def set_delayed_mem_value(target_mem, fn_name, param_pos, mem_size,
init_seed_flag):
mem_addr = target_mem.getAddress()
if init_seed_flag:
data = []
for d in range(0, mem_size):
seed_mem_layout[mem_addr + d] = 0x0
data.append(0x0)
else:
sym_addr = fn_param_seed_map[(fn_name, param_pos, 0,
Triton.getConcreteRegisterValue(
Triton.registers.rip))]
data = []
for d in range(0, mem_size):
data.append(seed_mem_layout[sym_addr + d])
fn_param_seed_map[(fn_name, param_pos, 0,
Triton.getConcreteRegisterValue(
Triton.registers.rip))] = mem_addr
Triton.setConcreteMemoryAreaValue(mem_addr, data)
for d in range(0, mem_size):
Triton.symbolizeMemory(MemoryAccess(mem_addr + d, CPUSIZE.BYTE))
def config_hook_table(binary):
for pltIndex in range(len(interface_hook_fn)):
if (interface_hook_fn[pltIndex][1] == None):
interface_hook_fn[pltIndex][1] = BASE_PLT + pltIndex
for pltgot_item in binary.pltgot_relocations:
pltgot_item_name = pltgot_item.symbol.name
pltgot_item_addr = pltgot_item.address
for hook_fn in interface_hook_fn:
hook_fn_addr = binary.get_function_address(hook_fn[0])
if (hook_fn_addr == 0x0 and pltgot_item_name == hook_fn[0]):
Triton.setConcreteMemoryValue(
MemoryAccess(pltgot_item_addr, CPUSIZE.QWORD), hook_fn[1])
if CONFIG_DEBUG:
print('[CONFIG-H] relocated %s from %x to %x' %
(pltgot_item_name, pltgot_item_addr, hook_fn[1]))
break
for sgx_fn in sgx_implicit_fn:
sgx_fn_addr = binary.get_function_address(sgx_fn)
sgx_implicit_fn[sgx_fn] = (sgx_fn_addr, sgx_implicit_fn[sgx_fn][1])
if CONFIG_DEBUG:
print(
'[CONFIG-H] create hooker for memory allocated method %s at 0x%x'
% (sgx_fn, sgx_fn_addr))
for warn_fn in sgx_warn_tag:
warn_fn_addr = binary.get_function_address(warn_fn)
sgx_warn_tag[warn_fn] = warn_fn_addr
if CONFIG_DEBUG:
print('[CONFIG-H] create hooker for warning method %s at 0x%x' %
(warn_fn, warn_fn_addr))
return
def test_defcamp_2015(self):
"""Load binary, self.Triton.setup environment and solve challenge with sym eval."""
# Load the binary
binary_file = os.path.join(os.path.dirname(__file__), "misc",
"defcamp-2015-r100.bin")
self.load_binary(binary_file)
# Define a fake stack
self.Triton.setConcreteRegisterValue(self.Triton.registers.rbp,
0x7fffffff)
self.Triton.setConcreteRegisterValue(self.Triton.registers.rsp,
0x6fffffff)
# Define an user input
self.Triton.setConcreteRegisterValue(self.Triton.registers.rdi,
0x10000000)
# Symbolize user inputs (30 bytes)
for index in range(30):
self.Triton.convertMemoryToSymbolicVariable(
MemoryAccess(0x10000000 + index, CPUSIZE.BYTE))
# Emulate from the verification function
solution = self.emulate(0x4006FD)
self.assertEqual(solution, 'Code_Talkers')
def hookingHandler():
pc = Triton.getConcreteRegisterValue(Triton.registers.rip)
for rel in customRelocation:
if rel[2] == pc:
# Emulate the routine and the return value
ret_value = rel[1]()
Triton.concretizeRegister(Triton.registers.rax)
Triton.setConcreteRegisterValue(Triton.registers.rax, ret_value)
# Get the return address
ret_addr = Triton.getConcreteMemoryValue(
MemoryAccess(
Triton.getConcreteRegisterValue(Triton.registers.rsp),
CPUSIZE.QWORD))
# Hijack RIP to skip the call
Triton.concretizeRegister(Triton.registers.rip)
Triton.setConcreteRegisterValue(Triton.registers.rip, ret_addr)
# Restore RSP (simulate the ret)
Triton.concretizeRegister(Triton.registers.rsp)
Triton.setConcreteRegisterValue(
Triton.registers.rsp,
Triton.getConcreteRegisterValue(Triton.registers.rsp) +
CPUSIZE.QWORD)
return
def initContext(ctx, seed):
# Clean symbolic state
ctx.concretizeAllRegister()
ctx.concretizeAllMemory()
# Symbolize the inputs in the seed.
# Todo: do the proper buffer version
seed = seed.copy()
inputLen = max(seed.keys()) + 1
for sentinelByteIndex in range(inputLen,
inputLen + RiverUtils.SENTINEL_SIZE):
seed[sentinelByteIndex] = 0
inputLen = max(seed.keys()) + 1
for byteIndex, value in seed.items():
byteAddr = INPUT_BUFFER_ADDRESS + byteIndex
ctx.setConcreteMemoryValue(byteAddr, value)
ctx.symbolizeMemory(MemoryAccess(byteAddr, CPUSIZE.BYTE))
# The commented version is the generic one
"""
for index in range(30):
ctx.symbolizeMemory(MemoryAccess(0x10000000+index, CPUSIZE.BYTE))
"""
# Point RDI on our buffer. The address of our buffer is arbitrary. We just need
# to point the RDI register on it as first argument of our targeted function.
ctx.setConcreteRegisterValue(ctx.registers.rdi, INPUT_BUFFER_ADDRESS)
ctx.setConcreteRegisterValue(ctx.registers.rsi, inputLen)
# Setup fake stack on an abitrary address.
ctx.setConcreteRegisterValue(ctx.registers.rsp, 0x7fffffff)
ctx.setConcreteRegisterValue(ctx.registers.rbp, 0x7fffffff)
return
def __atoi(instruction):
debug('atoi hooked')
# 2文字以上だと解なしになってしまう
atoi_argv_len = 1
# Get arguments
arg1_ptr = Triton.getConcreteRegisterValue(Triton.registers.rdi)
arg1 = getMemoryString(arg1_ptr)
# print('atoi("{}")'.format(arg1))
if Triton.getMemoryAst(MemoryAccess(arg1_ptr,
CPUSIZE.BYTE)).isSymbolized():
debug("atoi is symbolized")
sym_arg1_offset = []
for i in range(atoi_argv_len):
sym_arg1_offset.append(
Triton.getMemoryAst(MemoryAccess(arg1_ptr + i, CPUSIZE.BYTE)))
# Symbolize return register
Triton.convertRegisterToSymbolicVariable(Triton.registers.rax)
reg_rax = Triton.getSymbolicRegister(Triton.registers.rax)
ast = Triton.getAstContext()
ret_value = 0
for i in range(atoi_argv_len):
ret_value += (sym_arg1_offset[atoi_argv_len - i - 1] -
ord('0')) * (10**i)
conditional_branch_constraints.append(
ast.land([
sym_arg1_offset[i] >= ord('0'),
sym_arg1_offset[i] <= ord('9')
]))
padding_size = reg_rax.getAst().getBitvectorSize() - CPUSIZE.BYTE_BIT
rax_ast = ast.sx(padding_size, ret_value)
Triton.createSymbolicRegisterExpression(instruction, rax_ast,
Triton.registers.rax,
"assgin return value")
# import ipdb; ipdb.set_trace()
return 0
else:
# Return value
return int(arg1)
def libcMainHandler():
print '[+] __libc_start_main hooked'
# Get arguments
main = Triton.getConcreteRegisterValue(Triton.registers.rdi)
# Push the return value to jump into the main() function
Triton.concretizeRegister(Triton.registers.rsp)
Triton.setConcreteRegisterValue(
Triton.registers.rsp,
Triton.getConcreteRegisterValue(Triton.registers.rsp) - CPUSIZE.QWORD)
ret2main = MemoryAccess(
Triton.getConcreteRegisterValue(Triton.registers.rsp), CPUSIZE.QWORD)
Triton.concretizeMemory(ret2main)
Triton.setConcreteMemoryValue(ret2main, main)
# Setup argc / argv
Triton.concretizeRegister(Triton.registers.rdi)
Triton.concretizeRegister(Triton.registers.rsi)
argvs = [
"sample_1", # argv[0]
"my_first_arg", # argv[1]
]
# Define argc / argv
base = 0x20000000
addrs = list()
for argv in argvs:
addrs.append(base)
Triton.setConcreteMemoryAreaValue(base, argv + '\x00')
base += len(argv) + 1
argc = len(argvs)
argv = base
for addr in addrs:
Triton.setConcreteMemoryValue(MemoryAccess(base, CPUSIZE.QWORD), addr)
base += CPUSIZE.QWORD
Triton.setConcreteRegisterValue(Triton.registers.rdi, argc)
Triton.setConcreteRegisterValue(Triton.registers.rsi, argv)
return 0
def __libc_start_main(self):
# Get arguments
main = self.Triton.getConcreteRegisterValue(self.Triton.registers.rdi)
# Push the return value to jump into the main() function
self.Triton.concretizeRegister(self.Triton.registers.rsp)
self.Triton.setConcreteRegisterValue(self.Triton.registers.rsp, self.Triton.getConcreteRegisterValue(self.Triton.registers.rsp)-CPUSIZE.QWORD)
ret2main = MemoryAccess(self.Triton.getConcreteRegisterValue(self.Triton.registers.rsp), CPUSIZE.QWORD)
self.Triton.concretizeMemory(ret2main)
self.Triton.setConcreteMemoryValue(ret2main, main)
# Setup argc / argv
self.Triton.concretizeRegister(self.Triton.registers.rdi)
self.Triton.concretizeRegister(self.Triton.registers.rsi)
# Setup target argvs
argvs = list()
# Define argc / argv
base = self.BASE_ARGV
addrs = list()
index = 0
for argv in argvs:
addrs.append(base)
self.Triton.setConcreteMemoryAreaValue(base, argv+'\x00')
# Tainting argvs
for i in range(len(argv)):
self.Triton.taintMemory(base + i)
base += len(argv)+1
index += 1
argc = len(argvs)
argv = base
for addr in addrs:
self.Triton.setConcreteMemoryValue(MemoryAccess(base, CPUSIZE.QWORD), addr)
base += CPUSIZE.QWORD
self.Triton.setConcreteRegisterValue(self.Triton.registers.rdi, argc)
self.Triton.setConcreteRegisterValue(self.Triton.registers.rsi, argv)
return 0
def symbolizeInputs(seed,w):
Triton.concretizeAllRegister()
Triton.concretizeAllMemory()
Triton.setConcreteRegisterValue(Triton.registers.ebp, 0x6ffffffb)
Triton.setConcreteRegisterValue(Triton.registers.esp, 0x6fffffff)
esp=Triton.getConcreteRegisterValue(Triton.registers.ebp)
Triton.convertMemoryToSymbolicVariable(MemoryAccess(esp+8, CPUSIZE.DWORD))
Triton.setConcreteMemoryValue(esp+8,0x12)
Triton.setConcreteRegisterValue(Triton.registers.edi, esp+8)
address=328
addressv=0x5800
Triton.setConcreteMemoryValue(MemoryAccess(esp+12,CPUSIZE.WORD),address)
for i in range(10):
Triton.setConcreteMemoryValue(MemoryAccess(address,CPUSIZE.WORD),addressv)
address=address+4
for j in range(100):
Triton.convertMemoryToSymbolicVariable(MemoryAccess(addressv, CPUSIZE.WORD))
Triton.setConcreteMemoryValue(addressv,0x12)
addressv=addressv+1
for address, value in seed.items():
Triton.setConcreteMemoryValue(MemoryAccess(address,CPUSIZE.DWORD),value)
#Triton.setConcreteMemoryValue(address,value)
Triton.convertMemoryToSymbolicVariable(MemoryAccess(address, CPUSIZE.WORD))
#Triton.setConcreteMemoryValue(MemoryAccess(address,CPUSIZE.DWORD),value)
Triton.convertMemoryToSymbolicVariable(MemoryAccess(address+1, CPUSIZE.WORD))
return
def makeRelocation(binary):
# Perform our own relocations
for rel in binary.pltgot_relocations:
symbolName = rel.symbol.name
symbolRelo = rel.address
for crel in customRelocation:
if symbolName == crel[0]:
print('[+] Hooking %s' %(symbolName))
Triton.setConcreteMemoryValue(MemoryAccess(symbolRelo, CPUSIZE.QWORD), crel[2])
return
def test_taint_assignement_register_memory(self):
"""Check tainting assignment register <- memory."""
setArchitecture(ARCH.X86_64)
self.assertFalse(isRegisterTainted(REG.RAX))
taintRegister(REG.RAX)
self.assertTrue(isRegisterTainted(REG.RAX))
taintAssignmentRegisterMemory(REG.RAX, MemoryAccess(0x2000, 8))
self.assertFalse(isRegisterTainted(REG.RAX))
taintMemory(MemoryAccess(0x2000, 8))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 8)))
taintAssignmentRegisterMemory(REG.RAX, MemoryAccess(0x2000, 8))
self.assertTrue(isRegisterTainted(REG.RAX))
taintAssignmentRegisterMemory(REG.RAX, MemoryAccess(0x3000, 8))
self.assertFalse(isRegisterTainted(REG.RAX))
def test_bind_expr_to_memory(self):
"""Check symbolic expression binded to memory can be retrieve."""
# Bind expr1 to 0x100
expr1 = self.Triton.newSymbolicExpression(self.astCtxt.bv(0x11, 8))
mem = MemoryAccess(0x100, CPUSIZE.BYTE)
self.Triton.assignSymbolicExpressionToMemory(expr1, mem)
# Get expr from memory
expr2 = self.Triton.getSymbolicMemory(0x100)
self.assertEqual(expr1.getAst().evaluate(), expr2.getAst().evaluate())
def getNewInput():
inputs = list()
pco = Triton.getPathConstraints()
astCtxt = Triton.getAstContext()
'''****************
e= astCtxt.land(e,
Triton.getPathConstraintsAst()
)
f = simplify(e,usingZ3)
cstr = ast.assert_(
f
)
'*******************************'''
previousConstraints = astCtxt.equal(astCtxt.bvtrue(), astCtxt.bvtrue())
for pc in pco:
if pc.isMultipleBranches():
branches = pc.getBranchConstraints()
pc = Triton.getConcreteRegisterValue(Triton.registers.eip)
zfId = Triton.getSymbolicRegisterId(Triton.registers.zf)
zf = getFullAstFromId(zfId)
e = ast.equal(zf, ast.bv(1, 1))
for branch in branches:
if branch['isTaken'] == False:
models = Triton.getModel(
astCtxt.land(
[previousConstraints, branch['constraint']]))
seed = dict()
for k, v in models.items():
symVar = Triton.getSymbolicVariableFromId(k)
seed.update({symVar.getKindValue(): v.getValue()})
Triton.convertMemoryToSymbolicVariable(
MemoryAccess(k, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(
MemoryAccess(k + 1, CPUSIZE.DWORD))
if seed:
inputs.append(seed)
previousConstraints = astCtxt.land(
[previousConstraints,
pc.getTakenPathConstraintAst()])
Triton.clearPathConstraints()
return inputs
def makeRelocation(ctx, binary):
# Perform our own relocations
try:
for rel in binary.pltgot_relocations:
symbolName = rel.symbol.name
symbolRelo = rel.address
for crel in customRelocation:
if symbolName == crel[0]:
ctx.setConcreteMemoryValue(
MemoryAccess(symbolRelo, CPUSIZE.QWORD), crel[2])
except:
pass
def test_taint_assignement_register_memory(self):
"""Check tainting assignment register <- memory."""
Triton = TritonContext()
Triton.setArchitecture(ARCH.X86_64)
self.assertFalse(Triton.isRegisterTainted(Triton.registers.rax))
Triton.taintRegister(Triton.registers.rax)
self.assertTrue(Triton.isRegisterTainted(Triton.registers.rax))
Triton.taintAssignmentRegisterMemory(Triton.registers.rax,
MemoryAccess(0x2000, 8))
self.assertFalse(Triton.isRegisterTainted(Triton.registers.rax))
Triton.taintMemory(MemoryAccess(0x2000, 8))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 8)))
Triton.taintAssignmentRegisterMemory(Triton.registers.rax,
MemoryAccess(0x2000, 8))
self.assertTrue(Triton.isRegisterTainted(Triton.registers.rax))
Triton.taintAssignmentRegisterMemory(Triton.registers.rax,
MemoryAccess(0x3000, 8))
self.assertFalse(Triton.isRegisterTainted(Triton.registers.rax))
def test_taint_union_memory_register(self):
"""Check tainting union memory U register."""
setArchitecture(ARCH.X86_64)
taintMemory(MemoryAccess(0x2000, 4))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
taintUnionMemoryRegister(MemoryAccess(0x2000, 4), REG.RAX)
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertFalse(isRegisterTainted(REG.RAX))
untaintMemory(MemoryAccess(0x2000, 4))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertFalse(isRegisterTainted(REG.RAX))
taintUnionMemoryRegister(MemoryAccess(0x2000, 4), REG.RAX)
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertFalse(isRegisterTainted(REG.RAX))
taintRegister(REG.RAX)
taintUnionMemoryRegister(MemoryAccess(0x2000, 4), REG.RAX)
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertTrue(isRegisterTainted(REG.RAX))
def make_relocation(self, binary):
# Setup plt
for pltIndex in range(len(self.RELO)):
self.RELO[pltIndex][2] = self.BASE_PLT + pltIndex
# Perform our own relocations
for rel in binary.pltgot_relocations:
symbolName = rel.symbol.name
symbolRelo = rel.address
for crel in self.RELO:
if symbolName == crel[0]:
self.Triton.setConcreteMemoryValue(MemoryAccess(symbolRelo, CPUSIZE.QWORD), crel[2])
break
return
def test_8(self):
ctx = TritonContext()
ctx.setArchitecture(ARCH.X86_64)
ctx.enableMode(MODE.ONLY_ON_SYMBOLIZED, True)
ctx.setConcreteRegisterValue(ctx.registers.rax, 0x1337)
ctx.convertRegisterToSymbolicVariable(ctx.registers.rax)
ctx.convertMemoryToSymbolicVariable(MemoryAccess(0, CPUSIZE.QWORD))
inst = Instruction(b"\x48\x8b\x18") # mov rbx, qword ptr [rax]
self.assertTrue(ctx.processing(inst))
self.assertTrue(checkAstIntegrity(inst))
self.assertEqual(inst.getOperands()[1].getAddress(), 0x1337)
self.assertIsNotNone(inst.getOperands()[1].getLeaAst())
def test_5(self):
ctx = TritonContext()
ctx.setArchitecture(ARCH.X86_64)
ctx.enableMode(MODE.ONLY_ON_SYMBOLIZED, True)
ctx.convertMemoryToSymbolicVariable(MemoryAccess(0, CPUSIZE.QWORD))
inst = Instruction(b"\x48\x8b\x18") # mov rbx, qword ptr [rax]
self.assertTrue(ctx.processing(inst))
self.assertTrue(checkAstIntegrity(inst))
self.assertEqual(len(inst.getReadRegisters()), 0)
self.assertEqual(len(inst.getWrittenRegisters()), 1)
self.assertEqual(len(inst.getLoadAccess()), 1)
self.assertEqual(len(inst.getStoreAccess()), 0)
def test_taint_union_register_memory(self):
"""Check tainting union register U memory."""
Triton = TritonContext()
Triton.setArchitecture(ARCH.X86_64)
self.assertFalse(Triton.isRegisterTainted(Triton.registers.rax))
Triton.taintRegister(Triton.registers.rax)
self.assertTrue(Triton.isRegisterTainted(Triton.registers.rax))
Triton.taintUnionRegisterMemory(Triton.registers.rax,
MemoryAccess(0x2000, 4))
self.assertTrue(Triton.isRegisterTainted(Triton.registers.rax))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2000, 4)))
Triton.untaintRegister(Triton.registers.rax)
self.assertFalse(Triton.isRegisterTainted(Triton.registers.rax))
Triton.taintUnionRegisterMemory(Triton.registers.rax,
MemoryAccess(0x2000, 4))
self.assertFalse(Triton.isRegisterTainted(Triton.registers.rax))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2000, 4)))
# !T U T
Triton.untaintRegister(Triton.registers.rax)
Triton.taintMemory(MemoryAccess(0x2000, 4))
Triton.taintUnionRegisterMemory(Triton.registers.rax,
MemoryAccess(0x2000, 4))
self.assertTrue(Triton.isRegisterTainted(Triton.registers.rax))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 4)))
# T U T
Triton.taintRegister(Triton.registers.rax)
Triton.taintMemory(MemoryAccess(0x2000, 4))
Triton.taintUnionRegisterMemory(Triton.registers.rax,
MemoryAccess(0x2000, 4))
self.assertTrue(Triton.isRegisterTainted(Triton.registers.rax))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 4)))
def emulate(pc):
global instCount
global taintCount
astCtxt = Triton.getAstContext()
print('[+] Starting emulation.')
while pc:
opcode = Triton.getConcreteMemoryAreaValue(pc, 16)
instruction = Instruction()
instruction.setOpcode(opcode)
instruction.setAddress(pc)
if instruction.getAddress() == 0x400a74:
Triton.taintRegister(Triton.registers.rdi)
Triton.processing(instruction)
hookingHandler(Triton)
if "call" in str(instruction):
print('[call] %s' % (str(instruction)))
print("skipping...")
ret_addr = Triton.getConcreteMemoryValue(
MemoryAccess(
Triton.getConcreteRegisterValue(Triton.registers.rsp),
CPUSIZE.QWORD))
Triton.setConcreteRegisterValue(Triton.registers.rip, ret_addr)
Triton.setConcreteRegisterValue(
Triton.registers.rsp,
Triton.getConcreteRegisterValue(Triton.registers.rsp) +
CPUSIZE.QWORD)
instCount += 1
if instruction.isTainted():
print('[tainted] %s' % (str(instruction)))
taintCount += 1
else:
#print(instruction)
pass
pc = Triton.getConcreteRegisterValue(Triton.registers.rip)
print('[*] ' + str(instCount) + ' instructions emulated')
print('[*] ' + str(taintCount) + ' instructions tainted')
return
def symbolizeAndConcretizeArea(addr, values):
if symbolized:
if self.resetSymbolicMemoryAtEachRun: # Not used anymore
self.context.setConcreteMemoryAreaValue(addr, values)
for byteIndex, value in enumerate(values):
byteAddr = INPUT_BUFFER_ADDRESS + byteIndex
self.context.symbolizeMemory(
MemoryAccess(byteAddr, CPUSIZE.BYTE))
else:
# If not needed to reset symbolic state, just take the variable from the cache store and set its current value
# This will update both the symbolic state and concrete memory
for byteIndex, value in enumerate(values):
byteAddr = INPUT_BUFFER_ADDRESS + byteIndex
self.context.setConcreteVariableValue(
self.symbolicVariablesCache[byteIndex], value)
def makeRelocation(binary):
# Setup plt
for pltIndex in range(len(customRelocation)):
customRelocation[pltIndex][2] = BASE_PLT + pltIndex
# Perform our own relocations
for rel in binary.pltgot_relocations:
symbolName = rel.symbol.name
symbolRelo = rel.address
for crel in customRelocation:
if symbolName == crel[0]:
debug('Hooking %s' %(symbolName))
Triton.setConcreteMemoryValue(MemoryAccess(symbolRelo, CPUSIZE.QWORD), crel[2])
break
return
def emulate(pc):
global frameDepth
while (True):
opcode = Triton.getConcreteMemoryAreaValue(pc, 16)
inst = Instruction()
inst.setOpcode(opcode)
inst.setAddress(pc)
Triton.processing(inst)
# if(inst.getAddress() == int(sys.argv[2],16)):
# dumpInput()
# exit(0)
print inst,
print "size: " + str(format(inst.getSize(), 'x'))
if (inst.getType() == OPCODE.CALL):
frameDepth += 1
esp = Triton.getConcreteRegisterValue(Triton.registers.rsp)
retAddr = Triton.getConcreteMemoryValue(MemoryAccess(esp, 4))
returnStack.append(retAddr)
for ret in returnStack:
print format(ret, 'x')
# printStack()
if inst.getAddress() == 0x804849b or inst.getAddress(
) == 0x804847a or inst.getAddress() == 0x804844c:
print "EAX:"+str(format(Triton.getConcreteRegisterValue(Triton.registers.rax),'x')) + \
" EDX:"+str(format(Triton.getConcreteRegisterValue(Triton.registers.rdx),'x')) + \
" EBP : "+ str(format(Triton.getConcreteRegisterValue(Triton.registers.rbp),'x')) + \
" EIP : "+ str(format(Triton.getConcreteRegisterValue(Triton.registers.rip),'x'))
id = Triton.getSymbolicRegisterId(Triton.registers.rax)
currentEBP = Triton.getConcreteRegisterValue(Triton.registers.rbp)
if (inst.getType() == OPCODE.HLT):
break
hookingHandler()
if inst.getType() == OPCODE.RET:
frameDepth -= 1
evaluatepc()
if (inst.getAddress() == 0):
exit(0)
pc = Triton.getConcreteRegisterValue(Triton.registers.rip)
def __fgets():
debug('fgets hooked')
# Get arguments
arg1 = Triton.getConcreteRegisterValue(Triton.registers.rdi)
arg2 = Triton.getConcreteRegisterValue(Triton.registers.rsi)
indx = 0
user = "******"
for c in user:
mem = MemoryAccess(arg1 + indx, CPUSIZE.BYTE)
Triton.setConcreteMemoryValue(mem, ord(c))
indx += 1
# Return value
return arg1
def __fgets(ctx):
# Get arguments
arg1 = ctx.getConcreteRegisterValue(ctx.registers.rdi)
arg2 = ctx.getConcreteRegisterValue(ctx.registers.rsi)
indx = 0
#user = raw_input("")[:arg2]
user = "******"
for c in user:
mem = MemoryAccess(arg1 + indx, CPUSIZE.BYTE)
ctx.setConcreteMemoryValue(mem, ord(c))
indx += 1
# Return value
return arg1
def test_taint_union_memory_immediate(self):
"""Check tainting union memory U immediate."""
setArchitecture(ARCH.X86_64)
taintMemory(MemoryAccess(0x2000, 4))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
taintUnionMemoryImmediate(MemoryAccess(0x2000, 4))
self.assertTrue(isMemoryTainted(MemoryAccess(0x2000, 4)))
untaintMemory(MemoryAccess(0x2000, 4))
self.assertFalse(isMemoryTainted(MemoryAccess(0x2000, 4)))
def tainting(threadId):
rdi = getCurrentRegisterValue(Triton.registers.rdi) # argc
rsi = getCurrentRegisterValue(Triton.registers.rsi) # argv
while rdi > 1:
argv = getCurrentMemoryValue(rsi + ((rdi-1) * CPUSIZE.QWORD), CPUSIZE.QWORD)
offset = 0
while offset != STRLEN_ASSERT_LEN+5:
Triton.taintMemory(argv + offset)
concreteValue = getCurrentMemoryValue(argv + offset)
Triton.setConcreteMemoryValue(argv + offset, concreteValue)
Triton.convertMemoryToSymbolicVariable(MemoryAccess(argv + offset, CPUSIZE.BYTE))
offset += 1
print '[+] %03d bytes tainted from the argv[%d] (%#x) pointer' %(offset, rdi-1, argv)
rdi -= 1
return
def hookingHandler(ctx):
pc = ctx.getConcreteRegisterValue(ctx.registers.rip)
for rel in customRelocation:
if rel[2] == pc:
# Emulate the routine and the return value
ret_value = rel[1](ctx)
if ret_value is not None:
ctx.setConcreteRegisterValue(ctx.registers.rax, ret_value)
# Get the return address
ret_addr = ctx.getConcreteMemoryValue(MemoryAccess(ctx.getConcreteRegisterValue(ctx.registers.rsp), CPUSIZE.QWORD))
# Hijack RIP to skip the call
ctx.setConcreteRegisterValue(ctx.registers.rip, ret_addr)
# Restore RSP (simulate the ret)
ctx.setConcreteRegisterValue(ctx.registers.rsp, ctx.getConcreteRegisterValue(ctx.registers.rsp)+CPUSIZE.QWORD)
return
def test_taint_union_memory_immediate(self):
"""Check tainting union memory U immediate."""
Triton = TritonContext()
Triton.setArchitecture(ARCH.X86_64)
Triton.taintMemory(MemoryAccess(0x2000, 4))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 4)))
Triton.taintUnionMemoryImmediate(MemoryAccess(0x2000, 4))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 4)))
Triton.untaintMemory(MemoryAccess(0x2000, 4))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2000, 4)))
class TestMemory(unittest.TestCase):
"""Testing the MemoryAccess class."""
def setUp(self):
"""Define the architecture and memory access to check."""
setArchitecture(ARCH.X86_64)
self.mem = MemoryAccess(0x400f4d3, 8, 0x6162636465666768)
def test_address(self):
"""Check address data is correct."""
mem = MemoryAccess(0x1122334455667788, 8, 0x6162636465666768)
self.assertEqual(mem.getAddress(), 0x1122334455667788)
self.assertEqual(self.mem.getAddress(), 0x400f4d3)
def test_bit_size(self):
"""Check bit size of the accessed memory."""
self.assertEqual(self.mem.getBitSize(), 64)
def test_size(self):
"""Check size of the accessed memory."""
self.assertEqual(self.mem.getSize(), 8)
def test_type(self):
"""Check type of a memory access."""
self.assertEqual(self.mem.getType(), OPERAND.MEM)
def test_set_concrete_value(self):
"""Check memory is correctly set."""
self.mem.setConcreteValue(0x1000)
self.assertEqual(self.mem.getConcreteValue(), 0x1000)
self.assertEqual(self.mem.getSize(), 8)
def test_base_register(self):
"""Check base register modification."""
self.assertFalse(isRegisterValid(self.mem.getBaseRegister()))
self.mem.setBaseRegister(REG.RAX)
self.assertEqual(self.mem.getBaseRegister().getName(), "rax")
def test_index_register(self):
"""Check index register modification."""
self.assertFalse(isRegisterValid(self.mem.getIndexRegister()))
self.mem.setIndexRegister(REG.RCX)
self.assertEqual(self.mem.getIndexRegister().getName(), "rcx")
def test_segment_register(self):
"""Check segment register modification."""
self.assertFalse(isRegisterValid(self.mem.getSegmentRegister()))
self.mem.setSegmentRegister(REG.FS)
self.assertEqual(self.mem.getSegmentRegister().getName(), "fs")
def test_scale(self):
"""Check scale information."""
self.assertEqual(self.mem.getScale().getValue(), 0)
self.assertEqual(self.mem.getScale().getBitSize(), 1)
def test_displacement(self):
"""Check displacement information."""
self.assertEqual(self.mem.getDisplacement().getValue(), 0)
def test_ast_gen(self):
"""Check LeaAst."""
self.assertIsNone(self.mem.getLeaAst())
def test_overlaping(self):
"""Check overlaping."""
self.assertTrue(MemoryAccess(0x1000, 2).isOverlapWith(MemoryAccess(0x1001, 2)))
self.assertTrue(MemoryAccess(0xfff, 2).isOverlapWith(MemoryAccess(0x1000, 2)))
self.assertTrue(MemoryAccess(0x1000, 4).isOverlapWith(MemoryAccess(0x1003, 2)))
self.assertTrue(MemoryAccess(0x1000, 4).isOverlapWith(MemoryAccess(0x1002, 1)))
self.assertTrue(MemoryAccess(0x1002, 1).isOverlapWith(MemoryAccess(0x1000, 4)))
self.assertFalse(MemoryAccess(0x1000, 4).isOverlapWith(MemoryAccess(0x1004, 4)))
self.assertFalse(MemoryAccess(0x1000, 4).isOverlapWith(MemoryAccess(0x10000, 4)))
self.assertFalse(MemoryAccess(0x10000, 4).isOverlapWith(MemoryAccess(0x1000, 4)))
def test_address(self):
"""Check address data is correct."""
mem = MemoryAccess(0x1122334455667788, 8, 0x6162636465666768)
self.assertEqual(mem.getAddress(), 0x1122334455667788)
self.assertEqual(self.mem.getAddress(), 0x400f4d3)
def setUp(self):
"""Define the architecture and memory access to check."""
setArchitecture(ARCH.X86_64)
self.mem = MemoryAccess(0x400f4d3, 8, 0x6162636465666768)
def setUp(self):
"""Define the architecture and memory access to check."""
self.Triton = TritonContext()
self.Triton.setArchitecture(ARCH.X86_64)
self.mem = MemoryAccess(0x400f4d3, 8)