def compute(asm, inputstate={}, debug=False): sympool = dict(regs_init) sympool.update({k: ExprInt(v, k.size) for k, v in inputstate.iteritems()}) interm = ir_arch() symexec = SymbolicExecutionEngine(interm, sympool) instr = mn.fromstring(asm, symbol_pool, "l") code = mn.asm(instr)[0] instr = mn.dis(code, "l") instr.offset = inputstate.get(PC, 0) lbl = interm.add_instr(instr) symexec.run_at(lbl) if debug: for k, v in symexec.symbols.items(): if regs_init.get(k, None) != v: print k, v out = {} for k, v in symexec.symbols.items(): if k in EXCLUDE_REGS: continue elif regs_init.get(k, None) == v: continue elif isinstance(v, ExprInt): out[k] = v.arg.arg else: out[k] = v return out
def compute(asm, inputstate={}, debug=False): sympool = dict(regs_init) sympool.update({k: ExprInt_from(k, v) for k, v in inputstate.iteritems()}) interm = ir_arch() symexec = symbexec(interm, sympool) instr = mn.fromstring(asm, "l") code = mn.asm(instr)[0] instr = mn.dis(code, "l") instr.offset = inputstate.get(PC, 0) interm.add_instr(instr) symexec.emul_ir_blocs(interm, instr.offset) if debug: for k, v in symexec.symbols.items(): if regs_init.get(k, None) != v: print k, v out = {} for k, v in symexec.symbols.items(): if k in EXCLUDE_REGS: continue elif regs_init.get(k, None) == v: continue elif isinstance(v, ExprInt): out[k] = v.arg.arg else: out[k] = v return out
def compute(asm, inputstate={}, debug=False): loc_db = LocationDB() sympool = dict(regs_init) sympool.update({k: ExprInt(v, k.size) for k, v in inputstate.iteritems()}) ir_tmp = ir_arch(loc_db) ircfg = ir_tmp.new_ircfg() symexec = SymbolicExecutionEngine(ir_tmp, sympool) instr = mn.fromstring(asm, loc_db, "l") code = mn.asm(instr)[0] instr = mn.dis(code, "l") instr.offset = inputstate.get(PC, 0) lbl = ir_tmp.add_instr_to_ircfg(instr, ircfg) symexec.run_at(ircfg, lbl) if debug: for k, v in symexec.symbols.items(): if regs_init.get(k, None) != v: print k, v out = {} for k, v in symexec.symbols.items(): if k in EXCLUDE_REGS: continue elif regs_init.get(k, None) == v: continue elif isinstance(v, ExprInt): out[k] = long(v) else: out[k] = v return out
#! /usr/bin/env python2 #-*- coding:utf-8 -*- import unittest import logging from miasm2.ir.symbexec import SymbolicExecutionEngine from miasm2.arch.arm.arch import mn_arm as mn from miasm2.arch.arm.sem import ir_arml as ir_arch from miasm2.arch.arm.regs import * from miasm2.expression.expression import * from miasm2.core.asmblock import AsmSymbolPool from pdb import pm logging.getLogger('cpuhelper').setLevel(logging.ERROR) EXCLUDE_REGS = set([ir_arch().IRDst]) symbol_pool = AsmSymbolPool() def M(addr): return ExprMem(ExprInt(addr, 16), 16) def compute(asm, inputstate={}, debug=False): sympool = dict(regs_init) sympool.update({k: ExprInt(v, k.size) for k, v in inputstate.iteritems()}) interm = ir_arch() symexec = SymbolicExecutionEngine(interm, sympool) instr = mn.fromstring(asm, symbol_pool, "l") code = mn.asm(instr)[0] instr = mn.dis(code, "l")
#!/usr/bin/env python #-*- coding:utf-8 -*- import unittest import logging from miasm2.ir.symbexec import symbexec from miasm2.arch.arm.arch import mn_arm as mn from miasm2.arch.arm.sem import ir_arml as ir_arch from miasm2.arch.arm.regs import * from miasm2.expression.expression import * from pdb import pm logging.getLogger('cpuhelper').setLevel(logging.ERROR) EXCLUDE_REGS = set([ir_arch().IRDst]) def M(addr): return ExprMem(ExprInt(addr, 16), 16) def compute(asm, inputstate={}, debug=False): sympool = dict(regs_init) sympool.update({k: ExprInt_from(k, v) for k, v in inputstate.iteritems()}) interm = ir_arch() symexec = symbexec(interm, sympool) instr = mn.fromstring(asm, "l") code = mn.asm(instr)[0] instr = mn.dis(code, "l") instr.offset = inputstate.get(PC, 0) interm.add_instr(instr)