def test_replacement_solver(): sr = claripy.ReplacementFrontend(claripy.FullFrontend(claripy.backends.z3)) x = claripy.BVS('x', 32) nose.tools.assert_equals(len(sr.eval(x, 10)), 10) sr.result = None sr.add_replacement(x, claripy.BVV(0x101, 32)) nose.tools.assert_items_equal(sr.eval(x, 10), [0x101]) y = claripy.BVS('y', 32) sr.add([y+1 == 200]) assert (y+1).cache_key in sr._replacements assert sr._replacement(y+1) is claripy.BVV(200, 32) srb = sr.branch() assert len(srb.constraints) == len(sr.constraints) assert (y+1).cache_key in sr._replacements assert sr._replacement(y+1) is claripy.BVV(200, 32) sr = claripy.ReplacementFrontend(claripy.FullFrontend(claripy.backends.z3)) b = claripy.BoolS('b') assert sr._replacement(b) is b sr.add(claripy.Not(b)) assert sr._replacement(b) is claripy.false sr = claripy.ReplacementFrontend(claripy.LightFrontend(claripy.backends.vsa), complex_auto_replace=True) x = claripy.BVS('x', 64) sr.add([x + 8 <= 0xffffffffffffffff]) sr.add([x + 8 >= 0]) assert sr._replacement(x) is not x
def _solver(self): if self._stored_solver is not None: return self._stored_solver if o.ABSTRACT_SOLVER in self.state.options: self._stored_solver = claripy.LightFrontend(claripy.backends.vsa, cache=False) elif o.REPLACEMENT_SOLVER in self.state.options: self._stored_solver = claripy.ReplacementFrontend(claripy.FullFrontend(claripy.backends.z3), unsafe_replacement=True) elif o.COMPOSITE_SOLVER in self.state.options: self._stored_solver = claripy.CompositeFrontend(claripy.hybrid_vsa_z3()) elif o.SYMBOLIC in self.state.options: if o.approximation & self.state.options: self._stored_solver = claripy.hybrid_vsa_z3() else: self._stored_solver = claripy.FullFrontend(claripy.backends.z3) else: self._stored_solver = claripy.LightFrontend(claripy.backends.concrete) return self._stored_solver
def _solver(self): if self._stored_solver is not None: return self._stored_solver if o.ABSTRACT_SOLVER in self.state.options: self._stored_solver = claripy.LightFrontend(claripy.backend_vsa) elif o.COMPOSITE_SOLVER in self.state.options: self._stored_solver = claripy.CompositeFrontend(claripy.backend_z3) else: self._stored_solver = claripy.FullFrontend(claripy.backend_z3) return self._stored_solver
def test_replacement_solver(): sr = claripy.ReplacementFrontend(claripy.LightFrontend( claripy.backends.vsa), replace_constraints=True, complex_auto_replace=True) x = claripy.BVS('x', 32) sr.add(x + 8 == 10) assert sr.max(x) == sr.min(x) sr2 = sr.branch() sr2.add(x + 8 < 2000) assert sr2.max(x) == sr2.min(x) == sr.max(x)
def test_vsa_discrete_value_set(): """ Test cases for DiscreteStridedIntervalSet. """ # Set backend b = claripy.backend_vsa s = claripy.LightFrontend(claripy.backend_vsa) #pylint:disable=unused-variable SI = claripy.StridedInterval BVV = claripy.BVV # Allow the use of DiscreteStridedIntervalSet (cuz we wanna test it!) claripy.vsa.strided_interval.allow_dsis = True # # Union # val_1 = BVV(0, 32) val_2 = BVV(1, 32) r = val_1.union(val_2) nose.tools.assert_true(isinstance(r.model, DiscreteStridedIntervalSet)) nose.tools.assert_true( r.model.collapse(), claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=1)) r = r.union(BVV(3, 32)) ints = b.eval(r, 4) nose.tools.assert_equal(len(ints), 3) nose.tools.assert_equal(ints, [0, 1, 3]) # # Intersection # val_1 = BVV(0, 32) val_2 = BVV(1, 32) r = val_1.intersection(val_2) nose.tools.assert_true(isinstance(r.model, StridedInterval)) nose.tools.assert_true(r.model.is_empty) val_1 = claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=10) val_2 = claripy.SI(bits=32, stride=1, lower_bound=10, upper_bound=20) val_3 = claripy.SI(bits=32, stride=1, lower_bound=15, upper_bound=50) r = val_1.union(val_2) nose.tools.assert_true(isinstance(r.model, DiscreteStridedIntervalSet)) r = r.intersection(val_3) nose.tools.assert_equal(sorted(b.eval(r, 100)), [15, 16, 17, 18, 19, 20]) # # Some logical operations # val_1 = claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=10) val_2 = claripy.SI(bits=32, stride=1, lower_bound=5, upper_bound=20) r_1 = val_1.union(val_2) val_3 = claripy.SI(bits=32, stride=1, lower_bound=20, upper_bound=30) val_4 = claripy.SI(bits=32, stride=1, lower_bound=25, upper_bound=35) r_2 = val_3.union(val_4) nose.tools.assert_true(isinstance(r_1.model, DiscreteStridedIntervalSet)) nose.tools.assert_true(isinstance(r_2.model, DiscreteStridedIntervalSet)) # r_1 < r_2 nose.tools.assert_true(BoolResult.is_maybe(r_1 < r_2)) # r_1 <= r_2 nose.tools.assert_true(BoolResult.is_true(r_1 <= r_2)) # r_1 >= r_2 nose.tools.assert_true(BoolResult.is_maybe(r_1 >= r_2)) # r_1 > r_2 nose.tools.assert_true(BoolResult.is_false(r_1 > r_2)) # r_1 == r_2 nose.tools.assert_true(BoolResult.is_maybe(r_1 == r_2)) # r_1 != r_2 nose.tools.assert_true(BoolResult.is_maybe(r_1 != r_2)) # # Some arithmetic operations # val_1 = claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=10) val_2 = claripy.SI(bits=32, stride=1, lower_bound=5, upper_bound=20) r_1 = val_1.union(val_2) val_3 = claripy.SI(bits=32, stride=1, lower_bound=20, upper_bound=30) val_4 = claripy.SI(bits=32, stride=1, lower_bound=25, upper_bound=35) r_2 = val_3.union(val_4) nose.tools.assert_true(isinstance(r_1.model, DiscreteStridedIntervalSet)) nose.tools.assert_true(isinstance(r_2.model, DiscreteStridedIntervalSet)) # r_1 + r_2 r = r_1 + r_2 nose.tools.assert_true(isinstance(r.model, DiscreteStridedIntervalSet)) nose.tools.assert_true(r.model.collapse().identical( SI(bits=32, stride=1, lower_bound=20, upper_bound=55).model)) # r_2 - r_1 r = r_2 - r_1 nose.tools.assert_true(isinstance(r.model, DiscreteStridedIntervalSet)) nose.tools.assert_true(r.model.collapse().identical( SI(bits=32, stride=1, lower_bound=0, upper_bound=35).model))
def test_vsa_constraint_to_si(): # Set backend b = claripy.backend_vsa s = claripy.LightFrontend(claripy.backend_vsa) #pylint:disable=unused-variable SI = claripy.SI BVV = claripy.BVV claripy.vsa.strided_interval.allow_dsis = False # # If(SI == 0, 1, 0) == 1 # s1 = claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=2) ast_true = (claripy.If(s1 == BVV(0, 32), BVV(1, 1), BVV(0, 1)) == BVV(1, 1)) ast_false = (claripy.If(s1 == BVV(0, 32), BVV(1, 1), BVV(0, 1)) != BVV( 1, 1)) trueside_sat, trueside_replacement = b.constraint_to_si(ast_true) nose.tools.assert_equal(trueside_sat, True) nose.tools.assert_equal(len(trueside_replacement), 1) nose.tools.assert_true(trueside_replacement[0][0] is s1) # True side: claripy.SI<32>0[0, 0] nose.tools.assert_true( claripy.is_true(trueside_replacement[0][1] == claripy.SI( bits=32, stride=0, lower_bound=0, upper_bound=0))) falseside_sat, falseside_replacement = b.constraint_to_si(ast_false) nose.tools.assert_equal(falseside_sat, True) nose.tools.assert_equal(len(falseside_replacement), 1) nose.tools.assert_true(falseside_replacement[0][0] is s1) # False side; claripy.SI<32>1[1, 2] nose.tools.assert_true( claripy.is_true(falseside_replacement[0][1].identical( SI(bits=32, stride=1, lower_bound=1, upper_bound=2)))) # # Extract(0, 0, Concat(BVV(0, 63), If(SI == 0, 1, 0))) == 1 # s2 = claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=2) ast_true = (claripy.Extract( 0, 0, claripy.Concat(BVV(0, 63), claripy.If(s2 == 0, BVV(1, 1), BVV(0, 1)))) == 1) ast_false = (claripy.Extract( 0, 0, claripy.Concat(BVV(0, 63), claripy.If(s2 == 0, BVV(1, 1), BVV(0, 1)))) != 1) trueside_sat, trueside_replacement = b.constraint_to_si(ast_true) nose.tools.assert_equal(trueside_sat, True) nose.tools.assert_equal(len(trueside_replacement), 1) nose.tools.assert_true(trueside_replacement[0][0] is s2) # True side: claripy.SI<32>0[0, 0] nose.tools.assert_true( claripy.is_true(trueside_replacement[0][1].identical( SI(bits=32, stride=0, lower_bound=0, upper_bound=0)))) falseside_sat, falseside_replacement = b.constraint_to_si(ast_false) nose.tools.assert_equal(falseside_sat, True) nose.tools.assert_equal(len(falseside_replacement), 1) nose.tools.assert_true(falseside_replacement[0][0] is s2) # False side; claripy.SI<32>1[1, 2] nose.tools.assert_true( claripy.is_true(falseside_replacement[0][1].identical( SI(bits=32, stride=1, lower_bound=1, upper_bound=2)))) # # Extract(0, 0, ZeroExt(32, If(SI == 0, BVV(1, 32), BVV(0, 32)))) == 1 # s3 = claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=2) ast_true = (claripy.Extract( 0, 0, claripy.ZeroExt(32, claripy.If(s3 == 0, BVV(1, 32), BVV(0, 32)))) == 1) ast_false = (claripy.Extract( 0, 0, claripy.ZeroExt(32, claripy.If(s3 == 0, BVV(1, 32), BVV(0, 32)))) != 1) trueside_sat, trueside_replacement = b.constraint_to_si(ast_true) nose.tools.assert_equal(trueside_sat, True) nose.tools.assert_equal(len(trueside_replacement), 1) nose.tools.assert_true(trueside_replacement[0][0] is s3) # True side: claripy.SI<32>0[0, 0] nose.tools.assert_true( claripy.is_true(trueside_replacement[0][1].identical( SI(bits=32, stride=0, lower_bound=0, upper_bound=0)))) falseside_sat, falseside_replacement = b.constraint_to_si(ast_false) nose.tools.assert_equal(falseside_sat, True) nose.tools.assert_equal(len(falseside_replacement), 1) nose.tools.assert_true(falseside_replacement[0][0] is s3) # False side; claripy.SI<32>1[1, 2] nose.tools.assert_true( claripy.is_true(falseside_replacement[0][1].identical( SI(bits=32, stride=1, lower_bound=1, upper_bound=2)))) # # Extract(0, 0, ZeroExt(32, If(Extract(32, 0, (SI & claripy.SI)) < 0, BVV(1, 1), BVV(0, 1)))) # s4 = claripy.SI(bits=64, stride=1, lower_bound=0, upper_bound=0xffffffffffffffff) ast_true = (claripy.Extract( 0, 0, claripy.ZeroExt( 32, claripy.If( claripy.Extract(31, 0, (s4 & s4)).SLT(0), BVV(1, 32), BVV(0, 32)))) == 1) ast_false = (claripy.Extract( 0, 0, claripy.ZeroExt( 32, claripy.If( claripy.Extract(31, 0, (s4 & s4)).SLT(0), BVV(1, 32), BVV( 0, 32)))) != 1) trueside_sat, trueside_replacement = b.constraint_to_si(ast_true) nose.tools.assert_equal(trueside_sat, True) nose.tools.assert_equal(len(trueside_replacement), 1) nose.tools.assert_true(trueside_replacement[0][0] is s4) # True side: claripy.SI<32>0[0, 0] nose.tools.assert_true( claripy.is_true(trueside_replacement[0][1].identical( SI(bits=64, stride=1, lower_bound=-0x8000000000000000, upper_bound=-1)))) falseside_sat, falseside_replacement = b.constraint_to_si(ast_false) nose.tools.assert_equal(falseside_sat, True) nose.tools.assert_equal(len(falseside_replacement), 1) nose.tools.assert_true(falseside_replacement[0][0] is s4) # False side; claripy.SI<32>1[1, 2] nose.tools.assert_true( claripy.is_true(falseside_replacement[0][1].identical( SI(bits=64, stride=1, lower_bound=0, upper_bound=0x7fffffffffffffff))))