samva 2.0.5__py3-none-any.whl

samva/commands/commands_stm32.py

@@ -0,0 +1,385 @@
+# # SAMVA, initial software
+# # Copyright © INRIA, Affero GPL v3, 2022, v 1.0
+#
+# import csv
+# import json
+# import logging
+# import os
+# import sys
+# import time
+# from pathlib import Path
+#
+# import click
+# from tqdm import tqdm
+# from tqdm.contrib.logging import logging_redirect_tqdm
+#
+# from samva.physical.analysis.samva_file_line import convert_attack_path
+# from samva.physical.boards.targets.cv32e40p_litex import CV32E40P_Litex
+# from samva.core.common import setup_logging
+# from samva.core import Samva
+# from samva.core.model.db import Instruction
+# from samva.commands.commands_common import PythonLiteralOption, BASED_INT
+# from samva.core.common.attack_path import FaultModel, FaultParameters
+# from samva.experimentation.patcher import Patcher
+# from samva.physical.analysis.campaign import CampaignTarget
+# from samva.physical.analysis.simulation_branch_characterisation import SimulationBranchCharacterisation
+# from samva.physical.analysis.simulation_characterisation import SimulationCharacterisation, default_register_value, \
+#     dict_register_value
+# from samva.physical.attacks.campaign_stm32flash_verifypin import Campaign_STM32Flash_Verifypin
+# from samva.physical.boards.targets.stm32flash import STM32Flash
+# from samva.physical.boards.injectors.traitor import Traitor
+#
+# log = logging.getLogger(name=f"samva-{__name__}")
+# log.setLevel(logging.DEBUG)
+#
+# samva_config_characterization = """
+# {
+#   "starting_point": "characterization",
+#   "attack_points": [
+#     {
+#       "target": "instruction",
+#       "address": "characterization"
+#     }
+#   ],
+#   "global_avoid": [],
+#   "forced_types": []
+# }
+# """
+# 
+# @click.command()
+# @click.argument('samva_results_dir', required=1, type=click.Path(exists=True, file_okay=False, writable=True))
+# @click.argument('verifypin_dir', required=1, type=click.Path(exists=True, file_okay=False))
+# @click.argument('traitor_port', required=1, type=str)
+# # @click.argument('stm32_port', required=1, type=str)
+# @click.option('--attacked_versions', cls=PythonLiteralOption, default=None,
+#               help="Limit the attack to selected verifypin versions.")
+# @click.option('--attacks_per_version', required=False, type=int, default=5,
+#               help="Number of attacks for each verifypin version.")
+# @click.option('--verbose/--no-verbose', default=False)
+# def stm32_benchmark_traitor_verifypin(samva_results_dir, verifypin_dir, traitor_port, attacked_versions, # stm32_port
+#                                       attacks_per_version, verbose):
+#     setup_logging(logging.DEBUG if verbose else -1)
+#     targets = prepare_campaign(samva_results_dir, verifypin_dir, attacks_per_version, attacked_versions)
+#     # launch_campaign(samva_results_dir, traitor_port, stm32_port, targets)
+#     launch_campaign(samva_results_dir, traitor_port, None, targets)
+#
+# @click.command()
+# @click.argument('program_file', required=1, type=str)
+# @click.argument('samva_file', required=1, type=str)
+# def test_riscv(program_file, samva_file):
+#     setup_logging(logging.DEBUG)
+#     samva = Samva(program_file, config_file=samva_file, fault_model=FaultModel.TrueNOP, strategy="stack_safe")
+#     fault_parameters = FaultParameters(2, 10, 2, 3600)
+#     attack_result = samva.find_attack_paths(fault_parameters, 100, None)
+#     if attack_result.attack_paths is None:
+#         log.error("No attack path found.")
+#         return
+#     binary_file = program_file.replace(".elf", ".bin")
+#     with CV32E40P_Litex(samva, "/dev/ttyUSB2", binary_file) as cv32_board:
+#         log.warning(f"Run 1 = {cv32_board.run() = }")
+#         log.warning(f"Run 2 = {cv32_board.run() = }")
+#         log.warning(f"Run 3 = {cv32_board.run() = }")
+#
+#         iter_max = min(100, len(attack_result.attack_paths))
+#         time_total = 0
+#         for i, attack_path in enumerate(attack_result.attack_paths[:iter_max]):
+#             samva_lines = convert_attack_path(attack_path)
+#             expected_values = []
+#             for state in samva.samva_model.attack_options.simulation_final_state:
+#                 symbol, symbol_size, expected_value = state.symbol, state.size, state.value
+#                 symbol_addr = samva.samva_model.find_symbol_by_name(symbol).address
+#                 expected_values.append((symbol_addr, symbol_size, expected_value))
+#             time_t0 = time.time()
+#             validated = cv32_board.validate_instruction_skip_attack(samva_lines, expected_results=expected_values)
+#             time_t1 = time.time()
+#             time_total += time_t1 - time_t0
+#             log.debug(f"{i = } - {validated = }")
+#         log.debug(f"Validated {iter_max} attack paths, in {time_total:.2f} seconds,"
+#                   f"mean of {time_total/iter_max:.2f} seconds per attack path.")
+#
+#
+# @click.command()
+# @click.argument('samva_results_dir', required=1, type=click.Path(exists=True, file_okay=False, writable=True))
+# @click.argument('verifypin_dir', required=1, type=click.Path(exists=True, file_okay=False))
+# @click.argument('traitor_port', required=1, type=str)
+# # @click.argument('stm32_port', required=1, type=str)
+# @click.argument('version', required=1, type=str)
+# @click.argument('extension', required=1, type=str)
+# @click.argument('attack_number', required=1, type=str)
+# @click.option('--verbose/--no-verbose', default=False)
+# def stm32_traitor_attack_verifypin(samva_results_dir, verifypin_dir, traitor_port, version, extension, # stm32_port
+#                                    attack_number, verbose):
+#     setup_logging(logging.INFO if verbose else -1)
+#     target = create_target(samva_results_dir, verifypin_dir, version, extension, attack_number)
+#     if target is None:
+#         log.error("Impossible to create target!")
+#     else:
+#         launch_campaign(samva_results_dir, traitor_port, None, [target])
+#
+#
+#
+# @click.command()
+# @click.argument('program_file', required=1, type=str)
+# @click.argument('output_file', required=1, type=str)
+# @click.argument('code_addr', required=1, type=BASED_INT)
+# @click.argument('nb_word', required=1, type=int)
+# @click.option('--regs_value', type=(BASED_INT, BASED_INT, BASED_INT, BASED_INT, BASED_INT, BASED_INT,
+#                                     BASED_INT, BASED_INT, BASED_INT, BASED_INT), required=0, default=None)
+# @click.option('--max_repeat', required=False, type=int, default=None)
+# @click.option('--config_file', default=None, type=str)
+# @click.option('--map', default="", type=str)
+# # @click.option('--inst', type=(int, int, int, int, int, int, int, int), required=0, default=None)
+# def simulate(program_file, output_file, code_addr, nb_word, regs_value, max_repeat, config_file, map):
+#     parent_dir = os.path.dirname(output_file)
+#     if not os.path.exists(parent_dir):
+#         log.error(f"Output directory '{parent_dir}' does not exist!")
+#         sys.exit(-1)
+#
+#     config_text = samva_config_characterization if config_file is None else None
+#     samva = Samva(program_file, config_file=config_file, config_text=config_text, fault_model=FaultModel.Replay,
+#                   strategy="debug")
+#
+#     patcher = Patcher(samva.samva_model)
+#
+#     filter_regs = ['r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9']
+#     file_offset = patcher.convert_virtual_to_offset(code_addr)
+#
+#     with open(program_file, "rb") as file:
+#         file.seek(file_offset)
+#         nb_byte = nb_word * 4
+#         code = file.read(nb_byte)
+#
+#     if regs_value is None:
+#         registers_value = default_register_value(0)
+#     else:
+#         registers_value = dict_register_value(*regs_value)
+#
+#
+#     simu = SimulationCharacterisation()
+#     if map == "ram":
+#         simu.simulate_faults_ram(code,
+#                                  registers_value=registers_value,
+#                                  filter_regs=filter_regs,
+#                                  save_file=output_file,
+#                                  max_repetition=max_repeat,
+#                                  extra_sim=1)
+#
+#     else:
+#         simu.simulate_faults(code,
+#                              registers_value=registers_value,
+#                              filter_regs=filter_regs,
+#                              save_file=output_file,
+#                              max_repetition=max_repeat,
+#                              extra_sim=1)
+#
+# @click.command()
+# @click.argument('program_file', required=1, type=str)
+# @click.argument('output_file', required=1, type=str)
+# @click.option('--regs_value', type=(BASED_INT, BASED_INT, BASED_INT, BASED_INT, BASED_INT, BASED_INT,
+#                                     BASED_INT, BASED_INT, BASED_INT, BASED_INT), required=0, default=None)
+# @click.option('--max_repeat', required=False, type=int, default=None)
+# @click.option('--config_file', default=None, type=str)
+# def simulate_branch(program_file, output_file, regs_value, max_repeat, config_file):
+#     parent_dir = os.path.dirname(output_file)
+#     if not os.path.exists(parent_dir):
+#         log.error(f"Output directory '{parent_dir}' does not exist!")
+#         sys.exit(-1)
+#
+#     config_text = samva_config_characterization if config_file is None else None
+#     samva = Samva(program_file, config_file=config_file, config_text=config_text, fault_model=FaultModel.Replay,
+#                   strategy="debug")
+#
+#     simu = SimulationBranchCharacterisation()
+#     simu.simulate_faults(samva, regs_value, max_repeat)
+#
+#
+# def characterization_impl(traitor_port, stm32_port, program_file, simulation_file, output_file,
+#                           amplitudes, delays, durations, repetition, stlink):
+#     filter_regs = ['r0', 'r1', 'r2', 'r3', 'r4', 'r5', 'r6', 'r7', 'r8', 'r9']
+#
+#     with open(simulation_file) as simu_json:
+#         simu = json.load(simu_json)
+#
+#     if output_file is not None and not os.path.exists(output_file):
+#         with open(output_file, "w") as out:
+#             out.write("delay,duration,amplitude,test_number,classification,r0,r1,r2,r3,r4,r5,r6,r7,r8,r9\n")
+#
+#     params = [(amp, delay, duration, test_number) for amp in range(amplitudes[0], amplitudes[1] - 1, -1)
+#               for delay in range(delays[0], delays[1] + 1)
+#               for duration in range(durations[0], durations[1] + 1)
+#               for test_number in range(repetition)]
+#
+#     with Traitor(traitor_port) as traitor, STM32Flash(stm32_port, hla_serial=stlink) as stm32_flash:
+#         traitor.clear()
+#         stm32_flash.program(program_file)
+#
+#         traitor.execute_attack(stm32_flash)
+#         regs_normal = stm32_flash.ocd.read_all_registers()
+#         log.debug(f"{regs_normal = }")
+#         pc_normal = regs_normal["pc"]
+#
+#         with logging_redirect_tqdm():
+#             for param in tqdm(params):
+#                 amp, delay, duration, test_number = param
+#                 faults = [(delay, duration)]
+#
+#                 try:
+#                     traitor.execute_attack(stm32_flash, amp, faults)
+#
+#                     regs2 = stm32_flash.ocd.read_all_registers()
+#                     pc = regs2["pc"]
+#                     res = {reg: regs2[reg] for reg in filter_regs}
+#
+#                     if pc != pc_normal:
+#                         classification = "crash"
+#                     else:
+#                         classification = []
+#                         for exec_name, regs in simu["simulations"].items():
+#                             if res == regs:
+#                                 classification.append(exec_name)
+#
+#                         if len(classification) == 0:
+#                             classification = "undefined"
+#                         elif len(classification) == 1:
+#                             classification = classification[0]
+#                         else:
+#                             classification = f"\"{str(classification).replace(',', ';')}\""
+#                 except KeyboardInterrupt:
+#                     log.warning("Characterization canceled.")
+#                     sys.exit(0)
+#                 except:
+#                     classification = "crash"
+#                     res = {reg: -1 for reg in filter_regs}
+#                 finally:
+#                     if classification == "undefined":
+#                         log.warning(f"({delay}, {duration}) / {amp} | {classification} - {res}")
+#                     else:
+#                         log.info(f"({delay}, {duration}) / {amp} | {classification} - {res}")
+#
+#                     if output_file is not None:
+#                         with open(output_file, "a") as out:
+#                             out_text = f"{delay},{duration},{amp},{test_number},{classification},"
+#                             out_text += f"{res['r0']},{res['r1']},{res['r2']},{res['r3']},"
+#                             out_text += f"{res['r4']},{res['r5']},{res['r6']},{res['r7']}"
+#                             out_text += f"{res['r8']},{res['r9']}\n"
+#                             out.write(out_text)
+
+#
+# @click.command()
+# @click.argument('test_case_directory', required=1)
+# @click.argument('traitor_port', required=1, type=str)
+# @click.option('--stlink', default=None, type=str)
+# def test_bkpt(test_case_directory, traitor_port, stlink):
+#     test_case_name = os.path.basename(os.path.normpath(test_case_directory))
+#     log.debug(f"Test case name: {test_case_name}")
+#     binary_file = os.path.join(os.path.abspath(test_case_directory), f"bin/{test_case_name}.elf")
+#
+#     with Traitor(traitor_port) as traitor, STM32Flash(None, hla_serial=stlink) as stm32_flash:
+#         traitor.clear()
+#         stm32_flash.program(binary_file)
+#
+#         bkpt_p1 = 0x80002b0
+#         # bkpt_p2 = 0x8000294
+#         bkpt_p2 = 0x800029c
+#
+#         stm32_flash.reset()
+#         stm32_flash.halt()
+#         # stm32_flash.ocd.set_soft_breakpoint(bkpt_p1)
+#         # stm32_flash.ocd.set_soft_breakpoint(bkpt_p2)
+#
+#         # stm32_flash.reset()
+#         # stm32_flash.halt()
+#         # stm32_flash.ocd.__send_str("w 0x80002aa 2 r value " + hex(bkpt_p1) + " \n")
+#         # stm32_flash.ocd.__read_until(b"> ")
+#         # stm32_flash.ocd.set_soft_breakpoint(bkpt_p1)
+#
+#         traitor.execute_attack(stm32_flash)
+#         regs_normal = stm32_flash.ocd.read_all_registers()
+#         pc_normal = regs_normal["pc"]
+#         # log.debug(f"{regs_normal = }")
+#         log.debug(f"PC before attack 0x{pc_normal:0x}")
+#
+#         # for i in range(10):
+#         #     for j in range(10):
+#         # amp, delay, duration = (490, 48, 3)
+#         # faults = [(delay, duration)]
+#
+#         # for bkpt in range(0x80002a8, 0x8000280, -2):
+#         #     stm32_flash.reset()
+#         #     stm32_flash.halt()
+#         #     stm32_flash.ocd.enable_hard_breakpoint(bkpt)
+#
+#         for amp in range(491, 500):
+#             for delay in range(35, 55):
+#                 for duration in range(3, 7):
+#                     faults = [(delay, duration)]
+#
+#                     try:
+#                         traitor.execute_attack(stm32_flash, amp, faults)
+#                         time.sleep(0.1)
+#                         regs = stm32_flash.ocd.read_all_registers()
+#                         # log.debug(f"{regs = }")
+#                         pc_attack = regs["pc"]
+#                         # log.debug(f"BKPT = 0x{bkpt:0x} - PC = 0x{pc_attack:0x}")
+#                         log.debug(f"{amp} - ({delay}, {duration}) PC = 0x{pc_attack:0x}")
+#                     except KeyboardInterrupt:
+#                         log.warning("canceled.")
+#                         sys.exit(0)
+#                     except:
+#                         log.warning("crash")
+#
+#                     # stm32_flash.reset()
+#                     # stm32_flash.halt()
+#                     # stm32_flash.ocd.disable_soft_breakpoints()
+#
+#
+# @click.command()
+# @click.argument('traitor_port', required=1, type=str)
+# @click.argument('stm32_port', required=1, type=str)
+# @click.argument('program_file', required=1, type=str)
+# @click.argument('simulation_file', required=1, type=str)
+# @click.argument('output_file', required=1, type=str)
+# @click.option('--amplitudes', type=(int, int), default=(530, 460))
+# @click.option('--delays', type=(int, int), default=(10, 20))
+# @click.option('--durations', type=(int, int), default=(1, 15))
+# @click.option('--repetition', required=False, type=int, default=10)
+# @click.option('--stlink', default=None, type=str)
+# def characterization(traitor_port, stm32_port, program_file, simulation_file, output_file,
+#                      amplitudes, delays, durations, repetition, stlink):
+#     characterization_impl(traitor_port, stm32_port, program_file, simulation_file, output_file,
+#                           amplitudes, delays, durations, repetition, stlink)
+#
+#
+# @click.command()
+# @click.argument('test_case_directory', required=1)
+# @click.argument('traitor_port', required=1, type=str)
+# @click.option('--amplitudes', type=(int, int), default=(530, 460))
+# @click.option('--delays', type=(int, int), default=(10, 20))
+# @click.option('--durations', type=(int, int), default=(1, 15))
+# @click.option('--repetition', required=False, type=int, default=10)
+# @click.option('--stlink', default=None, type=str)
+# def test_case(test_case_directory, traitor_port, amplitudes, delays, durations, repetition, stlink):
+#     if not os.path.exists(test_case_directory):
+#         log.error(f"Test case directory '{test_case_directory}' does not exist!")
+#         sys.exit(-1)
+#
+#     test_case_name = os.path.basename(os.path.normpath(test_case_directory))
+#     log.debug(f"Test case name: {test_case_name}")
+#
+#     binary_file = os.path.join(os.path.abspath(test_case_directory), f"bin/{test_case_name}.elf")
+#     if not os.path.exists(binary_file):
+#         log.error(f"Binary file '{binary_file}' does not exist!")
+#         sys.exit(-1)
+#
+#     simu_file = os.path.join(os.path.abspath(test_case_directory), "simulations.json")
+#     if not os.path.exists(simu_file):
+#         log.error(f"Simulations file '{simu_file}' does not exist!")
+#         sys.exit(-1)
+#
+#     timestamp = str(time.strftime("%m%d%H%M%S"))
+#     output_file = os.path.join(os.path.abspath(test_case_directory), f"traitor/test_{timestamp}.csv")
+#     Path(output_file).parent.mkdir(exist_ok=True, parents=True)
+#
+#     characterization_impl(traitor_port, None, binary_file, simu_file, output_file, amplitudes, delays,
+#                           durations, repetition, stlink)
+#

samva/commands/cv32e40p.py

@@ -0,0 +1,24 @@
+# SAMVA, initial software
+# Copyright © INRIA, Affero GPL v3, 2022, v 1.0
+import logging
+import os
+from functools import partial
+
+from samva.commands.commands_common import check_logging, must_be_chained
+from samva.physical.boards.targets.cv32e40p_litex import CV32E40P_Litex
+
+log = logging.getLogger(name=f"samva-{__name__}")
+log.setLevel(logging.DEBUG)
+
+
+@check_logging
+@must_be_chained(False)
+def run_cv32e40p(previous, *, port, verbose):
+    for binary_name in previous.keys():
+        samva = previous[binary_name]["samva"]
+        binary_file = samva.binary_file.replace(".elf", ".bin")
+        if not os.path.isfile(binary_file):
+            log.error(f"Binary file '{binary_file}' does not exist. It should be placed in the same directory as the .elf file.")
+        else:
+            previous[binary_name]["create_target"] = partial(CV32E40P_Litex, samva, port, binary_file)
+    return previous

samva/commands/debugger.py

@@ -0,0 +1,37 @@
+# SAMVA, initial software
+# Copyright © INRIA, Affero GPL v3, 2022, v 1.0
+import logging
+
+from samva.commands.commands_common import check_logging, must_be_chained, hardware_attack
+from samva.physical.analysis.samva_file_line import convert_attack_path
+
+log = logging.getLogger(name=f"samva-{__name__}")
+log.setLevel(logging.DEBUG)
+
+
+@check_logging
+@must_be_chained(True)
+@hardware_attack
+def run_debugger(previous, *, target, binary_name, verbose):
+    if "samva" not in previous[binary_name] or "attack_result" not in previous[binary_name]:
+        log.error(f"Cannot run debugger validation on {binary_name} if an analysis is not run before.")
+        return 0, 0
+
+    samva = previous[binary_name]["samva"]
+    attack_result = previous[binary_name]["attack_result"]
+    iter_max = len(attack_result.attack_paths)
+    validated_counter = 0
+
+    with target:
+        for i, attack_path in enumerate(attack_result.attack_paths[:iter_max]):
+            samva_lines = convert_attack_path(attack_path)
+
+            initial_values = samva.samva_model.convert_simulation_states(samva.samva_model.attack_options.simulation_initial_state)
+            final_values = samva.samva_model.convert_simulation_states(samva.samva_model.attack_options.simulation_final_state)
+
+            validated = target.validate_instruction_skip_attack(samva_lines, initial_values=initial_values,
+                                                                final_values=final_values)
+            if validated:
+                validated_counter += 1
+
+    return iter_max, validated_counter

samva/commands/evaluate.py

@@ -0,0 +1,186 @@
+# SAMVA, initial software
+# Copyright © INRIA, Affero GPL v3, 2022, v 1.0
+import logging
+import os
+import re
+import time
+
+import click
+
+from samva.commands.commands_common import check_logging, must_be_chained
+from samva.core import Samva
+from samva.core.common import FaultParameters, FaultModel
+from samva.core.common.analysis_utils import Timing
+from samva.evaluator import EvaluatorSimulationUnicorn2, EvaluatorSimulationGem5
+
+log = logging.getLogger(name=f"samva-{__name__}")
+log.setLevel(logging.DEBUG)
+
+SAMVA_DEFAULT_RESULT_DIRECTORY = "samva_results"
+
+
+def prepare_result_folder(result_folder, fault_model, strategy):
+    timestamp = str(time.strftime("%Y%m%d_%H%M%S"))
+    result_folder = os.path.join(click.format_filename(result_folder),
+                                 "bench_" + fault_model + "_" + strategy + "_" + timestamp + "/")
+    os.mkdir(result_folder)
+    return result_folder
+
+def input_fault_model(fault_model: str) -> FaultModel:
+    if fault_model == "TrueNOP":
+        return FaultModel.TrueNOP
+    elif fault_model == "Replay":
+        return FaultModel.Replay
+    else:
+        return FaultModel.TrueNOP
+
+def get_configuration_file_from_binary_name(binary_file: str) -> str:
+    f = os.path.splitext(os.path.basename(binary_file))[0]
+    conf_file_name = f"{f}.json"
+    if "_alig" in binary_file:
+        conf_file_name = re.sub(r"_alig\d?", "", conf_file_name)
+        pass
+    return conf_file_name
+
+@check_logging
+@must_be_chained(False)
+def run_evaluate(previous, *, bin_path, samva_config_path, result_folder, fault_model, fault_parameters,
+                 max_paths_per_segment, max_cost_per_segment, max_cost_for_simulation, max_attack_paths, evaluator,
+                 unicorn_full_init, log_variable, timeout, stop_at_robustness, deprecated,
+                 deprecated_exhaustive, deprecated_max_solutions, verbose) -> dict:
+
+    if not os.path.exists(bin_path):
+        raise FileNotFoundError(f"Binary path {bin_path} does not exist.")
+    if not os.path.exists(samva_config_path):
+        raise FileNotFoundError(f"Samva configuration path {samva_config_path} does not exist.")
+
+    bin_path_is_file = os.path.isfile(bin_path)
+    samva_config_path_is_file = os.path.isfile(samva_config_path)
+    if not bin_path_is_file and samva_config_path_is_file:
+        raise ValueError("Cannot use a binary folder and a single samva configuration file")
+
+    strategy = "default"  # will be removed.
+    timeout = None if timeout <= 0 else timeout
+    fake_timeout = 999999
+    fault_parameters = FaultParameters(fault_parameters[0], fault_parameters[1], fault_parameters[2], fake_timeout)
+    if fault_model == "TrueNOP":
+        fault_model = FaultModel.TrueNOP
+    elif fault_model == "Replay":
+        fault_model = FaultModel.Replay
+    else:
+        raise ValueError("Provided fault model option is incorrect.")
+
+    samva_list: list[Samva] = []
+    if bin_path_is_file and samva_config_path_is_file:
+        samva_list.append(
+            Samva(
+                bin_path,
+                config_file=samva_config_path,
+                fault_model=fault_model,
+                strategy=strategy,
+                exhaustive=deprecated_exhaustive,
+            )
+        )
+    elif bin_path_is_file and not samva_config_path_is_file:
+        conf_file_name = get_configuration_file_from_binary_name(bin_path)
+        suggested_samva_config_path = os.path.abspath(os.path.join(samva_config_path, conf_file_name))
+        if not os.path.isfile(suggested_samva_config_path):
+            raise FileNotFoundError(f"Attack file does not exist: {suggested_samva_config_path}")
+        samva_list.append(
+            Samva(
+                bin_path,
+                config_file=suggested_samva_config_path,
+                fault_model=fault_model,
+                strategy=strategy,
+                exhaustive=deprecated_exhaustive,
+            )
+        )
+    else:
+        found_pairs = []
+        for f in os.listdir(bin_path):
+            if not f.endswith(".elf"):
+                continue
+            conf_file_name = get_configuration_file_from_binary_name(f)
+            suggested_samva_config_path = os.path.abspath(os.path.join(samva_config_path, conf_file_name))
+            if not os.path.isfile(suggested_samva_config_path):
+                continue
+            log.info(f"Found the binary {f} and its corresponding configuration file {suggested_samva_config_path}.")
+            found_pairs.append((os.path.join(bin_path, f), suggested_samva_config_path))
+        for bin_file, conf_file in found_pairs:
+            samva_list.append(
+                Samva(
+                    bin_file,
+                    config_file=conf_file,
+                    fault_model=fault_model,
+                    strategy=strategy,
+                    exhaustive=deprecated_exhaustive,
+                )
+            )
+        if len(found_pairs) == 0:
+            log.info("Unable to found pairs elf file / samva configuration file.")
+
+    if result_folder is None:
+        if not os.path.isdir(SAMVA_DEFAULT_RESULT_DIRECTORY):
+            os.mkdir(SAMVA_DEFAULT_RESULT_DIRECTORY)
+        result_folder = prepare_result_folder(SAMVA_DEFAULT_RESULT_DIRECTORY, fault_model.value, strategy)
+
+    match evaluator:
+        case "unicorn":
+            samva_evaluator = EvaluatorSimulationUnicorn2(
+                fault_model=fault_model,
+                result_folder=result_folder,
+                enable_log=True,
+                write_nop_files=True,
+                log_variables=log_variable,
+                disable_full_init=not unicorn_full_init,
+            )
+        case "gem5":
+            samva_evaluator = EvaluatorSimulationGem5(
+                result_folder=result_folder, enable_log=True, write_nop_files=True, log_variables=log_variable
+            )
+        case _:
+            samva_evaluator = None
+
+    result = {}
+    for samva in samva_list:
+        with Timing() as t_analysis:
+            if deprecated:
+                attack_result = samva.find_attack_paths(fault_parameters, deprecated_max_solutions, samva_evaluator)
+            else:
+                attack_result = samva.find_data_aware_attack_paths(
+                    fault_parameters,
+                    samva_evaluator,
+                    max_paths_per_segment=max_paths_per_segment,
+                    max_cost_per_segment=max_cost_per_segment,
+                    max_cost_for_simulation=max_cost_for_simulation,
+                    max_attack_paths=max_attack_paths,
+                    stop_when_robustness_found=stop_at_robustness,
+                    timeout=timeout,
+                )
+        if max_attack_paths is not None:
+            attack_result.attack_paths = attack_result.attack_paths[:max_attack_paths]
+
+        txt = []
+        binary_name = samva.samva_model.binary_name
+        if attack_result.attack_paths is None:
+            txt.append(f"{binary_name} - Specified fault parameters are not suited for this binary.")
+        elif len(attack_result.attack_paths) == 0:
+            txt.append(f"{binary_name} - No attack path found.")
+        else:
+            txt.append(f"{binary_name} - {len(attack_result.attack_paths)} attack paths found.")
+        if attack_result.robustness is not None:
+            txt.append(" " * len(binary_name) + f"   Robustness level is {attack_result.robustness}.")
+        txt.append(" " * len(binary_name) + f"   Analysis concluded in {t_analysis}")
+        if verbose and not deprecated:
+            txt.append(" " * len(binary_name) + f"   Candidate stats: {samva.cstats}")
+            txt.append(" " * len(binary_name) + f"   Evaluation stats: {samva.estats}")
+
+        for lign in txt:
+            log.info(lign)
+
+        result[binary_name] = {}
+        result[binary_name]["samva"] = samva
+        result[binary_name]["attack_result"] = attack_result
+        result[binary_name]["log"] = txt
+
+    return result

samva/commands/measure_cycles.py

@@ -0,0 +1,43 @@
+# SAMVA, initial software
+# Copyright © INRIA, Affero GPL v3, 2022, v 1.0
+import logging
+
+from samva.commands.commands_common import check_logging, must_be_chained
+from samva.core.common import AttackPointTarget
+
+log = logging.getLogger(name=f"samva-{__name__}")
+log.setLevel(logging.DEBUG)
+
+
+@check_logging
+@must_be_chained(True)
+def run_measure_cycles(previous, *, addr1 , addr2, verbose):
+    log.info(f"Measure cycles between {addr1} and {addr2}")
+
+    for binary_name in previous.keys():
+        if "create_target" not in previous[binary_name]:
+            log.warning(f"Cannot find target for binary {binary_name}")
+            continue
+        
+        if "samva" not in previous[binary_name]:
+            log.warning(f"Cannot find samva for binary {binary_name}")
+            continue
+        
+        samva = previous[binary_name]["samva"]
+        addr1 = samva.samva_model.retrieve_address_from_string(addr1, AttackPointTarget.INSTR)
+        addr2 = samva.samva_model.retrieve_address_from_string(addr2, AttackPointTarget.INSTR)
+
+        create_target = previous[binary_name]["create_target"]
+        target = create_target()
+        
+        with target:
+            measures = target.measure_cycles(addr1, addr2, must_reset=True)
+        
+        if measures is not None:
+            sum_cycles = sum(i[1] for i in measures)
+            log.info(f"Measured number of cycles: {sum_cycles}")
+            previous[binary_name]["measure_cycle"] = sum_cycles
+        else:
+            log.warning(f"Cannot measure cycles for binary {binary_name}")
+    
+    return previous