Ejemplo n.º 1
0
    def _solver(self):
        """
        Creates or gets a Claripy solver, based on the state options.
        """
        if self._stored_solver is not None:
            return self._stored_solver

        track = o.CONSTRAINT_TRACKING_IN_SOLVER in self.state.options

        if o.ABSTRACT_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverVSA()
        elif o.REPLACEMENT_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverReplacement(auto_replace=False)
        elif o.CACHELESS_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverCacheless(track=track)
        elif o.COMPOSITE_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverComposite(track=track)
        elif o.SYMBOLIC in self.state.options and o.approximation & self.state.options:
            self._stored_solver = claripy.SolverHybrid(track=track)
        elif o.SYMBOLIC in self.state.options:
            self._stored_solver = claripy.Solver(track=track)
        else:
            self._stored_solver = claripy.SolverConcrete()

        return self._stored_solver
Ejemplo n.º 2
0
    def _remove_redundant_terms(cond):
        """
        Extract all terms and test for each term if its truism impacts the truism of the entire condition. If not, the
        term is redundant and can be replaced with a True.
        """

        all_terms = set()
        for term in ConditionProcessor._extract_terms(cond):
            if term not in all_terms:
                all_terms.add(term)

        negations = {}
        to_skip = set()
        all_terms_without_negs = set()
        for term in all_terms:
            if term in to_skip:
                continue
            neg = claripy.Not(term)
            if neg in all_terms:
                negations[term] = neg
                to_skip.add(neg)
                all_terms_without_negs.add(term)
            else:
                all_terms_without_negs.add(term)

        solver = claripy.SolverCacheless()
        for term in all_terms_without_negs:
            neg = negations.get(term, None)

            replaced_with_true = ConditionProcessor._replace_term_in_ast(
                cond, term, claripy.true, neg, claripy.false)
            sat0 = solver.satisfiable(extra_constraints=(
                cond,
                claripy.Not(replaced_with_true),
            ))
            sat1 = solver.satisfiable(extra_constraints=(
                claripy.Not(cond),
                replaced_with_true,
            ))
            if sat0 or sat1:
                continue

            replaced_with_false = ConditionProcessor._replace_term_in_ast(
                cond, term, claripy.false, neg, claripy.true)
            sat0 = solver.satisfiable(extra_constraints=(
                cond,
                claripy.Not(replaced_with_false),
            ))
            sat1 = solver.satisfiable(extra_constraints=(
                claripy.Not(cond),
                replaced_with_false,
            ))
            if sat0 or sat1:
                continue

            # TODO: Finish the implementation
            print(term, "is redundant")
Ejemplo n.º 3
0
    def _solver(self):
        """
        Creates or gets a Claripy solver, based on the state options.
        """
        if self._stored_solver is not None:
            return self._stored_solver

        track = o.CONSTRAINT_TRACKING_IN_SOLVER in self.state.options
        approximate_first = o.APPROXIMATE_FIRST in self.state.options

        if o.STRINGS_ANALYSIS in self.state.options:
            if 'smtlib_cvc4' in backend_manager.backends._backends_by_name:
                our_backend = backend_manager.backends.smtlib_cvc4
            elif 'smtlib_z3' in backend_manager.backends._backends_by_name:
                our_backend = backend_manager.backends.smtlib_z3
            elif 'smtlib_abc' in backend_manager.backends._backends_by_name:
                our_backend = backend_manager.backends.smtlib_abc
            else:
                l.error(
                    "Cannot find a suitable string solver. Please ensure you have installed a string solver that "
                    "angr supports, and have imported the corresponding solver backend in claripy. You can try "
                    "adding \"from claripy.backends.backend_smtlib_solvers import *\" at the beginning of your "
                    "script.")
                raise ValueError("Cannot find a suitable string solver")
            if o.COMPOSITE_SOLVER in self.state.options:
                self._stored_solver = claripy.SolverComposite(
                    template_solver_string=claripy.SolverCompositeChild(
                        backend=our_backend, track=track))
        elif o.ABSTRACT_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverVSA()
        elif o.SYMBOLIC in self.state.options and o.REPLACEMENT_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverReplacement(auto_replace=False)
        elif o.SYMBOLIC in self.state.options and o.CACHELESS_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverCacheless(track=track)
        elif o.SYMBOLIC in self.state.options and o.COMPOSITE_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverComposite(track=track)
        elif o.SYMBOLIC in self.state.options and any(
                opt in self.state.options for opt in o.approximation):
            self._stored_solver = claripy.SolverHybrid(
                track=track, approximate_first=approximate_first)
        elif o.HYBRID_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverHybrid(
                track=track, approximate_first=approximate_first)
        elif o.SYMBOLIC in self.state.options:
            self._stored_solver = claripy.Solver(track=track)
        else:
            self._stored_solver = claripy.SolverConcrete()

        return self._stored_solver
Ejemplo n.º 4
0
    def _solver(self):
        """
        Creates or gets a Claripy solver, based on the state options.
        """
        if self._stored_solver is not None:
            return self._stored_solver

        track = o.CONSTRAINT_TRACKING_IN_SOLVER in self.state.options
        approximate_first = o.APPROXIMATE_FIRST in self.state.options

        if o.STRINGS_ANALYSIS in self.state.options:
            if 'smtlib_cvc4' in backend_manager.backends._backends_by_name:
                our_backend = backend_manager.backends.smtlib_cvc4
            elif 'smtlib_z3' in backend_manager.backends._backends_by_name:
                our_backend = backend_manager.backends.smtlib_z3
            elif 'smtlib_abc' in backend_manager.backends._backends_by_name:
                our_backend = backend_manager.backends.smtlib_abc
            else:
                raise ValueError("Could not find suitable string solver!")
            if o.COMPOSITE_SOLVER in self.state.options:
                self._stored_solver = claripy.SolverComposite(
                    template_solver_string=claripy.SolverCompositeChild(
                        backend=our_backend, track=track))
        elif o.ABSTRACT_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverVSA()
        elif o.SYMBOLIC in self.state.options and o.REPLACEMENT_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverReplacement(auto_replace=False)
        elif o.SYMBOLIC in self.state.options and o.CACHELESS_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverCacheless(track=track)
        elif o.SYMBOLIC in self.state.options and o.COMPOSITE_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverComposite(track=track)
        elif o.SYMBOLIC in self.state.options and any(
                opt in self.state.options for opt in o.approximation):
            self._stored_solver = claripy.SolverHybrid(
                track=track, approximate_first=approximate_first)
        elif o.HYBRID_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverHybrid(
                track=track, approximate_first=approximate_first)
        elif o.SYMBOLIC in self.state.options:
            self._stored_solver = claripy.Solver(track=track)
        else:
            self._stored_solver = claripy.SolverConcrete()

        return self._stored_solver
Ejemplo n.º 5
0
    def _revert_short_circuit_conditions(cond):

        # revert short-circuit conditions
        # !A||(A&&!B) ==> !(A&&B)

        if cond.op != "Or":
            return cond

        if len(cond.args) == 1:
            # redundant operator. get rid of it
            return cond.args[0]

        or_arg0, or_arg1 = cond.args[:2]
        if or_arg1.op == 'And':
            pass
        elif or_arg0.op == 'And':
            or_arg0, or_arg1 = or_arg1, or_arg0
        else:
            return cond

        not_a = or_arg0
        solver = claripy.SolverCacheless()

        if not_a.variables == or_arg1.args[0].variables:
            solver.add(not_a == or_arg1.args[0])
            not_b = or_arg1.args[1]
        elif not_a.variables == or_arg1.args[1].variables:
            solver.add(not_a == or_arg1.args[1])
            not_b = or_arg1.args[0]
        else:
            return cond

        if not solver.satisfiable():
            # found it!
            b = claripy.Not(not_b)
            a = claripy.Not(not_a)
            if len(cond.args) <= 2:
                return claripy.Not(claripy.And(a, b))
            else:
                return claripy.Or(claripy.Not(claripy.And(a, b)),
                                  *cond.args[2:])
        else:
            return cond
Ejemplo n.º 6
0
    def _solver(self):
        if self._stored_solver is not None:
            return self._stored_solver

        if o.ABSTRACT_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverVSA()
        elif o.REPLACEMENT_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverReplacement(auto_replace=False)
        elif o.CACHELESS_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverCacheless()
        elif o.COMPOSITE_SOLVER in self.state.options:
            self._stored_solver = claripy.SolverComposite()
        elif o.SYMBOLIC in self.state.options and o.approximation & self.state.options:
            self._stored_solver = claripy.SolverHybrid()
        elif o.SYMBOLIC in self.state.options:
            self._stored_solver = claripy.Solver()
        else:
            self._stored_solver = claripy.SolverConcrete()

        return self._stored_solver