def test_composite_solver():
s = claripy.CompositeFrontend(claripy.backend_z3)
x = claripy.BitVec("x", 32)
y = claripy.BitVec("y", 32)
z = claripy.BitVec("z", 32)
c = claripy.And(x == 1, y == 2, z == 3)
s.add(c)
nose.tools.assert_equals(len(s._solver_list),
4) # including the CONSTANT solver
nose.tools.assert_true(s.satisfiable())
s.add(x < y)
nose.tools.assert_equal(len(s._solver_list), 3)
nose.tools.assert_true(s.satisfiable())
s.simplify()
nose.tools.assert_equal(len(s._solver_list), 4)
nose.tools.assert_true(s.satisfiable())
s1 = s.branch()
s1.add(x > y)
nose.tools.assert_equal(len(s1._solver_list), 3)
nose.tools.assert_false(s1.satisfiable())
nose.tools.assert_equal(len(s._solver_list), 4)
nose.tools.assert_true(s.satisfiable())
s.add(claripy.BitVecVal(1, 32) == claripy.BitVecVal(2, 32))
nose.tools.assert_equal(len(s._solver_list), 4) # the CONCRETE one
nose.tools.assert_false(s.satisfiable())
def raw_solver_branching(solver_type):
s = solver_type(claripy.backend_z3)
x = claripy.BitVec("x", 32)
y = claripy.BitVec("y", 32)
s.add(claripy.UGT(x, y))
s.add(claripy.ULT(x, 10))
nose.tools.assert_greater(s.eval(x, 1)[0], 0)
t = s.branch()
if isinstance(s, claripy.FullFrontend):
nose.tools.assert_is(s._tls.solver, t._tls.solver)
nose.tools.assert_true(s._finalized)
nose.tools.assert_true(t._finalized)
t.add(x > 5)
#if isinstance(s, claripy.FullFrontend):
# nose.tools.assert_is(t._solver, None)
s.add(x == 3)
nose.tools.assert_true(s.satisfiable())
t.add(x == 3)
nose.tools.assert_false(t.satisfiable())
s.add(y == 2)
nose.tools.assert_true(s.satisfiable())
nose.tools.assert_equals(s.eval(x, 1)[0], 3)
nose.tools.assert_equals(s.eval(y, 1)[0], 2)
nose.tools.assert_false(t.satisfiable())
def test_fallback_abstraction():
bz = claripy.backend_z3
a = claripy.BitVecVal(5, 32)
b = claripy.BitVec('x', 32, explicit_name=True)
c = a + b
d = 5 + b
e = b + 5
f = b + b
g = a + a
nose.tools.assert_false(a.symbolic)
nose.tools.assert_true(b.symbolic)
nose.tools.assert_true(c.symbolic)
nose.tools.assert_true(d.symbolic)
nose.tools.assert_true(e.symbolic)
nose.tools.assert_true(f.symbolic)
nose.tools.assert_is(type(a.model), claripy.bv.BVV)
nose.tools.assert_is_instance(b.model, claripy.Base)
nose.tools.assert_is_instance(c.model, claripy.Base)
nose.tools.assert_is_instance(d.model, claripy.Base)
nose.tools.assert_is_instance(e.model, claripy.Base)
nose.tools.assert_is_instance(f.model, claripy.Base)
nose.tools.assert_is(type(g.model), claripy.bv.BVV)
nose.tools.assert_equal(str(b.resolved_with(bz)), 'x')
nose.tools.assert_equal(b.resolved_with(bz).__module__, 'z3')
nose.tools.assert_equal(str(c.resolved_with(bz)), '5 + x')
nose.tools.assert_equal(str(d.resolved_with(bz)), '5 + x')
nose.tools.assert_equal(str(e.resolved_with(bz)), 'x + 5')
nose.tools.assert_equal(str(f.resolved_with(bz)), 'x + x')
def test_datalayer():
l.info("Running test_datalayer")
pickle_dir = tempfile.mkdtemp()
ana.set_dl(pickle_dir=pickle_dir)
l.debug("Pickling to %s", pickle_dir)
a = claripy.BitVecVal(0, 32)
b = claripy.BitVec("x", 32)
c = a + b
d = a + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b + b
l.debug("Storing!")
a.ana_store()
c_info = c.ana_store()
d_info = d.ana_store()
l.debug("Loading!")
ana.set_dl(pickle_dir=pickle_dir)
#nose.tools.assert_equal(len(claripy.dl._cache), 0)
cc = claripy.ast.BV.ana_load(c_info)
nose.tools.assert_equal(str(cc), str(c))
cd = claripy.ast.BV.ana_load(d_info)
nose.tools.assert_equal(str(cd), str(d))
l.debug("Time to test some solvers!")
s = claripy.FullFrontend(claripy.backend_z3)
x = claripy.BitVec("x", 32)
s.add(x == 3)
s.finalize()
ss = claripy.FullFrontend.ana_load(s.ana_store())
nose.tools.assert_equal(str(s.constraints), str(ss.constraints))
nose.tools.assert_equal(str(s.variables), str(ss.variables))
s = claripy.CompositeFrontend(claripy.backend_z3)
x = claripy.BitVec("x", 32)
s.add(x == 3)
s.finalize()
ss = claripy.CompositeFrontend.ana_load(s.ana_store())
old_constraint_sets = [[hash(j) for j in k.constraints]
for k in s._solver_list]
new_constraint_sets = [[hash(j) for j in k.constraints]
for k in ss._solver_list]
nose.tools.assert_items_equal(old_constraint_sets, new_constraint_sets)
nose.tools.assert_equal(str(s.variables), str(ss.variables))
def test_model():
bc = claripy.backend_concrete
a = claripy.BitVecVal(5, 32)
b = claripy.BitVec('x', 32, explicit_name=True)
c = a + b
r_c = c.resolved_with(bc, result=claripy.Result(True, {'x': 10}))
nose.tools.assert_equal(r_c, 15)
r_d = c.resolved_with(bc, result=claripy.Result(True, {'x': 15}))
nose.tools.assert_equal(r_c, 15)
nose.tools.assert_equal(r_d, 20)
def test_pickle():
bz = claripy.backend_z3
a = claripy.BitVecVal(0, 32)
b = claripy.BitVec('x', 32, explicit_name=True)
c = a + b
nose.tools.assert_equal(c.resolved_with(bz).__module__, 'z3')
nose.tools.assert_equal(str(c.resolved_with(bz)), '0 + x')
c_copy = pickle.loads(pickle.dumps(c, -1))
nose.tools.assert_equal(c_copy.resolved_with(bz).__module__, 'z3')
nose.tools.assert_equal(str(c_copy.resolved_with(bz)), '0 + x')
def Unconstrained(self, name, bits, **kwargs):
if o.SYMBOLIC_INITIAL_VALUES in self.state.options:
# Return a symbolic value
if o.ABSTRACT_MEMORY in self.state.options:
l.debug("Creating new top StridedInterval")
r = claripy.TSI(bits=bits, name=name, uninitialized=True, **kwargs)
else:
l.debug("Creating new unconstrained BV named %s", name)
r = claripy.BitVec(name, bits, **kwargs)
self.state.log.add_event('unconstrained', name=iter(r.variables).next(), bits=bits, **kwargs)
return r
else:
# Return a default value, aka. 0
return claripy.BitVecVal(0, bits)
def raw_combine(solver_type):
s10 = solver_type(claripy.backend_z3)
s20 = solver_type(claripy.backend_z3)
s30 = solver_type(claripy.backend_z3)
x = claripy.BitVec("x", 32)
s10.add(x >= 10)
s20.add(x <= 20)
s30.add(x == 30)
nose.tools.assert_true(s10.satisfiable())
nose.tools.assert_true(s20.satisfiable())
nose.tools.assert_true(s30.satisfiable())
nose.tools.assert_true(s10.combine([s20]).satisfiable())
nose.tools.assert_true(s20.combine([s10]).satisfiable())
nose.tools.assert_true(s30.combine([s10]).satisfiable())
nose.tools.assert_false(s30.combine([s20]).satisfiable())
nose.tools.assert_equal(s30.combine([s10]).eval(x, 1), (30, ))
nose.tools.assert_equal(len(s30.combine([s10]).constraints), 2)
def raw_solver(solver_type):
#bc = claripy.backends.BackendConcrete(clrp)
#bz = claripy.backends.BackendZ3(clrp)
#claripy.expression_backends = [ bc, bz, ba ]
s = solver_type(claripy.backend_z3)
s.simplify()
x = claripy.BitVec('x', 32)
y = claripy.BitVec('y', 32)
z = claripy.BitVec('z', 32)
l.debug("adding constraints")
s.add(x == 10)
s.add(y == 15)
l.debug("checking")
nose.tools.assert_true(s.satisfiable())
nose.tools.assert_false(s.satisfiable(extra_constraints=[x == 5]))
nose.tools.assert_equal(s.eval(x + 5, 1)[0], 15)
nose.tools.assert_true(s.solution(x + 5, 15))
nose.tools.assert_true(s.solution(x, 10))
nose.tools.assert_true(s.solution(y, 15))
nose.tools.assert_false(s.solution(y, 13))
shards = s.split()
nose.tools.assert_equal(len(shards), 2)
nose.tools.assert_equal(len(shards[0].variables), 1)
nose.tools.assert_equal(len(shards[1].variables), 1)
nose.tools.assert_equal(
{len(shards[0].constraints),
len(shards[1].constraints)},
{1, 1}) # adds the != from the solution() check
# test result caching
s = solver_type(claripy.backend_z3)
s.add(x == 10)
s.add(y == 15)
nose.tools.assert_is(s.result, None)
nose.tools.assert_false(s.satisfiable(extra_constraints=(x == 5, )))
nose.tools.assert_is(s.result, None)
nose.tools.assert_true(s.satisfiable())
nose.tools.assert_is_not(s.result, None)
s = solver_type(claripy.backend_z3)
#claripy.expression_backends = [ bc, ba, bz ]
s.add(claripy.UGT(x, 10))
s.add(claripy.UGT(x, 20))
s.simplify()
nose.tools.assert_equal(len(s.constraints), 1)
#nose.tools.assert_equal(str(s.constraints[0]._obj), "Not(ULE(x <= 20))")
s.add(claripy.UGT(y, x))
s.add(claripy.ULT(z, 5))
#print "========================================================================================"
#print "========================================================================================"
#print "========================================================================================"
#print "========================================================================================"
#a = s.eval(z, 100)
#print "ANY:", a
#print "========================================================================================"
#mx = s.max(z)
#print "MAX",mx
#print "========================================================================================"
#mn = s.min(z)
#print "MIN",mn
#print "========================================================================================"
#print "========================================================================================"
#print "========================================================================================"
#print "========================================================================================"
print "CONSTRATINT COUNTS:", [len(_.constraints) for _ in s.split()]
nose.tools.assert_equal(s.max(z), 4)
nose.tools.assert_equal(s.min(z), 0)
nose.tools.assert_equal(s.min(y), 22)
nose.tools.assert_equal(s.max(y), 2**y.size() - 1)
print "CONSTRATINT COUNTS:", [len(_.constraints) for _ in s.split()]
ss = s.split()
nose.tools.assert_equal(len(ss), 2)
if isinstance(s, claripy.FullFrontend):
nose.tools.assert_equal({len(_.constraints)
for _ in ss},
{2, 3}) # constraints from min or max
elif isinstance(s, claripy.CompositeFrontend):
#nose.tools.assert_equal({ len(_.constraints) for _ in ss }, { 3, 3 }) # constraints from min or max
print "TODO: figure out why this is different now"
nose.tools.assert_equal({len(_.constraints)
for _ in ss},
{2, 2}) # constraints from min or max
# test that False makes it unsat
s = solver_type(claripy.backend_z3)
s.add(claripy.BitVecVal(1, 1) == claripy.BitVecVal(1, 1))
nose.tools.assert_true(s.satisfiable())
s.add(claripy.BitVecVal(1, 1) == claripy.BitVecVal(0, 1))
nose.tools.assert_false(s.satisfiable())
# test extra constraints
s = solver_type(claripy.backend_z3)
x = claripy.BitVec('x', 32)
nose.tools.assert_equal(s.eval(x, 2, extra_constraints=[x == 10]), (10, ))
s.add(x == 10)
nose.tools.assert_false(s.solution(x, 2))
nose.tools.assert_true(s.solution(x, 10))
# test result caching
s = solver_type(claripy.backend_z3)
nose.tools.assert_true(s.satisfiable())
s.add(claripy.BoolVal(False))
nose.tools.assert_false(s.satisfiable())
s.result = None
nose.tools.assert_false(s.satisfiable())
s = solver_type(claripy.backend_z3)
x = claripy.BitVec('x', 32)
s.add(x == 10)
nose.tools.assert_true(s.satisfiable())
nose.tools.assert_true(s.result is not None)
nose.tools.assert_equals(s.eval(x, 1)[0], 10)
s.add(x == 10)
s.add(x > 9)
s.add(x <= 11)
nose.tools.assert_true(s.result is not None)
def raw_simple_merging(solver_type):
s1 = solver_type(claripy.backend_z3)
s2 = solver_type(claripy.backend_z3)
w = claripy.BitVec("w", 8)
x = claripy.BitVec("x", 8)
y = claripy.BitVec("y", 8)
z = claripy.BitVec("z", 8)
m = claripy.BitVec("m", 8)
s1.add([x == 1, y == 10])
s2.add([x == 2, z == 20, w == 5])
_, sm = s1.merge([s2], m, [0, 1])
nose.tools.assert_equal(s1.eval(x, 1), (1, ))
nose.tools.assert_equal(s2.eval(x, 1), (2, ))
sm1 = sm.branch()
sm1.add(x == 1)
nose.tools.assert_equal(sm1.eval(x, 1), (1, ))
nose.tools.assert_equal(sm1.eval(y, 1), (10, ))
nose.tools.assert_equal(sm1.eval(z, 1), (0, ))
nose.tools.assert_equal(sm1.eval(w, 1), (0, ))
sm2 = sm.branch()
sm2.add(x == 2)
nose.tools.assert_equal(sm2.eval(x, 1), (2, ))
nose.tools.assert_equal(sm2.eval(y, 1), (0, ))
nose.tools.assert_equal(sm2.eval(z, 1), (20, ))
nose.tools.assert_equal(sm2.eval(w, 1), (5, ))
sm1 = sm.branch()
sm1.add(m == 0)
nose.tools.assert_equal(sm1.eval(x, 1), (1, ))
nose.tools.assert_equal(sm1.eval(y, 1), (10, ))
nose.tools.assert_equal(sm1.eval(z, 1), (0, ))
nose.tools.assert_equal(sm1.eval(w, 1), (0, ))
sm2 = sm.branch()
sm2.add(m == 1)
nose.tools.assert_equal(sm2.eval(x, 1), (2, ))
nose.tools.assert_equal(sm2.eval(y, 1), (0, ))
nose.tools.assert_equal(sm2.eval(z, 1), (20, ))
nose.tools.assert_equal(sm2.eval(w, 1), (5, ))
m2 = claripy.BitVec("m2", 32)
_, smm = sm1.merge([sm2], m2, [0, 1])
smm_1 = smm.branch()
smm_1.add(x == 1)
nose.tools.assert_equal(smm_1.eval(x, 1), (1, ))
nose.tools.assert_equal(smm_1.eval(y, 1), (10, ))
nose.tools.assert_equal(smm_1.eval(z, 1), (0, ))
nose.tools.assert_equal(smm_1.eval(w, 1), (0, ))
smm_2 = smm.branch()
smm_2.add(m == 1)
nose.tools.assert_equal(smm_2.eval(x, 1), (2, ))
nose.tools.assert_equal(smm_2.eval(y, 1), (0, ))
nose.tools.assert_equal(smm_2.eval(z, 1), (20, ))
nose.tools.assert_equal(smm_2.eval(w, 1), (5, ))
so = solver_type(claripy.backend_z3)
so.add(w == 0)
sa = so.branch()
sb = so.branch()
sa.add(x == 1)
sb.add(x == 2)
_, sm = sa.merge([sb], m, [0, 1])
smc = sm.branch()
smd = sm.branch()
smc.add(y == 3)
smd.add(y == 4)
_, smm = smc.merge([smd], m2, [0, 1])
wxy = claripy.Concat(w, x, y)
smm_1 = smm.branch()
smm_1.add(wxy == 0x000103)
nose.tools.assert_true(smm_1.satisfiable())
smm_1 = smm.branch()
smm_1.add(wxy == 0x000104)
nose.tools.assert_true(smm_1.satisfiable())
smm_1 = smm.branch()
smm_1.add(wxy == 0x000203)
nose.tools.assert_true(smm_1.satisfiable())
smm_1 = smm.branch()
smm_1.add(wxy == 0x000204)
nose.tools.assert_true(smm_1.satisfiable())
smm_1 = smm.branch()
smm_1.add(wxy != 0x000103)
smm_1.add(wxy != 0x000104)
smm_1.add(wxy != 0x000203)
smm_1.add(wxy != 0x000204)
nose.tools.assert_false(smm_1.satisfiable())