def _new_node_state(self, state, edge_type=JumpType.UNCONDITIONAL, condition=None): new_node = Node(state.environment.active_account.contract_name) old_node = state.node state.node = new_node new_node.constraints = state.mstate.constraints self.nodes[new_node.uid] = new_node self.edges.append(Edge(old_node.uid, new_node.uid, edge_type=edge_type, condition=condition)) if edge_type == JumpType.RETURN: new_node.flags |= NodeFlags.CALL_RETURN elif edge_type == JumpType.CALL: try: if 'retval' in str(state.mstate.stack[-1]): new_node.flags |= NodeFlags.CALL_RETURN else: new_node.flags |= NodeFlags.FUNC_ENTRY except StackUnderflowException: new_node.flags |= NodeFlags.FUNC_ENTRY address = state.environment.code.instruction_list[state.mstate.pc]['address'] environment = state.environment disassembly = environment.code if address in state.environment.code.addr_to_func: # Enter a new function environment.active_function_name = disassembly.addr_to_func[address] new_node.flags |= NodeFlags.FUNC_ENTRY logging.info( "- Entering function " + environment.active_account.contract_name + ":" + new_node.function_name) elif address == 0: environment.active_function_name = "fallback" new_node.function_name = environment.active_function_name
def _setup_global_state_for_execution(laser_evm, transaction) -> None: """Sets up global state and cfg for a transactions execution. :param laser_evm: :param transaction: """ # TODO: Resolve circular import between .transaction and ..svm to import LaserEVM here global_state = transaction.initial_global_state() global_state.transaction_stack.append((transaction, None)) new_node = Node( global_state.environment.active_account.contract_name, function_name=global_state.environment.active_function_name, ) if laser_evm.requires_statespace: laser_evm.nodes[new_node.uid] = new_node if transaction.world_state.node: if laser_evm.requires_statespace: laser_evm.edges.append( Edge( transaction.world_state.node.uid, new_node.uid, edge_type=JumpType.Transaction, condition=None, )) global_state.mstate.constraints += transaction.world_state.node.constraints new_node.constraints = global_state.mstate.constraints.as_list global_state.world_state.transaction_sequence.append(transaction) global_state.node = new_node new_node.states.append(global_state) laser_evm.work_list.append(global_state)
def test_concrete_call(): # arrange address = "0x10" state = GlobalState(None, None, None) state.mstate.memory = ["placeholder", "calldata_bling_0"] node = Node("example") node.contract_name = "the contract name" node.function_name = "the function name" to = Variable(1, VarType.CONCRETE) meminstart = Variable(1, VarType.CONCRETE) call = Call(node, state, None, None, to, None) # act issues = _concrete_call(call, state, address, meminstart) # assert issue = issues[0] assert issue.address == address assert issue.contract == node.contract_name assert issue.function == node.function_name assert issue.title == "Call data forwarded with delegatecall()" assert issue.type == 'Informational' assert issue.description == "This contract forwards its call data via DELEGATECALL in its fallback function." \ " This means that any function in the called contract can be executed." \ " Note that the callee contract will have access to the storage of the " \ "calling contract.\n DELEGATECALL target: 0x1"
def test_concrete_call_symbolic_to(): # arrange address = "0x10" active_account = Account(address) active_account.code = Disassembly("00") environment = Environment(active_account, None, None, None, None, None) state = GlobalState(None, environment, None) state.mstate.memory = ["placeholder", "calldata_bling_0"] node = Node("example") node.contract_name = "the contract name" node.function_name = "the function name" to = Variable("calldata_3", VarType.SYMBOLIC) meminstart = Variable(1, VarType.CONCRETE) call = Call(node, state, None, None, to, None) # act issues = _concrete_call(call, state, address, meminstart) # assert issue = issues[0] assert issue.address == address assert issue.contract == node.contract_name assert issue.function == node.function_name assert issue.title == "Call data forwarded with delegatecall()" assert issue.type == "Informational" assert ( issue.description == "This contract forwards its call data via DELEGATECALL in its fallback function." " This means that any function in the called contract can be executed." " Note that the callee contract will have access to the storage of the " "calling contract.\n DELEGATECALL target: calldata_3" )
def test_delegate_call(sym_mock, concrete_mock, curr_instruction): # arrange # sym_mock = mocker.patch.object(delegatecall, "_symbolic_call") # concrete_mock = mocker.patch.object(delegatecall, "_concrete_call") sym_mock.return_value = [] concrete_mock.return_value = [] curr_instruction.return_value = {"address": "0x10"} active_account = Account("0x10") active_account.code = Disassembly("00") environment = Environment(active_account, None, None, None, None, None) state = GlobalState(None, environment, Node) state.mstate.memory = ["placeholder", "calldata_bling_0"] state.mstate.stack = [1, 2, 3] assert state.get_current_instruction() == {"address": "0x10"} node = Node("example") node.contract_name = "the contract name" node.function_name = "fallback" to = Variable("storage_1", VarType.SYMBOLIC) call = Call(node, state, None, "DELEGATECALL", to, None) statespace = MagicMock() statespace.calls = [call] # act execute(statespace) # assert assert concrete_mock.call_count == 1 assert sym_mock.call_count == 1
def test_execute_node(mocker): record = TaintRecord() record.stack = [True, True, False, False] state_1 = GlobalState(None, None, None) state_1.mstate.stack = [1, 2, 3, 1] state_1.mstate.pc = 1 mocker.patch.object(state_1, "get_current_instruction") state_1.get_current_instruction.return_value = {"opcode": "SWAP1"} state_2 = GlobalState(None, 1, None) state_2.mstate.stack = [1, 2, 4, 1] mocker.patch.object(state_2, "get_current_instruction") state_2.get_current_instruction.return_value = {"opcode": "ADD"} node = Node("Test contract") node.states = [state_1, state_2] # Act records = TaintRunner.execute_node(node, record) # Assert assert len(records) == 2 assert records[0].stack == [True, True, False, False] assert records[1].stack == [True, True, False] assert state_2 in records[0].states assert state_1 in record.states
def test_symbolic_call_calldata_to(mocker): # arrange address = "0x10" state = GlobalState(None, None, None) state.mstate.memory = ["placeholder", "calldata_bling_0"] node = Node("example") node.contract_name = "the contract name" node.function_name = "the function name" to = Variable("calldata", VarType.SYMBOLIC) call = Call(node, state, None, "Type: ", to, None) mocker.patch.object(SymExecWrapper, "__init__", lambda x, y: None) statespace = SymExecWrapper(1) mocker.patch.object(statespace, "find_storage_write") statespace.find_storage_write.return_value = "Function name" # act issues = _symbolic_call(call, state, address, statespace) # assert issue = issues[0] assert issue.address == address assert issue.contract == node.contract_name assert issue.function == node.function_name assert issue.title == "Type: to a user-supplied address" assert issue.type == "Informational" assert ( issue.description == "This contract delegates execution to a contract address obtained from calldata. " "Be aware that the called contract gets unrestricted access to this contract's state." )
def _new_node_state( self, state: GlobalState, edge_type=JumpType.UNCONDITIONAL, condition=None ) -> None: """ :param state: :param edge_type: :param condition: """ new_node = Node(state.environment.active_account.contract_name) old_node = state.node state.node = new_node new_node.constraints = state.mstate.constraints if self.requires_statespace: self.nodes[new_node.uid] = new_node self.edges.append( Edge( old_node.uid, new_node.uid, edge_type=edge_type, condition=condition ) ) if edge_type == JumpType.RETURN: new_node.flags |= NodeFlags.CALL_RETURN elif edge_type == JumpType.CALL: try: if "retval" in str(state.mstate.stack[-1]): new_node.flags |= NodeFlags.CALL_RETURN else: new_node.flags |= NodeFlags.FUNC_ENTRY except StackUnderflowException: new_node.flags |= NodeFlags.FUNC_ENTRY address = state.environment.code.instruction_list[state.mstate.pc]["address"] environment = state.environment disassembly = environment.code if isinstance( state.world_state.transaction_sequence[-1], ContractCreationTransaction ): environment.active_function_name = "constructor" elif address in disassembly.address_to_function_name: # Enter a new function environment.active_function_name = disassembly.address_to_function_name[ address ] new_node.flags |= NodeFlags.FUNC_ENTRY log.debug( "- Entering function " + environment.active_account.contract_name + ":" + new_node.function_name ) elif address == 0: environment.active_function_name = "fallback" new_node.function_name = environment.active_function_name
def sym_exec(self, main_address): logging.debug("Starting LASER execution") # Initialize the execution environment environment = Environment( self.accounts[main_address], BitVec("caller", 256), [], BitVec("gasprice", 256), BitVec("callvalue", 256), BitVec("origin", 256), calldata_type=CalldataType.SYMBOLIC, ) # TODO: contact name fix initial_node = Node(environment.active_account.contract_name) self.nodes[initial_node.uid] = initial_node global_state = GlobalState(self.accounts, environment, initial_node) initial_node.states.append(global_state) # Empty the work_list before starting an execution self.work_list.append(global_state) self._sym_exec() logging.info("Execution complete") logging.info("%d nodes, %d edges, %d total states", len(self.nodes), len(self.edges), self.total_states)
def sym_exec(self, main_address): logging.debug("Starting LASER execution") self.time = datetime.now() # Initialize the execution environment environment = Environment( self.accounts[main_address], BitVec("caller", 256), [], BitVec("gasprice", 256), BitVec("callvalue", 256), BitVec("origin", 256), calldata_type=CalldataType.SYMBOLIC, ) self.instructions_covered = [ False for _ in environment.code.instruction_list ] initial_node = Node(environment.active_account.contract_name) self.nodes[initial_node.uid] = initial_node global_state = GlobalState(self.accounts, environment, initial_node) global_state.environment.active_function_name = "fallback()" initial_node.states.append(global_state) # Empty the work_list before starting an execution self.work_list.append(global_state) self._sym_exec() logging.info("Execution complete") logging.info("Achieved {0:.3g}% coverage".format(self.coverage)) logging.info("%d nodes, %d edges, %d total states", len(self.nodes), len(self.edges), self.total_states)
def run(self, open_world_states: list, evm): """ Runs this transaction on the evm starting from the open world states """ # Consume the open states open_states = open_world_states[:] del open_world_states[:] for open_world_state in open_states: # Initialize the execution environment environment = Environment( open_world_state[self.callee_address], self.caller, [], self.gas_price, self.call_value, self.origin, calldata_type=CalldataType.SYMBOLIC, ) new_node = Node(environment.active_account.contract_name) evm.instructions_covered = [False for _ in environment.code.instruction_list] evm.nodes[new_node.uid] = new_node if open_world_state.node: evm.edges.append(Edge(open_world_state.node.uid, new_node.uid, edge_type=JumpType.Transaction, condition=None)) global_state = GlobalState(open_world_state.accounts, environment, new_node) global_state.environment.active_function_name = 'fallback' new_node.states.append(global_state) evm.work_list.append(global_state) evm.exec() logging.info("Execution complete") logging.info("Achieved {0:.3g}% coverage".format(evm.coverage))
def _setup_global_state_for_execution(laser_evm, transaction): """ Sets up global state and cfg for a transactions execution""" global_state = transaction.initial_global_state() global_state.transaction_stack.append((transaction, None)) new_node = Node(global_state.environment.active_account.contract_name) laser_evm.nodes[new_node.uid] = new_node if transaction.world_state.node: laser_evm.edges.append( Edge(transaction.world_state.node.uid, new_node.uid, edge_type=JumpType.Transaction, condition=None)) global_state.mstate.constraints = transaction.world_state.node.constraints new_node.constraints = global_state.mstate.constraints global_state.node = new_node new_node.states.append(global_state) laser_evm.work_list.append(global_state)
def test_symbolic_call_storage_to(mocker): # arrange address = "0x10" active_account = Account(address) active_account.code = Disassembly("00") environment = Environment(active_account, None, None, None, None, None) state = GlobalState(None, environment, None) state.mstate.memory = ["placeholder", "calldata_bling_0"] node = Node("example") node.contract_name = "the contract name" node.function_name = "the function name" to = Variable("storage_1", VarType.SYMBOLIC) call = Call(node, state, None, "Type: ", to, None) mocker.patch.object(SymExecWrapper, "__init__", lambda x, y: None) statespace = SymExecWrapper(1) mocker.patch.object(statespace, "find_storage_write") statespace.find_storage_write.return_value = "Function name" # act issues = detector._symbolic_call(call, state, address, statespace) # assert issue = issues[0] assert issue.address == address assert issue.contract == node.contract_name assert issue.function == node.function_name assert issue.title == "Type: to a user-supplied address" assert issue.type == "Informational" assert issue.description == ( "This contract delegates execution to a contract address in storage slot 1." " This storage slot can be written to by calling the function `Function name`." " Be aware that the called contract gets unrestricted access to this contract's state." )
def test_delegate_call_not_fallback(sym_mock, concrete_mock): # arrange # sym_mock = mocker.patch.object(delegatecall, "_symbolic_call") # concrete_mock = mocker.patch.object(delegatecall, "_concrete_call") sym_mock.return_value = [] concrete_mock.return_value = [] node = Node("example") node.function_name = "not_fallback" to = Variable("storage_1", VarType.SYMBOLIC) call = Call(node, None, None, "DELEGATECALL", to, None) statespace = MagicMock() statespace.calls = [call] # act issues = execute(statespace) # assert assert issues == [] assert concrete_mock.call_count == 0 assert sym_mock.call_count == 0
def execute_message_call(self, callee_address): caller = BitVec("caller", 256) gas_price = BitVec("gasprice", 256) call_value = BitVec("callvalue", 256) origin = BitVec("origin", 256) open_states = self.open_states[:] del self.open_states[:] for open_world_state in open_states: transaction = MessageCallTransaction( open_world_state, open_world_state[callee_address], caller, [], gas_price, call_value, origin, CalldataType.SYMBOLIC, ) global_state = transaction.initial_global_state() global_state.transaction_stack.append((transaction, None)) new_node = Node( global_state.environment.active_account.contract_name) self.instructions_covered = [ False for _ in global_state.environment.code.instruction_list ] self.nodes[new_node.uid] = new_node if open_world_state.node: self.edges.append( Edge(open_world_state.node.uid, new_node.uid, edge_type=JumpType.Transaction, condition=None)) global_state.node = new_node new_node.states.append(global_state) self.work_list.append(global_state) self.exec() logging.info("Execution complete") logging.info("Achieved {0:.3g}% coverage".format(self.coverage))
def _setup_global_state_for_execution(laser_evm, transaction) -> None: """ Sets up global state and cfg for a transactions execution""" # TODO: Resolve circular import between .transaction and ..svm to import LaserEVM here global_state = transaction.initial_global_state() global_state.transaction_stack.append((transaction, None)) new_node = Node(global_state.environment.active_account.contract_name) laser_evm.nodes[new_node.uid] = new_node if transaction.world_state.node: laser_evm.edges.append( Edge( transaction.world_state.node.uid, new_node.uid, edge_type=JumpType.Transaction, condition=None, )) global_state.node = new_node new_node.states.append(global_state) laser_evm.work_list.append(global_state)
def test_execute(mocker): active_account = Account("0x00") environment = Environment(active_account, None, None, None, None, None) state_1 = GlobalState(None, environment, None, MachineState(gas_limit=8000000)) state_1.mstate.stack = [1, 2] mocker.patch.object(state_1, "get_current_instruction") state_1.get_current_instruction.return_value = {"opcode": "PUSH"} state_2 = GlobalState(None, environment, None, MachineState(gas_limit=8000000)) state_2.mstate.stack = [1, 2, 3] mocker.patch.object(state_2, "get_current_instruction") state_2.get_current_instruction.return_value = {"opcode": "ADD"} node_1 = Node("Test contract") node_1.states = [state_1, state_2] state_3 = GlobalState(None, environment, None, MachineState(gas_limit=8000000)) state_3.mstate.stack = [1, 2] mocker.patch.object(state_3, "get_current_instruction") state_3.get_current_instruction.return_value = {"opcode": "ADD"} node_2 = Node("Test contract") node_2.states = [state_3] edge = Edge(node_1.uid, node_2.uid) statespace = LaserEVM(None) statespace.edges = [edge] statespace.nodes[node_1.uid] = node_1 statespace.nodes[node_2.uid] = node_2 # Act result = TaintRunner.execute(statespace, node_1, state_1, [True, True]) # Assert print(result) assert len(result.records) == 3 assert result.records[2].states == [] assert state_3 in result.records[1].states