def test_quick_ct64():
p = ct64.load_rom(
os.path.join(os.path.dirname(os.path.realpath(__file__)),
'../test_programs/ct64/distribute.rom'))
simgr = p.factory.simulation_manager()
simgr.run(n=100)
assert len(simgr.active) == 6
for active in simgr.active:
assert active.posix.dumps(0) != ''
assert deinterlace(active.posix.dumps(1)) == 'PASSWORD: '
def test_crackme():
p = ct64.load_rom(
os.path.join(os.path.dirname(os.path.realpath(__file__)),
'../test_programs/ct64/distribute.rom'))
@p.hook(0x1303, length=2)
def bug_fix(s):
s.regs.sc3 = 14
simgr = p.factory.simulation_manager()
simgr.explore(find=lambda s: 'flag{' in deinterlace(s.posix.dumps(1)),
) #step_func=lambda lsm: lsm.drop(stash='deadended'))
if not simgr.found:
assert False, "Failed to find any path containing the flag"
out = deinterlace(simgr.one_found.posix.dumps(0))
print repr(out)
def test_quick_ct64():
p = ct64.load_rom(
os.path.join(os.path.dirname(os.path.realpath(__file__)),
'../test_programs/ct64/distribute.rom'))
# ct64 has a non-traditional byte width, which means we have to use the ListPages page model. UltraPages model does
# not work.
plugin_preset = SimState._presets['default'].copy()
plugin_preset._default_plugins['sym_memory'] = DefaultListPagesMemory
state = p.factory.entry_state(plugin_preset=plugin_preset)
simgr = p.factory.simulation_manager(state)
simgr.run(n=100)
assert len(simgr.active) == 6
for active in simgr.active:
assert active.posix.dumps(0) != b''
assert deinterlace(active.posix.dumps(1)) == b'PASSWORD: '
def test_crackme():
p = ct64.load_rom(
os.path.join(os.path.dirname(os.path.realpath(__file__)),
'../test_programs/ct64/distribute.rom'))
@p.hook(0x1303, length=2)
def bug_fix(s):
s.regs.sc3 = 14
plugin_preset = SimState._presets['default'].copy()
plugin_preset._default_plugins['sym_memory'] = DefaultListPagesMemory
state = p.factory.entry_state(plugin_preset=plugin_preset)
simgr = p.factory.simulation_manager(state)
simgr.explore(avoid=[0x12cc, 0x1316, 0x1338, 0x14c9],
find=0x1608,
step_func=lambda lsm: lsm.drop(stash='deadended'))
if not simgr.found:
assert False, "Failed to find any path containing the flag"
out = deinterlace(simgr.one_found.posix.dumps(0))
print(repr(out))