266
|
-
def test_calloc_multiplies_X86(self):
|
|
267
|
-
self._run_calloc_multiplies("X86")
|
|
268
|
-
|
|
269
|
-
def test_calloc_multiplies_AMD64(self):
|
|
270
|
-
self._run_calloc_clears("AMD64")
|
|
271
|
-
|
|
272
|
-
def _run_calloc_clears(self, arch):
|
|
273
|
-
s = SimState(arch=arch, plugins={"heap": SimHeapPTMalloc(heap_base=0xD0000000, heap_size=0x1000)})
|
|
274
|
-
s.memory.store(0xD0000000 + 2 * s.heap._chunk_size_t_size, s.solver.BVV(-1, 100 * 8))
|
|
275
|
-
sc = s.copy()
|
|
276
|
-
p1 = s.heap.calloc(6, 5)
|
|
277
|
-
p2 = sc.heap.malloc(30)
|
|
278
|
-
v1 = s.memory.load(p1, 30)
|
|
279
|
-
v2 = sc.memory.load(p2, 30)
|
|
280
|
-
assert s.solver.is_true(v1 == 0)
|
|
281
|
-
assert sc.solver.is_true(v2 == -1)
|
|
282
|
-
|
|
283
|
-
def test_calloc_clears_X86(self):
|
|
284
|
-
self._run_calloc_clears("X86")
|
|
285
|
-
|
|
286
|
-
def test_calloc_clears_AMD64(self):
|
|
287
|
-
self._run_calloc_clears("AMD64")
|
|
288
|
-
|
|
289
|
-
|
|
290
|
-
if __name__ == "__main__":
|
|
291
|
-
unittest.main()
|
tests/storage/test_relro_perm.py
DELETED
|
@@ -1,49 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests.storage" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import os
|
|
5
|
-
import unittest
|
|
6
|
-
|
|
7
|
-
import angr
|
|
8
|
-
|
|
9
|
-
from ..common import bin_location
|
|
10
|
-
|
|
11
|
-
test_location = os.path.join(bin_location, "tests")
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
class TestRelro(unittest.TestCase):
|
|
15
|
-
def _run_fauxware_relro(self, arch):
|
|
16
|
-
p = angr.Project(os.path.join(test_location, arch, "fauxware"), use_sim_procedures=False)
|
|
17
|
-
s = p.factory.full_init_state(add_options={angr.options.STRICT_PAGE_ACCESS})
|
|
18
|
-
|
|
19
|
-
relro_segment = next((s for s in p.loader.main_object.segments if s.relro), None)
|
|
20
|
-
if relro_segment is None:
|
|
21
|
-
# No relro on this arch
|
|
22
|
-
return
|
|
23
|
-
|
|
24
|
-
assert not relro_segment.is_writable, "The RELRO segment should not be writable"
|
|
25
|
-
|
|
26
|
-
try:
|
|
27
|
-
s.memory.store(relro_segment.min_addr, b"\x42")
|
|
28
|
-
assert False, "The RELRO segment should not be writable"
|
|
29
|
-
except angr.errors.SimSegfaultException:
|
|
30
|
-
pass
|
|
31
|
-
|
|
32
|
-
def test_fauxware_i386(self):
|
|
33
|
-
self._run_fauxware_relro("i386")
|
|
34
|
-
|
|
35
|
-
def test_fauxware_x86_64(self):
|
|
36
|
-
self._run_fauxware_relro("x86_64")
|
|
37
|
-
|
|
38
|
-
def test_fauxware_ppc(self):
|
|
39
|
-
self._run_fauxware_relro("ppc")
|
|
40
|
-
|
|
41
|
-
def test_fauxware_armel(self):
|
|
42
|
-
self._run_fauxware_relro("armel")
|
|
43
|
-
|
|
44
|
-
def test_fauxware_mips(self):
|
|
45
|
-
self._run_fauxware_relro("mips")
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
if __name__ == "__main__":
|
|
49
|
-
unittest.main()
|
|
@@ -1,86 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env python3
|
|
2
|
-
__package__ = __package__ or "tests" # pylint:disable=redefined-builtin
|
|
3
|
-
|
|
4
|
-
import os
|
|
5
|
-
from unittest import TestCase, main
|
|
6
|
-
|
|
7
|
-
import archinfo
|
|
8
|
-
|
|
9
|
-
from angr.calling_conventions import SimTypeInt, SimTypeFixedSizeArray, SimCCSystemVAMD64, SimTypeFunction, SimRegArg
|
|
10
|
-
from angr.sim_type import parse_file, SimStructValue
|
|
11
|
-
from angr import Project, load_shellcode
|
|
12
|
-
|
|
13
|
-
from .common import bin_location
|
|
14
|
-
|
|
15
|
-
test_location = os.path.join(bin_location, "tests")
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
class TestCallingConvention(TestCase):
|
|
19
|
-
def test_SystemVAMD64_flatten_int(self):
|
|
20
|
-
arch = archinfo.arch_from_id("amd64")
|
|
21
|
-
cc = SimCCSystemVAMD64(arch)
|
|
22
|
-
|
|
23
|
-
int_type = SimTypeInt().with_arch(arch)
|
|
24
|
-
flattened_int = cc._flatten(int_type)
|
|
25
|
-
self.assertTrue(all(isinstance(key, int) for key in flattened_int))
|
|
26
|
-
self.assertTrue(all(isinstance(value, list) for value in flattened_int.values()))
|
|
27
|
-
for v in flattened_int.values():
|
|
28
|
-
for subtype in v:
|
|
29
|
-
self.assertIsInstance(subtype, SimTypeInt)
|
|
30
|
-
|
|
31
|
-
def test_SystemVAMD64_flatten_array(self):
|
|
32
|
-
arch = archinfo.arch_from_id("amd64")
|
|
33
|
-
cc = SimCCSystemVAMD64(arch)
|
|
34
|
-
|
|
35
|
-
int_type = SimTypeInt().with_arch(arch)
|
|
36
|
-
array_type = SimTypeFixedSizeArray(int_type, 20).with_arch(arch)
|
|
37
|
-
flattened_array = cc._flatten(array_type)
|
|
38
|
-
self.assertTrue(all(isinstance(key, int) for key in flattened_array))
|
|
39
|
-
self.assertTrue(all(isinstance(value, list) for value in flattened_array.values()))
|
|
40
|
-
for v in flattened_array.values():
|
|
41
|
-
for subtype in v:
|
|
42
|
-
self.assertIsInstance(subtype, SimTypeInt)
|
|
43
|
-
|
|
44
|
-
def test_arg_locs_array(self):
|
|
45
|
-
arch = archinfo.arch_from_id("amd64")
|
|
46
|
-
cc = SimCCSystemVAMD64(arch)
|
|
47
|
-
proto = SimTypeFunction([SimTypeFixedSizeArray(SimTypeInt().with_arch(arch), 2).with_arch(arch)], None)
|
|
48
|
-
|
|
49
|
-
# It should not raise any exception!
|
|
50
|
-
cc.arg_locs(proto)
|
|
51
|
-
|
|
52
|
-
def test_struct_ffi(self):
|
|
53
|
-
with open(os.path.join(test_location, "../tests_src/test_structs.c")) as fp:
|
|
54
|
-
decls = parse_file(fp.read())
|
|
55
|
-
|
|
56
|
-
p = Project(os.path.join(test_location, "x86_64/test_structs.o"), auto_load_libs=False)
|
|
57
|
-
|
|
58
|
-
def make_callable(name):
|
|
59
|
-
return p.factory.callable(p.loader.find_symbol(name).rebased_addr, decls[0][name])
|
|
60
|
-
|
|
61
|
-
test_small_struct_return = make_callable("test_small_struct_return")
|
|
62
|
-
result = test_small_struct_return()
|
|
63
|
-
self.assertIsInstance(result, SimStructValue)
|
|
64
|
-
self.assertTrue((result.a == 1).is_true())
|
|
65
|
-
self.assertTrue((result.b == 2).is_true())
|
|
66
|
-
|
|
67
|
-
def test_array_ffi(self):
|
|
68
|
-
# NOTE: if this test is failing and you think it is wrong, you might be right :)
|
|
69
|
-
p = load_shellcode(b"\xc3", arch="amd64")
|
|
70
|
-
s = p.factory.blank_state()
|
|
71
|
-
s.regs.rdi = 123
|
|
72
|
-
s.regs.rsi = 456
|
|
73
|
-
s.regs.rdx = 789
|
|
74
|
-
execve = parse_file("int execve(const char *pathname, char *const argv[], char *const envp[]);")[0]["execve"]
|
|
75
|
-
cc = p.factory.cc()
|
|
76
|
-
assert all((x == y).is_true() for x, y in zip(cc.get_args(s, execve), (123, 456, 789)))
|
|
77
|
-
# however, this is defintely right
|
|
78
|
-
assert [list(loc.get_footprint()) for loc in cc.arg_locs(execve)] == [
|
|
79
|
-
[SimRegArg("rdi", 8)],
|
|
80
|
-
[SimRegArg("rsi", 8)],
|
|
81
|
-
[SimRegArg("rdx", 8)],
|
|
82
|
-
]
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
if __name__ == "__main__":
|
|
86
|
-
main()
|