def test_coverage(self):
'''
((mem[piva_global(0xbfbfee08):1] | (mem[(arg0 + 72):4] & 0xffffff00)) + piva_global())
'''
ids = []
piva1 = vsc.Var('piva_global', 4)
ids.append(piva1._sym_id)
arg = vsc.Const(0xbfbfee08, 4)
ids.append(arg._sym_id)
call = vsc.Call(piva1, 4, argsyms=[arg])
ids.append(call._sym_id)
con = vsc.Const(1, 4)
ids.append(con._sym_id)
mem1 = vsc.Mem(call, con)
ids.append(mem1._sym_id)
arg = vsc.Arg(0, 4)
ids.append(arg._sym_id)
addop = vsc.Const(72, 4)
ids.append(addop._sym_id)
add = vsc.o_add(arg, addop, 4)
ids.append(add._sym_id)
con = vsc.Const(4, 4)
ids.append(con._sym_id)
memac = vsc.Mem(add, con)
ids.append(memac._sym_id)
andop = vsc.Const(0xffffff00, 4)
ids.append(andop._sym_id)
mem2 = vsc.o_and(memac, andop, 4)
ids.append(mem2._sym_id)
memor = vsc.o_or(mem1, mem2, 4)
ids.append(memor._sym_id)
piva2 = vsc.Var('piva_global', 4)
ids.append(piva2._sym_id)
call2 = vsc.Call(piva2, 4, argsyms=[])
ids.append(call2._sym_id)
add = vsc.o_add(memor, call2, 4)
ids.append(add._sym_id)
traveled_ids = []
def walkerTest(path, symobj, ctx):
traveled_ids.append(symobj._sym_id)
add.walkTree(walkerTest)
self.assertEqual(traveled_ids, ids)
self.assertEqual(
'((mem[piva_global(0xbfbfee08):1] | (mem[(arg0 + 72):4] & 0xffffff00)) + piva_global())',
str(add))
def test_wipeAstArch(self):
vw = viv.VivWorkspace()
vw.addMemoryMap(0x00, e_mem.MM_RWX, 'code', [0 for x in range(256)])
vw.addLocation(0x40, 47, viv_const.LOC_POINTER)
vw.setMeta('Architecture', 'i386')
symctx = vsym_analysis.SymbolikAnalysisContext(vw)
func = vsc.Var('eax', 4)
call = vsc.Call(func, 4)
addr = vsc.Var('arg0', 4) + call
mem = vsc.Mem(addr, vsc.Const(4, 4))
op = mem + vsc.Var('edx', 4)
final = op * vsc.Var('edx', 4)
wiped = vsym_archind.wipeAstArch(symctx, [final])
self.assertEquals(1, len(wiped))
self.assertEquals('((mem[(arg0 + 1indreg()):4] + 0indreg) * 0indreg)', str(wiped[0]))
def test_basic(self):
vw = viv.VivWorkspace()
vw.addMemoryMap(0x56560000, 7, 'woot', b'A' * 8192)
vw.setMeta('Architecture', 'i386')
symctx = vsym_analysis.getSymbolikAnalysisContext(vw)
base = vsc.Mem(vsc.Const(0x56560020, 4), vsc.Const(
4, 4)) - (vsc.Var('arg0', 4) + vsc.Var('ecx', 4)) * (
vsc.Var('ebx', 4) + vsc.Var('ebx', 4)) + vsc.Const(9999, 4)
eqs = [
vsc.Mem(vsc.Const(0x56560020, 4), vsc.Const(4, 4)) -
(vsc.Var('arg0', 4) + vsc.Var('ebx', 4)) *
(vsc.Var('ecx', 4) + vsc.Var('ecx', 4)) + vsc.Const(9999, 4),
vsc.Mem(vsc.Const(0x56560020, 4), vsc.Const(4, 4)) -
(vsc.Var('eax', 4) + vsc.Var('eax', 4)) *
(vsc.Var('edx', 4) + vsc.Var('arg0', 4)) + vsc.Const(9999, 4),
vsc.Mem(vsc.Const(0x56560020, 4), vsc.Const(4, 4)) -
(vsc.Var('arg0', 4) + vsc.Var('ecx', 4)) *
(vsc.Var('ebx', 4) + vsc.Var('ebx', 4)) + vsc.Const(9999, 4),
vsc.Mem(vsc.Const(0x56560056, 4), vsc.Const(4, 4)) -
(vsc.Var('arg0', 4) + vsc.Var('ecx', 4)) *
(vsc.Var('ebx', 4) + vsc.Var('ebx', 4)) + vsc.Const(9999, 4),
]
nes = [
vsc.Mem(vsc.Const(0x56560020, 4), vsc.Const(4, 4)) -
(vsc.Var('arg0', 4) + vsc.Var('ebx', 4)) *
(vsc.Var('ebx', 4) + vsc.Var('ecx', 4)) + vsc.Const(9999, 4),
vsc.Mem(vsc.Const(0x56560020, 4), vsc.Const(4, 4)) -
(vsc.Var('eax', 4) + vsc.Var('arg1', 4)) *
(vsc.Var('edx', 4) + vsc.Var('arg0', 4)) + vsc.Const(9999, 4),
vsc.Mem(vsc.Const(0x56560020, 4), vsc.Const(4, 4)) -
(vsc.Var('arg0', 4) + vsc.Var('ecx', 4)) *
(vsc.Var('ebx', 4) + vsc.Var('ebx', 4)) + vsc.Const(8888, 4),
vsc.Mem(vsc.Const(0x56560020, 4), vsc.Const(4, 4)) -
(vsc.Var('arg0', 4) + vsc.Var('ecx', 4)) *
(vsc.Var('ebx', 4) + vsc.Var('ebx', 4)) + vsc.Const(0x56560020, 4),
vsc.Mem(vsc.Const(0x56560020, 4), vsc.Const(4, 4)) -
(vsc.Var('arg0', 4) + vsc.Var('ecx', 4)) *
(vsc.Var('ebx', 4) + vsc.Var('ebx', 4)) + vsc.Const(0x56560040, 4),
]
post_eqs = [
'((mem[0archindva:4] - ((arg0 + 0indreg) * (1indreg + 1indreg))) + 0x0000270f)',
'((mem[0archindva:4] - ((1indreg + 1indreg) * (0indreg + arg0))) + 0x0000270f)',
'((mem[0archindva:4] - ((arg0 + 0indreg) * (1indreg + 1indreg))) + 0x0000270f)',
'((mem[0archindva:4] - ((arg0 + 0indreg) * (1indreg + 1indreg))) + 0x0000270f)',
]
post_nes = [
'((mem[0archindva:4] - ((arg0 + 0indreg) * (0indreg + 1indreg))) + 0x0000270f)',
'((mem[0archindva:4] - ((1indreg + arg1) * (0indreg + arg0))) + 0x0000270f)',
'((mem[0archindva:4] - ((arg0 + 0indreg) * (1indreg + 1indreg))) + 0x000022b8)',
'((mem[0archindva:4] - ((arg0 + 0indreg) * (1indreg + 1indreg))) + 0archindva)',
'((mem[0archindva:4] - ((arg0 + 0indreg) * (1indreg + 1indreg))) + 1archindva)',
]
for i in range(len(post_eqs)):
eq = vsym_archind.wipeAstArch(symctx, [eqs[i]], wipeva=True)[0]
self.assertEqual(post_eqs[i], str(eq))
for i in range(len(post_nes)):
ne = vsym_archind.wipeAstArch(symctx, [nes[i]], wipeva=True)[0]
self.assertEqual(post_nes[i], str(ne))
base = vsym_archind.wipeAstArch(symctx, [
base,
], wipeva=True)[0]
baseval = base.solve(emu=None)
for match in eqs:
self.assertEqual(match.solve(emu=None), baseval)
for nonmatch in nes:
self.assertNotEqual(nonmatch.solve(emu=None), baseval)