def handle_call(self, op, trace):
stack = self.stack
gas = stack.pop()
addr = stack.pop()
if op == "call":
wei = stack.pop()
else:
assert op == "staticcall"
wei = 0
arg_start = stack.pop()
arg_len = stack.pop()
ret_start = stack.pop()
ret_len = stack.pop()
if addr == 4: # Identity
m = mem_load(arg_start, arg_len)
trace(("setmem", ("range", ret_start, arg_len), m))
stack.append("memcopy.success")
elif type(addr) == int and addr in precompiled:
m = mem_load(arg_start, arg_len)
args = mem_load(arg_start, arg_len)
var_name = precompiled_var_names[addr]
trace(("precompiled", var_name, precompiled[addr], args))
trace(("setmem", ("range", ret_start, ret_len), ("var", var_name)))
stack.append("{}.result".format(precompiled[addr]))
else:
assert op in ("call", "staticcall")
call_trace = (
op,
gas,
addr,
wei,
)
if arg_len == 0:
call_trace += None, None
elif arg_len == 4:
call_trace += mem_load(arg_start, 4), None
else:
fname = mem_load(arg_start, 4)
fparams = mem_load(add_op(arg_start, 4), sub_op(arg_len, 4))
call_trace += fname, fparams
trace(call_trace)
# trace(('comment', mem_load(arg_start, arg_len)))
self.call_len = ret_len
stack.append("ext_call.success")
if lt_op(0, ret_len):
return_data = ("ext_call.return_data", 0, ret_len)
trace(("setmem", ("range", ret_start, ret_len), return_data))
def apply_stack(self, ret, line):
def trace(exp, *format_args):
if '--verbose' in sys.argv: # otherwise breaks sometimes, e.g. 0x00a159d41a5bc12dce2f8AcA8e5BB5Beb8F6ABc8.update
logger.debug("Trace: %s", str(exp).format(*format_args))
if type(exp) == str:
ret.append(exp.format(*format_args))
else:
ret.append(exp)
def trace_extend(l):
assert type(l) == list
for r in l:
trace(r)
stack = self.stack
op = line[1]
previous_len = stack.len()
if '--verbose' in sys.argv or '--explain' in sys.argv:
trace(C.asm(' '+str(stack)))
trace('')
if "push" not in op and "dup" not in op and "swap" not in op:
trace('[{}] {}',line[0],C.asm(op))
else:
if type(line[2]) == str:
trace('[{}] {} {}',line[0],C.asm(op),C.asm(" ”"+line[2]+"”"))
elif line[2] > 0x1000000000:
trace('[{}] {} {}',line[0],C.asm(op),C.asm(hex(line[2])))
else:
trace('[{}] {} {}',line[0],C.asm(op),C.asm(str(line[2])))
assert op not in ['jump', 'jumpi', 'revert', 'return', 'stop', 'jumpdest']
param = 0
if len(line)>2:
param = line[2]
if op in ['exp', 'and', 'eq', 'div', 'lt', 'gt', 'slt', 'sgt', 'mod', 'xor', 'signextend', 'smod', 'sdiv']:
stack.append(arithmetic.eval((op, stack.pop(), stack.pop(),)))
if op in ['mulmod', 'addmod']:
stack.append(('mulmod', stack.pop(), stack.pop(), stack.pop()))
if op == 'mul':
stack.append(mul_op(stack.pop(), stack.pop()))
if op == 'or':
stack.append(or_op(stack.pop(), stack.pop()))
if op == 'shl':
off = stack.pop()
exp = stack.pop()
if all_concrete(off, exp):
stack.append(exp << off)
else:
stack.append(mask_op(exp, shl = off))
if op == 'shr':
off = stack.pop()
exp = stack.pop()
if all_concrete(off, exp):
stack.append(exp >> off)
else:
stack.append(mask_op(exp, offset=minus_op(off), shr = off))
if op == 'add':
stack.append(add_op(stack.pop(), stack.pop()))
if op == 'sub':
left = stack.pop()
right = stack.pop()
if type(left) == int and type(right) == int:
stack.append(arithmetic.sub(left, right))
else:
stack.append(sub_op(left, right))
elif op in ['not', 'iszero']:
stack.append((op, stack.pop()))
elif op == 'sha3':
p = stack.pop()
n = stack.pop()
res = mem_load(p, n)
self.counter += 1
vname = f'_{self.counter}'
vval = ('sha3', res, )
trace(('setvar', vname, vval))
stack.append(('var', vname))
elif op == 'calldataload':
stack.append(('cd', stack.pop(),))
elif op == 'byte':
val = stack.pop()
num = stack.pop()
off = sub_op(256, to_bytes(num))
stack.append(mask_op(val, 8, off, shr=off))
elif op == 'balance':
addr = stack.pop()
if opcode(addr) == 'mask_shl' and addr[:4] == ('mask_shl', 160, 0, 0):
stack.append(('balance', addr[4],))
else:
stack.append(('balance', addr,))
elif op == 'swap':
stack.swap(param)
elif op[:3] == 'log':
p = stack.pop()
s = stack.pop()
topics = []
param = int(op[3])
for i in range(param):
el = stack.pop()
topics.append(el)
trace(('log', mem_load(p, s), ) + tuple(topics))
elif op == 'sload':
sloc = stack.pop()
stack.append(('storage', 256, 0, sloc))
elif op == 'sstore':
sloc = stack.pop()
val = stack.pop()
trace(('store', 256, 0, sloc, val))
elif op == 'mload':
memloc = stack.pop()
loaded = mem_load(memloc)
self.counter += 1
vname = f'_{self.counter}'
trace(('setvar', vname, ('mem', ('range', memloc, 32))))
stack.append(('var',vname))
elif op == 'mstore':
memloc = stack.pop()
val = stack.pop()
trace(('setmem', ('range', memloc, 32), val,))
elif op == 'mstore8':
memloc = stack.pop()
val = stack.pop()
trace(('setmem', ('range', memloc, 8), val,))
elif op == 'extcodecopy':
addr = stack.pop()
mem_pos = stack.pop()
code_pos = stack.pop()
data_len = stack.pop()
trace(('setmem', ('range', mem_pos, data_len), ('extcodecopy', addr, ('range', code_pos, data_len))))
elif op == 'codecopy':
mem_pos = stack.pop()
call_pos = stack.pop()
data_len = stack.pop()
if (type(call_pos), type(data_len)) == (int, int) and call_pos+data_len < len(self.loader.binary):
res = 0
for i in range(call_pos-1, call_pos+data_len-1):
res = res << 8
res += self.loader.binary[i] # this breaks with out of range for some contracts
# may be because we're usually getting compiled code binary
# and not runtime binary
trace(('setmem', ('range', mem_pos, data_len), res))# ('bytes', data_len, res)))
else:
trace(('setmem', ('range', mem_pos, data_len), ('code.data', call_pos, data_len, ),))
elif op == 'codesize':
stack.append(len(self.loader.binary))
elif op == 'calldatacopy':
mem_pos = stack.pop()
call_pos = stack.pop()
data_len = stack.pop()
if data_len != 0:
call_data = ('call.data', call_pos, data_len)
# call_data = mask_op(('call.data', bits(add_op(data_len, call_pos))), size=bits(data_len), shl=bits(call_pos))
trace(('setmem', ('range', mem_pos, data_len), call_data))
elif op == 'returndatacopy':
mem_pos = stack.pop()
ret_pos = stack.pop()
data_len = stack.pop()
if data_len != 0:
return_data = ('ext_call.return_data', ret_pos, data_len)
# return_data = mask_op(('ext_call.return_data', bits(add_op(data_len, ret_pos))), size=bits(data_len), shl=bits(ret_pos))
trace(('setmem', ('range', mem_pos, data_len), return_data))
elif op == 'call':
self.handle_call(op, trace)
elif op == 'staticcall':
self.handle_call(op, trace)
elif op == 'delegatecall':
gas = stack.pop()
addr = stack.pop()
arg_start = stack.pop()
arg_len = stack.pop()
ret_start = stack.pop()
ret_len = stack.pop()
call_trace = ('delegatecall', gas, addr, ) # arg_start, arg_len, ret_start, ret_len)
if arg_len == 0:
fname = None
fparams = None
elif arg_len == 4:
fname = mem_load( arg_start, 4 )
fparams = 0
else:
fname = mem_load( arg_start, 4 )
fparams = mem_load( add_op(arg_start, 4), sub_op(arg_len, 4))
call_trace += (fname, fparams)
trace(call_trace)
self.call_len = ret_len
stack.append('delegate.return_code')
if 0 != ret_len:
return_data = ('delegate.return_data', 0, ret_len)
trace(('setmem', ('range', ret_start, ret_len), return_data))
elif op == 'callcode':
gas = stack.pop()
addr = stack.pop()
value = stack.pop()
arg_start = stack.pop()
arg_len = stack.pop()
ret_start = stack.pop()
ret_len = stack.pop()
call_trace = ('callcode', gas, addr, value, )
if arg_len == 0:
fname = None
fparams = None
elif arg_len == 4:
fname = mem_load( arg_start, 4 )
fparams = 0
else:
fname = mem_load( arg_start, 4 )
fparams = mem_load( add_op(arg_start, 4), sub_op(arg_len, 4))
call_trace += (fname, fparams)
trace(call_trace)
self.call_len = ret_len
stack.append('callcode.return_code')
if 0 != ret_len:
return_data = ('callcode.return_data', 0, ret_len)
trace(('setmem', ('range', ret_start, ret_len), return_data))
elif op == 'create':
wei, mem_start, mem_len = stack.pop(), stack.pop(), stack.pop()
call_trace = ('create', wei)
code = mem_load(mem_start, mem_len)
call_trace += (code, )
trace(call_trace)
stack.append('create.new_address')
elif op == 'create2':
wei, mem_start, mem_len, salt = stack.pop(), stack.pop(), stack.pop(), stack.pop()
call_trace = ('create2', wei, ('mem', ('range', mem_start, mem_len)), salt)
trace(call_trace)
stack.append('create2.new_address')
elif op[:4] == 'push':
stack.append(param)
elif op == 'pc':
stack.append(line[0])
elif op == 'pop':
stack.pop()
elif op == 'dup':
stack.dup(param)
elif op == 'msize':
self.counter += 1
vname = f'_{self.counter}'
trace(('setvar', vname, 'msize'))
stack.append(('var',vname))
elif op in ('extcodesize', 'extcodehash', 'blockhash'):
stack.append((op, stack.pop(),))
elif op in ['callvalue', 'caller', 'address', 'number', 'gas', 'origin', 'timestamp',
'difficulty', 'gasprice', 'coinbase', 'gaslimit', 'calldatasize', 'returndatasize']:
stack.append(op)
if stack.len() - previous_len != opcode_dict.stack_diffs[op]:
logger.error('line: %s', line)
logger.error('stack: %s', stack)
logger.error('expected %s, got %s stack diff', opcode_dict.stack_diffs[op], stack.len() - org_len)
assert False, f'opcode {op} not processed correctly'
stack.cleanup()
def apply_stack(self, ret, line):
def trace(exp, *format_args):
try:
logger.debug("Trace: %s", str(exp).format(*format_args))
except Exception:
pass
if type(exp) == str:
ret.append(exp.format(*format_args))
else:
ret.append(exp)
stack = self.stack
op = line[1]
previous_len = stack.len()
if "--verbose" in sys.argv or "--explain" in sys.argv:
trace(C.asm(" " + str(stack)))
trace("")
if "push" not in op and "dup" not in op and "swap" not in op:
trace("[{}] {}", line[0], C.asm(op))
else:
if type(line[2]) == str:
trace("[{}] {} {}", line[0], C.asm(op),
C.asm(" ”" + line[2] + "”"))
elif line[2] > 0x1000000000:
trace("[{}] {} {}", line[0], C.asm(op),
C.asm(hex(line[2])))
else:
trace("[{}] {} {}", line[0], C.asm(op),
C.asm(str(line[2])))
param = 0
if len(line) > 2:
param = line[2]
if op in [
"exp",
"and",
"eq",
"div",
"lt",
"gt",
"slt",
"sgt",
"mod",
"xor",
"signextend",
"smod",
"sdiv",
]:
stack.append(arithmetic.eval((
op,
stack.pop(),
stack.pop(),
)))
elif op[:4] == "push":
stack.append(param)
elif op == "pop":
stack.pop()
elif op == "dup":
stack.dup(param)
elif op == "mul":
stack.append(mul_op(stack.pop(), stack.pop()))
elif op == "or":
stack.append(or_op(stack.pop(), stack.pop()))
elif op == "add":
stack.append(add_op(stack.pop(), stack.pop()))
elif op == "sub":
left = stack.pop()
right = stack.pop()
if type(left) == int and type(right) == int:
stack.append(arithmetic.sub(left, right))
else:
stack.append(sub_op(left, right))
elif op in ["mulmod", "addmod"]:
stack.append(("mulmod", stack.pop(), stack.pop(), stack.pop()))
elif op == "shl":
off = stack.pop()
exp = stack.pop()
if all_concrete(off, exp):
stack.append(exp << off)
else:
stack.append(mask_op(exp, shl=off))
elif op == "shr":
off = stack.pop()
exp = stack.pop()
if all_concrete(off, exp):
stack.append(exp >> off)
else:
stack.append(mask_op(exp, offset=minus_op(off), shr=off))
elif op == "sar":
off = stack.pop()
exp = stack.pop()
if all_concrete(off, exp):
sign = exp & (1 << 255)
if off >= 256:
if sign:
stack.append(2**256 - 1)
else:
stack.append(0)
else:
shifted = exp >> off
if sign:
shifted |= (2**256 - 1) << (256 - off)
stack.append(shifted)
else:
# FIXME: This won't give the right result...
stack.append(mask_op(exp, offset=minus_op(off), shr=off))
elif op in ["not", "iszero"]:
stack.append((op, stack.pop()))
elif op == "sha3":
p = stack.pop()
n = stack.pop()
res = mem_load(p, n)
self.counter += 1
vname = f"_{self.counter}"
vval = (
"sha3",
res,
)
trace(("setvar", vname, vval))
stack.append(("var", vname))
elif op == "calldataload":
stack.append((
"cd",
stack.pop(),
))
elif op == "byte":
val = stack.pop()
num = stack.pop()
off = sub_op(256, to_bytes(num))
stack.append(mask_op(val, 8, off, shr=off))
elif op == "selfbalance":
stack.append((
"balance",
"address",
))
elif op == "balance":
addr = stack.pop()
if opcode(addr) == "mask_shl" and addr[:4] == ("mask_shl", 160, 0,
0):
stack.append((
"balance",
addr[4],
))
else:
stack.append((
"balance",
addr,
))
elif op == "swap":
stack.swap(param)
elif op[:3] == "log":
p = stack.pop()
s = stack.pop()
topics = []
param = int(op[3])
for i in range(param):
el = stack.pop()
topics.append(el)
trace((
"log",
mem_load(p, s),
) + tuple(topics))
elif op == "sload":
sloc = stack.pop()
stack.append(("storage", 256, 0, sloc))
elif op == "sstore":
sloc = stack.pop()
val = stack.pop()
trace(("store", 256, 0, sloc, val))
elif op == "mload":
memloc = stack.pop()
self.counter += 1
vname = f"_{self.counter}"
trace(("setvar", vname, ("mem", ("range", memloc, 32))))
stack.append(("var", vname))
elif op == "mstore":
memloc = stack.pop()
val = stack.pop()
trace((
"setmem",
("range", memloc, 32),
val,
))
elif op == "mstore8":
memloc = stack.pop()
val = stack.pop()
trace((
"setmem",
("range", memloc, 8),
val,
))
elif op == "extcodecopy":
addr = stack.pop()
mem_pos = stack.pop()
code_pos = stack.pop()
data_len = stack.pop()
trace((
"setmem",
("range", mem_pos, data_len),
("extcodecopy", addr, ("range", code_pos, data_len)),
))
elif op == "codecopy":
mem_pos = stack.pop()
call_pos = stack.pop()
data_len = stack.pop()
if (type(call_pos), type(data_len)) == (
int,
int,
) and call_pos + data_len < len(self.loader.binary):
res = 0
for i in range(call_pos - 1, call_pos + data_len - 1):
res = res << 8
res += self.loader.binary[
i] # this breaks with out of range for some contracts
# may be because we're usually getting compiled code binary
# and not runtime binary
trace(("setmem", ("range", mem_pos, data_len),
res)) # ('bytes', data_len, res)))
else:
trace((
"setmem",
("range", mem_pos, data_len),
(
"code.data",
call_pos,
data_len,
),
))
elif op == "codesize":
stack.append(len(self.loader.binary))
elif op == "calldatacopy":
mem_pos = stack.pop()
call_pos = stack.pop()
data_len = stack.pop()
if data_len != 0:
call_data = ("call.data", call_pos, data_len)
# call_data = mask_op(('call.data', bits(add_op(data_len, call_pos))), size=bits(data_len), shl=bits(call_pos))
trace(("setmem", ("range", mem_pos, data_len), call_data))
elif op == "returndatacopy":
mem_pos = stack.pop()
ret_pos = stack.pop()
data_len = stack.pop()
if data_len != 0:
return_data = ("ext_call.return_data", ret_pos, data_len)
# return_data = mask_op(('ext_call.return_data', bits(add_op(data_len, ret_pos))), size=bits(data_len), shl=bits(ret_pos))
trace(("setmem", ("range", mem_pos, data_len), return_data))
elif op == "call":
self.handle_call(op, trace)
elif op == "staticcall":
self.handle_call(op, trace)
elif op == "delegatecall":
gas = stack.pop()
addr = stack.pop()
arg_start = stack.pop()
arg_len = stack.pop()
ret_start = stack.pop()
ret_len = stack.pop()
call_trace = (
"delegatecall",
gas,
addr,
) # arg_start, arg_len, ret_start, ret_len)
if arg_len == 0:
fname = None
fparams = None
elif arg_len == 4:
fname = mem_load(arg_start, 4)
fparams = 0
else:
fname = mem_load(arg_start, 4)
fparams = mem_load(add_op(arg_start, 4), sub_op(arg_len, 4))
call_trace += (fname, fparams)
trace(call_trace)
self.call_len = ret_len
stack.append("delegate.return_code")
if 0 != ret_len:
return_data = ("delegate.return_data", 0, ret_len)
trace(("setmem", ("range", ret_start, ret_len), return_data))
elif op == "callcode":
gas = stack.pop()
addr = stack.pop()
value = stack.pop()
arg_start = stack.pop()
arg_len = stack.pop()
ret_start = stack.pop()
ret_len = stack.pop()
call_trace = (
"callcode",
gas,
addr,
value,
)
if arg_len == 0:
fname = None
fparams = None
elif arg_len == 4:
fname = mem_load(arg_start, 4)
fparams = 0
else:
fname = mem_load(arg_start, 4)
fparams = mem_load(add_op(arg_start, 4), sub_op(arg_len, 4))
call_trace += (fname, fparams)
trace(call_trace)
self.call_len = ret_len
stack.append("callcode.return_code")
if 0 != ret_len:
return_data = ("callcode.return_data", 0, ret_len)
trace(("setmem", ("range", ret_start, ret_len), return_data))
elif op == "create":
wei, mem_start, mem_len = stack.pop(), stack.pop(), stack.pop()
call_trace = ("create", wei)
code = mem_load(mem_start, mem_len)
call_trace += (code, )
trace(call_trace)
stack.append("create.new_address")
elif op == "create2":
wei, mem_start, mem_len, salt = (
stack.pop(),
stack.pop(),
stack.pop(),
stack.pop(),
)
call_trace = ("create2", wei, ("mem", ("range", mem_start,
mem_len)), salt)
trace(call_trace)
stack.append("create2.new_address")
elif op == "pc":
stack.append(line[0])
elif op == "msize":
self.counter += 1
vname = f"_{self.counter}"
trace(("setvar", vname, "msize"))
stack.append(("var", vname))
elif op in ("extcodesize", "extcodehash", "blockhash"):
stack.append((
op,
stack.pop(),
))
elif op in [
"callvalue",
"caller",
"address",
"number",
"gas",
"origin",
"timestamp",
"chainid",
"difficulty",
"gasprice",
"coinbase",
"gaslimit",
"calldatasize",
"returndatasize",
]:
stack.append(op)
else:
# TODO: Maybe raise an error directly?
assert op not in [
"jump",
"jumpi",
"revert",
"return",
"stop",
"jumpdest",
"UNKNOWN",
]
if stack.len() - previous_len != opcode_dict.stack_diffs[op]:
logger.error("line: %s", line)
logger.error("stack: %s", stack)
logger.error(
"expected %s, got %s stack diff",
opcode_dict.stack_diffs[op],
stack.len() - previous_len,
)
assert False, f"opcode {op} not processed correctly"
stack.cleanup()
def eval_bool(exp, known_true=True, symbolic=True):
if exp == known_true:
return True
if is_zero(exp) == known_true:
return False
if exp == is_zero(known_true):
return False
if type(exp) == int:
return exp > 0
if exp in (True, False):
return True
if opcode(exp) == "bool":
return eval_bool(exp[1], known_true=known_true, symbolic=symbolic)
if opcode(exp) == "iszero":
e = eval_bool(exp[1], known_true=known_true, symbolic=symbolic)
if e is not None:
return not e
if opcode(exp) == "or":
res = 0
for e in exp[1:]:
ev = eval_bool(e, known_true=known_true, symbolic=symbolic)
if ev is None:
return None
res = res or ev
return res
#'ge', 'gt', 'eq' - tbd
if opcode(exp) in ["le", "lt"] and opcode(exp) == opcode(known_true):
if exp[1] == known_true[1]:
# ('le', x, sth) while ('le', x, sth2) is known to be true
if eval_bool((opcode(exp), known_true[2], exp[2])) is True:
return True
if not symbolic:
r = eval(exp)
if type(r) == int:
return r != 0
return None
if opcode(exp) == "le":
left = eval(exp[1])
right = eval(exp[2])
if left == right:
return True
if type(left) == int and type(right) == int:
return left <= right
try:
return algebra.le_op(left, right)
except Exception:
return None
if opcode(exp) == "lt":
left = eval(exp[1])
right = eval(exp[2])
if left == right:
return False
if type(left) == int and type(right) == int:
return left < right
try:
return algebra.lt_op(left, right)
except Exception:
return None
if opcode(exp) == "gt":
left = eval(exp[1])
right = eval(exp[2])
if type(left) == int and type(right) == int:
return left > right
if left == right:
return False
try: # a > b iff b < a iff b+1 <= a
le = algebra.lt_op(algebra.add_op(left, 1), right, 1)
logger.debug("le %s %s %s", le, left, right)
if le == True:
return False
if le == False:
return True
if le is None:
return None
except Exception:
pass
if opcode(exp) == "ge":
left = eval(exp[1])
right = eval(exp[2])
if type(left) == int and type(right) == int:
return left >= right
if left == right:
return True
try:
lt = algebra.lt_op(left, right)
if lt == True:
return False
if lt == False:
return True
if lt is None:
return None
except Exception:
pass
if opcode(exp) == "eq":
left = eval(exp[1])
right = eval(exp[2])
if left == right:
return True
if algebra.sub_op(left, right) == 0:
return True
return None
