Ejemplo n.º 1
0
def freedom_search(language: Language, space, generate_rules_only=False,
                   distinct=False,
                   can_be_same=True):
    rules = set()
    names = language.all_card_names()
    all_vars = list(map(z3.Int, names))

    print(names)
    print(all_vars)

    for cut1 in tqdm(space(1)):
        for cut2 in space(2, cut1):
            for cut3 in space(3, cut1, cut2):
                for sequence in permutations(range(4)):
                    cuts = (cut1, cut2, cut3)
                    rule = freedom_of_spelling(all_vars, cuts, sequence, language, can_be_same)
                    rules.add(rule)

    if distinct:
        rules.add(Distinct(all_vars))
    else:
        for position in range(0, 52):
            at_starting_point = [card == position for card in all_vars]
            rule = AtMost(*at_starting_point, 1)
            rules.add(rule)

    rules.add(rules_all_cards_on_deck(all_vars))

    if generate_rules_only:
        return

    print(len(rules))

    s = Solver()
    s.set('smt.arith.random_initial_value', True)

    # random_seed (unsigned int) random seed (default: 0)
    s.set('random_seed', random.randint(0, 2 ** 8))

    # seed (unsigned int) random seed. (default: 0)
    s.set('seed', random.randint(0, 2 ** 8))

    s.add(rules)
    r = s.check()
    if r == unsat:
        print("no solution")
    elif r == unknown:
        print("failed to solve")
        try:
            print(s.reason_unknown())
            print(s.model())
        except Z3Exception:
            return
    else:
        print(s.model())
Ejemplo n.º 2
0
 def __init__(self, rand: random.Random, expr: z3.ExprRef, solver: z3.Solver):
     if self.condition_value is None:
         if not solver_is_sat(solver):
             debug('bad solver', solver.sexpr())
             raise CrosshairInternal('unexpected un sat')
         self.condition_value = solver.model().evaluate(expr, model_completion=True)
     WorstResultNode.__init__(self, rand, expr == self.condition_value, solver)
Ejemplo n.º 3
0
def main(known):
    s = Solver()
    matrix = [[Int(f"m{x}{y}") for x in range(1, 10)] for y in range(1, 10)]
    for i in range(9):
        for j in range(9):
            v = matrix[i][j]
            if known[i][j]:
                s.add(v == known[i][j])
            else:
                s.add(v >= 1)
                s.add(v <= 9)
    for i in range(9):
        s.add(Distinct(*[matrix[i][j] for j in range(9)]))
        s.add(Distinct(*[matrix[j][i] for j in range(9)]))
    for i in range(3):
        for j in range(3):
            s.add(
                Distinct(*[
                    matrix[3 * i + k][3 * j + l] for k in range(3)
                    for l in range(3)
                ]))
    s.check()
    m = s.model()
    print("Solution:")
    for i in range(9):
        print(*[m[matrix[i][j]] for j in range(9)])
Ejemplo n.º 4
0
def solve():
    start = time.time()
    s = Solver()
    s.reset()
    for req in conf.reqs:
        target = req[0]
        accessConstraint = req[1]

        requirementEncoding = encodeRequirement(target, accessConstraint)
        s.add(ForAll(template.getAttributeVars(), requirementEncoding))
    timeToTranslate = time.time() - start

    measurements.addToTranslationTime(timeToTranslate)

    start = time.time()
    solution = None
    if s.check() == sat:
        solution = {}
        model = s.model()
        for PEP in conf.PEPS:
            solution[PEP] = template.PEPPolicy(PEP, model)
    else:
        solution = unsat
    timeToSolve = time.time() - start
    measurements.addToSMTTime(timeToSolve)
    return solution
Ejemplo n.º 5
0
def collide(target_str, base_str, count=10, size_suffix=6, prefix=False):
    '''Generates a string with the following properties:
            * strcmp(res, base_str) = 0
            * H(res) == H(target_str)'''
    solver = Solver()

    if prefix:
        res = generate_ascii_printable_string(
            'res', size_suffix, solver) + str_to_BitVecVals8(base_str)
    else:
        res = str_to_BitVecVals8(base_str) + generate_ascii_printable_string(
            'res', size_suffix, solver)

    target_checksum = H(str_to_BitVecVals8(target_str))
    res_checksum = H(res)
    solver.add(res_checksum == target_checksum)

    for i in range(count):
        if solver.check() == sat:
            model = solver.model()

            if prefix:
                solution = "".join(
                    chr(model[x].as_long())
                    for x in res[:size_suffix]) + base_str
                solver.add(
                    [x != model[x].as_long() for x in res[:size_suffix]])
            else:
                solution = base_str + "".join(
                    chr(model[x].as_long()) for x in res[-size_suffix:])
                solver.add(
                    [x != model[x].as_long() for x in res[-size_suffix:]])

            yield solution
Ejemplo n.º 6
0
def collide(target_str, base_str, count = 10, size_suffix = 6, prefix = False):
    '''Generates a string with the following properties:
            * strcmp(res, base_str) = 0
            * H(res) == H(target_str)'''
    solver = Solver()
    
    if prefix:
        res = generate_ascii_printable_string('res', size_suffix, solver) + str_to_BitVecVals8(base_str)
    else:
        res = str_to_BitVecVals8(base_str) + generate_ascii_printable_string('res', size_suffix, solver)

    target_checksum = H(str_to_BitVecVals8(target_str))
    res_checksum = H(res)
    solver.add(res_checksum == target_checksum)
    
    for i in range(count):
        if solver.check() == sat:
            model = solver.model()
        
            if prefix:
                solution = "".join(chr(model[x].as_long()) for x in res[:size_suffix]) + base_str
                solver.add([x != model[x].as_long() for x in res[:size_suffix]])
            else:
                solution = base_str + "".join(chr(model[x].as_long()) for x in res[-size_suffix:])
                solver.add([x != model[x].as_long() for x in res[-size_suffix:]])
                
            yield solution
Ejemplo n.º 7
0
def check_adversarial_robustness_z3():
    from z3 import Reals, Int, Solver, If, And
    sk, sk_1, zk, zk_1 = Reals('sk sk_1 zk zk_1')
    i = Int('i')

    s = Solver()
    s.add(And(i >= 0, i <= 20, sk_1 >= 0, sk >= 0, zk >= 0, zk_1 >= 0))
    A = If(sk * 1 >= 0, sk * 1, 0)
    B = If(zk * 1 >= 0, zk * 1, 0)

    s.add(If(i == 0,
             And(sk >= 0, sk <= 3, zk >= 10, zk <= 21, sk_1 == 0, zk_1 == 0),
             sk - zk >= sk_1 - zk_1 + 21 / i))

    s.add(And(A < B, i == 20))
    # # we negate the condition, instead if for all sk condition we check if there exists sk not condition
    # s.add(sk_ReLU * w > ylim)

    t = s.check()
    if t == sat:
        print("z3 result:", s.model())
        return False
    else:
        # print("z3 result:", t)
        return True
Ejemplo n.º 8
0
def get_state(doubles, browser):
    if browser == "node":
        browser = "chrome"
    elif browser not in ("chrome", "firefox", "safari"):
        raise ValueError(f"invalid browser {browser}")
    if browser == "chrome":
        doubles = doubles[::-1]

    # from the doubles, generate known piece of the original uint64
    generated = [from_double(double, browser) for double in doubles]

    # setup symbolic state for xorshift128+
    ostate0, ostate1 = BitVecs("ostate0 ostate1", 64)
    sym_state0 = ostate0
    sym_state1 = ostate1
    solver = Solver()
    conditions = []

    # run symbolic xorshift128+ algorithm for three iterations
    # using the recovered numbers as constraints
    for val in generated:
        sym_state0, sym_state1, ret_conditions = sym_xs128p(
            solver, sym_state0, sym_state1, val, browser)
        conditions += ret_conditions
    if solver.check(conditions) == sat:
        # get a solved state
        m = solver.model()
        state0 = m[ostate0].as_long()
        state1 = m[ostate1].as_long()
        solver.add(Or(ostate0 != m[ostate0], ostate1 != m[ostate1]))
        if solver.check(conditions) == sat:
            print("WARNING: multiple solutions found! use more doubles!")
        return state0, state1
    else:
        raise ValueError("unsat model")
Ejemplo n.º 9
0
def solve(formulas):
    s = Solver()
    s.add(formulas)
    status = s.check();    print(status)
    if status == sat:
        m = s.model();     print(m)
        return m
Ejemplo n.º 10
0
def solve():    
    start = time.time()
    s = Solver()
    s.reset()
    for req in conf.reqs:
        target = req[0]
        accessConstraint = req[1]
             
        requirementEncoding = encodeRequirement(target, accessConstraint)  
        s.add(ForAll(template.getAttributeVars(), requirementEncoding))
    timeToTranslate = time.time() - start
    
    measurements.addToTranslationTime(timeToTranslate)
        
    start = time.time()
    solution = None
    if s.check() == sat:
        solution = {}        
        model = s.model()        
        for PEP in conf.PEPS:           
            solution[PEP] = template.PEPPolicy(PEP, model) 
    else:
        solution = unsat
    timeToSolve = time.time() - start
    measurements.addToSMTTime(timeToSolve)
    return solution
Ejemplo n.º 11
0
    def _z3_bounded_model_count(solver: z3.Solver, variables: List[z3.ExprRef],
                                u: int) -> Optional[int]:
        """
        If the solver assertions have less than u models that are distinct for the given variables it
        returns the exact model count, otherwise it returns None.
        :param solver:
        :param variables:
        :param u:
        """

        solver.push()

        for i in range(u):
            response = solver.check()

            if response == z3.unknown:
                solver.pop()
                raise RuntimeError("Solver responded with unknown")
            elif response == z3.unsat:
                solver.pop()
                return i

            # in the last iteration adding the constraint would be unnecessary, thus is skipped
            if i != u - 1:
                # add assertion that found model cannot be satisfying again
                m = solver.model()
                solver.add(z3.Or([x != m[x] for x in variables]))

        solver.pop()

        return None
Ejemplo n.º 12
0
 def z3_solve(self, n, timeout_amount):
     """ Integer factorization using z3 theorem prover implementation:
     We can factor composite integers by SAT solving the model N=PQ directly using the clasuse (n==p*q),
     wich gives a lot of degree of freedom to z3, so we want to contraint the search space.
     Since every composite number n=pq, there always exists some p>sqrt(n) and q<sqrt(n).
     We can safely asume the divisor p is in the range n > p >= next_prime(sqrt(n)) 
     if this later clause doesn't hold and sqrt(p) is prime the number is a perfect square.
     We can also asume that p and q are alyaws odd otherwise our whole composite is even.
     Not all composite numbers generate a valid model that z3 can SAT.
     SAT solving is efficient with low bit count set in the factors, 
     the complexity of the algorithm grows exponential with every bit set.
     The problem of SAT solving integer factorization still is NP complete,
     making this just a showcase. Don't expect big gains.
     """
     s = Solver()
     s.set("timeout", timeout_amount * 1000)
     p = Int("p")
     q = Int("q")
     i = int(isqrt(n))
     np = int(next_prime(i))
     s.add(p * q == n, n > p, n > q, p >= np, q < i, q > 1, p > 1,
           q % 2 != 0, p % 2 != 0)
     try:
         s_check_output = s.check()
         if s_check_output == sat:
             res = s.model()
             P, Q = res[p].as_long(), res[q].as_long()
             assert P * Q == n
             return P, Q
         else:
             return None, None
     except:
         return None, None
Ejemplo n.º 13
0
def sat_solve_prev(keystream, next, prev):
    """Find previous keystream by solving boolean satisfiability problem.

    Parameters
    ----------
    keystream : list of bool
        Current keystream converted to list of boolean representing binary
        values

    next : list of z3.BoolRef
        list containing bit triplet DNF constraints from the original next()

    prev :  list of z3.BoolRef
        list containing bool representation of the previous keystream, to be
        used as an index for Solver().model()

    Returns
    -------
    keystream : list of bool
        bool representation of keystream input from the previous call of next()

    """
    solver = Solver()
    for idx in range(N):
        # add next keystream bools as constraints
        solver.add(next[idx] == keystream[idx])
    # check() should be 'sat' because we know we can get back to seed with
    # these constraints, but we want to catch semantic errors just in case
    if solver.check() == unsat:
        raise Exception('Error in SAT DNF constraints')
    model = solver.model()
    # replace current keystream with solved previous values
    for idx in range(N):
        keystream[idx] = bool(model[prev[idx]])
    return keystream
Ejemplo n.º 14
0
    def solve(self, board, pieces, sum_requirements=[]):
        if len(pieces) == 0:
            return []

        solver = Solver()

        # Create z3 variables for each cell
        extended_board = [(row, column, value, Int(self.cell_name(row,
                                                                  column)))
                          for (row, column, value) in board]

        constraints = \
            self.set_prefilled_cell_values(extended_board) + \
            self.set_possible_target_cell_values(extended_board, pieces) + \
            self.require_unique_row_and_column_cells(extended_board) + \
            self.match_sum_requirements(extended_board, sum_requirements) + \
            self.target_cells_use_all_available_pieces(extended_board, pieces)

        for constraint in constraints:
            solver.add(constraint)

        if solver.check() == sat:
            model = solver.model()
            return [(row, column, model[cell].as_long())
                    for (row, column, value, cell) in extended_board
                    if self.is_cell_empty(value)]
        else:
            return False
Ejemplo n.º 15
0
def main():
    if len(sys.argv) != 2 or sys.argv[1] in ("-h", "help"):
        print("Usage:", sys.argv[0], "NONOGRAMM-FILE")
        exit(1)
    elif not os.path.isfile(sys.argv[1]):
        print("'{}' is not a valid file".format(sys.argv[1]))
        exit(1)

    nonogramm = Nonogramm.from_file(sys.argv[1])

    if nonogramm is None:
        print("'{}' doesn't contain a valid nonogramm".format(sys.argv[1]))
        exit(2)

    solver = Solver()

    print("Generating constraints ...")

    for constraint in nonogramm.gen_constraints():
        solver.add(simplify(constraint))

    print("Solving...")

    if solver.check() == sat:
        print("Solved:")
        nonogramm.print_grid(solver.model())
    else:
        print("Unsolvable!")
def check_unique_solution(pins, problem):
    s = Solver()
    s.add(problem)

    print(problem)

    if s.check() == z3.sat:
        print(s.model())

        s.add(Not(model_to_condition(pins, s.model())))
        if s.check() == z3.sat:
            print(s.model())
            print('Solution not unique!')
        else:
            print('Solution is unique!')
    else:
        print('Not solvable!')
Ejemplo n.º 17
0
def get_z3_result(query, debug=False) -> bool:
    s = Solver()

    s.add(query)
    if s.check() == sat:
        if debug:
            print(s, s.model())
        return True
    return False
Ejemplo n.º 18
0
def _solve(*args, **keywords):
    s = Solver()
    s.set(**keywords)
    s.add(*args)
    if keywords.get('show', False):
        print(s)
    r = s.check()
    if r == unsat:
        print("no solution")
    elif r == unknown:
        print("failed to solve")
        try:
            return s.model()
        except Z3Exception as e:
            print(e)
            return
    else:
        return s.model()
Ejemplo n.º 19
0
def fm(a: Formula, b: Formula, env: Environment, solver: z3.Solver,
       timer: Timer) -> Tuple[z3.CheckSatResult, Optional[z3.ModelRef]]:
    solver.push()
    solver.add(toZ3(a, env))
    solver.add(z3.Not(toZ3(b, env)))
    r = timer.solver_check(solver)
    m = solver.model() if r == z3.sat else None
    solver.pop()
    return (r, m)
Ejemplo n.º 20
0
def main():
    s = Solver()

    X = Int('X')
    Y = Int('Y')
    Z = Int('Z')

    # X, Y, Z: 1-9
    s.add(*[And(cur >= 1, cur <= 9) for cur in (X, Y, Z)])
    s.add(Distinct(X, Y, Z))

    given_number = as_number(X, Y, Z)
    reversed_number = as_number(Z, Y, X)

    high_min_low = symbolic_max(given_number, reversed_number) - symbolic_min(
        given_number, reversed_number)

    high_min_low_rev = as_number(digit_at_pos(high_min_low, 0),
                                 digit_at_pos(high_min_low, 1),
                                 digit_at_pos(high_min_low, 2))

    s.push()
    # Check that it always holds/there is no counterexample:
    total = high_min_low + high_min_low_rev
    s.add(total != 1089)
    res = s.check()

    if res.r == -1:
        print("unsat -> it holds. Example:")
        s.pop()
        s.add(total == 1089)
        s.check()

        mod = s.model()

        print(f"given number: {mod.eval(given_number)}")
        print(f"reversed: {mod.eval(reversed_number)}")
        print(
            f"highest - lowest: {mod.eval(high_min_low)}, reversed: {mod.eval(high_min_low_rev)}"
        )
        print(f"sums to: {mod.eval(total)}")
    else:
        print("sat.")
        print(s.model())
Ejemplo n.º 21
0
    def solve_z3(self):

        print("[+] {}".format("Sovling using Z3\n"))

        symbols = {e: Int(e) for e in self.elements}

        # first we build a solver with the general constraints for sudoku puzzles:
        s = Solver()

        # assure that every cell holds a value of [1,9]
        for symbol in symbols.values():
            s.add(Or([symbol == int(i) for i in self.cols]))

        # assure that every row covers every value:
        for row in "ABCDEFGHI":
            s.add(Distinct([symbols[row + col] for col in "123456789"]))

        # assure that every column covers every value:
        for col in "123456789":
            s.add(Distinct([symbols[row + col] for row in "ABCDEFGHI"]))

        # assure that every block covers every value:
        for i in range(3):
            for j in range(3):
                s.add(
                    Distinct([
                        symbols["ABCDEFGHI"[m + i * 3] +
                                "123456789"[n + j * 3]] for m in range(3)
                        for n in range(3)
                    ]))

        # adding sum constraints if provided
        if self.constraints is not None:
            print("[+] {}\n{}".format("Applying constraints",
                                      self.constraints))
            sum_constr = self.get_constraints()
            for c in sum_constr:
                expr = []

                for i in c[0]:
                    expr.append("symbols['" + i + "']")

                s.add(eval("+".join(expr) + "==" + str(c[1])))

        # now we put the assumptions of the given puzzle into the solver:
        for elem, value in self.values.items():
            if value in "123456789":
                s.add(symbols[elem] == value)

        if not s.check() == sat:
            raise Exception("Unsolvable")

        model = s.model()
        values = {e: model.evaluate(s).as_string() for e, s in symbols.items()}

        self.solution = values
Ejemplo n.º 22
0
 def test_sort_duplicates(self):
     lst_to_sort = [10, 9, 8, 7, 6, 10, 9, 8, 7, 6, 1]
     sorted_variables, assertions = sort_bubble(lst_to_sort)
     s = Solver()
     s.add(assertions)
     result = s.check()
     solution = s.model()
     sorted_integers = [solution[v].as_long() for v in sorted_variables]
     self.assertEqual(result, sat)
     self.assertEqual(sorted_integers, [1, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10])
def dd_solve_(dd, vr1s1, vr1s2, vr2s1, vr2s2, wavelength):
    sol = Solver()
    r1s1, r1s2, r2s1, r2s2 = Ints('r1s1 r1s2 r2s1 r2s2')
    err = Real('err')
    err1, err1, err3, err4 = Reals('err1 err2 err3 err4')
#    sol.add(err > 0)

    sol.add(r1s1 - r1s2 - r2s1 + r2s2 == dd)

    sol.add(ToReal(r1s1)*wavelength + err1 > vr1s1)
    sol.add(ToReal(r1s1)*wavelength - err1 < vr1s1)

    sol.add(ToReal(r1s2)*wavelength + err2 > vr1s2)
    sol.add(ToReal(r1s2)*wavelength - err2 < vr1s2)

    sol.add(ToReal(r2s1)*wavelength + err3 > vr2s1)
    sol.add(ToReal(r2s1)*wavelength - err3 < vr2s1)

    sol.add(ToReal(r2s2)*wavelength + err4 > vr2s2)
    sol.add(ToReal(r2s2)*wavelength - err4 < vr2s2)

    if sol.check() != sat:
        return None
    
    def minimize():
        # try to push the error lower, if possible
        for mult in [0.5, 0.85]:
            while sol.check() == sat:
                sol.push()
                sol.check()
                err_bound = frac_to_float(sol.model()[err])
                if err_bound < 0.2:
                    # not gonna do better than that...
                    return
                sol.add(err < err_bound*mult)
            sol.pop()
            sol.check()
    
    minimize()
    return (
        [sol.model()[r].as_long() for r in [r1s1, r1s2, r2s1, r2s2]],
        frac_to_float(sol.model()[err])
    )
Ejemplo n.º 24
0
 def __init__(self, rand: random.Random, expr: z3.ExprRef,
              solver: z3.Solver):
     if not solver_is_sat(solver):
         debug("Solver unexpectedly unsat; solver state:", solver.sexpr())
         raise CrosshairInternal("Unexpected unsat from solver")
     self.condition_value = solver.model().evaluate(expr,
                                                    model_completion=True)
     self._stats_key = f"realize_{expr}" if z3.is_const(expr) else None
     WorstResultNode.__init__(self, rand, expr == self.condition_value,
                              solver)
Ejemplo n.º 25
0
class MySolver(object):

    def __init__(self):
        self._solver = Solver()
        # TODO: Initialize datatypes here

    # TODO: Port the below functions to here as methods

    def push(self):
        """Push solver state."""
        self._solver.push()

    def pop(self):
        """Pop solver state."""
        self._solver.pop()

    def add(self, assertion):
        """Add an assertion to the solver state.

        Arguments:
            assertion : Z3-friendly predicate or boolean
        """
        return self._solver.add(assertion)

    def model(self):
        """Return a model for the current solver state.

        Returns:
            : Z3 model. TODO: Modify this all so that it returns sets, etc.
        """
        return self._solver.model()

    def check(self):
        """Check satisfiability of current satisfiability state.

        Returns:
            : boolean -- True if sat, False if unsat
        """
        # check() returns either unsat or sat
        # sat.r is 1, unsat.r is -1
        return self._solver.check().r > 0

    @contextmanager
    def context(self):
        """To do something in between a push and a pop, use a `with context()`."""
        self.push()
        yield
        self.pop()

    def quick_check(self, assertion):
        """Add an assertion only temporarily, and check sat."""
        with self.context():
            self.add(assertion)
            return self.check()
Ejemplo n.º 26
0
def all_solutions_point2(solver: z3.Solver,
                         fillet_center) -> typing.List[Point2]:
    solutions = []
    x, y = fillet_center
    while solver.check() == z3.sat:
        m = solver.model()
        solution = Point2(solution_as_float(m[x]), solution_as_float(m[y]))
        solutions.append(solution)
        solver.add((x - solution.x)**2 +
                   (y - solution.y)**2 > 10**(-PRECISION) * 100)
    return solutions
def print_solution(problem):
    print(problem)
    print(z3.simplify(problem))

    s = Solver()
    s.add(problem)
    if s.check() == z3.sat:
        m = s.model()
        print(m)
    else:
        print('unsat')
Ejemplo n.º 28
0
 def test_sort_no_duplicates(self):
     lst_to_sort = [10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0, -1, -2]
     sorted_variables, assertions = sort_no_duplicates(lst_to_sort)
     s = Solver()
     s.add(assertions)
     result = s.check()
     solution = s.model()
     sorted_integers = [solution[v].as_long() for v in sorted_variables]
     self.assertEqual(result, sat)
     self.assertEqual(sorted_integers,
                      [-2, -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10])
Ejemplo n.º 29
0
def get_model(constraints):
    s = Solver()
    s.set("timeout", 100000)

    for constraint in constraints:
        s.add(constraint)
    result = s.check()
    if result == sat:
        return s.model()
    elif result == unknown:
        logging.info("Timeout encountered while solving expression using z3")
    raise UnsatError
Ejemplo n.º 30
0
def test_concrete_calldata_calldatasize():
    # Arrange
    calldata = ConcreteCalldata(0, [1, 4, 7, 3, 7, 2, 9])
    solver = Solver()

    # Act
    solver.check()
    model = solver.model()
    result = model.eval(calldata.calldatasize)

    # Assert
    assert result == 7
Ejemplo n.º 31
0
def solve(formula):
    solver = Solver()
    solver.add(formula)
    # print(formula)
    result = solver.check()
    if str(result) == "sat":
        m = solver.model()
        if len(ST.alphabet) < 3 and ST.k < 3:
            for v in ST.var_list:
                print("{}: {}".format(v, m[v]))
    elif str(result) == "unsat":
        print("UNSAT")
Ejemplo n.º 32
0
def Password():
    from z3 import Int, Solver

    Buffer = Int('Buffer')
    v9 = Int('v9')
    v10 = Int('v10')
    v11 = Int('v11')
    v12 = Int('v12')
    v13 = Int('v13')
    v14 = Int('v14')
    v15 = Int('v15')
    v16 = Int('v16')
    v17 = Int('v17')

    s = Solver()

    s.add(v14 + v15 == 205)
    s.add(v13 + v16 == 201)
    s.add(v11 + v14 + v15 == 314)
    s.add(v13 + v16 + v12 + v17 == 367)
    s.add(Buffer + v9 == 194)
    s.add(v17 + v16 + v15 + v14 + v13 + v12 + v11 + v10 + v9 + Buffer == 923)
    s.add(v16 == 85)
    s.add(Buffer + v10 == 128)
    s.add(v12 - v15 == -50)
    s.add(v14 + v17 == 219)

    return "Status : %s \nPassword = %s" % (
        s.check(),
        chr(s.model()[Buffer].as_long()) + chr(s.model()[v9].as_long()) +
        chr(s.model()[v10].as_long()) + chr(s.model()[v11].as_long()) +
        chr(s.model()[v12].as_long()) + chr(s.model()[v13].as_long()) +
        chr(s.model()[v14].as_long()) + chr(s.model()[v15].as_long()) +
        chr(s.model()[v16].as_long()) + chr(s.model()[v17].as_long()))
Ejemplo n.º 33
0
def get_model(constraints):
    s = Solver()
    s.set("timeout", 2000)

    for constraint in constraints:
        s.add(constraint)

    if (s.check() == sat):

        return s.model()

    else:
        raise UnsatError
Ejemplo n.º 34
0
def is_tautology(formula) :
    """Check whether the formula is a tautology, and give a counterexample
    if it is not.
    
    Parameters
    ----------
    formula@Formula - The formula to be tested.
    
    Returns
    ----------
    check_res@bool - Whether the formula is a tautology.
    
    counterexample@Model - None if the formula is a tautology, otherwise a 
    counterexample.
    """
    s = Solver()
    s.add(Not(formula))
    if s.check() == unsat :
        return True, None
    return False, s.model()
Ejemplo n.º 35
0
def check_termination(trs, DEBUG=False):
	# create the variables we're solving for
	W = WeightFunction(trs.functions)
	P = Precedence(trs.functions)
	# create solver and constraints
	solver = Solver()
	if DEBUG: print("Solver created...")
	# constraint 1: weight constraints
	solver.assert_exprs(W[0] > 0)
	for f, arity in trs.functions.items():
		solver.assert_exprs(P[f] >= 0)
		if arity == 0:
			solver.assert_exprs(W[f] >= W[0])
		elif arity == 1:
			local_constraints = []
			for g in trs.functions.keys():
				local_constraints.append(P[f] >= P[g])
			solver.assert_exprs(Implies(W[f] == 0, And(local_constraints)))
	if DEBUG: print("Weight constraints asserted...")
	# constraint 2: kbo constraint per rule
	for lhs, rhs in trs.rules:
		solver.assert_exprs(kbo(lhs, rhs, trs, W, P))
		if DEBUG: print("Rule constraint asserted...")
	if DEBUG:
		for c in solver.assertions():
			print(c.sexpr())
		print("Starting z3...")
		start_time = clock()
	if solver.check() == unsat:
		if DEBUG: print("Done - z3 ran for {} seconds.".format(clock() - start_time))
		return None
	else:
		model = solver.model()
		weights, precedence = {}, {}
		for f in trs.functions.keys():
			weights[f] = model[W[f]].as_long()
			precedence[f] = model[P[f]].as_long()
		weights[0] = model[W[0]].as_long()
		if DEBUG: print("Done - z3 ran for {} seconds.".format(clock() - start_time))
		return weights, precedence
Ejemplo n.º 36
0
def get_models(F):
    result = []
    s = Solver()
    s.add(F)
    while True:
        if s.check() == sat:
            m = s.model()
            result.append(m)
            # Create a new constraint the blocks the current model
            block = []
            for d in m:
                # d is a declaration
                if d.arity() > 0:
                    raise Z3Exception(
                        "uninterpreted functions are not suppported")
                # create a constant from declaration
                c = d()
                if is_array(c) or c.sort().kind() == Z3_UNINTERPRETED_SORT:
                    raise Z3Exception(
                        "arrays and uninterpreted sorts are not supported")
                block.append(c != m[d])
            s.add(Or(block))
        else:
            return result
Ejemplo n.º 37
0
solver.add(IsKinase(MEK1))
solver.add(IsKinase(ERK1))
solver.add(IsKinase(RAF))
solver.add(Not(IsKinase(HRAS)))

solver.add(Phosphorylates(MEK1, ERK1))
solver.add(Phosphorylates(RAF, MEK1))

solver.add(IsActiveWhenPhosphorylated(MEK1))
solver.add(IsActiveWhenPhosphorylated(ERK1))
solver.add(IsActiveWhenPhosphorylated(SAF1))

### SOLVING THE MODEL

solver.check()
model = solver.model()
print model


### QUERIES

def is_valid(predicate):
    solver.push()
    solver.add(Not(predicate))
    response = solver.check().r
    solver.pop()
    if response > 0:
        return False
    return True

def is_sat(predicate):
Ejemplo n.º 38
0
def Synthesize(spec, specInputPorts, specConn, circuits):
    wellFormedConstraints = [Bool(True)]

    for circuit in circuits:
        wellFormedConstraints.append(circuit.GenerateWellFormednessConstraints())

    wellFormedConstraints.append(GenerateCircuitSimilarityConstraints(circuits))

    psiWfp = And(wellFormedConstraints)

    psiConn = And([circuit.GenerateConnectionConstraints() for circuit in circuits])
    #if logger.IsLogging(): print psiConn

    examples = []

    iterCounter = 0
    synthSolver = Solver()
    verifSolver = Solver()

    synthSolver.assert_exprs(psiWfp)
    synthSolver.assert_exprs(GenerateConstraintForExample(spec, specConn, circuits, 
        psiConn, {}, iterCounter))

    while True:
        iterCounter+=1
        if logger.IsLogging(): print 'Attempting Synthesis...'

        if synthSolver.check() == unsat:
            if logger.IsLogging(): print 'Synth Failed!'
            return False

        model = synthSolver.model()
        if logger.IsLogging(): print 'Synthesized program:\n'

        if logger.IsLogging():
            for circuit in circuits:
                print circuit.funcName
                print circuit.LValToProg(model)
                print '\n'

        verifConstraint = GenerateVerificationConstraint(spec, specConn, 
            circuits, psiConn, model)

        verifSolver.push()
        verifSolver.assert_exprs(verifConstraint)

        if logger.IsLogging(): print 'Attempting Verification...'
        #if logger.IsLogging(): print verifConstraint
        #raw_input("waiting for keypress")
        if (verifSolver.check() == unsat):
            if logger.IsLogging(): print 'Verification succeeded!\n'
            verifSolver.pop()
            if logger.IsLogging(): print 'Took %d iterations to '\
            'complete synthesis' % (iterCounter)
            if logger.IsLogging(): print 'Final Circuits:\n'
            printedCircuits = []
            for circuit in circuits:
                if not circuit.funcName in printedCircuits:
                    print circuit.GenerateCircuitExpression(model)
                printedCircuits.append(circuit.funcName)
            return True


        if logger.IsLogging(): print 'Verification Failed!\n'
        newExample = GetExampleFromInputModel(verifSolver.model(), specInputPorts)
        verifSolver.pop()
        examples.append(newExample)

        synthConstraintForExample = GenerateConstraintForExample(spec, specConn,
            circuits, psiConn, newExample, iterCounter)

        synthSolver.assert_exprs(synthConstraintForExample)

        if logger.IsLogging(): print 'Added Example %d:' % iterCounter
        if logger.IsLogging(): print newExample
Ejemplo n.º 39
0
	def synthesize_with_components(self, components, constraint, system):
		# components maps unique comp_ids to component objects
		# not one-to-one, but def. onto
		# step 0: some useful values
		card_I, N = len(self.synth_function.parameters), len(components)
		# step 1: make some solvers
		synth_solver = Solver()
		verify_solver = Solver()
		# step 2: initialize examples
		S = []
		# step 2b: create location variables and location constraints
		initial_constraints = []
		L = create_location_variables(components)
		if system:
			patterns = create_pattern_constraints(L, components, system)
			initial_constraints.append(patterns)
		wfp = create_wfp_constraint(L, N)
		initial_constraints.append(wfp)
		# step 3: looooooooop
		while True:
			# step 4: assert L constraint
			synth_solver.assert_exprs(*initial_constraints)
			# step 5: start the looooop
			for i, X in enumerate(S):
				I, O, T = [], [], []
				for w in range(constraint.width):
					# step 6: create I, O, T for synth at width i
					I_w = create_input_variables(self.synth_function.parameters, i, w)
					O_w = create_output_variables(self.synth_function.output, i, w)
					T_w = create_temp_variables(components, i, w)
					# step 7: assert library and connection constraints
					lib = create_lib_constraint(T_w, I_w, components)
					# for conn constraint, need map from component_id to l value
					locations = create_location_map(O_w, T_w, L, N)
					conn = create_conn_constraint(O_w, T_w, locations)
					synth_solver.assert_exprs(lib, conn)
					I += I_w
					O += O_w
					T += T_w
				# step 8: once we've got all the I, O, we can assert the spec constraint
				conn_spec, spec = create_spec_constraint(I, O, X, constraint)
				synth_solver.assert_exprs(conn_spec, spec)
			# get a model, or just bail
			if synth_solver.check() == unsat:
				if DEBUG: print("Failed to find a model.")
				return None
			model = synth_solver.model()
			curr_l = [l._replace(value=model[l.value]) for l in L]

			# step 9: need to verify the model we just found, so we'll construct verificatio constraint
			I, O, T = [], [], []
			for w in range(constraint.width):
				# same as above, but we only have a single example
				I_w = create_input_variables(self.synth_function.parameters, 0, w)
				O_w = create_output_variables(self.synth_function.output, 0, w)
				T_w = create_temp_variables(components, 0, w)
				lib = create_lib_constraint(T_w, I_w, components)
				locations = create_location_map(O_w, T_w, curr_l, N)
				conn = create_conn_constraint(O_w, T_w, locations)
				verify_solver.assert_exprs(lib, conn)
				I += I_w
				O += O_w
				T += T_w
			# now we need to create variables for X so we can check our spec
			X = create_spec_variables(constraint, self.variables)
			conn_spec, spec = create_spec_constraint(I, O, X, constraint)
			verify_solver.assert_exprs(conn_spec, Not(spec))
			# now we'll try and get a model of our exectution
			if verify_solver.check() == unsat:
				return curr_l
			model = verify_solver.model()
			example = [x._replace(value=model[x.value]) for x in X]
			S.append(example)
			if DEBUG:
				print("Found bad solution: ", [l.value.sexpr() for l in curr_l])
			# clear synthesizers and start anew
			synth_solver.reset()
			verify_solver.reset()
		return None
Ejemplo n.º 40
0
def exploit(t):
    target = lambda: remote(t['hostname'], t['port'], timeout=3)

    try:
        with target() as s:
            n_inputs = int(s.recvline().strip())
            for _ in range(n_inputs):
                inp = s.recvline().strip()
                c1, c2, c3 = solve_for(inp)
                s.sendline('{} {} {}'.format(c1, c2, c3))

            s.recvuntil("want?:")
            s.send("2\n3\n19\n"+t['flag_id']+"\n16\n"+"A"*16+"\n0\n")
            s.recvuntil("GameTime:")
            v19_c, v20_c, x_c, v22_c, v23_c, y_c = map(int, s.recv().split(', '))
            solv = Solver()
            v18 = Int('v18')
            v21 = Int('v21')
            v19 = Int('v19')
            solv.add(v19 == v19_c)
            v20 = Int('v20')
            solv.add(v20 == v20_c)
            v22 = Int('v22')
            solv.add(v22 == v22_c)
            v23 = Int('v23')
            solv.add(v23 == v23_c)
            x = Int('x')
            solv.add(x == x_c)
            solv.add(x == v19*v18 + v20*v21)
            y = Int('y')
            solv.add(y == y_c)
            solv.add(y == v22*v18 + v21*v23)

            solv.check()
            solv.model()

            s.sendline(str(solv.model()[v18].as_long()))
            s.sendline(str(solv.model()[v21].as_long()))
            s.recvuntil("log:")
            s.send("15\n:83xkHFchNObsWf\n")
            s.recvuntil("):")
            s.sendline("478175")
            s.recvuntil("Name:")
            magic = s.recvuntil(":")[:-1]

        with target() as s:
            n_inputs = int(s.recvline().strip())
            for _ in range(n_inputs):
                inp = s.recvline().strip()
                c1, c2, c3 = solve_for(inp)
                s.sendline('{} {} {}'.format(c1, c2, c3))

            s.recvuntil("want?:")
            s.send("2\n5\n19\n"+t['flag_id']+"\n16\n"+magic+"\n")
            s.recvline()
            flag = s.recvline().strip()

        return flag

    except:
        return
Ejemplo n.º 41
0
class ACL22SMT(object):
    class status:
        def __init__(self, value):
            self.value = value

            def __str__(self):
                if self.value is True:
                    return "QED"
                elif self.value.__class__ == "msg".__class__:
                    return self.value
                else:
                    raise Exception("unknown status?")

                def isThm(self):
                    return self.value is True

    class atom:  # added my mrg, 21 May 2015
        def __init__(self, string):
            self.who_am_i = string.lower()

        def __eq__(self, other):
            return self.who_am_i == other.who_am_i

        def __ne__(self, other):
            return self.who_am_i != other.who_am_i

        def __str__(self):
            return self.who_am_i

    def __init__(self, solver=0):
        if solver != 0:
            self.solver = solver
        else:
            self.solver = Solver()
        self.nameNumber = 0

    def newVar(self):
        varName = "$" + str(self.nameNumber)
        self.nameNumber = self.nameNumber + 1
        return varName

    def isBool(self, who):
        return Bool(who)

    def isInt(self, who):
        return Int(who)

    def isReal(self, who):
        return Real(who)

    def plus(self, *args):
        return reduce(lambda x, y: x + y, args)

    def times(self, *args):
        return reduce(lambda x, y: x * y, args)

    def reciprocal(self, x):
        if type(x) is int:
            return Q(1, x)
        elif type(x) is float:
            return 1.0 / x
        else:
            return 1.0 / x

    def negate(self, x):
        return -x

    def lt(self, x, y):
        return x < y

    def equal(self, x, y):
        return x == y

    def notx(self, x):
        return Not(x)

    def implies(self, x, y):
        return Implies(x, y)

    def Qx(self, x, y):
        return Q(x, y)

    # type related functions
    def integerp(self, x):
        return sort(x) == IntSort()

    def rationalp(self, x):
        return sort(x) == RealSort()

    def booleanp(self, x):
        return sort(x) == BoolSort()

    def ifx(self, condx, thenx, elsex):
        return If(condx, thenx, elsex)

    # usage prove(claim) or prove(hypotheses, conclusion)
    def prove(self, hypotheses, conclusion=0):
        if conclusion is 0:
            claim = hypotheses
        else:
            claim = Implies(hypotheses, conclusion)

        self.solver.push()
        self.solver.add(Not(claim))
        res = self.solver.check()

        if res == unsat:
            print "proved"
            return self.status(True)  # It's a theorem
        elif res == sat:
            print "counterexample"
            m = self.solver.model()
            print m
            # return an counterexample??
            return self.status(False)
        else:
            print "failed to prove"
            r = self.status(False)

        self.solver.pop()
        return r
Ejemplo n.º 42
0
    def __call__(self, project, test, dump):
        logger.info('inferring specification for test \'{}\''.format(test))

        environment = dict(os.environ)
        if self.config['klee_max_forks'] is not None:
            environment['ANGELIX_KLEE_MAX_FORKS'] = str(self.config['klee_max_forks'])
        if self.config['klee_max_depth'] is not None:
            environment['ANGELIX_KLEE_MAX_DEPTH'] = str(self.config['klee_max_depth'])
        if self.config['klee_search'] is not None:
            environment['ANGELIX_KLEE_SEARCH'] = self.config['klee_search']
        if self.config['klee_timeout'] is not None:
            environment['ANGELIX_KLEE_MAX_TIME'] = str(self.config['klee_timeout'])
        if self.config['klee_solver_timeout'] is not None:
            environment['ANGELIX_KLEE_MAX_SOLVER_TIME'] = str(self.config['klee_solver_timeout'])
        if self.config['klee_debug']:
            environment['ANGELIX_KLEE_DEBUG'] = 'YES'
        if self.config['klee_ignore_errors']:
            environment['KLEE_DISABLE_MEMORY_ERROR'] = 'YES'
        if self.config['use_semfix_syn']:
            environment['ANGELIX_USE_SEMFIX_SYN'] = 'YES'
        environment['ANGELIX_KLEE_WORKDIR'] = project.dir

        test_dir = self.get_test_dir(test)
        shutil.rmtree(test_dir, ignore_errors='true')
        klee_dir = join(test_dir, 'klee')
        os.makedirs(klee_dir)

        self.run_test(project, test, klee=True, env=environment)

        # loading dump

        # name -> value list
        oracle = dict()

        vars = os.listdir(dump)
        for var in vars:
            instances = os.listdir(join(dump, var))
            for i in range(0, len(instances)):
                if str(i) not in instances:
                    logger.error('corrupted dump for test \'{}\''.format(test))
                    raise InferenceError()
            oracle[var] = []
            for i in range(0, len(instances)):
                file = join(dump, var, str(i))
                with open(file) as f:
                    content = f.read()
                oracle[var].append(content)

        # solving path constraints

        angelic_paths = []

        solver = Solver()

        smt_glob = join(project.dir, 'klee-out-0', '*.smt2')
        smt_files = glob(smt_glob)
        for smt in smt_files:
            logger.info('solving path {}'.format(relpath(smt)))

            try:
                path = z3.parse_smt2_file(smt)
            except:
                logger.warning('failed to parse {}'.format(smt))
                continue

            variables = [str(var) for var in get_vars(path)
                         if str(var).startswith('int!')
                         or str(var).startswith('bool!')
                         or str(var).startswith('char!')
                         or str(var).startswith('reachable!')]

            outputs, choices, constants, reachable, original_available = parse_variables(variables)

            # name -> value list (parsed)
            oracle_constraints = dict()

            def str_to_int(s):
                return int(s)

            def str_to_bool(s):
                if s == 'false':
                    return False
                if s == 'true':
                    return True
                raise InferenceError()

            def str_to_char(s):
                if len(s) != 1:
                    raise InferenceError()
                return s[0]

            dump_parser_by_type = dict()
            dump_parser_by_type['int'] = str_to_int
            dump_parser_by_type['bool'] = str_to_bool
            dump_parser_by_type['char'] = str_to_char

            def bool_to_bv32(b):
                if b:
                    return BitVecVal(1, 32)
                else:
                    return BitVecVal(0, 32)

            def int_to_bv32(i):
                return BitVecVal(i, 32)

            to_bv32_converter_by_type = dict()
            to_bv32_converter_by_type['bool'] = bool_to_bv32
            to_bv32_converter_by_type['int'] = int_to_bv32

            def bv32_to_bool(bv):
                return bv.as_long() != 0

            def bv32_to_int(bv):
                l = bv.as_long()
                if l >> 31 == 1:  # negative
                    l -= 4294967296
                return l

            from_bv32_converter_by_type = dict()
            from_bv32_converter_by_type['bool'] = bv32_to_bool
            from_bv32_converter_by_type['int'] = bv32_to_int

            matching_path = True

            for expected_variable, expected_values in oracle.items():
                if expected_variable == 'reachable':
                    expected_reachable = set(expected_values)
                    if not (expected_reachable == reachable):
                        logger.info('labels \'{}\' executed while {} required'.format(
                            list(reachable),
                            list(expected_reachable)))
                        matching_path = False
                        break
                    continue
                if expected_variable not in outputs.keys():
                    outputs[expected_variable] = (None, 0)  # unconstraint does not mean wrong
                required_executions = len(expected_values)
                actual_executions = outputs[expected_variable][1]
                if required_executions != actual_executions:
                    logger.info('value \'{}\' executed {} times while {} required'.format(
                        expected_variable,
                        actual_executions,
                        required_executions))
                    matching_path = False
                    break
                oracle_constraints[expected_variable] = []
                for i in range(0, required_executions):
                    type = outputs[expected_variable][0]
                    try:
                        value = dump_parser_by_type[type](expected_values[i])
                    except:
                        logger.error('variable \'{}\' has incompatible type {}'.format(expected_variable,
                                                                                       type))
                        raise InferenceError()
                    oracle_constraints[expected_variable].append(value)

            if not matching_path:
                continue

            solver.reset()
            solver.add(path)

            def array_to_bv32(array):
                return Concat(Select(array, BitVecVal(3, 32)),
                              Select(array, BitVecVal(2, 32)),
                              Select(array, BitVecVal(1, 32)),
                              Select(array, BitVecVal(0, 32)))

            def angelic_selector(expr, instance):
                s = 'angelic!{}!{}!{}!{}!{}'.format(expr[0], expr[1], expr[2], expr[3], instance)
                return BitVec(s, 32)

            def original_selector(expr, instance):
                s = 'original!{}!{}!{}!{}!{}'.format(expr[0], expr[1], expr[2], expr[3], instance)
                return BitVec(s, 32)

            def env_selector(expr, instance, name):
                s = 'env!{}!{}!{}!{}!{}!{}'.format(name, expr[0], expr[1], expr[2], expr[3], instance)
                return BitVec(s, 32)

            for name, values in oracle_constraints.items():
                type, _ = outputs[name]
                for i, value in enumerate(values):
                    array = self.output_variable(type, name, i)
                    bv_value = to_bv32_converter_by_type[type](value)
                    solver.add(bv_value == array_to_bv32(array))

            for (expr, item) in choices.items():
                type, instances, env = item
                for instance in range(0, instances):
                    selector = angelic_selector(expr, instance)
                    array = self.angelic_variable(type, expr, instance)
                    solver.add(selector == array_to_bv32(array))

                    selector = original_selector(expr, instance)
                    array = self.original_variable(type, expr, instance)
                    solver.add(selector == array_to_bv32(array))

                    for name in env:
                        selector = env_selector(expr, instance, name)
                        env_type = 'int' #FIXME
                        array = self.env_variable(env_type, expr, instance, name)
                        solver.add(selector == array_to_bv32(array))

            result = solver.check()
            if result != z3.sat:
                logger.info('UNSAT')
                continue
            model = solver.model()

            # store smt2 files
            shutil.copy(smt, klee_dir)

            # generate IO file
            self.generate_IO_file(test, choices, oracle_constraints, outputs)

            # expr -> (angelic * original * env) list
            angelic_path = dict()

            for (expr, item) in choices.items():
                angelic_path[expr] = []
                type, instances, env = item
                for instance in range(0, instances):
                    bv_angelic = model[angelic_selector(expr, instance)]
                    angelic = from_bv32_converter_by_type[type](bv_angelic)
                    bv_original = model[original_selector(expr, instance)]
                    original = from_bv32_converter_by_type[type](bv_original)
                    if original_available:
                        logger.info('expression {}[{}]: angelic = {}, original = {}'.format(expr,
                                                                                            instance,
                                                                                            angelic,
                                                                                            original))
                    else:
                        logger.info('expression {}[{}]: angelic = {}'.format(expr,
                                                                             instance,
                                                                             angelic))
                    env_values = dict()
                    for name in env:
                        bv_env = model[env_selector(expr, instance, name)]
                        value = from_bv32_converter_by_type['int'](bv_env)
                        env_values[name] = value

                    if original_available:
                        angelic_path[expr].append((angelic, original, env_values))
                    else:
                        angelic_path[expr].append((angelic, None, env_values))

            # TODO: add constants to angelic path

            angelic_paths.append(angelic_path)

        # update IO files
        for smt in glob(join(klee_dir, '*.smt2')):
            with open(smt) as f_smt:
                for line in f_smt.readlines():
                    if re.search("declare-fun [a-z]+!output!", line):
                        output_var = line.split(' ')[1]
                        output_var_type = output_var.split('!')[0]
                        for io_file in glob(join(test_dir, '*.IO')):
                            if not output_var in open(io_file).read():
                                with open(io_file, "a") as f_io:
                                    f_io.write("\n")
                                    f_io.write("@output\n")
                                    f_io.write('name {}\n'.format(output_var))
                                    f_io.write('type {}\n'.format(output_var_type))


        if self.config['max_angelic_paths'] is not None and \
           len(angelic_paths) > self.config['max_angelic_paths']:
            angelic_paths = self._reduce_angelic_forest(angelic_paths)
        else:
            logger.info('found {} angelic paths for test \'{}\''.format(len(angelic_paths), test))

        return angelic_paths
Ejemplo n.º 43
0
q2x = p1[0]+t2*(p2[0]-p1[0])
q2y = p1[1]+t2*(p2[1]-p1[1])

q3x = p2[0]+t3*(p3[0]-p2[0])
q3y = p2[1]+t3*(p3[1]-p2[1])

q4x = p3[0]+t4*(p4[0]-p3[0])
q4y = p3[1]+t4*(p4[1]-p3[1])

solver = Solver()

solver.add(t1 >= 0, t2 >= 0, t3 >= 0, t4 >= 0)
solver.add(t1 <= 1, t2 <= 1, t3 <= 1, t4 <= 1)


def orthogonal(px, py, qx, qy, rx, ry):
    return (px-qx)*(rx-qx)+(py-qy)*(ry-qy) == 0

solver.add(orthogonal(q1x, q1y, q2x, q2y, q3x, q3y))
solver.add(orthogonal(q2x, q2y, q3x, q4y, q4x, q4y))
solver.add(orthogonal(q3x, q3y, q4x, q4y, q1x, q1y))
solver.add(orthogonal(q4x, q4y, q1x, q1y, q2x, q2y))
solver.add((q2x-q1x)**2+(q2y-q1y)**2 == (q4x-q3x)**2+(q4y-q3y)**2)
solver.add((q3x-q2x)**2+(q3y-q2y)**2 == (q4x-q1x)**2+(q4y-q1y)**2)
solver.add()


solver.check()
print(solver.model())
Ejemplo n.º 44
0
from z3 import Solver, BitVec

s = Solver()
x = BitVec('x', 32)

s.add(x > 1337)
s.add(x*7 + 4 == 1337)

s.check()
print s.model()
Ejemplo n.º 45
0
from z3 import Real, Solver


s = Solver()
x = Real('x')

s.add((x * 3.0 + 18.0) == (x * 12.56637061435917))

print s.check()
print s.model()

print s.model()[x].as_decimal(10)
Ejemplo n.º 46
0
s = Solver()

s.add(dword_3 + dword_2 == 0x0C0DCDFCE)
s.add(dword_3 + dword_2 == 0x0C0DCDFCE)
s.add(dword_2 + dword_1 == 0x0D5D3DDDC)
s.add((dword_2 * 5) + (dword_1 * 3) == 0x404A7666)
s.add((dword_4 ^ dword_1) == 0x18030607)
s.add((dword_1 & dword_4) == 0x666C6970)
s.add(dword_2 * dword_5 == 0xB180902B)
s.add(dword_5 * dword_3 == 0x3E436B5F)
s.add(dword_5 + (dword_6 * 2) == 0x5C483831)
s.add((dword_6 & 0x70000000) == 0x70000000)
s.add(dword_6 / dword_7 == 1)
s.add(dword_6 % dword_7 == 0x0E000CEC)
s.add((dword_5 * 3) + (dword_8 * 2) == 0x3726EB17)
s.add((dword_8 * 7) + (dword_3 * 4) == 0x8B0B922D)
s.add((dword_8 * 3) + dword_4 == 0xB9CF9C91)

s.check()
m = s.model() 

dword_map = {}

for d in m.decls():
	dword_map[d.name()] = m[d].as_signed_long()

for key in sorted(dword_map):
	print_dword(dword_map[key])

print ""
Ejemplo n.º 47
0
    def __call__(self, project, test, dump, validation_project):
        logger.info('inferring specification for test \'{}\''.format(test))

        environment = dict(os.environ)
        if self.config['klee_max_forks'] is not None:
            environment['ANGELIX_KLEE_MAX_FORKS'] = str(self.config['klee_max_forks'])
        if self.config['klee_max_depth'] is not None:
            environment['ANGELIX_KLEE_MAX_DEPTH'] = str(self.config['klee_max_depth'])
        if self.config['klee_search'] is not None:
            environment['ANGELIX_KLEE_SEARCH'] = self.config['klee_search']
        if self.config['klee_timeout'] is not None:
            environment['ANGELIX_KLEE_MAX_TIME'] = str(self.config['klee_timeout'])
        if self.config['klee_solver_timeout'] is not None:
            environment['ANGELIX_KLEE_MAX_SOLVER_TIME'] = str(self.config['klee_solver_timeout'])
        if self.config['klee_debug']:
            environment['ANGELIX_KLEE_DEBUG'] = 'YES'
        if self.config['klee_ignore_errors']:
            environment['KLEE_DISABLE_MEMORY_ERROR'] = 'YES'
        if self.config['use_semfix_syn']:
            environment['ANGELIX_USE_SEMFIX_SYN'] = 'YES'
        environment['ANGELIX_KLEE_WORKDIR'] = project.dir

        klee_start_time = time.time()
        self.run_test(project, test, klee=True, env=environment)
        klee_end_time = time.time()
        klee_elapsed = klee_end_time - klee_start_time
        statistics.data['time']['klee'] += klee_elapsed
        statistics.save()

        logger.info('sleeping for 1 second...')
        time.sleep(1)

        smt_glob = join(project.dir, 'klee-out-0', '*.smt2')
        smt_files = glob(smt_glob)

        err_glob = join(project.dir, 'klee-out-0', '*.err')
        err_files = glob(err_glob)

        err_list = []
        for err in err_files:
            err_list.append(os.path.basename(err).split('.')[0])

        non_error_smt_files = []
        for smt in smt_files:
            smt_id = os.path.basename(smt).split('.')[0]
            if not smt_id in err_list:
                non_error_smt_files.append(smt)

        if not self.config['ignore_infer_errors']:
            smt_files = non_error_smt_files

        if len(smt_files) == 0 and len(err_list) == 0:
            logger.warning('No paths explored')
            raise NoSmtError()

        if len(smt_files) == 0:
            logger.warning('No non-error paths explored')
            raise NoSmtError()

        # loading dump

        # name -> value list
        oracle = dict()

        vars = os.listdir(dump)
        for var in vars:
            instances = os.listdir(join(dump, var))
            for i in range(0, len(instances)):
                if str(i) not in instances:
                    logger.error('corrupted dump for test \'{}\''.format(test))
                    raise InferenceError()
            oracle[var] = []
            for i in range(0, len(instances)):
                file = join(dump, var, str(i))
                with open(file) as f:
                    content = f.read()
                oracle[var].append(content)

        # solving path constraints
        inference_start_time = time.time()

        angelic_paths = []

        z3.set_param("timeout", self.config['path_solving_timeout'])

        solver = Solver()

        for smt in smt_files:
            logger.info('solving path {}'.format(relpath(smt)))

            try:
                path = z3.parse_smt2_file(smt)
            except:
                logger.warning('failed to parse {}'.format(smt))
                continue

            variables = [str(var) for var in get_vars(path)
                         if str(var).startswith('int!')
                         or str(var).startswith('long!')
                         or str(var).startswith('bool!')
                         or str(var).startswith('char!')
                         or str(var).startswith('reachable!')]

            try:
                outputs, choices, constants, reachable, original_available = parse_variables(variables)
            except:
                continue

            # name -> value list (parsed)
            oracle_constraints = dict()

            def str_to_int(s):
                return int(s)

            def str_to_long(s):
                return int(s)

            def str_to_bool(s):
                if s == 'false':
                    return False
                if s == 'true':
                    return True
                raise InferenceError()

            def str_to_char(s):
                if len(s) != 1:
                    raise InferenceError()
                return s[0]

            dump_parser_by_type = dict()
            dump_parser_by_type['int'] = str_to_int
            dump_parser_by_type['long'] = str_to_long
            dump_parser_by_type['bool'] = str_to_bool
            dump_parser_by_type['char'] = str_to_char

            def bool_to_bv(b):
                if b:
                    return BitVecVal(1, 32)
                else:
                    return BitVecVal(0, 32)

            def int_to_bv(i):
                return BitVecVal(i, 32)
            
            def long_to_bv(i):
                return BitVecVal(i, 64)

            def char_to_bv(c):
                return BitVecVal(ord(c), 32)

            to_bv_converter_by_type = dict()
            to_bv_converter_by_type['bool'] = bool_to_bv
            to_bv_converter_by_type['int'] = int_to_bv
            to_bv_converter_by_type['long'] = long_to_bv
            to_bv_converter_by_type['char'] = char_to_bv
            
            def bv_to_bool(bv):
                return bv.as_long() != 0

            def bv_to_int(bv):
                l = bv.as_long()
                if l >> 31 == 1:  # negative
                    l -= pow(2, 32)
                return l

            def bv_to_long(bv):
                l = bv.as_long()
                if l >> 63 == 1:  # negative
                    l -= pow(2, 64)
                return l

            def bv_to_char(bv):
                l = bv.as_long()
                return chr(l)

            from_bv_converter_by_type = dict()
            from_bv_converter_by_type['bool'] = bv_to_bool
            from_bv_converter_by_type['int'] = bv_to_int
            from_bv_converter_by_type['long'] = bv_to_long
            from_bv_converter_by_type['char'] = bv_to_char

            matching_path = True

            for expected_variable, expected_values in oracle.items():
                if expected_variable == 'reachable':
                    expected_reachable = set(expected_values)
                    if not (expected_reachable == reachable):
                        logger.info('labels \'{}\' executed while {} required'.format(
                            list(reachable),
                            list(expected_reachable)))
                        matching_path = False
                        break
                    continue
                if expected_variable not in outputs.keys():
                    outputs[expected_variable] = (None, 0)  # unconstraint does not mean wrong
                required_executions = len(expected_values)
                actual_executions = outputs[expected_variable][1]
                if required_executions != actual_executions:
                    logger.info('value \'{}\' executed {} times while {} required'.format(
                        expected_variable,
                        actual_executions,
                        required_executions))
                    matching_path = False
                    break
                oracle_constraints[expected_variable] = []
                for i in range(0, required_executions):
                    type = outputs[expected_variable][0]
                    try:
                        value = dump_parser_by_type[type](expected_values[i])
                    except:
                        logger.error('variable \'{}\' has incompatible type {}'.format(expected_variable,
                                                                                       type))
                        raise InferenceError()
                    oracle_constraints[expected_variable].append(value)

            if not matching_path:
                continue

            solver.reset()
            solver.add(path)

            def array_to_bv32(array):
                return Concat(Select(array, BitVecVal(3, 32)),
                              Select(array, BitVecVal(2, 32)),
                              Select(array, BitVecVal(1, 32)),
                              Select(array, BitVecVal(0, 32)))

            def array_to_bv64(array):
                return Concat(Select(array, BitVecVal(7, 32)),
                              Select(array, BitVecVal(6, 32)),
                              Select(array, BitVecVal(5, 32)),
                              Select(array, BitVecVal(4, 32)),
                              Select(array, BitVecVal(3, 32)),
                              Select(array, BitVecVal(2, 32)),
                              Select(array, BitVecVal(1, 32)),
                              Select(array, BitVecVal(0, 32)))

            def angelic_variable(type, expr, instance):
                pattern = '{}!choice!{}!{}!{}!{}!{}!angelic'
                s = pattern.format(type, expr[0], expr[1], expr[2], expr[3], instance)
                return Array(s, BitVecSort(32), BitVecSort(8))

            def original_variable(type, expr, instance):
                pattern = '{}!choice!{}!{}!{}!{}!{}!original'
                s = pattern.format(type, expr[0], expr[1], expr[2], expr[3], instance)
                return Array(s, BitVecSort(32), BitVecSort(8))

            def env_variable(expr, instance, name):
                pattern = 'int!choice!{}!{}!{}!{}!{}!env!{}'
                s = pattern.format(expr[0], expr[1], expr[2], expr[3], instance, name)
                return Array(s, BitVecSort(32), BitVecSort(8))

            def output_variable(type, name, instance):
                s = '{}!output!{}!{}'.format(type, name, instance)
                if type == 'long':
                    return Array(s, BitVecSort(32), BitVecSort(8))
                else:
                    return Array(s, BitVecSort(32), BitVecSort(8))

            def angelic_selector(expr, instance):
                s = 'angelic!{}!{}!{}!{}!{}'.format(expr[0], expr[1], expr[2], expr[3], instance)
                return BitVec(s, 32)

            def original_selector(expr, instance):
                s = 'original!{}!{}!{}!{}!{}'.format(expr[0], expr[1], expr[2], expr[3], instance)
                return BitVec(s, 32)

            def env_selector(expr, instance, name):
                s = 'env!{}!{}!{}!{}!{}!{}'.format(name, expr[0], expr[1], expr[2], expr[3], instance)
                return BitVec(s, 32)

            for name, values in oracle_constraints.items():
                type, _ = outputs[name]
                for i, value in enumerate(values):
                    array = output_variable(type, name, i)
                    bv_value = to_bv_converter_by_type[type](value)
                    if type == 'long':
                        solver.add(bv_value == array_to_bv64(array))
                    else:
                        solver.add(bv_value == array_to_bv32(array))
                    

            for (expr, item) in choices.items():
                type, instances, env = item
                for instance in range(0, instances):
                    selector = angelic_selector(expr, instance)
                    array = angelic_variable(type, expr, instance)
                    solver.add(selector == array_to_bv32(array))

                    selector = original_selector(expr, instance)
                    array = original_variable(type, expr, instance)
                    solver.add(selector == array_to_bv32(array))

                    for name in env:
                        selector = env_selector(expr, instance, name)
                        array = env_variable(expr, instance, name)
                        solver.add(selector == array_to_bv32(array))


            result = solver.check()
            if result != z3.sat:
                logger.info('UNSAT') # TODO: can be timeout
                continue
            model = solver.model()

            # expr -> (angelic * original * env) list
            angelic_path = dict()

            if os.path.exists(self.load[test]):
                shutil.rmtree(self.load[test])
            os.mkdir(self.load[test])

            for (expr, item) in choices.items():
                angelic_path[expr] = []
                type, instances, env = item
                
                expr_str = '{}-{}-{}-{}'.format(expr[0], expr[1], expr[2], expr[3])
                expression_dir = join(self.load[test], expr_str)
                if not os.path.exists(expression_dir):
                    os.mkdir(expression_dir)

                for instance in range(0, instances):
                    bv_angelic = model[angelic_selector(expr, instance)]
                    angelic = from_bv_converter_by_type[type](bv_angelic)
                    bv_original = model[original_selector(expr, instance)]
                    original = from_bv_converter_by_type[type](bv_original)
                    if original_available:
                        logger.info('expression {}[{}]: angelic = {}, original = {}'.format(expr,
                                                                                            instance,
                                                                                            angelic,
                                                                                            original))
                    else:
                        logger.info('expression {}[{}]: angelic = {}'.format(expr,
                                                                             instance,
                                                                             angelic))
                    env_values = dict()
                    for name in env:
                        bv_env = model[env_selector(expr, instance, name)]
                        value = from_bv_converter_by_type['int'](bv_env)
                        env_values[name] = value

                    if original_available:
                        angelic_path[expr].append((angelic, original, env_values))
                    else:
                        angelic_path[expr].append((angelic, None, env_values))

                    # Dump angelic path to dump folder
                    instance_file = join(expression_dir, str(instance))
                    with open(instance_file, 'w') as file:
                        if isinstance(angelic, bool):
                            if angelic:
                                file.write('1')
                            else:
                                file.write('0')
                        else:
                            file.write(str(angelic))
            

            # Run Tester to validate the dumped values
            validated = self.run_test(validation_project, test, load=self.load[test])
            if validated:
                angelic_paths.append(angelic_path)
            else:
                logger.info('spurious angelic path')

        if self.config['synthesis_bool_only']:
            angelic_paths = self._boolean_angelic_forest(angelic_paths)

        if self.config['max_angelic_paths'] is not None and \
           len(angelic_paths) > self.config['max_angelic_paths']:
            angelic_paths = self._reduce_angelic_forest(angelic_paths)
        else:
            logger.info('found {} angelic paths for test \'{}\''.format(len(angelic_paths), test))

        inference_end_time = time.time()
        inference_elapsed = inference_end_time - inference_start_time
        statistics.data['time']['inference'] += inference_elapsed

        iter_stat = dict()
        iter_stat['time'] = dict()
        iter_stat['time']['klee'] = klee_elapsed
        iter_stat['time']['inference'] = inference_elapsed
        iter_stat['paths'] = dict()
        iter_stat['paths']['explored'] = len(smt_files)
        iter_stat['paths']['angelic'] = len(angelic_paths)
        statistics.data['iterations']['klee'].append(iter_stat)
        statistics.save()

        return angelic_paths