def emulate(pc, index, y, targetadd): Triton.concretizeAllRegister() Triton.concretizeAllMemory() flag = 0 Triton.setConcreteRegisterValue(Triton.registers.ebp, 0x6ffffffb) Triton.setConcreteRegisterValue(Triton.registers.ebp, 0x6fffffff) esp = Triton.buildSymbolicRegister(Triton.registers.ebp).evaluate() address = 28 addressv = 200 Triton.setConcreteMemoryValue(esp + 12, address) Triton.setConcreteMemoryValue(address, addressv) for i in range(index + 1): Triton.setConcreteMemoryValue(addressv, ord('S')) addressv = addressv + 1 if (y == 1): #strin= "" for j in range(index): print 'F' #strin = strin+'F' #print strin,hex(targetadd) print hex(targetadd) while pc: opcodes = Triton.getConcreteMemoryAreaValue(pc, 16) instruction = Instruction() instruction.setOpcode(opcodes) instruction.setAddress(pc) Triton.processing(instruction) if (instruction.isControlFlow()): flag = flag + 1 if instruction.getType() == OPCODE.INT: pc = instruction.getNextAddress() y = Triton.buildSymbolicRegister(Triton.registers.eax).evaluate() if y == 1: break continue pc = Triton.buildSymbolicRegister(Triton.registers.eip).evaluate() if (pc == 28): return 5 return 1
class TestInstruction(unittest.TestCase): """Testing the Instruction class.""" def setUp(self): """Define and process the instruction to test.""" self.Triton = TritonContext() self.Triton.setArchitecture(ARCH.X86_64) self.inst = Instruction() self.inst.setOpcode("\x48\x01\xd8") # add rax, rbx self.inst.setAddress(0x400000) self.Triton.setConcreteRegisterValue(self.Triton.registers.rax, 0x1122334455667788) self.Triton.setConcreteRegisterValue(self.Triton.registers.rbx, 0x8877665544332211) self.Triton.processing(self.inst) def test_address(self): """Check instruction current and next address.""" self.assertEqual(self.inst.getAddress(), 0x400000) self.assertEqual(self.inst.getNextAddress(), 0x400003) def test_memory(self): """Check memory access.""" self.assertListEqual(self.inst.getLoadAccess(), []) self.assertListEqual(self.inst.getStoreAccess(), []) self.assertFalse(self.inst.isMemoryWrite()) self.assertFalse(self.inst.isMemoryRead()) def test_registers(self): """Check register access.""" self.assertEqual(len(self.inst.getReadRegisters()), 2, "access RAX and RBX") self.assertEqual(len(self.inst.getWrittenRegisters()), 8, "write in RAX, RIP, AF, XF, OF, PF, SF and ZF") def test_taints(self): """Check taints attributes.""" self.assertFalse(self.inst.isTainted()) def test_prefix(self): """Check prefix data.""" self.assertFalse(self.inst.isPrefixed()) self.assertEqual(self.inst.getPrefix(), PREFIX.INVALID) def test_control_flow(self): """Check control flow flags.""" self.assertFalse(self.inst.isControlFlow(), "It is not a jmp, ret or call") self.assertFalse(self.inst.isBranch(), "It is not a jmp") def test_condition(self): """Check condition flags.""" self.assertFalse(self.inst.isConditionTaken()) def test_opcode(self): """Check opcode informations.""" self.assertEqual(self.inst.getOpcode(), "\x48\x01\xd8") self.assertEqual(self.inst.getType(), OPCODE.ADD) def test_thread(self): """Check threads information.""" self.assertEqual(self.inst.getThreadId(), 0) def test_operand(self): """Check operand information.""" self.assertEqual(len(self.inst.getOperands()), 2) self.assertEqual(self.inst.getOperands()[0].getName(), "rax") self.assertEqual(self.inst.getOperands()[1].getName(), "rbx") with self.assertRaises(Exception): self.inst.getOperands()[2] def test_symbolic(self): """Check symbolic information.""" self.assertEqual(len(self.inst.getSymbolicExpressions()), 8) def test_size(self): """Check size information.""" self.assertEqual(self.inst.getSize(), 3) def test_disassembly(self): """Check disassembly equivalent.""" self.assertEqual(self.inst.getDisassembly(), "add rax, rbx")
class TestInstruction(unittest.TestCase): """Testing the Instruction class.""" def setUp(self): """Define and process the instruction to test.""" self.Triton = TritonContext() self.Triton.setArchitecture(ARCH.X86_64) self.inst = Instruction() self.inst.setOpcode(b"\x48\x01\xd8") # add rax, rbx self.inst.setAddress(0x400000) self.Triton.setConcreteRegisterValue(self.Triton.registers.rax, 0x1122334455667788) self.Triton.setConcreteRegisterValue(self.Triton.registers.rbx, 0x8877665544332211) self.Triton.processing(self.inst) def test_address(self): """Check instruction current and next address.""" self.assertEqual(self.inst.getAddress(), 0x400000) self.assertEqual(self.inst.getNextAddress(), 0x400003) inst = Instruction() inst.setAddress(-1) self.assertEqual(inst.getAddress(), 0xffffffffffffffff) inst.setAddress(-2) self.assertEqual(inst.getAddress(), 0xfffffffffffffffe) inst.setAddress(-3) self.assertEqual(inst.getAddress(), 0xfffffffffffffffd) def test_memory(self): """Check memory access.""" self.assertListEqual(self.inst.getLoadAccess(), []) self.assertListEqual(self.inst.getStoreAccess(), []) self.assertFalse(self.inst.isMemoryWrite()) self.assertFalse(self.inst.isMemoryRead()) def test_registers(self): """Check register access.""" self.assertEqual(len(self.inst.getReadRegisters()), 2, "access RAX and RBX") self.assertEqual(len(self.inst.getWrittenRegisters()), 8, "write in RAX, RIP, AF, XF, OF, PF, SF and ZF") def test_taints(self): """Check taints attributes.""" self.assertFalse(self.inst.isTainted()) def test_prefix(self): """Check prefix data.""" self.assertFalse(self.inst.isPrefixed()) self.assertEqual(self.inst.getPrefix(), PREFIX.X86.INVALID) def test_control_flow(self): """Check control flow flags.""" self.assertFalse(self.inst.isControlFlow(), "It is not a jmp, ret or call") self.assertFalse(self.inst.isBranch(), "It is not a jmp") def test_condition(self): """Check condition flags.""" self.assertFalse(self.inst.isConditionTaken()) def test_opcode(self): """Check opcode informations.""" self.assertEqual(self.inst.getOpcode(), b"\x48\x01\xd8") self.assertEqual(self.inst.getType(), OPCODE.X86.ADD) def test_thread(self): """Check threads information.""" self.assertEqual(self.inst.getThreadId(), 0) def test_operand(self): """Check operand information.""" self.assertEqual(len(self.inst.getOperands()), 2) self.assertEqual(self.inst.getOperands()[0].getName(), "rax") self.assertEqual(self.inst.getOperands()[1].getName(), "rbx") with self.assertRaises(Exception): self.inst.getOperands()[2] def test_symbolic(self): """Check symbolic information.""" self.assertEqual(len(self.inst.getSymbolicExpressions()), 8) def test_size(self): """Check size information.""" self.assertEqual(self.inst.getSize(), 3) def test_disassembly(self): """Check disassembly equivalent.""" self.assertEqual(self.inst.getDisassembly(), "add rax, rbx")
def emulate(pc, index, y, targetadd): Triton.concretizeAllRegister() Triton.concretizeAllMemory() x = 0 #Triton.buildSymbolicRegister(Triton.registers.eax).evaluate() Triton.setConcreteRegisterValue(Triton.registers.ebp, 0x6ffffffb) Triton.setConcreteRegisterValue(Triton.registers.ebp, 0x6fffffff) esp = Triton.buildSymbolicRegister(Triton.registers.ebp).evaluate() address = 28 addressv = 234 Triton.setConcreteMemoryValue(esp + 12, address) Triton.setConcreteMemoryValue(address, addressv) #Triton.setConcreteMemoryAreaValue(address,CPUSIZE.WORD,addressv) #print 'index',index for i in range(index + 1): #index=index-1 Triton.setConcreteMemoryValue(addressv, ord('A')) #print 'A' addressv = addressv + 1 if (y == 1): print 'This Input its is going to given/invalid address' strin = "" for j in range(index): strin = strin + 'A' print strin, hex(targetadd) #, type(targetadd) #Triton.setConcreteMemoryValue(MemoryAccess(addressv,CPUSIZE.DWORD),targetadd) #inte = int(targetadd[2:3]) #print unichr(inte) #+ targetadd[0]+targetadd[1]+targetadd[2]+targetadd[3]+targetadd[4]+targetadd[5]+targetadd[6] #Triton.setConcreteMemoryAreaValue(address,CPUSIZE.WORD,addressv) while pc: # Fetch opcodes opcodes = Triton.getConcreteMemoryAreaValue(pc, 16) # Create the Triton instruction instruction = Instruction() instruction.setOpcode(opcodes) instruction.setAddress(pc) # Process Triton.processing(instruction) #print instruction if (instruction.isControlFlow()): x = x + 1 if instruction.getType() == OPCODE.INT: pc = instruction.getNextAddress() y = Triton.buildSymbolicRegister(Triton.registers.eax).evaluate() #y = getConcreteRegisterValue(REG.EAX) if y == 1: break continue # Next pc = Triton.buildSymbolicRegister(Triton.registers.eip).evaluate() #print pc if (pc == 28): #print "reached" return 5 #print 'The number of control transfer instructions are :' #print x return 1
def emulate(pc, sgx_ocall, sgx_free, is_threaded): count = 0 policies.init_emulator() policies.init_thread_env() while pc and count < MAX_INST_CNT: if (not policies.is_thread_unlocked()): continue if is_threaded: emul_thread_lock.acquire() opcode = Triton.getConcreteMemoryAreaValue(pc, 16) instruction = Instruction() instruction.setOpcode(opcode) instruction.setAddress(pc) try: ret = Triton.processing(instruction) if not ret: if WARN_DEBUG: print( '[LIMITATION] unsupported instruction at 0x%x' % (pc)) Triton.setConcreteRegisterValue(Triton.registers.rip, instruction.getNextAddress()) except: if WARN_DEBUG: print('[EXCEPTION] instruction process error ...') if('\xf3\x0f\x1e\xfa' in opcode): Triton.setConcreteRegisterValue(Triton.registers.rip, pc + 0x4) else: break count += 1 inst_ring_buffer[instruction.getAddress()] = True if (PRINT_INST_DEBUG and instruction.getType() == OPCODE.X86.RET): ret_addr = Triton.getConcreteRegisterValue(Triton.registers.rip) print('[INSTRUCTION] return instruction: ', instruction) print('[INSTRUCTION] return to: 0x%x' % ret_addr) if (PRINT_INST_DEBUG and instruction.getType() == OPCODE.X86.CALL): print('[INSTRUCTION] call instruction: ', instruction) policies.push_inst_to_ring_buffer(instruction) policies.inspection(instruction) if (instruction.getDisassembly() == sgx_ocall or instruction.getDisassembly() == sgx_free): force_return_to_callsite(0x0) if (instruction.getType() == OPCODE.X86.XGETBV): Triton.setConcreteRegisterValue(Triton.registers.rip, instruction.getNextAddress()) if instruction.getType() == OPCODE.X86.HLT: if is_threaded: emul_thread_lock.release() break if (not hook_process_inst(instruction)): if is_threaded: emul_thread_lock.release() break if (policies.is_report_avl()): print_report() policies.clear_last_report() if is_threaded: emul_thread_lock.release() break pc = Triton.getConcreteRegisterValue(Triton.registers.rip) del instruction if is_threaded: emul_thread_lock.release() if (count % 10000 == 0): gc.collect() policies.exit_emulator() policies.destroy_thread_env() return (count)