def setUp(self):
self._arch_info = X86ArchitectureInformation(ARCH_X86_MODE_32)
self._emulator = ReilEmulator(self._arch_info)
self._asm_parser = X86Parser(ARCH_X86_MODE_32)
self._reil_parser = ReilParser()
self._translator = X86Translator(ARCH_X86_MODE_32)
def setUp(self):
self._address_size = 32
self._parser = ReilParser()
self._solver = SmtSolver()
self._translator = SmtTranslator(self._solver, self._address_size)
self._arch_info = X86ArchitectureInformation(ARCH_X86_MODE_32)
self._translator.set_arch_alias_mapper(self._arch_info.alias_mapper)
self._translator.set_arch_registers_size(self._arch_info.registers_size)
def setUp(self):
self._arch_info = X86ArchitectureInformation(ARCH_X86_MODE_32)
self._emulator = ReilEmulator(self._arch_info)
self._asm_parser = X86Parser(ARCH_X86_MODE_32)
self._reil_parser = ReilParser()
self._translator = X86Translator(ARCH_X86_MODE_32)
class ReilParserTests(unittest.TestCase):
def setUp(self):
self._parser = ReilParser()
def test_add(self):
instrs = ["str [eax, EMPTY, t0]"]
instrs += ["str [ebx, EMPTY, t1]"]
instrs += ["add [t0, t1, t2]"]
instrs += ["str [t2, EMPTY, eax]"]
instrs_parse = self._parser.parse(instrs)
self.assertEqual(str(instrs_parse[0]),
"str [UNK eax, EMPTY, UNK t0]")
self.assertEqual(str(instrs_parse[1]),
"str [UNK ebx, EMPTY, UNK t1]")
self.assertEqual(str(instrs_parse[2]),
"add [UNK t0, UNK t1, UNK t2]")
self.assertEqual(str(instrs_parse[3]),
"str [UNK t2, EMPTY, UNK eax]")
def test_parse_operand_size(self):
instrs = ["str [DWORD eax, EMPTY, DWORD t0]"]
instrs += ["str [eax, EMPTY, DWORD t0]"]
instrs += ["str [eax, EMPTY, t0]"]
instrs_parse = self._parser.parse(instrs)
self.assertEqual(instrs_parse[0].operands[0].size, 32)
self.assertEqual(instrs_parse[0].operands[1].size, 0)
self.assertEqual(instrs_parse[0].operands[2].size, 32)
self.assertEqual(instrs_parse[1].operands[0].size, None)
self.assertEqual(instrs_parse[1].operands[1].size, 0)
self.assertEqual(instrs_parse[1].operands[2].size, 32)
self.assertEqual(instrs_parse[2].operands[0].size, None)
self.assertEqual(instrs_parse[2].operands[1].size, 0)
self.assertEqual(instrs_parse[2].operands[2].size, None)
class ReilParserTests(unittest.TestCase):
def setUp(self):
self._parser = ReilParser()
def test_add(self):
instrs = ["str [eax, EMPTY, t0]"]
instrs += ["str [ebx, EMPTY, t1]"]
instrs += ["add [t0, t1, t2]"]
instrs += ["str [t2, EMPTY, eax]"]
instrs_parse = self._parser.parse(instrs)
self.assertEqual(str(instrs_parse[0]), "str [UNK eax, EMPTY, UNK t0]")
self.assertEqual(str(instrs_parse[1]), "str [UNK ebx, EMPTY, UNK t1]")
self.assertEqual(str(instrs_parse[2]), "add [UNK t0, UNK t1, UNK t2]")
self.assertEqual(str(instrs_parse[3]), "str [UNK t2, EMPTY, UNK eax]")
def test_parse_operand_size(self):
instrs = ["str [DWORD eax, EMPTY, DWORD t0]"]
instrs += ["str [eax, EMPTY, DWORD t0]"]
instrs += ["str [eax, EMPTY, t0]"]
instrs_parse = self._parser.parse(instrs)
self.assertEqual(instrs_parse[0].operands[0].size, 32)
self.assertEqual(instrs_parse[0].operands[1].size, 0)
self.assertEqual(instrs_parse[0].operands[2].size, 32)
self.assertEqual(instrs_parse[1].operands[0].size, None)
self.assertEqual(instrs_parse[1].operands[1].size, 0)
self.assertEqual(instrs_parse[1].operands[2].size, 32)
self.assertEqual(instrs_parse[2].operands[0].size, None)
self.assertEqual(instrs_parse[2].operands[1].size, 0)
self.assertEqual(instrs_parse[2].operands[2].size, None)
def setUp(self):
self._parser = ReilParser()
def setUp(self):
self._address_size = 32
self._parser = ReilParser()
self._solver = SmtSolver()
class SmtTranslatorTests(unittest.TestCase):
def setUp(self):
self._address_size = 32
self._parser = ReilParser()
self._solver = SmtSolver()
self._translator = SmtTranslator(self._solver, self._address_size)
self._arch_info = X86ArchitectureInformation(ARCH_X86_MODE_32)
self._translator.set_arch_alias_mapper(self._arch_info.alias_mapper)
self._translator.set_arch_registers_size(
self._arch_info.registers_size)
# Arithmetic Instructions
def test_translate_add_1(self):
# Same size operands.
instr = self._parser.parse(["add [BYTE t0, BYTE t1, BYTE t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value, "(= t2_1 (bvadd t0_0 t1_0))")
def test_translate_add_2(self):
# Destination operand larger than source operands.
instr = self._parser.parse(["add [BYTE t0, BYTE t1, WORD t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(
form[0].value,
"(= t2_1 (bvadd ((_ zero_extend 8) t0_0) ((_ zero_extend 8) t1_0)))"
)
def test_translate_add_3(self):
# Destination operand smaller than source operands.
instr = self._parser.parse(["add [WORD t0, WORD t1, BYTE t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value,
"(= t2_1 ((_ extract 7 0) (bvadd t0_0 t1_0)))")
def test_translate_add_4(self):
# Mixed source operands.
instr = self._parser.parse(["add [BYTE t0, BYTE 0x12, WORD t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(
form[0].value,
"(= t2_1 (bvadd ((_ zero_extend 8) t0_0) ((_ zero_extend 8) #x12)))"
)
def test_translate_sub(self):
instr = self._parser.parse(["sub [BYTE t0, BYTE t1, BYTE t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value, "(= t2_1 (bvsub t0_0 t1_0))")
def test_translate_mul(self):
instr = self._parser.parse(["mul [BYTE t0, BYTE t1, BYTE t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value, "(= t2_1 (bvmul t0_0 t1_0))")
def test_translate_div(self):
instr = self._parser.parse(["div [BYTE t0, BYTE t1, BYTE t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value, "(= t2_1 (bvudiv t0_0 t1_0))")
def test_translate_mod(self):
instr = self._parser.parse(["mod [BYTE t0, BYTE t1, BYTE t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value, "(= t2_1 (bvurem t0_0 t1_0))")
def test_translate_bsh(self):
instr = self._parser.parse(["bsh [DWORD t0, DWORD t1, DWORD t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(
form[0].value,
"(= t2_1 (ite (bvsge t1_0 #x00000000) (bvshl t0_0 t1_0) (bvlshr t0_0 (bvneg t1_0))))"
)
# Bitwise Instructions
def test_translate_and(self):
instr = self._parser.parse(["and [BYTE t0, BYTE t1, BYTE t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value, "(= t2_1 (bvand t0_0 t1_0))")
def test_translate_or(self):
instr = self._parser.parse(["or [BYTE t0, BYTE t1, BYTE t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value, "(= t2_1 (bvor t0_0 t1_0))")
def test_translate_xor(self):
instr = self._parser.parse(["xor [BYTE t0, BYTE t1, BYTE t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value, "(= t2_1 (bvxor t0_0 t1_0))")
# Data Transfer Instructions
def test_translate_ldm(self):
instr = self._parser.parse(["ldm [DWORD t0, empty, BYTE t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value,
"(= (select MEM_0 (bvadd t0_0 #x00000000)) t2_1)")
def test_translate_stm(self):
instr = self._parser.parse(["stm [BYTE t0, empty, DWORD t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(
form[0].value,
"(= MEM_1 (store MEM_0 (bvadd t2_0 #x00000000) t0_0))")
def test_translate_str(self):
instr = self._parser.parse(["str [BYTE t0, empty, BYTE t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value, "(= t2_1 t0_0)")
# Conditional Instructions
def test_translate_bisz(self):
instr = self._parser.parse(["bisz [DWORD t0, empty, DWORD t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(
form[0].value,
"(= t2_1 (ite (= t0_0 #x00000000) #x00000001 #x00000000))")
def test_translate_jcc(self):
instr = self._parser.parse(["jcc [BIT t0, empty, DWORD t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value, "(not (= t0_0 #b0))")
# Other Instructions
def test_translate_undef(self):
instr = self._parser.parse(["undef [empty, empty, DWORD t2]"])[0]
with self.assertRaises(Exception) as context:
self._translator.translate(instr)
self.assertTrue("Unsupported instruction : UNDEF" in context.exception)
def test_translate_unkn(self):
instr = self._parser.parse(["unkn [empty, empty, empty]"])[0]
with self.assertRaises(Exception) as context:
self._translator.translate(instr)
self.assertTrue("Unsupported instruction : UNKN" in context.exception)
def test_translate_nop(self):
instr = self._parser.parse(["nop [empty, empty, empty]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 0)
# Extensions
def test_translate_sext(self):
instr = self._parser.parse(["sext [BYTE t0, empty, WORD t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value, "(= t2_1 ((_ sign_extend 8) t0_0))")
def test_translate_sdiv(self):
instr = self._parser.parse(["sdiv [BYTE t0, BYTE t1, BYTE t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value, "(= t2_1 (bvsdiv t0_0 t1_0))")
def test_translate_smod(self):
instr = self._parser.parse(["smod [BYTE t0, BYTE t1, BYTE t2]"])[0]
form = self._translator.translate(instr)
self.assertEqual(len(form), 1)
self.assertEqual(form[0].value, "(= t2_1 (bvsmod t0_0 t1_0))")
class ReilEmulatorTests(unittest.TestCase):
def setUp(self):
self._arch_info = X86ArchitectureInformation(ARCH_X86_MODE_32)
self._emulator = ReilEmulator(self._arch_info)
self._asm_parser = X86Parser(ARCH_X86_MODE_32)
self._reil_parser = ReilParser()
self._translator = X86Translator(ARCH_X86_MODE_32)
def test_add(self):
asm_instrs = self._asm_parser.parse("add eax, ebx")
self.__set_address(0xdeadbeef, [asm_instrs])
reil_instrs = self._translator.translate(asm_instrs)
regs_initial = {
"eax": 0x1,
"ebx": 0x2,
}
regs_final, _ = self._emulator.execute_lite(reil_instrs,
context=regs_initial)
self.assertEqual(regs_final["eax"], 0x3)
self.assertEqual(regs_final["ebx"], 0x2)
def test_loop(self):
# 0x08048060 : b8 00 00 00 00 mov eax,0x0
# 0x08048065 : bb 0a 00 00 00 mov ebx,0xa
# 0x0804806a : 83 c0 01 add eax,0x1
# 0x0804806d : 83 eb 01 sub ebx,0x1
# 0x08048070 : 83 fb 00 cmp ebx,0x0
# 0x08048073 : 75 f5 jne 0x0804806a
asm_instrs_str = [(0x08048060, "mov eax,0x0", 5)]
asm_instrs_str += [(0x08048065, "mov ebx,0xa", 5)]
asm_instrs_str += [(0x0804806a, "add eax,0x1", 3)]
asm_instrs_str += [(0x0804806d, "sub ebx,0x1", 3)]
asm_instrs_str += [(0x08048070, "cmp ebx,0x0", 3)]
asm_instrs_str += [(0x08048073, "jne 0x0804806a", 2)]
asm_instrs = []
for addr, asm, size in asm_instrs_str:
asm_instr = self._asm_parser.parse(asm)
asm_instr.address = addr
asm_instr.size = size
asm_instrs.append(asm_instr)
reil_instrs = self.__translate(asm_instrs)
regs_final, _ = self._emulator.execute(reil_instrs,
start=0x08048060 << 8)
self.assertEqual(regs_final["eax"], 0xa)
self.assertEqual(regs_final["ebx"], 0x0)
def test_mov(self):
asm_instrs = [self._asm_parser.parse("mov eax, 0xdeadbeef")]
asm_instrs += [self._asm_parser.parse("mov al, 0x12")]
asm_instrs += [self._asm_parser.parse("mov ah, 0x34")]
self.__set_address(0xdeadbeef, asm_instrs)
reil_instrs = self._translator.translate(asm_instrs[0])
reil_instrs += self._translator.translate(asm_instrs[1])
reil_instrs += self._translator.translate(asm_instrs[2])
regs_initial = {
"eax": 0xffffffff,
}
regs_final, _ = self._emulator.execute_lite(reil_instrs,
context=regs_initial)
self.assertEqual(regs_final["eax"], 0xdead3412)
def test_pre_handler(self):
def pre_handler(emulator, instruction, parameter):
paramter.append(True)
asm = ["mov eax, ebx"]
x86_instrs = [self._asm_parser.parse(i) for i in asm]
self.__set_address(0xdeadbeef, x86_instrs)
reil_instrs = [self._translator.translate(i) for i in x86_instrs]
paramter = []
self._emulator.set_instruction_pre_handler(pre_handler, paramter)
reil_ctx_out, reil_mem_out = self._emulator.execute_lite(
reil_instrs[0])
self.assertTrue(len(paramter) > 0)
def test_post_handler(self):
def post_handler(emulator, instruction, parameter):
paramter.append(True)
asm = ["mov eax, ebx"]
x86_instrs = [self._asm_parser.parse(i) for i in asm]
self.__set_address(0xdeadbeef, x86_instrs)
reil_instrs = [self._translator.translate(i) for i in x86_instrs]
paramter = []
self._emulator.set_instruction_post_handler(post_handler, paramter)
_, _ = self._emulator.execute_lite(reil_instrs[0])
self.assertTrue(len(paramter) > 0)
def test_zero_division_error_1(self):
asm_instrs = [self._asm_parser.parse("div ebx")]
self.__set_address(0xdeadbeef, asm_instrs)
reil_instrs = self._translator.translate(asm_instrs[0])
regs_initial = {
"eax": 0x2,
"edx": 0x2,
"ebx": 0x0,
}
self.assertRaises(ReilCpuZeroDivisionError,
self._emulator.execute_lite,
reil_instrs,
context=regs_initial)
def test_zero_division_error_2(self):
instrs = ["mod [DWORD eax, DWORD ebx, DWORD t0]"]
reil_instrs = self._reil_parser.parse(instrs)
reil_instrs[0].address = 0xdeadbeef00
regs_initial = {
"eax": 0x2,
"ebx": 0x0,
}
self.assertRaises(ReilCpuZeroDivisionError,
self._emulator.execute_lite,
reil_instrs,
context=regs_initial)
def test_invalid_address_error_1(self):
asm_instrs = [self._asm_parser.parse("jmp eax")]
self.__set_address(0xdeadbeef, asm_instrs)
reil_instrs = self.__translate(asm_instrs)
regs_initial = {
"eax": 0xffffffff,
}
self.assertRaises(ReilCpuInvalidAddressError,
self._emulator.execute,
reil_instrs,
start=0xdeadbeef << 8,
registers=regs_initial)
def test_invalid_address_error_2(self):
asm_instrs = [self._asm_parser.parse("mov eax, 0xdeadbeef")]
self.__set_address(0xdeadbeef, asm_instrs)
reil_instrs = self.__translate(asm_instrs)
regs_initial = {
"eax": 0xffffffff,
}
self.assertRaises(ReilCpuInvalidAddressError,
self._emulator.execute,
reil_instrs,
start=0xdeadbef0 << 8,
registers=regs_initial)
# Auxiliary methods
# ======================================================================== #
def __set_address(self, address, asm_instrs):
addr = address
for asm_instr in asm_instrs:
asm_instr.address = addr
addr += 1
def __translate(self, asm_instrs):
instr_container = ReilContainer()
asm_instr_last = None
instr_seq_prev = None
for asm_instr in asm_instrs:
instr_seq = ReilSequence()
for reil_instr in self._translator.translate(asm_instr):
instr_seq.append(reil_instr)
if instr_seq_prev:
instr_seq_prev.next_sequence_address = instr_seq.address
instr_container.add(instr_seq)
instr_seq_prev = instr_seq
if instr_seq_prev:
if asm_instr_last:
instr_seq_prev.next_sequence_address = (
asm_instr_last.address + asm_instr_last.size) << 8
# instr_container.dump()
return instr_container
def setUp(self):
self.__address_size = 32
self.__parser = ReilParser()
class ReilCpuTests(unittest.TestCase):
def setUp(self):
self.__address_size = 32
self.__parser = ReilParser()
# Arithmetic Instructions
def test_add(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["add [DWORD t0, DWORD t1, DWORD t2]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
t1 = 0x1234
cpu.registers['t0'] = t0
cpu.registers['t1'] = t1
cpu.execute(instr)
self.assertEquals(t0 + t1, cpu.registers['t2'])
def test_sub(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["sub [DWORD t0, DWORD t1, DWORD t2]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
t1 = 0x1234
cpu.registers['t0'] = t0
cpu.registers['t1'] = t1
cpu.execute(instr)
self.assertEquals(t0 - t1, cpu.registers['t2'])
def test_mul(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["mul [DWORD t0, DWORD t1, DWORD t2]"])[0]
instr.address = 0xcafecafe00
t0 = 0x1234
t1 = 0x1234
cpu.registers['t0'] = t0
cpu.registers['t1'] = t1
cpu.execute(instr)
self.assertEquals(t0 * t1, cpu.registers['t2'])
def test_div(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["div [DWORD t0, DWORD t1, DWORD t2]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
t1 = 0x1234
cpu.registers['t0'] = t0
cpu.registers['t1'] = t1
cpu.execute(instr)
self.assertEquals(t0 // t1, cpu.registers['t2'])
def test_mod(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["mod [DWORD t0, DWORD t1, DWORD t2]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
t1 = 0x1234
cpu.registers['t0'] = t0
cpu.registers['t1'] = t1
cpu.execute(instr)
self.assertEquals(t0 % t1, cpu.registers['t2'])
def test_bsh_left(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["bsh [DWORD t0, DWORD t1, DWORD t2]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
t1 = 0x8
cpu.registers['t0'] = t0
cpu.registers['t1'] = t1
cpu.execute(instr)
self.assertEquals((t0 << t1) & 2**32 - 1, cpu.registers['t2'])
def test_bsh_rigt(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["bsh [DWORD t0, DWORD t1, DWORD t2]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
t1 = 0x8
cpu.registers['t0'] = t0
cpu.registers['t1'] = -t1
cpu.execute(instr)
self.assertEquals(t0 >> t1, cpu.registers['t2'])
# Bitwise Instructions
def test_and(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["and [DWORD t0, DWORD t1, DWORD t2]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
t1 = 0x1234
cpu.registers['t0'] = t0
cpu.registers['t1'] = t1
cpu.execute(instr)
self.assertEquals(t0 & t1, cpu.registers['t2'])
def test_or(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["or [DWORD t0, DWORD t1, DWORD t2]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
t1 = 0x1234
cpu.registers['t0'] = t0
cpu.registers['t1'] = t1
cpu.execute(instr)
self.assertEquals(t0 | t1, cpu.registers['t2'])
def test_xor(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["xor [DWORD t0, DWORD t1, DWORD t2]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
t1 = 0x1234
cpu.registers['t0'] = t0
cpu.registers['t1'] = t1
cpu.execute(instr)
self.assertEquals(t0 ^ t1, cpu.registers['t2'])
# Data Transfer Instructions
def test_ldm(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["ldm [DWORD t0, EMPTY, DWORD t1]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
t1 = 0x1234
cpu.registers['t0'] = t0
cpu.memory.write(t0, 4, t1)
cpu.execute(instr)
self.assertEquals(t1, cpu.registers['t1'])
def test_stm(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["stm [DWORD t0, EMPTY, DWORD t1]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
t1 = 0x1234
cpu.registers['t0'] = t0
cpu.registers['t1'] = t1
cpu.execute(instr)
self.assertEquals(t0, cpu.memory.read(t1, 4))
def test_str(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["str [DWORD t0, EMPTY, DWORD t1]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
cpu.registers['t0'] = t0
cpu.execute(instr)
self.assertEquals(t0, cpu.registers['t1'])
# Conditional Instructions
def test_bisz(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["BISZ [DWORD t0, EMPTY, BIT t1]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
cpu.registers['t0'] = t0
cpu.execute(instr)
self.assertEquals(1 if t0 == 0 else 0, cpu.registers['t1'])
def test_jcc(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["jcc [BIT t0, EMPTY, POINTER t1]"])[0]
instr.address = 0xcafecafe00
t0 = 0x1
t1 = 0x1234567800
cpu.registers['t0'] = t0
cpu.registers['t1'] = t1
next_ip = cpu.execute(instr)
self.assertEquals(t1, next_ip)
# Extensions
def test_sext(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["sext [DWORD t0, EMPTY, QWORD t1]"])[0]
instr.address = 0xcafecafe00
t0 = 0x12345678
cpu.registers['t0'] = -t0 & 2**32 - 1
cpu.execute(instr)
self.assertEquals(-t0 & 2**64 - 1, cpu.registers['t1'])
def test_sdiv(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["sdiv [DWORD t0, DWORD t1, DWORD t2]"])[0]
instr.address = 0xcafecafe00
t0 = -0x12345678
t1 = -0x1234
cpu.registers['t0'] = t0
cpu.registers['t1'] = t1
cpu.execute(instr)
self.assertEquals(t0 // t1, cpu.registers['t2'])
def test_smod(self):
mem = ReilMemoryEx(self.__address_size)
cpu = ReilCpu(mem)
instr = self.__parser.parse(["smod [DWORD t0, DWORD t1, DWORD t2]"])[0]
instr.address = 0xcafecafe00
t0 = -0x12345678
t1 = -0x1234
cpu.registers['t0'] = t0
cpu.registers['t1'] = t1
cpu.execute(instr)
self.assertEquals((t0 % t1) & 2**32 - 1, cpu.registers['t2'])
class ReilEmulatorTests(unittest.TestCase):
def setUp(self):
self._arch_info = X86ArchitectureInformation(ARCH_X86_MODE_32)
self._emulator = ReilEmulator(self._arch_info)
self._asm_parser = X86Parser(ARCH_X86_MODE_32)
self._reil_parser = ReilParser()
self._translator = X86Translator(ARCH_X86_MODE_32)
def test_add(self):
asm_instrs = self._asm_parser.parse("add eax, ebx")
self.__set_address(0xdeadbeef, [asm_instrs])
reil_instrs = self._translator.translate(asm_instrs)
regs_initial = {
"eax" : 0x1,
"ebx" : 0x2,
}
regs_final, _ = self._emulator.execute_lite(
reil_instrs,
context=regs_initial
)
self.assertEqual(regs_final["eax"], 0x3)
self.assertEqual(regs_final["ebx"], 0x2)
def test_loop(self):
# 0x08048060 : b8 00 00 00 00 mov eax,0x0
# 0x08048065 : bb 0a 00 00 00 mov ebx,0xa
# 0x0804806a : 83 c0 01 add eax,0x1
# 0x0804806d : 83 eb 01 sub ebx,0x1
# 0x08048070 : 83 fb 00 cmp ebx,0x0
# 0x08048073 : 75 f5 jne 0x0804806a
asm_instrs_str = [(0x08048060, "mov eax,0x0", 5)]
asm_instrs_str += [(0x08048065, "mov ebx,0xa", 5)]
asm_instrs_str += [(0x0804806a, "add eax,0x1", 3)]
asm_instrs_str += [(0x0804806d, "sub ebx,0x1", 3)]
asm_instrs_str += [(0x08048070, "cmp ebx,0x0", 3)]
asm_instrs_str += [(0x08048073, "jne 0x0804806a", 2)]
asm_instrs = []
for addr, asm, size in asm_instrs_str:
asm_instr = self._asm_parser.parse(asm)
asm_instr.address = addr
asm_instr.size = size
asm_instrs.append(asm_instr)
reil_instrs = self.__translate(asm_instrs)
regs_final, _ = self._emulator.execute(
reil_instrs,
start=0x08048060 << 8
)
self.assertEqual(regs_final["eax"], 0xa)
self.assertEqual(regs_final["ebx"], 0x0)
def test_mov(self):
asm_instrs = [self._asm_parser.parse("mov eax, 0xdeadbeef")]
asm_instrs += [self._asm_parser.parse("mov al, 0x12")]
asm_instrs += [self._asm_parser.parse("mov ah, 0x34")]
self.__set_address(0xdeadbeef, asm_instrs)
reil_instrs = self._translator.translate(asm_instrs[0])
reil_instrs += self._translator.translate(asm_instrs[1])
reil_instrs += self._translator.translate(asm_instrs[2])
regs_initial = {
"eax" : 0xffffffff,
}
regs_final, _ = self._emulator.execute_lite(reil_instrs, context=regs_initial)
self.assertEqual(regs_final["eax"], 0xdead3412)
def test_pre_handler(self):
def pre_handler(emulator, instruction, parameter):
paramter.append(True)
asm = ["mov eax, ebx"]
x86_instrs = [self._asm_parser.parse(i) for i in asm]
self.__set_address(0xdeadbeef, x86_instrs)
reil_instrs = [self._translator.translate(i) for i in x86_instrs]
paramter = []
self._emulator.set_instruction_pre_handler(pre_handler, paramter)
reil_ctx_out, reil_mem_out = self._emulator.execute_lite(
reil_instrs[0]
)
self.assertTrue(len(paramter) > 0)
def test_post_handler(self):
def post_handler(emulator, instruction, parameter):
paramter.append(True)
asm = ["mov eax, ebx"]
x86_instrs = [self._asm_parser.parse(i) for i in asm]
self.__set_address(0xdeadbeef, x86_instrs)
reil_instrs = [self._translator.translate(i) for i in x86_instrs]
paramter = []
self._emulator.set_instruction_post_handler(post_handler, paramter)
_, _ = self._emulator.execute_lite(
reil_instrs[0]
)
self.assertTrue(len(paramter) > 0)
def test_zero_division_error_1(self):
asm_instrs = [self._asm_parser.parse("div ebx")]
self.__set_address(0xdeadbeef, asm_instrs)
reil_instrs = self._translator.translate(asm_instrs[0])
regs_initial = {
"eax" : 0x2,
"edx" : 0x2,
"ebx" : 0x0,
}
self.assertRaises(ReilCpuZeroDivisionError, self._emulator.execute_lite, reil_instrs, context=regs_initial)
def test_zero_division_error_2(self):
instrs = ["mod [DWORD eax, DWORD ebx, DWORD t0]"]
reil_instrs = self._reil_parser.parse(instrs)
reil_instrs[0].address = 0xdeadbeef00
regs_initial = {
"eax" : 0x2,
"ebx" : 0x0,
}
self.assertRaises(ReilCpuZeroDivisionError, self._emulator.execute_lite, reil_instrs, context=regs_initial)
def test_invalid_address_error_1(self):
asm_instrs = [self._asm_parser.parse("jmp eax")]
self.__set_address(0xdeadbeef, asm_instrs)
reil_instrs = self.__translate(asm_instrs)
regs_initial = {
"eax" : 0xffffffff,
}
self.assertRaises(ReilCpuInvalidAddressError, self._emulator.execute, reil_instrs, start=0xdeadbeef << 8, registers=regs_initial)
def test_invalid_address_error_2(self):
asm_instrs = [self._asm_parser.parse("mov eax, 0xdeadbeef")]
self.__set_address(0xdeadbeef, asm_instrs)
reil_instrs = self.__translate(asm_instrs)
regs_initial = {
"eax" : 0xffffffff,
}
self.assertRaises(ReilCpuInvalidAddressError, self._emulator.execute, reil_instrs, start=0xdeadbef0 << 8, registers=regs_initial)
# Auxiliary methods
# ======================================================================== #
def __set_address(self, address, asm_instrs):
addr = address
for asm_instr in asm_instrs:
asm_instr.address = addr
addr += 1
def __translate(self, asm_instrs):
instr_container = ReilContainer()
asm_instr_last = None
instr_seq_prev = None
for asm_instr in asm_instrs:
instr_seq = ReilSequence()
for reil_instr in self._translator.translate(asm_instr):
instr_seq.append(reil_instr)
if instr_seq_prev:
instr_seq_prev.next_sequence_address = instr_seq.address
instr_container.add(instr_seq)
instr_seq_prev = instr_seq
if instr_seq_prev:
if asm_instr_last:
instr_seq_prev.next_sequence_address = (asm_instr_last.address + asm_instr_last.size) << 8
# instr_container.dump()
return instr_container