def _gen_path_constraints(self, translator, expr, expected):
"""Generate path constraint from @expr. Handle special case with
generated loc_keys
"""
out = []
expected = canonize_to_exprloc(self._ircfg.loc_db, expected)
expected_is_loc_key = expected.is_loc()
for consval in possible_values(expr):
value = canonize_to_exprloc(self._ircfg.loc_db, consval.value)
if expected_is_loc_key and value != expected:
continue
if not expected_is_loc_key and value.is_loc_key():
continue
conds = z3.And(*[
translator.from_expr(cond.to_constraint())
for cond in consval.constraints
])
if expected != value:
conds = z3.And(
conds, translator.from_expr(ExprAssign(value, expected)))
out.append(conds)
if out:
conds = z3.Or(*out)
else:
# Ex: expr: lblgen1, expected: 0x1234
# -> Avoid inconsistent solution lblgen1 = 0x1234
conds = translator.from_expr(self.unsat_expr)
return conds
def solve_for_memory_access(self, expr_mem, access_type, additional_constraints=set()):
# Check that input has effect on memory referenced
if get_expr_ids(expr_mem.ptr) & self.symbolized_mem_ids:
for possibility in possible_values(expr_mem.ptr):
address_expr = possibility.value
access_len = int(expr_mem.size/8)
# 5 sec timeout
#self.dse.cur_solver.set('timeout', 5000)
# Save solver state
self.dse.cur_solver.push()
# Add constraints from the expr itself
for cons in possibility.constraints.union(additional_constraints):
eaff = cons.to_constraint()
#print '\tADDING CONSTRAINT: ' + str(eaff)
self.dse.cur_solver.add(self.dse.z3_trans.from_expr(eaff))
# Add memory constraints
for mem_range in self.dse.valid_ranges:
# Add range constraint
rc = z3.Not(z3.And(z3.UGE(self.dse.z3_trans.from_expr(address_expr), self.dse.z3_trans.from_expr(mem_range[0])),
z3.ULE(self.dse.z3_trans.from_expr(address_expr), self.dse.z3_trans.from_expr(mem_range[1]-ExprInt(access_len-1, 64)))
)
)
self.dse.cur_solver.add(rc)
#print solver
#import pdb; pdb.set_trace()
if self.dse.cur_solver.check()==z3.sat:
model = self.dse.cur_solver.model()
#import pdb; pdb.set_trace()
log.debug('SYMB 0x{:08X}: {:s} -> {}AV[{:s}] '.format(self.dse.jitter.pc, \
str(model), access_type, \
str(self.dse.symb.eval_expr(address_expr, eval_cache={})))
)
# Evaluate the buffer that would cause the crash
crashbuf = self.derive_crashbuf(model)
# Evaluate the AV adress
values = self.get_values_from_model(model)
self.dse.crashes.append(crash( self.dse.jitter.pc, \
self.dse.symb.eval_expr(address_expr, eval_cache=values), \
access_type, \
crashbuf, \
int(self.dse.callsite)
)
)
# Reset the solver
self.dse.cur_solver.pop()
return
def compute_cst_propagation_states(ir_arch, ircfg, init_addr, init_infos):
"""
Propagate "constant expressions" in a function.
The attribute "constant expression" is true if the expression is based on
constants or "init" regs values.
@ir_arch: IntermediateRepresentation instance
@init_addr: analysis start address
@init_infos: dictionary linking expressions to their values at @init_addr
"""
done = set()
state = SymbExecState.StateEngine(init_infos)
lbl = ircfg.get_loc_key(init_addr)
todo = set([lbl])
states = {lbl: state}
while todo:
if not todo:
break
lbl = todo.pop()
state = states[lbl]
if (lbl, state) in done:
continue
done.add((lbl, state))
if lbl not in ircfg.blocks:
continue
symbexec_engine = SymbExecState(ir_arch, ircfg, state)
addr = symbexec_engine.run_block_at(ircfg, lbl)
symbexec_engine.del_mem_above_stack(ir_arch.sp)
for dst in possible_values(addr):
value = dst.value
if value.is_mem():
LOG_CST_PROPAG.warning('Bad destination: %s', value)
continue
elif value.is_int():
value = ircfg.get_loc_key(value)
add_state(
ircfg, todo, states, value,
symbexec_engine.get_state()
)
return states
def compute_cst_propagation_states(ir_arch, ircfg, init_addr, init_infos):
"""
Propagate "constant expressions" in a function.
The attribute "constant expression" is true if the expression is based on
constants or "init" regs values.
@ir_arch: IntermediateRepresentation instance
@init_addr: analysis start address
@init_infos: dictionary linking expressions to their values at @init_addr
"""
done = set()
state = SymbExecState.StateEngine(init_infos)
lbl = ircfg.get_loc_key(init_addr)
todo = set([lbl])
states = {lbl: state}
while todo:
if not todo:
break
lbl = todo.pop()
state = states[lbl]
if (lbl, state) in done:
continue
done.add((lbl, state))
if lbl not in ircfg.blocks:
continue
symbexec_engine = SymbExecState(ir_arch, ircfg, state)
addr = symbexec_engine.run_block_at(ircfg, lbl)
symbexec_engine.del_mem_above_stack(ir_arch.sp)
for dst in possible_values(addr):
value = dst.value
if value.is_mem():
LOG_CST_PROPAG.warning('Bad destination: %s', value)
continue
elif value.is_int():
value = ircfg.get_loc_key(value)
add_state(ircfg, todo, states, value, symbexec_engine.get_state())
return states
def handle(self, cur_addr):
cur_addr = canonize_to_exprloc(self.ir_arch.loc_db, cur_addr)
symb_pc = self.eval_expr(self.ir_arch.IRDst)
possibilities = possible_values(symb_pc)
cur_path_constraint = set() # path_constraint for the concrete path
if len(possibilities) == 1:
dst = next(iter(possibilities)).value
dst = canonize_to_exprloc(self.ir_arch.loc_db, dst)
assert dst == cur_addr
else:
for possibility in possibilities:
target_addr = canonize_to_exprloc(self.ir_arch.loc_db,
possibility.value)
path_constraint = set(
) # Set of ExprAssign for the possible path
# Get constraint associated to the possible path
memory_to_add = ModularIntervals(symb_pc.size)
for cons in possibility.constraints:
eaff = cons.to_constraint()
# eaff.get_r(mem_read=True) is not enough
# ExprAssign consider a Memory access in dst as a write
mem = eaff.dst.get_r(mem_read=True)
mem.update(eaff.src.get_r(mem_read=True))
for expr in mem:
if expr.is_mem():
addr_range = expr_range(expr.ptr)
# At upper bounds, add the size of the memory access
# if addr (- [a, b], then @size[addr] reachables
# values are in @8[a, b + size[
for start, stop in addr_range:
stop += expr.size // 8 - 1
full_range = ModularIntervals(
symb_pc.size, [(start, stop)])
memory_to_add.update(full_range)
path_constraint.add(eaff)
if memory_to_add.length > self.MAX_MEMORY_INJECT:
# TODO re-croncretize the constraint or z3-try
raise RuntimeError("Not implemented: too long memory area")
# Inject memory
for start, stop in memory_to_add:
for address in range(start, stop + 1):
expr_mem = ExprMem(
ExprInt(address, self.ir_arch.pc.size), 8)
value = self.eval_expr(expr_mem)
if not value.is_int():
raise TypeError("Rely on a symbolic memory case, " \
"address 0x%x" % address)
path_constraint.add(ExprAssign(expr_mem, value))
if target_addr == cur_addr:
# Add path constraint
cur_path_constraint = path_constraint
elif self.produce_solution(target_addr):
# Looking for a new solution
self.cur_solver.push()
for cons in path_constraint:
trans = self.z3_trans.from_expr(cons)
trans = z3.simplify(trans)
self.cur_solver.add(trans)
result = self.cur_solver.check()
if result == z3.sat:
model = self.cur_solver.model()
self.handle_solution(model, target_addr)
self.cur_solver.pop()
self.handle_correct_destination(cur_addr, cur_path_constraint)
def handle(self, cur_addr):
cur_addr = self.ir_arch.loc_db.canonize_to_exprloc(cur_addr)
symb_pc = self.eval_expr(self.ir_arch.IRDst)
possibilities = possible_values(symb_pc)
cur_path_constraint = set() # path_constraint for the concrete path
if len(possibilities) == 1:
dst = next(iter(possibilities)).value
dst = self.ir_arch.loc_db.canonize_to_exprloc(dst)
assert dst == cur_addr
else:
for possibility in possibilities:
target_addr = self.ir_arch.loc_db.canonize_to_exprloc(
possibility.value
)
path_constraint = set() # Set of ExprAssign for the possible path
# Get constraint associated to the possible path
memory_to_add = ModularIntervals(symb_pc.size)
for cons in possibility.constraints:
eaff = cons.to_constraint()
# eaff.get_r(mem_read=True) is not enough
# ExprAssign consider a Memory access in dst as a write
mem = eaff.dst.get_r(mem_read=True)
mem.update(eaff.src.get_r(mem_read=True))
for expr in mem:
if expr.is_mem():
addr_range = expr_range(expr.ptr)
# At upper bounds, add the size of the memory access
# if addr (- [a, b], then @size[addr] reachables
# values are in @8[a, b + size[
for start, stop in addr_range:
stop += expr.size // 8 - 1
full_range = ModularIntervals(
symb_pc.size,
[(start, stop)]
)
memory_to_add.update(full_range)
path_constraint.add(eaff)
if memory_to_add.length > self.MAX_MEMORY_INJECT:
# TODO re-croncretize the constraint or z3-try
raise RuntimeError("Not implemented: too long memory area")
# Inject memory
for start, stop in memory_to_add:
for address in range(start, stop + 1):
expr_mem = ExprMem(ExprInt(address,
self.ir_arch.pc.size),
8)
value = self.eval_expr(expr_mem)
if not value.is_int():
raise TypeError("Rely on a symbolic memory case, " \
"address 0x%x" % address)
path_constraint.add(ExprAssign(expr_mem, value))
if target_addr == cur_addr:
# Add path constraint
cur_path_constraint = path_constraint
elif self.produce_solution(target_addr):
# Looking for a new solution
self.cur_solver.push()
for cons in path_constraint:
trans = self.z3_trans.from_expr(cons)
trans = z3.simplify(trans)
self.cur_solver.add(trans)
result = self.cur_solver.check()
if result == z3.sat:
model = self.cur_solver.model()
self.handle_solution(model, target_addr)
self.cur_solver.pop()
self.handle_correct_destination(cur_addr, cur_path_constraint)