smallworld-re 1.0.0__py3-none-any.whl

smallworld/emulators/angr/scratch.py

@@ -0,0 +1,43 @@
+import copy
+
+import angr
+
+from ...utils import RangeCollection
+
+
+class ExpandedScratchPlugin(angr.state_plugins.SimStateScratch):
+    def __init__(self, scratch=None):
+        super().__init__(scratch=scratch)
+        self.exit_points = set()
+        self.bounds = RangeCollection()
+        self.memory_map = RangeCollection()
+        self.global_insn_bp = None
+        self.global_syscall_func = None
+        self.global_read_bp = None
+        self.global_write_bp = None
+        self.insn_bps = dict()
+        self.func_bps = dict()
+        self.syscall_funcs = dict()
+        self.mem_read_bps = dict()
+        self.mem_write_bps = dict()
+        self.extensions = dict()
+
+        if scratch is not None:
+            self.exit_points |= scratch.exit_points
+            self.bounds.update(scratch.bounds)
+            self.memory_map.update(scratch.memory_map)
+            self.global_insn_bp = scratch.global_insn_bp
+            self.global_syscall_func = scratch.global_syscall_func
+            self.global_read_bp = scratch.global_read_bp
+            self.global_write_bp = scratch.global_write_bp
+            self.insn_bps.update(scratch.insn_bps)
+            self.func_bps.update(scratch.func_bps)
+            self.syscall_funcs.update(scratch.syscall_funcs)
+            self.mem_read_bps.update(scratch.mem_read_bps)
+            self.mem_write_bps.update(scratch.mem_write_bps)
+            for name, ext in scratch.extensions.items():
+                self.extensions[name] = copy.deepcopy(ext)
+
+    @angr.SimStatePlugin.memo
+    def copy(self, memo):
+        return self.__class__(scratch=self)

smallworld/emulators/angr/simos.py

@@ -0,0 +1,53 @@
+import angr
+
+
+class SyscallHookProcedure(angr.SimProcedure):
+    def run(self):
+        # Get the syscall number
+        number = self.cc.syscall_num(self.state)
+
+        if number.symbolic:
+            raise NotImplementedError(f"Symbolic syscall number {number}")
+        number = number.concrete_value
+
+        # See if we have a global handler
+        global_func = self.state.scratch.global_syscall_func
+        if global_func is not None:
+            global_func(self.state, number)
+
+        # See if we have a local handler
+        if number in self.state.scratch.syscall_funcs:
+            local_func = self.state.scratch.syscall_funcs[number]
+            local_func(self.state)
+
+        # Force execution to resume at the syscall exit point.
+        self.jump(self.state._ip)
+
+
+class HookableSimOS(angr.simos.simos.SimOS):
+    def syscall(self, state, allow_unsupported=True):
+        SYSCALL_CC = angr.calling_conventions.SYSCALL_CC
+        arch_name = state.arch.name
+        os_name = state.os_name
+        if arch_name in SYSCALL_CC:
+            if os_name in SYSCALL_CC[arch_name]:
+                cc = SYSCALL_CC[arch_name][os_name](state.arch)
+            else:
+                cc = SYSCALL_CC[arch_name]["default"](state.arch)
+        else:
+            cc = None
+
+        out = SyscallHookProcedure(
+            project=self.project,
+            cc=cc,
+            prototype=None,
+            returns=None,
+            is_syscall=True,
+            is_stub=False,
+            num_args=None,
+            display_name=None,
+            library_name=None,
+            is_function=None,
+        )
+        out.addr = state._ip
+        return out

smallworld/emulators/angr/utils.py

@@ -0,0 +1,70 @@
+import logging
+
+from ...exceptions import AnalysisError
+
+log = logging.getLogger(__name__)
+
+
+def reg_name_from_offset(arch, addr: int, size: int):
+    """Get a register name from its offset and size in the register file
+
+    This should be straightforward, and it is for standard architectures.
+
+    Architectures supported via pcode have a nasty quirk
+    where register down-casts happen before reading the register.
+    This means angr can't tell the difference between a real sub-register,
+    or a read from part of a larger register.
+    This has the effect of selecting incorrect sub-registers,
+    or hallucinating non-existent sub-registers.
+
+    This function does a bit of searching to try
+    and match the specified address/size to the closest register.
+
+    Arguments:
+        arch:   angr architecture object
+        addr:   address of register write
+        size:   size of register write
+
+    Returns:
+        A string containing the register name
+
+    Raises:
+        AnalysisException: If no matching register is found
+
+    """
+    orig_size = size
+    done = False
+
+    if (addr, size) in arch.register_size_names:
+        # We have an exact match.
+        # Don't bother with other checks.
+        done = True
+    else:
+        # Check if we're accessing the tail of a larger register.
+        for r_addr, r_size in arch.register_size_names:
+            if addr == r_addr + r_size - size:
+                addr = r_addr
+                size = r_size
+                done = True
+                break
+
+    # Hypothesize we're accessing the head of a larger register
+    # TODO: This assumes power-of-two-sized registers
+    #
+    # I know this isn't accurate for some architectures.
+    # It also won't be accurate if the sleigh model
+    # includes non-power-of-two extractions.
+    #
+    # TODO: Do any architectures have registers larger than 512 bits?
+    # If they do, I'm very sorry.
+    while not done and size < 1024:
+        if (addr, size) in arch.register_size_names:
+            done = True
+            break
+
+        if not done:
+            size = size << 1
+
+    if not done:
+        raise AnalysisError(f"Unknown register for {arch.name}: ({addr}, {orig_size})")
+    return arch.register_size_names[(addr, size)]