def test_replacement_solver():
sr = claripy.ReplacementFrontend(claripy.FullFrontend(claripy.backends.z3))
x = claripy.BVS('x', 32)
nose.tools.assert_equals(len(sr.eval(x, 10)), 10)
sr.result = None
sr.add_replacement(x, claripy.BVV(0x101, 32))
nose.tools.assert_items_equal(sr.eval(x, 10), [0x101])
y = claripy.BVS('y', 32)
sr.add([y+1 == 200])
assert (y+1).cache_key in sr._replacements
assert sr._replacement(y+1) is claripy.BVV(200, 32)
srb = sr.branch()
assert len(srb.constraints) == len(sr.constraints)
assert (y+1).cache_key in sr._replacements
assert sr._replacement(y+1) is claripy.BVV(200, 32)
sr = claripy.ReplacementFrontend(claripy.FullFrontend(claripy.backends.z3))
b = claripy.BoolS('b')
assert sr._replacement(b) is b
sr.add(claripy.Not(b))
assert sr._replacement(b) is claripy.false
sr = claripy.ReplacementFrontend(claripy.LightFrontend(claripy.backends.vsa), complex_auto_replace=True)
x = claripy.BVS('x', 64)
sr.add([x + 8 <= 0xffffffffffffffff])
sr.add([x + 8 >= 0])
assert sr._replacement(x) is not x
def _solver(self):
if self._stored_solver is not None:
return self._stored_solver
if o.ABSTRACT_SOLVER in self.state.options:
self._stored_solver = claripy.LightFrontend(claripy.backends.vsa, cache=False)
elif o.REPLACEMENT_SOLVER in self.state.options:
self._stored_solver = claripy.ReplacementFrontend(claripy.FullFrontend(claripy.backends.z3), unsafe_replacement=True)
elif o.COMPOSITE_SOLVER in self.state.options:
self._stored_solver = claripy.CompositeFrontend(claripy.hybrid_vsa_z3())
elif o.SYMBOLIC in self.state.options:
if o.approximation & self.state.options:
self._stored_solver = claripy.hybrid_vsa_z3()
else:
self._stored_solver = claripy.FullFrontend(claripy.backends.z3)
else:
self._stored_solver = claripy.LightFrontend(claripy.backends.concrete)
return self._stored_solver
def _solver(self):
if self._stored_solver is not None:
return self._stored_solver
if o.ABSTRACT_SOLVER in self.state.options:
self._stored_solver = claripy.LightFrontend(claripy.backend_vsa)
elif o.COMPOSITE_SOLVER in self.state.options:
self._stored_solver = claripy.CompositeFrontend(claripy.backend_z3)
else:
self._stored_solver = claripy.FullFrontend(claripy.backend_z3)
return self._stored_solver
def test_replacement_solver():
sr = claripy.ReplacementFrontend(claripy.LightFrontend(
claripy.backends.vsa),
replace_constraints=True,
complex_auto_replace=True)
x = claripy.BVS('x', 32)
sr.add(x + 8 == 10)
assert sr.max(x) == sr.min(x)
sr2 = sr.branch()
sr2.add(x + 8 < 2000)
assert sr2.max(x) == sr2.min(x) == sr.max(x)
def test_vsa_discrete_value_set():
"""
Test cases for DiscreteStridedIntervalSet.
"""
# Set backend
b = claripy.backend_vsa
s = claripy.LightFrontend(claripy.backend_vsa) #pylint:disable=unused-variable
SI = claripy.StridedInterval
BVV = claripy.BVV
# Allow the use of DiscreteStridedIntervalSet (cuz we wanna test it!)
claripy.vsa.strided_interval.allow_dsis = True
#
# Union
#
val_1 = BVV(0, 32)
val_2 = BVV(1, 32)
r = val_1.union(val_2)
nose.tools.assert_true(isinstance(r.model, DiscreteStridedIntervalSet))
nose.tools.assert_true(
r.model.collapse(),
claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=1))
r = r.union(BVV(3, 32))
ints = b.eval(r, 4)
nose.tools.assert_equal(len(ints), 3)
nose.tools.assert_equal(ints, [0, 1, 3])
#
# Intersection
#
val_1 = BVV(0, 32)
val_2 = BVV(1, 32)
r = val_1.intersection(val_2)
nose.tools.assert_true(isinstance(r.model, StridedInterval))
nose.tools.assert_true(r.model.is_empty)
val_1 = claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=10)
val_2 = claripy.SI(bits=32, stride=1, lower_bound=10, upper_bound=20)
val_3 = claripy.SI(bits=32, stride=1, lower_bound=15, upper_bound=50)
r = val_1.union(val_2)
nose.tools.assert_true(isinstance(r.model, DiscreteStridedIntervalSet))
r = r.intersection(val_3)
nose.tools.assert_equal(sorted(b.eval(r, 100)), [15, 16, 17, 18, 19, 20])
#
# Some logical operations
#
val_1 = claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=10)
val_2 = claripy.SI(bits=32, stride=1, lower_bound=5, upper_bound=20)
r_1 = val_1.union(val_2)
val_3 = claripy.SI(bits=32, stride=1, lower_bound=20, upper_bound=30)
val_4 = claripy.SI(bits=32, stride=1, lower_bound=25, upper_bound=35)
r_2 = val_3.union(val_4)
nose.tools.assert_true(isinstance(r_1.model, DiscreteStridedIntervalSet))
nose.tools.assert_true(isinstance(r_2.model, DiscreteStridedIntervalSet))
# r_1 < r_2
nose.tools.assert_true(BoolResult.is_maybe(r_1 < r_2))
# r_1 <= r_2
nose.tools.assert_true(BoolResult.is_true(r_1 <= r_2))
# r_1 >= r_2
nose.tools.assert_true(BoolResult.is_maybe(r_1 >= r_2))
# r_1 > r_2
nose.tools.assert_true(BoolResult.is_false(r_1 > r_2))
# r_1 == r_2
nose.tools.assert_true(BoolResult.is_maybe(r_1 == r_2))
# r_1 != r_2
nose.tools.assert_true(BoolResult.is_maybe(r_1 != r_2))
#
# Some arithmetic operations
#
val_1 = claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=10)
val_2 = claripy.SI(bits=32, stride=1, lower_bound=5, upper_bound=20)
r_1 = val_1.union(val_2)
val_3 = claripy.SI(bits=32, stride=1, lower_bound=20, upper_bound=30)
val_4 = claripy.SI(bits=32, stride=1, lower_bound=25, upper_bound=35)
r_2 = val_3.union(val_4)
nose.tools.assert_true(isinstance(r_1.model, DiscreteStridedIntervalSet))
nose.tools.assert_true(isinstance(r_2.model, DiscreteStridedIntervalSet))
# r_1 + r_2
r = r_1 + r_2
nose.tools.assert_true(isinstance(r.model, DiscreteStridedIntervalSet))
nose.tools.assert_true(r.model.collapse().identical(
SI(bits=32, stride=1, lower_bound=20, upper_bound=55).model))
# r_2 - r_1
r = r_2 - r_1
nose.tools.assert_true(isinstance(r.model, DiscreteStridedIntervalSet))
nose.tools.assert_true(r.model.collapse().identical(
SI(bits=32, stride=1, lower_bound=0, upper_bound=35).model))
def test_vsa_constraint_to_si():
# Set backend
b = claripy.backend_vsa
s = claripy.LightFrontend(claripy.backend_vsa) #pylint:disable=unused-variable
SI = claripy.SI
BVV = claripy.BVV
claripy.vsa.strided_interval.allow_dsis = False
#
# If(SI == 0, 1, 0) == 1
#
s1 = claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=2)
ast_true = (claripy.If(s1 == BVV(0, 32), BVV(1, 1), BVV(0,
1)) == BVV(1, 1))
ast_false = (claripy.If(s1 == BVV(0, 32), BVV(1, 1), BVV(0, 1)) != BVV(
1, 1))
trueside_sat, trueside_replacement = b.constraint_to_si(ast_true)
nose.tools.assert_equal(trueside_sat, True)
nose.tools.assert_equal(len(trueside_replacement), 1)
nose.tools.assert_true(trueside_replacement[0][0] is s1)
# True side: claripy.SI<32>0[0, 0]
nose.tools.assert_true(
claripy.is_true(trueside_replacement[0][1] == claripy.SI(
bits=32, stride=0, lower_bound=0, upper_bound=0)))
falseside_sat, falseside_replacement = b.constraint_to_si(ast_false)
nose.tools.assert_equal(falseside_sat, True)
nose.tools.assert_equal(len(falseside_replacement), 1)
nose.tools.assert_true(falseside_replacement[0][0] is s1)
# False side; claripy.SI<32>1[1, 2]
nose.tools.assert_true(
claripy.is_true(falseside_replacement[0][1].identical(
SI(bits=32, stride=1, lower_bound=1, upper_bound=2))))
#
# Extract(0, 0, Concat(BVV(0, 63), If(SI == 0, 1, 0))) == 1
#
s2 = claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=2)
ast_true = (claripy.Extract(
0, 0,
claripy.Concat(BVV(0, 63), claripy.If(s2 == 0, BVV(1, 1),
BVV(0, 1)))) == 1)
ast_false = (claripy.Extract(
0, 0,
claripy.Concat(BVV(0, 63), claripy.If(s2 == 0, BVV(1, 1), BVV(0, 1))))
!= 1)
trueside_sat, trueside_replacement = b.constraint_to_si(ast_true)
nose.tools.assert_equal(trueside_sat, True)
nose.tools.assert_equal(len(trueside_replacement), 1)
nose.tools.assert_true(trueside_replacement[0][0] is s2)
# True side: claripy.SI<32>0[0, 0]
nose.tools.assert_true(
claripy.is_true(trueside_replacement[0][1].identical(
SI(bits=32, stride=0, lower_bound=0, upper_bound=0))))
falseside_sat, falseside_replacement = b.constraint_to_si(ast_false)
nose.tools.assert_equal(falseside_sat, True)
nose.tools.assert_equal(len(falseside_replacement), 1)
nose.tools.assert_true(falseside_replacement[0][0] is s2)
# False side; claripy.SI<32>1[1, 2]
nose.tools.assert_true(
claripy.is_true(falseside_replacement[0][1].identical(
SI(bits=32, stride=1, lower_bound=1, upper_bound=2))))
#
# Extract(0, 0, ZeroExt(32, If(SI == 0, BVV(1, 32), BVV(0, 32)))) == 1
#
s3 = claripy.SI(bits=32, stride=1, lower_bound=0, upper_bound=2)
ast_true = (claripy.Extract(
0, 0, claripy.ZeroExt(32, claripy.If(s3 == 0, BVV(1, 32),
BVV(0, 32)))) == 1)
ast_false = (claripy.Extract(
0, 0, claripy.ZeroExt(32, claripy.If(s3 == 0, BVV(1, 32), BVV(0, 32))))
!= 1)
trueside_sat, trueside_replacement = b.constraint_to_si(ast_true)
nose.tools.assert_equal(trueside_sat, True)
nose.tools.assert_equal(len(trueside_replacement), 1)
nose.tools.assert_true(trueside_replacement[0][0] is s3)
# True side: claripy.SI<32>0[0, 0]
nose.tools.assert_true(
claripy.is_true(trueside_replacement[0][1].identical(
SI(bits=32, stride=0, lower_bound=0, upper_bound=0))))
falseside_sat, falseside_replacement = b.constraint_to_si(ast_false)
nose.tools.assert_equal(falseside_sat, True)
nose.tools.assert_equal(len(falseside_replacement), 1)
nose.tools.assert_true(falseside_replacement[0][0] is s3)
# False side; claripy.SI<32>1[1, 2]
nose.tools.assert_true(
claripy.is_true(falseside_replacement[0][1].identical(
SI(bits=32, stride=1, lower_bound=1, upper_bound=2))))
#
# Extract(0, 0, ZeroExt(32, If(Extract(32, 0, (SI & claripy.SI)) < 0, BVV(1, 1), BVV(0, 1))))
#
s4 = claripy.SI(bits=64,
stride=1,
lower_bound=0,
upper_bound=0xffffffffffffffff)
ast_true = (claripy.Extract(
0, 0,
claripy.ZeroExt(
32,
claripy.If(
claripy.Extract(31, 0, (s4 & s4)).SLT(0), BVV(1, 32),
BVV(0, 32)))) == 1)
ast_false = (claripy.Extract(
0, 0,
claripy.ZeroExt(
32,
claripy.If(
claripy.Extract(31, 0, (s4 & s4)).SLT(0), BVV(1, 32), BVV(
0, 32)))) != 1)
trueside_sat, trueside_replacement = b.constraint_to_si(ast_true)
nose.tools.assert_equal(trueside_sat, True)
nose.tools.assert_equal(len(trueside_replacement), 1)
nose.tools.assert_true(trueside_replacement[0][0] is s4)
# True side: claripy.SI<32>0[0, 0]
nose.tools.assert_true(
claripy.is_true(trueside_replacement[0][1].identical(
SI(bits=64,
stride=1,
lower_bound=-0x8000000000000000,
upper_bound=-1))))
falseside_sat, falseside_replacement = b.constraint_to_si(ast_false)
nose.tools.assert_equal(falseside_sat, True)
nose.tools.assert_equal(len(falseside_replacement), 1)
nose.tools.assert_true(falseside_replacement[0][0] is s4)
# False side; claripy.SI<32>1[1, 2]
nose.tools.assert_true(
claripy.is_true(falseside_replacement[0][1].identical(
SI(bits=64,
stride=1,
lower_bound=0,
upper_bound=0x7fffffffffffffff))))
