smallworld-re 1.0.2__py3-none-any.whl → 2.0.0__py3-none-any.whl

smallworld/analyses/trace_execution.py

@@ -0,0 +1,160 @@
+import copy
+import hashlib
+import logging
+import typing
+from enum import Enum
+
+import capstone
+
+import smallworld
+from smallworld.analyses.trace_execution_types import CmpInfo, TraceElement, TraceRes
+from smallworld.instructions import RegisterOperand
+
+from .. import platforms
+from ..hinting.hints import TraceExecutionHint
+from . import analysis
+
+logger = logging.getLogger(__name__)
+
+
+class TraceExecutionCBPoint(Enum):
+    BEFORE_INSTRUCTION = 1
+    AFTER_INSTRUCTION = 2
+
+
+def get_cmp_info(
+    platform: smallworld.platforms.Platform,
+    emulator: smallworld.emulators.Emulator,
+    cs_insn: capstone.CsInsn,
+) -> typing.Tuple[typing.List[CmpInfo], typing.List[int]]:
+    pdefs = platforms.defs.PlatformDef.for_platform(platform)
+    if cs_insn.mnemonic in pdefs.compare_mnemonics:
+        # it's a compare -- return list of "reads'
+        sw_insn = smallworld.instructions.Instruction.from_capstone(cs_insn)
+        cmp_info = []
+        for op in cs_insn.operands:
+            if op.type == capstone.CS_OP_MEM and (op.access & capstone.CS_AC_READ):
+                cmp_info.append(sw_insn._memory_reference_operand(op))
+            if op.type == capstone.CS_OP_REG and (op.access & capstone.CS_AC_READ):
+                cmp_info.append(RegisterOperand(cs_insn.reg_name(op.value.reg)))
+            if op.type == capstone.CS_OP_IMM:
+                cmp_info.append(op.value.imm)
+        immediates = []
+        for op in cs_insn.operands:
+            if op.type == capstone.x86.X86_OP_IMM:
+                immediates.append(op.value.imm)
+        return (cmp_info, immediates)
+    return ([], [])
+
+
+class TraceExecution(analysis.Analysis):
+    name = "trace_execution"
+    description = "perform one concrete execution given a machine state, collecting trace, coverage, and errors"
+    version = "0.0.1"
+
+    def __init__(
+        self,
+        *args,
+        num_insns: int,
+        seed: int = 1234567,
+        **kwargs,
+    ):
+        super().__init__(*args, **kwargs)
+        self.num_insns = num_insns
+        self.seed = seed
+        self.before_instruction_cbs: typing.List[typing.Any] = []
+        self.after_instruction_cbs: typing.List[typing.Any] = []
+
+    def register_emu_summary(self):
+        pdefs = platforms.defs.PlatformDef.for_platform(self.platform)
+        m = hashlib.md5()
+        for reg in pdefs.general_purpose_registers:
+            vs = (str(self.emulator.read_register(reg))).encode("utf-8")
+            m.update(vs)
+        return m.hexdigest()
+
+    def register_cb(self, cb_point, cb_function):
+        assert isinstance(cb_point, TraceExecutionCBPoint)
+        if cb_point == TraceExecutionCBPoint.BEFORE_INSTRUCTION:
+            self.before_instruction_cbs.append(cb_function)
+        if cb_point == TraceExecutionCBPoint.AFTER_INSTRUCTION:
+            self.after_instruction_cbs.append(cb_function)
+
+    def run(self, machine: smallworld.state.Machine) -> None:
+        self.machine = copy.deepcopy(machine)
+        self.platform = machine.get_platform()
+        self.emulator = smallworld.emulators.unicorn.UnicornEmulator(self.platform)
+        self.machine.apply(self.emulator)
+
+        logger.debug(f"starting regs in emu {self.register_emu_summary()}")
+
+        def get_insn(pc):
+            code = self.emulator.read_memory(pc, 15)
+            if code is None:
+                raise smallworld.exceptions.AnalysisRunError(
+                    "Unable to read next instruction out of emulator memory"
+                )
+            (cs_insns, disas) = self.emulator._disassemble(code, pc, 1)
+            return cs_insns[0]
+
+        the_exc = None
+        emu_result = TraceRes.ER_NONE
+
+        pdefs = platforms.defs.PlatformDef.for_platform(self.platform)
+
+        i = 0
+        trace = []
+        while True:
+            pc = self.emulator.read_register("pc")
+            cs_insn = get_insn(pc)
+            (cmp_info, imm_info) = get_cmp_info(self.platform, self.emulator, cs_insn)
+            branch_info = cs_insn.mnemonic in pdefs.conditional_branch_mnemonics
+            te = TraceElement(
+                pc, i, cs_insn.mnemonic, cs_insn.op_str, cmp_info, branch_info, imm_info
+            )
+            trace.append(te)
+            # run any callbacks
+            for before_cb in self.before_instruction_cbs:
+                before_cb(self.emulator, pc, te)
+            try:
+                i += 1
+                self.emulator.step()
+            except smallworld.exceptions.EmulationBounds:
+                # this one really isnt an error of any kind; we
+                # encountered code we were not supposed to execute
+                emu_result = TraceRes.ER_BOUNDS
+                break
+            except Exception as e:
+                # grab the exception and save it for hinting
+                emu_result = TraceRes.ER_FAIL
+                the_exc = e
+                break
+            # run any after callbacks
+            for after_cb in self.after_instruction_cbs:
+                after_cb(self.emulator, pc, te)
+            if i == self.num_insns:
+                emu_result = TraceRes.ER_MAX_INSNS
+                break
+
+        m = hashlib.md5()
+        for te in trace:
+            logger.debug(te)
+            m.update((str(te.pc).encode("utf-8")))
+
+        logger.info(
+            f"captured trace of {i} instructions, res={emu_result} trace_digest={m.hexdigest()}"
+        )
+
+        assert emu_result is not None
+
+        hint = TraceExecutionHint(
+            message="A single execution trace",
+            trace=trace,
+            trace_digest=m.hexdigest(),
+            seed=self.seed,
+            emu_result=emu_result,
+            exception=the_exc,
+            exception_class=str(type(the_exc)),
+        )
+
+        self.hinter.send(hint)

smallworld/analyses/trace_execution_types.py

@@ -0,0 +1,42 @@
+import json
+import typing
+from dataclasses import dataclass
+from enum import Enum
+
+from smallworld.instructions import Operand
+
+CmpInfo = typing.Tuple[str, Operand, int]
+
+
+class TraceRes(Enum):
+    ER_NONE = 0
+    ER_BOUNDS = 1
+    ER_MAX_INSNS = 2
+    ER_FAIL = 3
+
+
+# one element in a trace
+@dataclass
+class TraceElement:
+    pc: int
+    ic: int  # instruction count
+    mnemonic: str
+    op_str: str
+    cmp: typing.List[CmpInfo]
+    branch: bool
+    immediates: typing.List[int]
+
+    def __str__(self):
+        return f"{self.ic} 0x{self.pc:x} [{self.mnemonic} {self.op_str}] {self.cmp} {self.branch} {self.immediates}"
+
+    # NOTE this is just used for logging. Can't un-jsonify
+    def to_json(self):
+        d = {
+            "instruction_count": self.ic,
+            "pc": self.pc,
+            "instr": f"{self.mnemonic} {self.op_str}",
+            "cmp": str(self.cmp),
+            "branch": self.branch,
+            "immediates": self.immediates,
+        }
+        return json.dumps(d)

smallworld/analyses/unstable/angr/divergence.py

@@ -11,7 +11,6 @@ from .utils import print_state
 from .visitor import ConditionalVisitor
 
 log = logging.getLogger(__name__)
-hinter = hinting.get_hinter(__name__)
 
 
 class DivergentAddressSignal(AnalysisSignal):
@@ -144,7 +143,7 @@ class DivergenceMemoryMixin(BaseMemoryMixin):
                 address=str(addr),
                 options=[(str(k), str(v)) for (k, v) in guards.items()],
             )
-            hinter.info(hint)
+            self.hinter.info(hint)
             options = {
                 "fork": self.divergence_fork,
                 "choose": self.divergence_choose,

smallworld/analyses/unstable/angr/model.py

@@ -12,7 +12,6 @@ from .base import BaseMemoryMixin
 from .visitor import EvalVisitor
 
 log = logging.getLogger(__name__)
-hinter = hinting.get_hinter(__name__)
 visitor = EvalVisitor()
 
 
@@ -158,7 +157,7 @@ class ModelMemoryMixin(BaseMemoryMixin):
                     instruction=self.state._ip.concrete_value,
                     value=str(res),
                 )
-                hinter.info(hint)
+                self.hinter.send(hint)
             else:
                 res = self._handle_untyped_register(reg_name, res)
                 hint = hinting.UntypedUnderSpecifiedRegisterHint(
@@ -167,7 +166,7 @@ class ModelMemoryMixin(BaseMemoryMixin):
                     instruction=self.state._ip.concrete_value,
                     value=str(res),
                 )
-                hinter.info(hint)
+                self.hinter.send(hint)
             if isinstance(res, int):
                 res = self.state.solver.BVV(res, size * 8)
         else:
@@ -182,7 +181,7 @@ class ModelMemoryMixin(BaseMemoryMixin):
                     instruction=self.state._ip.concrete_value,
                     value=str(res),
                 )
-                hinter.info(hint)
+                self.hinter.send(hint)
             else:
                 hint = hinting.UntypedUnderSpecifiedMemoryHint(
                     message="Memory has no type or value",
@@ -191,7 +190,7 @@ class ModelMemoryMixin(BaseMemoryMixin):
                     instruction=self.state._ip.concrete_value,
                     value=str(res),
                 )
-                hinter.info(hint)
+                self.hinter.send(hint)
                 self._handle_untyped_address(addr, res)
 
         return res
@@ -255,7 +254,7 @@ class ModelMemoryMixin(BaseMemoryMixin):
                         instruction=self.state._ip.concrete_value,
                         value=str(value),
                     )
-                    hinter.info(hint)
+                    self.hinter.send(hint)
                 environ.set_symbol(v.args[0], value)
                 if isinstance(value, int):
                     pretty_value = hex(value)

smallworld/analyses/unstable/angr_nwbt.py

@@ -6,7 +6,6 @@ from .angr.nwbt import configure_nwbt_plugins, configure_nwbt_strategy
 from .angr.utils import print_state
 
 log = logging.getLogger(__name__)
-hinter = hinting.get_hinter(__name__)
 
 
 class AngrNWBTAnalysis(analysis.Analysis):
@@ -71,21 +70,21 @@ class AngrNWBTAnalysis(analysis.Analysis):
                 registers=st.registers.create_hint(),
                 memory=st.memory.create_hint(),
             )
-            hinter.info(hint)
+            self.hinter.send(hint)
         for st in emu.mgr.deadended:
             hint = hinting.OutputHint(
                 message="State exited due to breakpoint",
                 registers=st.registers.create_hint(),
                 memory=st.memory.create_hint(),
             )
-            hinter.info(hint)
+            self.hinter.send(hint)
         for st in emu.mgr.unsat:
             hint = hinting.OutputHint(
                 message="State cannot continue; constraints unsat",
                 registers=st.registers.create_hint(),
                 memory=st.memory.create_hint(),
             )
-            hinter.info(hint)
+            self.hinter.send(hint)
         for err in emu.mgr.errored:
             print_state(log.info, err.state, "error")
             log.error(

smallworld/analyses/unstable/code_coverage.py

@@ -6,7 +6,6 @@ from ... import emulators, exceptions, hinting, state
 from .. import analysis
 
 logger = logging.getLogger(__name__)
-hinter = hinting.get_hinter(__name__)
 
 
 class CodeCoverage(analysis.Analysis):
@@ -48,7 +47,7 @@ class CodeCoverage(analysis.Analysis):
                     instruction_num=i,
                     exception=str(e),
                 )
-                hinter.info(exhint)
+                self.hinter.send(exhint)
                 break
         hint = hinting.CoverageHint(message="Coverage for execution", coverage=coverage)
-        hinter.info(hint)
+        self.hinter.send(hint)

smallworld/analyses/unstable/code_reachable.py

@@ -5,13 +5,12 @@ from ... import emulators, exceptions, hinting, state
 from .. import analysis
 
 logger = logging.getLogger(__name__)
-hinter = hinting.get_hinter(__name__)
 
 
 class CodeReachable(analysis.Analysis):
     """A simple analysis that logs what code is reachable by symbolic execution."""
 
-    def __init__(self, max_steps=500, **kwargs):
+    def __init__(self, *args, max_steps=500, **kwargs):
         self.steps_left = max_steps
         super().__init__(**kwargs)
 
@@ -35,7 +34,7 @@ class CodeReachable(analysis.Analysis):
                             message=f"Address {hex(pc)} is reachable via symbolic execution",
                             address=pc,
                         )
-                        hinter.info(hint)
+                        self.hinter.send(hint)
                 if self.steps_left is not None:
                     self.steps_left -= 1
         except exceptions.EmulationStop:

smallworld/analyses/unstable/control_flow_tracer.py

@@ -5,7 +5,6 @@ from ... import emulators, exceptions, hinting, instructions, state
 from .. import analysis
 
 logger = logging.getLogger(__name__)
-hinter = hinting.get_hinter(__name__)
 
 
 class ControlFlowTracer(analysis.Analysis):
@@ -41,7 +40,7 @@ class ControlFlowTracer(analysis.Analysis):
                     ),
                     to_instruction=instructions.Instruction.from_capstone(instruction),
                 )
-                hinter.info(hint)
+                self.hinter.send(hint)
                 from_instruction = None
             if self.is_cfi(instruction):
                 from_instruction = instruction
@@ -56,7 +55,7 @@ class ControlFlowTracer(analysis.Analysis):
                     instruction_num=i,
                     exception=str(e),
                 )
-                hinter.info(exhint)
+                self.hinter.send(exhint)
                 break
 
     def is_cfi(self, instruction):

smallworld/analyses/unstable/pointer_finder.py

@@ -7,7 +7,6 @@ from ... import emulators, exceptions, hinting, instructions, state
 from .. import analysis
 
 logger = logging.getLogger(__name__)
-hinter = hinting.get_hinter(__name__)
 
 
 class PointerFinder(analysis.Analysis):
@@ -41,7 +40,7 @@ class PointerFinder(analysis.Analysis):
 
         assert p, "we can't find the pointer"
         hint = hinting.PointerHint(message="Pointer Found", instruction=i, pointer=r)
-        hinter.info(hint)
+        self.hinter.send(hint)
 
     def run(self, state: state.Machine) -> None:
         machine = copy.deepcopy(state)
@@ -86,5 +85,5 @@ class PointerFinder(analysis.Analysis):
                     instruction_num=i,
                     exception=str(e),
                 )
-                hinter.info(exhint)
+                self.hinter.send(exhint)
                 break

smallworld/analyses/unstable/utils/tui.py

@@ -0,0 +1,71 @@
+import logging
+
+log = logging.getLogger(__name__)
+
+
+class TUIContinueException(Exception):
+    """Exception for signaling that a TUI handler shouldn't exit the loop."""
+
+    pass
+
+
+class SimpleTUI:
+    def __init__(self, help_banner="Available commands:"):
+        self._cases = dict()
+        self._shorts = dict()
+        self._hints = dict()
+        self._help_banner = help_banner
+        self.add_case("help", self.print_help, hint="Print this message")
+
+    def add_case(self, name, handler, hint=None):
+        name = name.lower()
+        short = name[0]
+        if short in self._shorts:
+            raise ValueError(
+                "Colliding short name {short}: already bound for {self._shorts[short]}"
+            )
+        if name in self._cases:
+            raise ValueError("Case {name} already registered")
+        self._cases[name] = handler
+        self._shorts[short] = name
+        self._hints[name] = hint
+
+    def print_help(self, **kwargs):
+        log.warn(self._help_banner)
+        for name in self._cases:
+            log.warn(
+                f'- {name} | {name[0]}:\t\t\t{self._hints[name] if self._hints[name] is not None else ""}'
+            )
+        raise TUIContinueException()
+
+    def handle(self, _default, _disabled, **kwargs):
+        prompt = " | ".join(
+            map(
+                lambda x: x.upper() if x == _default else x,
+                filter(lambda x: x not in _disabled, self._cases.keys()),
+            )
+        )
+        prompt = f"( {prompt} ) > "
+        while True:
+            opt = input(prompt).lower()
+            if opt == "":
+                if _default is None:
+                    log.error("No default case available")
+                    continue
+                opt = _default
+
+            if opt in self._shorts:
+                opt = self._shorts[opt]
+
+            if opt in _disabled:
+                log.error("Option {opt} not available")
+                continue
+
+            if opt not in self._cases:
+                log.error("Unknown option {opt}")
+                continue
+
+            try:
+                return self._cases[opt](**kwargs)
+            except TUIContinueException:
+                continue

smallworld/emulators/__init__.py

@@ -2,6 +2,8 @@ from .angr import *  # noqa: F401, F403
 from .angr import __all__ as __angr__
 from .emulator import *  # noqa: F401, F403
 from .emulator import __all__ as __emulator__
+from .ghidra import *  # noqa: F401, F403
+from .ghidra import __all__ as __pcode__
 from .unicorn import *  # noqa: F401, F403
 from .unicorn import __all__ as __unicorn__
 
@@ -11,4 +13,4 @@ try:
 except ImportError:
     __panda__ = []
 
-__all__ = __emulator__ + __unicorn__ + __angr__ + __panda__
+__all__ = __emulator__ + __unicorn__ + __angr__ + __panda__ + __pcode__

smallworld/emulators/angr/angr.py

@@ -74,6 +74,12 @@ class AngrEmulator(
         # Plugin preset; tells us which plugin preset to use.
         self._plugin_preset = "default"
 
+        # The platform definition;
+        # Holds global info about the platform
+        self.platdef: platforms.PlatformDef = platforms.PlatformDef.for_platform(
+            platform
+        )
+
         # The machine definition;
         # helps translate between angr and smallworld
         self.machdef: AngrMachineDef = AngrMachineDef.for_platform(platform)
@@ -301,7 +307,7 @@ class AngrEmulator(
             )
 
         if name == "pc":
-            name = self.machdef.pc_reg
+            name = self.platdef.pc_register
 
         (off, size) = self.machdef.angr_reg(name)
         return self.state.registers.load(off, size)
@@ -328,7 +334,7 @@ class AngrEmulator(
             )
 
         if name == "pc":
-            name = self.machdef.pc_reg
+            name = self.platdef.pc_register
 
         try:
             # This considers all BVSs to be labeled values;
@@ -357,7 +363,7 @@ class AngrEmulator(
     ) -> None:
         if not self._initialized and content is not None:
             if name == "pc":
-                name = self.machdef.pc_reg
+                name = self.platdef.pc_register
             # Test that the angr register exists
             _, _ = self.machdef.angr_reg(name)
             self._register_contents[name] = content
@@ -371,7 +377,7 @@ class AngrEmulator(
         # write_register_label().
 
         if name == "pc":
-            name = self.machdef.pc_reg
+            name = self.platdef.pc_register
         (off, size) = self.machdef.angr_reg(name)
 
         if content is None:
@@ -404,7 +410,7 @@ class AngrEmulator(
             return
         elif not self._initialized:
             if name == "pc":
-                name = self.machdef.pc_reg
+                name = self.platdef.pc_register
             # Test that the angr register exists
             _, _ = self.machdef.angr_reg(name)
             self._register_labels[name] = label
@@ -414,7 +420,7 @@ class AngrEmulator(
             )
         else:
             if name == "pc":
-                name = self.machdef.pc_reg
+                name = self.platdef.pc_register
             (off, size) = self.machdef.angr_reg(name)
 
             # This will bind whatever value is currently in the register
@@ -840,7 +846,14 @@ class AngrEmulator(
                     return False
                 read_end = read_start + read_size
 
-                return start <= read_start and end >= read_end
+                rng = range(start, end)
+                access_rng = range(read_start, read_end)
+                return (
+                    read_start in rng
+                    or read_end - 1 in rng
+                    or start in access_rng
+                    or end - 1 in access_rng
+                )
 
             def read_callback(state):
                 # The breakpoint action.
@@ -961,7 +974,7 @@ class AngrEmulator(
 
                 res = function(ConcreteAngrEmulator(state, self), addr, size, expr)
 
-                if self.platform.byteorder == platforms.byteorder.LITTLE:
+                if self.platform.byteorder == platforms.Byteorder.LITTLE:
                     # fix byte order if needed.
                     # i don't know _why_ this is needed,
                     # but encoding the result as little-endian on a little-endian
@@ -1085,7 +1098,14 @@ class AngrEmulator(
                     state.inspect.mem_write_length = write_size
                 write_end = write_start + write_size
 
-                return start <= write_start and end >= write_end
+                rng = range(start, end)
+                access_rng = range(write_start, write_end)
+                return (
+                    write_start in rng
+                    or write_end - 1 in rng
+                    or start in access_rng
+                    or end - 1 in access_rng
+                )
 
             def write_callback(state):
                 addr = state.inspect.mem_write_address
@@ -1625,6 +1645,7 @@ class ConcreteAngrEmulator(AngrEmulator):
         self.platform: platforms.Platform = parent.platform
         self.proj: angr.Project = parent.proj
         self.state: angr.SimState = state
+        self.platdef: platforms.PlatformDef = parent.platdef
         self.machdef: AngrMachineDef = parent.machdef
         self.pagesize: int = parent.PAGE_SIZE
 

smallworld/emulators/angr/machdefs/__init__.py

@@ -7,6 +7,7 @@ from .arm import (
     ARMv7MMachineDef,
 )
 from .i386 import i386MachineDef
+from .loongarch import LoongArch64MachineDef
 from .machdef import AngrMachineDef
 from .mips import MIPSBEMachineDef, MIPSELMachineDef
 from .mips64 import MIPS64BEMachineDef, MIPS64ELMachineDef
@@ -23,6 +24,7 @@ __all__ = [
     "ARMv6MThumbMachineDef",
     "ARMv7MMachineDef",
     "i386MachineDef",
+    "LoongArch64MachineDef",
     "MIPSBEMachineDef",
     "MIPSELMachineDef",
     "MIPS64BEMachineDef",

smallworld/emulators/angr/machdefs/aarch64.py

@@ -9,7 +9,6 @@ class AArch64MachineDef(AngrMachineDef):
     byteorder = Byteorder.LITTLE
 
     angr_arch = archinfo.arch_aarch64.ArchAArch64()
-    pc_reg = "pc"
 
     _registers = {
         # *** General Purpose Registers ***
@@ -77,6 +76,7 @@ class AArch64MachineDef(AngrMachineDef):
         "w30": "w30",
         "pc": "pc",
         "sp": "sp",
+        "wsp": "wsp",
         "fp": "fp",
         "lr": "lr",
         "xzr": "xzr",

smallworld/emulators/angr/machdefs/amd64.py

@@ -12,8 +12,6 @@ class AMD64MachineDef(AngrMachineDef):
 
     angr_arch = archinfo.arch_amd64.ArchAMD64()
 
-    pc_reg = "rip"
-
     _registers = {
         # *** General Purpose Registers ***
         "rax": "rax",
@@ -187,6 +185,4 @@ class AMD64MachineDef(AngrMachineDef):
         "xmm14": "xmm14",
         "ymm15": "ymm15",
         "xmm15": "xmm15",
-        "ymm16": "ymm16",
-        "xmm16": "xmm16",
     }

smallworld/emulators/angr/machdefs/arm.py

@@ -5,8 +5,6 @@ from .machdef import AngrMachineDef
 
 
 class ARMMachineDef(AngrMachineDef):
-    pc_reg = "pc"
-
     def __init__(self):
         self._registers = {
             # *** General-purpose registers ***

smallworld/emulators/angr/machdefs/i386.py

@@ -14,8 +14,6 @@ class i386MachineDef(AngrMachineDef):
 
     angr_arch = archinfo.arch_x86.ArchX86()
 
-    pc_reg = "eip"
-
     _registers = {
         # *** General Purpose Registers ***
         "eax": "eax",