dst_cast = "uint%d_t" % size
for index, arg in expr.iter_args():
out.append("(((%s)(%s & %s)) << %d)" %
(dst_cast, self.from_expr(arg),
self._size2mask(arg.size), index))
out = ' | '.join(out)
return '(' + out + ')'
else:
# Convert all parts to bignum
args = []
for index, arg in expr.iter_args():
arg_str = self.from_expr(arg)
if arg.size <= self.NATIVE_INT_MAX_SIZE:
arg_str = '((%s) & %s)' % (arg_str,
self._size2mask(arg.size))
arg_str = 'bignum_from_uint64(%s)' % arg_str
else:
arg_str = 'bignum_mask(%s, %d)' % (arg_str, arg.size)
arg_str = 'bignum_lshift(%s, %d)' % (arg_str, index)
args.append(arg_str)
out = args.pop()
while args:
arg = args.pop()
out = "bignum_or(%s, %s)" % (out, arg)
return out
# Register the class
Translator.register(TranslatorC)
if len(expr.args) == 1:
return "((%s %s) & 0x%x)" % (expr.op, args[0],
(1 << expr.size) - 1)
else:
return "((%s) & 0x%x)" % ((" %s " % expr.op).join(args),
(1 << expr.size) - 1)
elif expr.op == "parity":
return "(%s & 0x1)" % self.from_expr(expr.args[0])
elif expr.op in ["<<<", ">>>"]:
amount_raw = expr.args[1]
amount = expr.args[1] % ExprInt(amount_raw.size, expr.size)
amount_inv = ExprInt(expr.size, expr.size) - amount
if expr.op == "<<<":
amount, amount_inv = amount_inv, amount
part1 = "(%s >> %s)" % (self.from_expr(
expr.args[0]), self.from_expr(amount))
part2 = "(%s << %s)" % (self.from_expr(
expr.args[0]), self.from_expr(amount_inv))
return "((%s | %s) &0x%x)" % (part1, part2, int(expr.mask))
raise NotImplementedError("Unknown operator: %s" % expr.op)
def from_ExprAff(self, expr):
return "%s = %s" % tuple(map(self.from_expr, (expr.dst, expr.src)))
# Register the class
Translator.register(TranslatorPython)
def from_ExprCond(self, expr):
return "ExprCond(%s, %s, %s)" % (self.from_expr(expr.cond),
self.from_expr(expr.src1),
self.from_expr(expr.src2))
def from_ExprSlice(self, expr):
return "ExprSlice(%s, %d, %d)" % (self.from_expr(expr.arg),
expr.start,
expr.stop)
def from_ExprOp(self, expr):
return "ExprOp(%s, %s)" % (repr(expr.op),
", ".join(map(self.from_expr, expr.args)))
def from_ExprCompose(self, expr):
args = ["(%s, %d, %d)" % (self.from_expr(arg), start, stop)
for arg, start, stop in expr.args]
return "ExprCompose([%s])" % ", ".join(args)
def from_ExprAff(self, expr):
return "ExprAff(%s, %s)" % (self.from_expr(expr.dst),
self.from_expr(expr.src))
def from_ExprMem(self, expr):
return "ExprMem(%s, size=%d)" % (self.from_expr(expr.arg), expr.size)
# Register the class
Translator.register(TranslatorMiasm)
def from_ExprInt(self, expr):
return "ExprInt(0x%x, %d)" % (int(expr), expr.size)
def from_ExprCond(self, expr):
return "ExprCond(%s, %s, %s)" % (self.from_expr(
expr.cond), self.from_expr(expr.src1), self.from_expr(expr.src2))
def from_ExprSlice(self, expr):
return "ExprSlice(%s, %d, %d)" % (self.from_expr(
expr.arg), expr.start, expr.stop)
def from_ExprOp(self, expr):
return "ExprOp(%s, %s)" % (repr(expr.op), ", ".join(
map(self.from_expr, expr.args)))
def from_ExprCompose(self, expr):
args = ["%s" % self.from_expr(arg) for arg in expr.args]
return "ExprCompose(%s)" % ", ".join(args)
def from_ExprAff(self, expr):
return "ExprAff(%s, %s)" % (self.from_expr(
expr.dst), self.from_expr(expr.src))
def from_ExprMem(self, expr):
return "ExprMem(%s, size=%d)" % (self.from_expr(expr.arg), expr.size)
# Register the class
Translator.register(TranslatorMiasm)
@classmethod
def from_expr(cls, expr, endianness="<"):
# This mess is just to handle cache and Z3Mem instance management
# Might be improved in the future
del_cache = False
del_mem = False
if cls._cache is None:
cls._cache = {}
del_cache = True
if cls._mem is None:
cls._mem = Z3Mem(endianness)
del_mem = True
try:
if expr in cls._cache:
return cls._cache[expr]
else:
ret = super(TranslatorZ3, cls).from_expr(expr)
cls._cache[expr] = ret
return ret
finally:
# Clean cache and Z3Mem if this call is the root call
if del_cache:
cls._cache = None
if del_mem:
cls._mem = None
# Register the class
Translator.register(TranslatorZ3)
"""
ret = ""
ret += "(set-logic {})\n".format(logic)
# define bit vectors
for bv in self._bitvectors:
size = self._bitvectors[bv]
ret += "{}\n".format(declare_bv(bv, size))
# define memory arrays
for size in self._mem.mems:
mem = self._mem.mems[size]
ret += "{}\n".format(declare_array(mem, bit_vec(size), bit_vec(8)))
# merge SMT2 expressions
for expr in exprs:
ret += expr + "\n"
# define action
ret += "(check-sat)\n"
# enable model generation
if model:
ret += "(get-model)\n"
return ret
# Register the class
Translator.register(TranslatorSMT2)
self._size2mask(expr.stop - expr.start)
)
def from_ExprCompose(self, expr):
out = []
# XXX check mask for 64 bit & 32 bit compat
if expr.size in [8, 16, 32, 64, 128]:
size = expr.size
else:
# Uncommon expression size
size = expr.size
next_power = 1
while next_power <= size:
next_power <<= 1
size = next_power
dst_cast = "uint%d_t" % size
for index, arg in expr.iter_args():
out.append("(((%s)(%s & %s)) << %d)" % (
dst_cast,
self.from_expr(arg),
self._size2mask(arg.size),
index)
)
out = ' | '.join(out)
return '(' + out + ')'
# Register the class
Translator.register(TranslatorC)
for i in xrange(8):
res = res ^ z3.Extract(i, i, arg)
elif expr.op == '-':
res = -res
elif expr.op == "bsf":
size = expr.size
src = res
res = z3.If((src & (1 << (size - 1))) != 0, size - 1, src)
for i in xrange(size - 2, -1, -1):
res = z3.If((src & (1 << i)) != 0, i, res)
elif expr.op == "bsr":
size = expr.size
src = res
res = z3.If((src & 1) != 0, 0, src)
for i in xrange(size - 1, 0, -1):
index = - i % size
res = z3.If((src & (1 << index)) != 0, index, res)
else:
raise NotImplementedError("Unsupported OP yet: %s" % expr.op)
return res
def from_ExprAff(self, expr):
src = self.from_expr(expr.src)
dst = self.from_expr(expr.dst)
return (src == dst)
# Register the class
Translator.register(TranslatorZ3)
"""
ret = ""
ret += "(set-logic {})\n".format(logic)
# define bit vectors
for bv in self._bitvectors:
size = self._bitvectors[bv]
ret += "{}\n".format(declare_bv(bv, size))
# define memory arrays
for size in self._mem.mems:
mem = self._mem.mems[size]
ret += "{}\n".format(declare_array(mem, bit_vec(size), bit_vec(8)))
# merge SMT2 expressions
for expr in exprs:
ret += expr + "\n"
# define action
ret += "(check-sat)\n"
# enable model generation
if model:
ret += "(get-model)\n"
return ret
# Register the class
Translator.register(TranslatorSMT2)
return "((%s %s) & 0x%x)" % (expr.op,
args[0],
(1 << expr.size) - 1)
else:
return "((%s) & 0x%x)" % ((" %s " % expr.op).join(args),
(1 << expr.size) - 1)
elif expr.op == "parity":
return "(%s & 0x1)" % self.from_expr(expr.args[0])
elif expr.op in ["<<<", ">>>"]:
amount_raw = expr.args[1]
amount = expr.args[1] % ExprInt(amount_raw.size, expr.size)
amount_inv = ExprInt(expr.size, expr.size) - amount
if expr.op == "<<<":
amount, amount_inv = amount_inv, amount
part1 = "(%s >> %s)"% (self.from_expr(expr.args[0]),
self.from_expr(amount))
part2 = "(%s << %s)"% (self.from_expr(expr.args[0]),
self.from_expr(amount_inv))
return "((%s | %s) &0x%x)" % (part1, part2, int(expr.mask))
raise NotImplementedError("Unknown operator: %s" % expr.op)
def from_ExprAff(self, expr):
return "%s = %s" % tuple(map(self.from_expr, (expr.dst, expr.src)))
# Register the class
Translator.register(TranslatorPython)
