angr 9.2.87__py3-none-win_amd64.whl → 9.2.89__py3-none-win_amd64.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.


This version of angr might be problematic. Click here for more details.

Files changed (249) hide show
  1. angr/__init__.py +4 -1
  2. angr/analyses/decompiler/clinic.py +16 -0
  3. angr/analyses/decompiler/decompiler.py +3 -0
  4. angr/analyses/decompiler/optimization_passes/__init__.py +5 -0
  5. angr/analyses/decompiler/optimization_passes/cross_jump_reverter.py +108 -0
  6. angr/analyses/decompiler/optimization_passes/optimization_pass.py +17 -4
  7. angr/analyses/decompiler/optimization_passes/return_duplicator.py +4 -32
  8. angr/analyses/decompiler/structured_codegen/c.py +12 -2
  9. angr/analyses/decompiler/utils.py +13 -0
  10. angr/analyses/typehoon/dfa.py +108 -0
  11. angr/analyses/typehoon/lifter.py +34 -2
  12. angr/analyses/typehoon/simple_solver.py +1043 -503
  13. angr/analyses/typehoon/translator.py +13 -4
  14. angr/analyses/typehoon/typeconsts.py +117 -36
  15. angr/analyses/typehoon/typehoon.py +31 -11
  16. angr/analyses/typehoon/typevars.py +88 -21
  17. angr/analyses/typehoon/variance.py +10 -0
  18. angr/analyses/variable_recovery/engine_ail.py +28 -9
  19. angr/analyses/variable_recovery/engine_base.py +50 -43
  20. angr/analyses/variable_recovery/variable_recovery_base.py +16 -3
  21. angr/analyses/variable_recovery/variable_recovery_fast.py +14 -5
  22. angr/exploration_techniques/tracer.py +2 -0
  23. angr/lib/angr_native.dll +0 -0
  24. angr/misc/autoimport.py +26 -0
  25. angr/procedures/definitions/__init__.py +32 -3
  26. angr/utils/constants.py +1 -0
  27. angr/utils/graph.py +20 -1
  28. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/METADATA +7 -6
  29. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/RECORD +33 -245
  30. angr-9.2.89.dist-info/top_level.txt +1 -0
  31. angr/procedures/definitions/ntdll.py +0 -12
  32. angr-9.2.87.dist-info/top_level.txt +0 -2
  33. tests/__init__.py +0 -0
  34. tests/analyses/__init__.py +0 -0
  35. tests/analyses/cfg/__init__.py +0 -0
  36. tests/analyses/cfg/test_cfg_clflush.py +0 -43
  37. tests/analyses/cfg/test_cfg_get_any_node.py +0 -34
  38. tests/analyses/cfg/test_cfg_manager.py +0 -32
  39. tests/analyses/cfg/test_cfg_model.py +0 -55
  40. tests/analyses/cfg/test_cfg_patching.py +0 -378
  41. tests/analyses/cfg/test_cfg_rust_got_resolution.py +0 -36
  42. tests/analyses/cfg/test_cfg_thumb_firmware.py +0 -50
  43. tests/analyses/cfg/test_cfg_vex_postprocessor.py +0 -27
  44. tests/analyses/cfg/test_cfgemulated.py +0 -634
  45. tests/analyses/cfg/test_cfgfast.py +0 -1123
  46. tests/analyses/cfg/test_cfgfast_soot.py +0 -38
  47. tests/analyses/cfg/test_const_resolver.py +0 -38
  48. tests/analyses/cfg/test_iat_resolver.py +0 -37
  49. tests/analyses/cfg/test_jumptables.py +0 -3008
  50. tests/analyses/cfg/test_noop_blocks.py +0 -54
  51. tests/analyses/cfg_slice_to_sink/__init__.py +0 -0
  52. tests/analyses/cfg_slice_to_sink/test_cfg_slice_to_sink.py +0 -93
  53. tests/analyses/cfg_slice_to_sink/test_graph.py +0 -114
  54. tests/analyses/cfg_slice_to_sink/test_transitions.py +0 -28
  55. tests/analyses/decompiler/__init__.py +0 -0
  56. tests/analyses/decompiler/test_baseptr_save_simplifier.py +0 -80
  57. tests/analyses/decompiler/test_decompiler.py +0 -3336
  58. tests/analyses/decompiler/test_peephole_optimizations.py +0 -48
  59. tests/analyses/decompiler/test_propagator_loops.py +0 -101
  60. tests/analyses/decompiler/test_structurer.py +0 -275
  61. tests/analyses/reaching_definitions/__init__.py +0 -0
  62. tests/analyses/reaching_definitions/test_dep_graph.py +0 -432
  63. tests/analyses/reaching_definitions/test_function_handler.py +0 -131
  64. tests/analyses/reaching_definitions/test_heap_allocator.py +0 -46
  65. tests/analyses/reaching_definitions/test_rd_state.py +0 -78
  66. tests/analyses/reaching_definitions/test_reachingdefinitions.py +0 -463
  67. tests/analyses/reaching_definitions/test_subject.py +0 -76
  68. tests/analyses/test_bindiff.py +0 -52
  69. tests/analyses/test_block_simplifier.py +0 -112
  70. tests/analyses/test_boyscout.py +0 -104
  71. tests/analyses/test_calling_convention_analysis.py +0 -352
  72. tests/analyses/test_callsite_maker.py +0 -60
  73. tests/analyses/test_cdg.py +0 -165
  74. tests/analyses/test_cfb.py +0 -37
  75. tests/analyses/test_class_identifier.py +0 -46
  76. tests/analyses/test_clinic.py +0 -30
  77. tests/analyses/test_codetagging.py +0 -32
  78. tests/analyses/test_constantpropagation.py +0 -88
  79. tests/analyses/test_ddg.py +0 -95
  80. tests/analyses/test_ddg_global_var_dependencies.py +0 -83
  81. tests/analyses/test_ddg_memvar_addresses.py +0 -40
  82. tests/analyses/test_disassembly.py +0 -121
  83. tests/analyses/test_find_objects_static.py +0 -35
  84. tests/analyses/test_flirt.py +0 -49
  85. tests/analyses/test_identifier.py +0 -33
  86. tests/analyses/test_init_finder.py +0 -38
  87. tests/analyses/test_proximitygraph.py +0 -31
  88. tests/analyses/test_reassembler.py +0 -295
  89. tests/analyses/test_regionidentifier.py +0 -27
  90. tests/analyses/test_slicing.py +0 -164
  91. tests/analyses/test_stack_pointer_tracker.py +0 -74
  92. tests/analyses/test_static_hooker.py +0 -28
  93. tests/analyses/test_typehoon.py +0 -55
  94. tests/analyses/test_variablerecovery.py +0 -464
  95. tests/analyses/test_vfg.py +0 -221
  96. tests/analyses/test_vtable.py +0 -31
  97. tests/analyses/test_xrefs.py +0 -77
  98. tests/common.py +0 -128
  99. tests/engines/__init__.py +0 -0
  100. tests/engines/light/__init__.py +0 -0
  101. tests/engines/light/test_data.py +0 -17
  102. tests/engines/pcode/__init__.py +0 -0
  103. tests/engines/pcode/test_emulate.py +0 -607
  104. tests/engines/pcode/test_pcode.py +0 -84
  105. tests/engines/test_actions.py +0 -27
  106. tests/engines/test_hook.py +0 -112
  107. tests/engines/test_java.py +0 -697
  108. tests/engines/test_unicorn.py +0 -518
  109. tests/engines/vex/__init__.py +0 -0
  110. tests/engines/vex/test_lifter.py +0 -124
  111. tests/engines/vex/test_vex.py +0 -574
  112. tests/exploration_techniques/__init__.py +0 -0
  113. tests/exploration_techniques/test_cacher.py +0 -45
  114. tests/exploration_techniques/test_director.py +0 -67
  115. tests/exploration_techniques/test_driller_core.py +0 -48
  116. tests/exploration_techniques/test_loop_seer.py +0 -158
  117. tests/exploration_techniques/test_memory_watcher.py +0 -46
  118. tests/exploration_techniques/test_oppologist.py +0 -65
  119. tests/exploration_techniques/test_spiller.py +0 -82
  120. tests/exploration_techniques/test_stochastic.py +0 -40
  121. tests/exploration_techniques/test_tech_builder.py +0 -61
  122. tests/exploration_techniques/test_tracer.py +0 -856
  123. tests/exploration_techniques/test_unique.py +0 -40
  124. tests/exploration_techniques/test_veritesting.py +0 -120
  125. tests/factory/__init__.py +0 -0
  126. tests/factory/block/__init__.py +0 -0
  127. tests/factory/block/test_block_cache.py +0 -33
  128. tests/factory/block/test_keystone.py +0 -106
  129. tests/factory/test_argc.py +0 -101
  130. tests/factory/test_argc_sym.py +0 -110
  131. tests/factory/test_argv.py +0 -158
  132. tests/factory/test_callable.py +0 -266
  133. tests/factory/test_windows_args.py +0 -36
  134. tests/knowledge_plugins/__init__.py +0 -0
  135. tests/knowledge_plugins/cfg/__init__.py +0 -0
  136. tests/knowledge_plugins/cfg/test_cfg_manager.py +0 -36
  137. tests/knowledge_plugins/functions/__init__.py +0 -0
  138. tests/knowledge_plugins/functions/test_function.py +0 -91
  139. tests/knowledge_plugins/functions/test_function2.py +0 -79
  140. tests/knowledge_plugins/functions/test_function_manager.py +0 -139
  141. tests/knowledge_plugins/functions/test_prototypes.py +0 -53
  142. tests/knowledge_plugins/key_definitions/__init__.py +0 -0
  143. tests/knowledge_plugins/key_definitions/test_atoms.py +0 -24
  144. tests/knowledge_plugins/key_definitions/test_environment.py +0 -126
  145. tests/knowledge_plugins/key_definitions/test_heap_address.py +0 -27
  146. tests/knowledge_plugins/key_definitions/test_live_definitions.py +0 -72
  147. tests/knowledge_plugins/test_dwarf_variables.py +0 -240
  148. tests/knowledge_plugins/test_kb_plugins.py +0 -91
  149. tests/knowledge_plugins/test_kb_plugins_dwarf.py +0 -36
  150. tests/knowledge_plugins/test_patches.py +0 -48
  151. tests/misc/__init__.py +0 -0
  152. tests/misc/test_hookset.py +0 -57
  153. tests/perf/__init__.py +0 -0
  154. tests/perf/perf_cfgemulated.py +0 -19
  155. tests/perf/perf_cfgfast.py +0 -18
  156. tests/perf/perf_concrete_execution.py +0 -41
  157. tests/perf/perf_siminspect_nop.py +0 -36
  158. tests/perf/perf_state_copy.py +0 -33
  159. tests/perf/perf_unicorn_0.py +0 -27
  160. tests/perf/perf_unicorn_1.py +0 -23
  161. tests/procedures/__init__.py +0 -0
  162. tests/procedures/glibc/__init__.py +0 -0
  163. tests/procedures/glibc/test_ctype_locale.py +0 -164
  164. tests/procedures/libc/__init__.py +0 -0
  165. tests/procedures/libc/test_fgets.py +0 -53
  166. tests/procedures/libc/test_scanf.py +0 -205
  167. tests/procedures/libc/test_sprintf.py +0 -44
  168. tests/procedures/libc/test_sscanf.py +0 -63
  169. tests/procedures/libc/test_strcasecmp.py +0 -37
  170. tests/procedures/libc/test_string.py +0 -1102
  171. tests/procedures/libc/test_strtol.py +0 -78
  172. tests/procedures/linux_kernel/__init__.py +0 -0
  173. tests/procedures/linux_kernel/test_lseek.py +0 -174
  174. tests/procedures/posix/__init__.py +0 -0
  175. tests/procedures/posix/test_chroot.py +0 -33
  176. tests/procedures/posix/test_getenv.py +0 -78
  177. tests/procedures/posix/test_pwrite_pread.py +0 -57
  178. tests/procedures/posix/test_sim_time.py +0 -46
  179. tests/procedures/posix/test_unlink.py +0 -46
  180. tests/procedures/test_project_resolve_simproc.py +0 -43
  181. tests/procedures/test_sim_procedure.py +0 -117
  182. tests/procedures/test_stub_procedure_args.py +0 -53
  183. tests/serialization/__init__.py +0 -0
  184. tests/serialization/test_db.py +0 -197
  185. tests/serialization/test_pickle.py +0 -95
  186. tests/serialization/test_serialization.py +0 -132
  187. tests/serialization/test_vault.py +0 -169
  188. tests/sim/__init__.py +0 -3
  189. tests/sim/exec_func/__init__.py +0 -0
  190. tests/sim/exec_func/test_mem_funcs.py +0 -55
  191. tests/sim/exec_func/test_str_funcs.py +0 -93
  192. tests/sim/exec_func/test_syscall_result.py +0 -39
  193. tests/sim/exec_insn/__init__.py +0 -0
  194. tests/sim/exec_insn/test_adc.py +0 -44
  195. tests/sim/exec_insn/test_ops.py +0 -83
  196. tests/sim/exec_insn/test_rcr.py +0 -26
  197. tests/sim/exec_insn/test_rol.py +0 -51
  198. tests/sim/exec_insn/test_signed_div.py +0 -34
  199. tests/sim/exec_insn/test_sqrt.py +0 -56
  200. tests/sim/options/__init__.py +0 -0
  201. tests/sim/options/test_0div.py +0 -54
  202. tests/sim/options/test_symbolic_fd.py +0 -59
  203. tests/sim/options/test_unsupported.py +0 -34
  204. tests/sim/test_accuracy.py +0 -137
  205. tests/sim/test_checkbyte.py +0 -53
  206. tests/sim/test_echo.py +0 -36
  207. tests/sim/test_fauxware.py +0 -202
  208. tests/sim/test_self_modifying_code.py +0 -65
  209. tests/sim/test_simple_api.py +0 -36
  210. tests/sim/test_simulation_manager.py +0 -147
  211. tests/sim/test_stack_alignment.py +0 -65
  212. tests/sim/test_state.py +0 -303
  213. tests/sim/test_state_customization.py +0 -54
  214. tests/sim/test_symbol_hooked_by.py +0 -49
  215. tests/simos/__init__.py +0 -0
  216. tests/simos/windows/__init__.py +0 -0
  217. tests/simos/windows/test_windows_stack_cookie.py +0 -58
  218. tests/state_plugins/__init__.py +0 -0
  219. tests/state_plugins/inspect/__init__.py +0 -0
  220. tests/state_plugins/inspect/test_inspect.py +0 -310
  221. tests/state_plugins/inspect/test_syscall_override.py +0 -90
  222. tests/state_plugins/posix/__init__.py +0 -0
  223. tests/state_plugins/posix/test_file_struct_funcs.py +0 -56
  224. tests/state_plugins/posix/test_files.py +0 -69
  225. tests/state_plugins/posix/test_posix.py +0 -72
  226. tests/state_plugins/solver/__init__.py +0 -0
  227. tests/state_plugins/solver/test_simsolver.py +0 -58
  228. tests/state_plugins/solver/test_symbolic.py +0 -153
  229. tests/state_plugins/solver/test_variable_registration.py +0 -46
  230. tests/state_plugins/test_callstack.py +0 -54
  231. tests/state_plugins/test_gdb_plugin.py +0 -35
  232. tests/state_plugins/test_multi_open_file.py +0 -47
  233. tests/state_plugins/test_symbolization.py +0 -38
  234. tests/storage/__init__.py +0 -0
  235. tests/storage/test_memory.py +0 -960
  236. tests/storage/test_memory_merge.py +0 -114
  237. tests/storage/test_memview.py +0 -205
  238. tests/storage/test_mmap.py +0 -26
  239. tests/storage/test_multivalues.py +0 -44
  240. tests/storage/test_permissions.py +0 -32
  241. tests/storage/test_ptmalloc.py +0 -291
  242. tests/storage/test_relro_perm.py +0 -49
  243. tests/test_calling_conventions.py +0 -86
  244. tests/test_types.py +0 -329
  245. tests/utils/__init__.py +0 -0
  246. tests/utils/test_graph.py +0 -41
  247. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/LICENSE +0 -0
  248. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/WHEEL +0 -0
  249. {angr-9.2.87.dist-info → angr-9.2.89.dist-info}/entry_points.txt +0 -0
@@ -1,310 +0,0 @@
1
- #!/usr/bin/env python3
2
- # pylint: disable=missing-class-docstring,disable=no-self-use
3
- __package__ = __package__ or "tests.state_plugins.inspect" # pylint:disable=redefined-builtin
4
-
5
- import os
6
- import unittest
7
-
8
- import pyvex
9
- import claripy
10
- import archinfo
11
-
12
- import angr
13
- from angr import SimState, BP_AFTER, BP_BEFORE, SIM_PROCEDURES, concretization_strategies
14
- from angr.engines import ProcedureEngine, HeavyVEXMixin, SimInspectMixin
15
-
16
- from ...common import bin_location
17
-
18
-
19
- test_location = os.path.join(bin_location, "tests")
20
-
21
-
22
- class InspectEngine(SimInspectMixin, HeavyVEXMixin):
23
- pass
24
-
25
-
26
- class TestInspect(unittest.TestCase):
27
- def test_inspect(self):
28
- class counts: # pylint:disable=no-init
29
- mem_read = 0
30
- mem_write = 0
31
- reg_read = 0
32
- reg_write = 0
33
- tmp_read = 0
34
- tmp_write = 0
35
- expr = 0
36
- statement = 0
37
- instruction = 0
38
- constraints = 0
39
- variables = 0
40
-
41
- def act_mem_read(state): # pylint:disable=unused-argument
42
- counts.mem_read += 1
43
-
44
- def act_mem_write(state): # pylint:disable=unused-argument
45
- counts.mem_write += 1
46
-
47
- def act_reg_read(state): # pylint:disable=unused-argument
48
- counts.reg_read += 1
49
-
50
- def act_reg_write(state): # pylint:disable=unused-argument
51
- counts.reg_write += 1
52
-
53
- def act_tmp_read(state): # pylint:disable=unused-argument
54
- counts.tmp_read += 1
55
-
56
- def act_tmp_write(state): # pylint:disable=unused-argument
57
- counts.tmp_write += 1
58
-
59
- def act_expr(state): # pylint:disable=unused-argument
60
- counts.expr += 1
61
-
62
- def act_statement(state): # pylint:disable=unused-argument
63
- counts.statement += 1
64
-
65
- def act_instruction(state): # pylint:disable=unused-argument
66
- counts.instruction += 1
67
-
68
- def act_variables(state): # pylint:disable=unused-argument
69
- # print "CREATING:", state.inspect.symbolic_name
70
- counts.variables += 1
71
-
72
- # def act_constraints(state): #pylint:disable=unused-argument
73
- # counts.constraints += 1
74
-
75
- s = SimState(arch="AMD64", mode="symbolic")
76
-
77
- s.inspect.b("mem_write", when=BP_AFTER, action=act_mem_write)
78
- assert counts.mem_write == 0
79
- s.memory.store(100, s.solver.BVV(10, 32))
80
- assert counts.mem_write == 1
81
-
82
- s.inspect.b("mem_read", when=BP_AFTER, action=act_mem_read)
83
- s.inspect.b("mem_read", when=BP_AFTER, action=act_mem_read, mem_read_address=100)
84
- s.inspect.b("mem_read", when=BP_AFTER, action=act_mem_read, mem_read_address=123)
85
- s.inspect.b("mem_read", when=BP_BEFORE, action=act_mem_read, mem_read_length=3)
86
- assert counts.mem_read == 0
87
- s.memory.load(123, 4)
88
- s.memory.load(223, 3)
89
- assert counts.mem_read == 4
90
-
91
- s.inspect.b("reg_read", when=BP_AFTER, action=act_reg_read)
92
- assert counts.reg_read == 0
93
- s.registers.load(16, size=8)
94
- assert counts.reg_read == 1
95
-
96
- s.inspect.b("reg_write", when=BP_AFTER, action=act_reg_write)
97
- assert counts.reg_write == 0
98
- s.registers.store(16, s.solver.BVV(10, 32))
99
- assert counts.reg_write == 1
100
- assert counts.mem_write == 1
101
- assert counts.mem_read == 4
102
- assert counts.reg_read == 1
103
-
104
- s.inspect.b("tmp_read", when=BP_AFTER, action=act_tmp_read, tmp_read_num=0)
105
- s.inspect.b("tmp_write", when=BP_AFTER, action=act_tmp_write, tmp_write_num=0)
106
- s.inspect.b("expr", when=BP_AFTER, action=act_expr, expr_result=1016)
107
- s.inspect.b("statement", when=BP_AFTER, action=act_statement)
108
- s.inspect.b("instruction", when=BP_AFTER, action=act_instruction, instruction=1001)
109
- s.inspect.b("instruction", when=BP_AFTER, action=act_instruction, instruction=1000)
110
- irsb = pyvex.IRSB(b"\x90\x90\x90\x90\xeb\x0a", mem_addr=1000, arch=archinfo.ArchAMD64(), opt_level=0)
111
- irsb.pp()
112
- InspectEngine(None).process(s, irsb=irsb)
113
- assert counts.reg_write == 7
114
- assert counts.reg_read == 2
115
- assert counts.tmp_write == 1
116
- assert counts.tmp_read == 1
117
- assert counts.expr == 3
118
- assert counts.statement == 11
119
- assert counts.instruction == 2
120
- assert counts.constraints == 0
121
- assert counts.mem_write == 1
122
- assert counts.mem_read == 4
123
-
124
- s = SimState(arch="AMD64", mode="symbolic")
125
- s.inspect.b("symbolic_variable", when=BP_AFTER, action=act_variables)
126
- s.memory.load(0, 10)
127
- assert counts.variables == 1
128
-
129
- def test_inspect_exit(self):
130
- class counts: # pylint:disable=no-init
131
- exit_before = 0
132
- exit_after = 0
133
-
134
- def handle_exit_before(state):
135
- counts.exit_before += 1
136
- exit_target = state.inspect.exit_target
137
- assert state.solver.eval(exit_target) == 0x3F8
138
- # change exit target
139
- state.inspect.exit_target = 0x41414141
140
- assert state.inspect.exit_jumpkind == "Ijk_Boring"
141
- assert state.inspect.exit_guard.is_true()
142
-
143
- def handle_exit_after(state): # pylint:disable=unused-argument
144
- counts.exit_after += 1
145
-
146
- s = SimState(arch="AMD64", mode="symbolic")
147
- irsb = pyvex.IRSB(b"\x90\x90\x90\x90\xeb\x0a", mem_addr=1000, arch=archinfo.ArchAMD64())
148
-
149
- # break on exit
150
- s.inspect.b("exit", BP_BEFORE, action=handle_exit_before)
151
- s.inspect.b("exit", BP_AFTER, action=handle_exit_after)
152
-
153
- # step it
154
- succ = HeavyVEXMixin(None).process(s, irsb=irsb).flat_successors
155
-
156
- # check
157
- assert succ[0].solver.eval(succ[0].ip) == 0x41414141
158
- assert counts.exit_before == 1
159
- assert counts.exit_after == 1
160
-
161
- def test_inspect_syscall(self):
162
- class counts: # pylint:disable=no-init
163
- exit_before = 0
164
- exit_after = 0
165
-
166
- def handle_syscall_before(state):
167
- counts.exit_before += 1
168
- syscall_name = state.inspect.syscall_name
169
- assert syscall_name == "close"
170
-
171
- def handle_syscall_after(state):
172
- counts.exit_after += 1
173
- syscall_name = state.inspect.syscall_name
174
- assert syscall_name == "close"
175
-
176
- s = SimState(arch="AMD64", mode="symbolic")
177
- # set up to call so syscall close
178
- s.regs.rax = 3
179
- s.regs.rdi = 2
180
-
181
- # break on syscall
182
- s.inspect.b("syscall", BP_BEFORE, action=handle_syscall_before)
183
- s.inspect.b("syscall", BP_AFTER, action=handle_syscall_after)
184
-
185
- # step it
186
- proc = SIM_PROCEDURES["posix"]["close"](is_syscall=True)
187
- ProcedureEngine(None).process(s, procedure=proc, ret_to=s.ip)
188
-
189
- # check counts
190
- assert counts.exit_before == 1
191
- assert counts.exit_after == 1
192
-
193
- def test_inspect_concretization(self):
194
- # some values for the test
195
- x = claripy.BVS("x", 64)
196
- y = claripy.BVS("y", 64)
197
-
198
- #
199
- # This tests concretization-time address redirection.
200
- #
201
-
202
- def change_symbolic_target(state):
203
- if state.inspect.address_concretization_action == "store":
204
- state.inspect.address_concretization_expr = claripy.BVV(0x1000, state.arch.bits)
205
-
206
- s = SimState(arch="AMD64")
207
- s.inspect.b("address_concretization", BP_BEFORE, action=change_symbolic_target)
208
- s.memory.store(x, "A")
209
- assert list(s.solver.eval_upto(x, 10)) == [0x1000]
210
- assert list(s.solver.eval_upto(s.memory.load(0x1000, 1), 10)) == [0x41]
211
-
212
- #
213
- # This tests disabling constraint adding through siminspect -- the write still happens
214
- #
215
-
216
- def dont_add_constraints(state):
217
- state.inspect.address_concretization_add_constraints = False
218
-
219
- s = SimState(arch="AMD64")
220
- s.inspect.b("address_concretization", BP_BEFORE, action=dont_add_constraints)
221
- s.memory.store(x, "A")
222
- assert len(s.solver.eval_upto(x, 10)) == 10
223
-
224
- #
225
- # This tests raising an exception if symbolic concretization fails (i.e., if the address
226
- # is too unconstrained). The write aborts.
227
- #
228
-
229
- class UnconstrainedAbort(Exception):
230
- def __init__(self, message, state):
231
- Exception.__init__(self, message)
232
- self.state = state
233
-
234
- def abort_unconstrained(state):
235
- print(state.inspect.address_concretization_strategy, state.inspect.address_concretization_result)
236
- if (
237
- isinstance(
238
- state.inspect.address_concretization_strategy,
239
- concretization_strategies.SimConcretizationStrategyRange,
240
- )
241
- and state.inspect.address_concretization_result is None
242
- ):
243
- raise UnconstrainedAbort("uh oh", state)
244
-
245
- s = SimState(arch="AMD64")
246
- s.memory.write_strategies.insert(0, concretization_strategies.SimConcretizationStrategyRange(128))
247
- s.memory._write_address_range = 1
248
- s.memory._write_address_range_approx = 1
249
- s.add_constraints(y == 10)
250
- s.inspect.b("address_concretization", BP_AFTER, action=abort_unconstrained)
251
- s.memory.store(y, "A")
252
- assert list(s.solver.eval_upto(s.memory.load(y, 1), 10)) == [0x41]
253
-
254
- try:
255
- s.memory.store(x, "A")
256
- print("THIS SHOULD NOT BE REACHED")
257
- assert False
258
- except UnconstrainedAbort as e:
259
- assert e.state.memory is s.memory
260
-
261
- def test_inspect_engine_process(self):
262
- p = angr.Project(os.path.join(test_location, "x86_64", "fauxware"), auto_load_libs=False)
263
-
264
- def check_first_symbolic_fork(state):
265
- succs = state.inspect.sim_successors.successors
266
- succ_addr = [hex(s.addr) for s in succs]
267
- assert len(succ_addr) == 2
268
- assert "0x400692L" in succ_addr
269
- assert "0x400699L" in succ_addr
270
- print("Fork after:", hex(state.addr))
271
- print("Successors:", succ_addr)
272
-
273
- def check_second_symbolic_fork(state):
274
- succs = state.inspect.sim_successors.successors
275
- succ_addr = [hex(s.addr) for s in succs]
276
- assert len(succ_addr) == 2
277
- assert "0x4006dfL" in succ_addr
278
- assert "0x4006e6L" in succ_addr
279
- print("Fork after:", hex(state.addr))
280
- print("Successors:", succ_addr)
281
-
282
- def first_symbolic_fork(state):
283
- return hex(state.addr) == "0x40068eL" and isinstance(state.inspect.sim_engine, HeavyVEXMixin)
284
- # TODO: I think this latter check is meaningless with the eleventh hour refactor
285
-
286
- def second_symbolic_fork(state):
287
- return hex(state.addr) == "0x4006dbL" and isinstance(state.inspect.sim_engine, HeavyVEXMixin)
288
-
289
- def check_state(state):
290
- assert hex(state.inspect.sim_successors.addr) in ("0x40068eL", "0x4006dbL")
291
-
292
- state = p.factory.entry_state(addr=p.loader.find_symbol("main").rebased_addr)
293
- pg = p.factory.simulation_manager(state)
294
- state.inspect.b("engine_process", when=BP_BEFORE, action=check_state, condition=first_symbolic_fork)
295
- state.inspect.b(
296
- "engine_process", when=BP_AFTER, action=check_first_symbolic_fork, condition=first_symbolic_fork
297
- )
298
- pg.run()
299
-
300
- state = p.factory.entry_state(addr=p.loader.find_symbol("main").rebased_addr)
301
- pg = p.factory.simulation_manager(state)
302
- state.inspect.b("engine_process", when=BP_BEFORE, action=check_state, condition=second_symbolic_fork)
303
- state.inspect.b(
304
- "engine_process", when=BP_AFTER, action=check_second_symbolic_fork, condition=second_symbolic_fork
305
- )
306
- pg.run()
307
-
308
-
309
- if __name__ == "__main__":
310
- unittest.main()
@@ -1,90 +0,0 @@
1
- #!/usr/bin/env python3
2
- __package__ = __package__ or "tests.state_plugins.inspect" # pylint:disable=redefined-builtin
3
-
4
- import os
5
- import unittest
6
-
7
- import angr
8
-
9
- from ...common import bin_location, broken
10
-
11
-
12
- test_location = os.path.join(bin_location, "tests")
13
-
14
- target_addrs = {"i386": [0x080485C9], "x86_64": [0x4006ED], "ppc": [0x1000060C], "armel": [0x85F0], "mips": [0x4009FC]}
15
-
16
- avoid_addrs = {
17
- "i386": [0x080485DD, 0x08048564],
18
- "x86_64": [0x4006AA, 0x4006FD],
19
- "ppc": [0x10000644, 0x1000059C],
20
- "armel": [0x86F8, 0x857C],
21
- "mips": [0x400A10, 0x400774],
22
- }
23
-
24
- corrupt_addrs = {
25
- "i386": [0x80486B6, b"bO\xcc", lambda s: s.memory.store(s.regs.esp, s.regs.eax)],
26
- "x86_64": [0x400742, b"\xd4&\xb0[\x41", lambda s: s.registers.store("rdx", 8)],
27
- "ppc": [0x100006B8, b"\x05\xad\xc2\xea", lambda s: s.registers.store("r5", 8)],
28
- "armel": [0x8678, b"\xbdM\xec3", lambda s: s.registers.store("r2", 8)],
29
- "mips": [0x400918, b"[\xf8\x96@"[::-1], lambda s: s.registers.store("a2", 8)],
30
- }
31
-
32
-
33
- class TestSyscallOverride(unittest.TestCase):
34
- def _run_fauxware_override(self, arch):
35
- # auto_load_libs can't be disabled as the test fails
36
- p = angr.Project(os.path.join(test_location, arch, "fauxware"), use_sim_procedures=False)
37
- s = p.factory.full_init_state()
38
-
39
- def overwrite_str(state):
40
- state.posix.get_fd(1).write_data(b"HAHA\0")
41
-
42
- queued_syscall_returns = []
43
- queued_syscall_returns.append(None) # let the mmap run
44
- queued_syscall_returns.append(overwrite_str) # prompt for username
45
- queued_syscall_returns.append(0) # username read
46
- queued_syscall_returns.append(0) # newline read
47
- # queued_syscall_returns.append(0) # prompt for password -- why isn't this called?
48
- queued_syscall_returns.append(None) # password input
49
- queued_syscall_returns.append(0) # password \n input
50
-
51
- def syscall_hook(state):
52
- if not state.inspect.simprocedure.is_syscall:
53
- return
54
- try:
55
- f = queued_syscall_returns.pop(0)
56
- if f is None:
57
- return
58
- state.inspect.simprocedure_result = f(state) if callable(f) else f
59
- except IndexError:
60
- return
61
-
62
- s.inspect.make_breakpoint("simprocedure", s.inspect.BP_BEFORE, action=syscall_hook)
63
-
64
- results = p.factory.simulation_manager(thing=s).explore(find=target_addrs[arch], avoid=avoid_addrs[arch])
65
- stdin = results.found[0].posix.dumps(0)
66
- assert b"SOSNEAKY" == stdin
67
- stdout = results.found[0].posix.dumps(1)
68
- assert b"HAHA\0" == stdout
69
-
70
- def test_fauxware_override_x86_64(self):
71
- self._run_fauxware_override("x86_64")
72
-
73
- def test_fauxware_override_i386(self):
74
- self._run_fauxware_override("i386")
75
-
76
- @broken
77
- def test_fauxware_override_ppc(self):
78
- self._run_fauxware_override("ppc")
79
-
80
- @broken
81
- def test_fauxware_override_armel(self):
82
- self._run_fauxware_override("armel")
83
-
84
- @broken
85
- def test_fauxware_override_mips(self):
86
- self._run_fauxware_override("mips")
87
-
88
-
89
- if __name__ == "__main__":
90
- unittest.main()
File without changes
@@ -1,56 +0,0 @@
1
- #!/usr/bin/env python3
2
- # pylint: disable=missing-class-docstring,disable=no-self-use
3
- __package__ = __package__ or "tests.state_plugins.posix" # pylint:disable=redefined-builtin
4
-
5
- import os
6
- import unittest
7
-
8
- import angr
9
-
10
- from ...common import bin_location
11
-
12
-
13
- test_location = os.path.join(bin_location, "tests")
14
-
15
-
16
- class TestFileStructFuncs(unittest.TestCase):
17
- def check_state_1(self, state):
18
- # Need to dump file.txt by path because program closes it
19
- return (
20
- state.posix.dump_file_by_path("file.txt") == b"testing abcdef"
21
- and state.posix.dumps(0)[:4] == b"xyz\n"
22
- and state.posix.dumps(1) == b"good1\n"
23
- and state.posix.dumps(2) == b""
24
- )
25
-
26
- def check_state_2(self, state):
27
- return (
28
- state.posix.dump_file_by_path("file.txt") == b"testing abcdef"
29
- and state.posix.dumps(0)[:4] == b"wxyz"
30
- and state.posix.dumps(1) == b""
31
- and state.posix.dumps(2) == b"good2\n"
32
- )
33
-
34
- def check_state_3(self, state):
35
- return (
36
- state.posix.dump_file_by_path("file.txt") == b"testing abcdef"
37
- and state.posix.dumps(1) == b""
38
- and state.posix.dumps(2) == b""
39
- )
40
-
41
- def test_file_struct_funcs(self):
42
- test_bin = os.path.join(test_location, "x86_64", "file_func_test")
43
- b = angr.Project(test_bin, auto_load_libs=False)
44
-
45
- pg = b.factory.simulation_manager()
46
- pg.active[0].options.discard("LAZY_SOLVES")
47
- pg.explore()
48
-
49
- assert len(pg.deadended) == 3
50
-
51
- for p in pg.deadended:
52
- assert self.check_state_1(p) or self.check_state_2(p) or self.check_state_3(p)
53
-
54
-
55
- if __name__ == "__main__":
56
- unittest.main()
@@ -1,69 +0,0 @@
1
- #!/usr/bin/env python3
2
- # pylint: disable=missing-class-docstring,disable=no-self-use
3
- __package__ = __package__ or "tests.state_plugins.posix" # pylint:disable=redefined-builtin
4
-
5
- import os
6
- import sys
7
- import unittest
8
-
9
- import angr
10
- from angr.state_plugins.posix import Flags
11
-
12
- from ...common import bin_location
13
-
14
-
15
- test_location = os.path.join(bin_location, "tests")
16
-
17
-
18
- class TestFile(unittest.TestCase):
19
- def test_files(self):
20
- s = angr.SimState(arch="AMD64")
21
- s.posix.get_fd(1).write_data(b"HELLO")
22
- s.posix.get_fd(1).write_data(b"WORLD")
23
- assert s.posix.dumps(1) == b"HELLOWORLD"
24
- assert s.posix.stdout.concretize() == [b"HELLO", b"WORLD"]
25
-
26
- s = angr.SimState(arch="AMD64")
27
- s.posix.get_fd(1).write_data(b"A" * 0x1000, 0x800)
28
- assert s.posix.dumps(1) == b"A" * 0x800
29
-
30
- def test_file_read_missing_content(self):
31
- # test in tracing mode since the Reverse operator will not be optimized away
32
- s = angr.SimState(arch="AMD64", mode="tracing")
33
- fd = s.posix.open(b"/tmp/oops", Flags.O_RDWR)
34
- length = s.posix.get_fd(fd).read(0xC00000, 100)
35
-
36
- data = s.memory.load(0xC00000, length, endness="Iend_BE")
37
- assert data.op != "Reverse", "Byte strings read directly out of a file should not have Reverse operators."
38
- assert data.op == "BVS"
39
- assert len(data.variables) == 1
40
- assert "oops" in next(iter(data.variables))
41
-
42
- @unittest.skipIf(sys.platform == "win32", "broken on windows")
43
- def test_concrete_fs_resolution(self):
44
- bin_path = os.path.join(test_location, "i386", "fauxware")
45
- proj = angr.Project(bin_path, auto_load_libs=False)
46
- state = proj.factory.entry_state(concrete_fs=True)
47
- fd = state.posix.open(bin_path, Flags.O_RDONLY)
48
- stat = state.posix.fstat(fd)
49
- size = stat.st_size
50
- int_size = state.solver.eval(size)
51
-
52
- assert stat
53
- assert int_size != 0
54
- assert not state.solver.symbolic(size)
55
-
56
- def test_sim_fs_resolution(self):
57
- bin_path = os.path.join(test_location, "i386", "fauxware")
58
- proj = angr.Project(bin_path, auto_load_libs=False)
59
- state = proj.factory.entry_state()
60
- fd = state.posix.open(bin_path, Flags.O_RDONLY)
61
- stat = state.posix.fstat(fd)
62
- size = stat.st_size
63
-
64
- assert stat
65
- assert state.solver.symbolic(size)
66
-
67
-
68
- if __name__ == "__main__":
69
- unittest.main()
@@ -1,72 +0,0 @@
1
- #!/usr/bin/env python3
2
- # pylint: disable=missing-class-docstring,no-self-use,line-too-long
3
-
4
- import unittest
5
-
6
- from angr import SimState, SimFile
7
-
8
-
9
- class TestPosix(unittest.TestCase):
10
- def test_file_create(self):
11
- # Create a state first
12
- state = SimState(arch="AMD64", mode="symbolic")
13
-
14
- # Create a file
15
- fd = state.posix.open(b"test", 1)
16
-
17
- assert fd == 3
18
-
19
- def test_file_read(self):
20
- state = SimState(arch="AMD64", mode="symbolic")
21
-
22
- content = state.solver.BVV(0xBADF00D, 32)
23
- content_size = content.size() // 8
24
-
25
- fd = state.posix.open(b"test", 1)
26
- simfd = state.posix.get_fd(fd)
27
- simfd.write_data(content)
28
- simfd.seek(0)
29
- simfd.read(0xC0000000, content_size)
30
-
31
- data = state.memory.load(0xC0000000, content_size)
32
-
33
- assert data is content
34
-
35
- def test_file_seek(self):
36
- # TODO: Make this test more complete
37
-
38
- state = SimState(arch="AMD64", mode="symbolic")
39
-
40
- # Normal seeking
41
- fd = state.posix.open(b"test1", 1)
42
- simfd = state.posix.get_fd(fd)
43
- simfd.seek(0, "start")
44
- assert state.solver.is_true(simfd.tell() == 0)
45
- state.posix.close(fd)
46
-
47
- # TODO: test case: seek cannot go beyond the file size or current file pos
48
-
49
- # seek should not work for stdin/stdout/stderr
50
- assert state.solver.is_false(state.posix.get_fd(0).seek(0))
51
- assert state.solver.is_false(state.posix.get_fd(1).seek(0))
52
- assert state.solver.is_false(state.posix.get_fd(2).seek(0))
53
-
54
- # Seek from the end
55
- state.fs.insert("test2", SimFile(name="qwer", size=20))
56
- fd = state.posix.open(b"test2", 1)
57
- simfd = state.posix.get_fd(fd)
58
- simfd.seek(0, "end")
59
- assert state.solver.is_true(simfd.tell() == 20)
60
- state.posix.close(fd)
61
-
62
- # seek to a symbolic position (whence symbolic end)
63
- fd = state.posix.open(b"unknown_size", 1)
64
- simfd = state.posix.get_fd(fd)
65
- real_end = state.fs.get("unknown_size").size
66
- simfd.seek(0, "end")
67
- assert real_end is simfd.tell()
68
- state.posix.close(fd)
69
-
70
-
71
- if __name__ == "__main__":
72
- unittest.main()
File without changes
@@ -1,58 +0,0 @@
1
- #!/usr/bin/env python3
2
- # pylint:disable=no-self-use
3
-
4
- import struct
5
- import unittest
6
-
7
- import claripy
8
-
9
- import angr
10
-
11
-
12
- class TestSolverEvalCasting(unittest.TestCase):
13
- """
14
- Basic test cases of SimSolver::eval's `cast_to` function.
15
- """
16
-
17
- def test_eval_cast_bvv_to_bytes(self):
18
- s = angr.SimState(arch="AMD64", mode="symbolic")
19
- assert s.solver.eval(claripy.BVV(0, 0), cast_to=bytes) == b""
20
- assert s.solver.eval(claripy.BVV(0, 8), cast_to=bytes) == b"\x00"
21
- assert s.solver.eval(claripy.BVV(0x12345678, 32), cast_to=bytes) == b"\x12\x34\x56\x78"
22
-
23
- def test_eval_cast_bvv_to_bytes__non_8bit_length_multiple(self):
24
- s = angr.SimState(arch="AMD64", mode="symbolic")
25
- for nbits in [1, 2, 7]:
26
- with self.subTest(nbits=nbits):
27
- with self.assertRaises(ValueError):
28
- s.solver.eval(claripy.BVV(0, nbits), cast_to=bytes)
29
-
30
- def test_eval_cast_fpv_to_bytes(self):
31
- s = angr.SimState(arch="AMD64", mode="symbolic")
32
- value = 1.23456
33
- fpv = claripy.FPV(value, claripy.FSORT_FLOAT)
34
- assert s.solver.eval(fpv, cast_to=bytes) == struct.pack(">f", value)
35
- fpv = claripy.FPV(value, claripy.FSORT_DOUBLE)
36
- assert s.solver.eval(fpv, cast_to=bytes) == struct.pack(">d", value)
37
-
38
- def test_eval_cast_fpv_to_int(self):
39
- s = angr.SimState(arch="AMD64", mode="symbolic")
40
- value = 1.23456
41
- fpv = claripy.FPV(value, claripy.FSORT_FLOAT)
42
- assert s.solver.eval(fpv, cast_to=int) == int.from_bytes(struct.pack(">f", value), "big")
43
- fpv = claripy.FPV(value, claripy.FSORT_DOUBLE)
44
- assert s.solver.eval(fpv, cast_to=int) == int.from_bytes(struct.pack(">d", value), "big")
45
-
46
- def test_eval_cast_bool_to_bytes(self):
47
- s = angr.SimState(arch="AMD64", mode="symbolic")
48
- assert s.solver.eval(claripy.BoolV(False), cast_to=bytes) == b"\x00"
49
- assert s.solver.eval(claripy.BoolV(True), cast_to=bytes) == b"\x01"
50
-
51
- def test_eval_cast_bool_to_int(self):
52
- s = angr.SimState(arch="AMD64", mode="symbolic")
53
- assert s.solver.eval(claripy.BoolV(False), cast_to=int) == 0
54
- assert s.solver.eval(claripy.BoolV(True), cast_to=int) == 1
55
-
56
-
57
- if __name__ == "__main__":
58
- unittest.main()