def test_extract_contract(self):
self.astEquals(TAst.extract(7, 0, TAst.bv(0xffff, 16)),
self.mba8.from_cst(0xff))
self.astEquals(TAst.concat([TAst.bv(0xff, 8),
TAst.bv(0x00, 8)]),
self.mba16.from_cst(0xff00))
def test_bind_expr_to_register(self):
"""Check symbolic expression binded to register."""
expr1 = newSymbolicExpression(ast.bv(0x11223344, 64))
assignSymbolicExpressionToRegister(expr1, REG.RAX)
self.assertEqual(getSymbolicRegisterValue(REG.RAX), 0x11223344)
expr1 = newSymbolicExpression(ast.bv(0x11223344, 32))
with self.assertRaises(Exception):
# Incorrect size
assignSymbolicExpressionToRegister(expr1, REG.RAX)
def test_mba(self):
# x^y = (x+y) - ((x&y)<<1)
e = TAst.bvsub(
TAst.bvadd(self.x8_t, self.y8_t),
TAst.bvshl(TAst.bvand(self.x8_t, self.y8_t), TAst.bv(1, 8)))
ea = tritonast2arybo(e, use_exprs=False, use_esf=True)
simplify_inplace(expand_esf_inplace(ea))
self.assertEqual(ea, self.x8 ^ self.y8)
def test_bind_expr_to_memory(self):
"""Check symbolic expression binded to memory can be retrieve."""
# Bind expr1 to 0x100
expr1 = newSymbolicExpression(ast.bv(0x11, 8))
mem = MemoryAccess(0x100, CPUSIZE.BYTE)
assignSymbolicExpressionToMemory(expr1, mem)
# Get expr from memory
expr2 = getSymbolicExpressionFromId(getSymbolicMemoryId(0x100))
self.assertEqual(expr1.getAst().evaluate(), expr2.getAst().evaluate())
def test_binaryops(self):
ops = ((TAst.bvadd, operator.add), (TAst.bvsub, operator.sub),
(TAst.bvand, operator.and_), (TAst.bvor, operator.or_),
(TAst.bvxor, operator.xor), (TAst.bvmul, operator.mul),
(TAst.bvnand, lambda x, y: ~(x & y)),
(TAst.bvnor, lambda x, y: ~(x | y)), (TAst.bvxnor,
lambda x, y: ~(x ^ y)))
for op in ops:
self.astEquals(op[0](self.x8_t, self.y8_t), op[1](self.x8,
self.y8))
# One udiv test because it can take a lot of time...
e = TAst.bvudiv(self.x8_t, TAst.bv(15, 8))
self.astEquals(e, self.x8.udiv(15))
def test_shifts(self):
# Triton interface is not consistant between sh{r,l} and ro{l,r}.
# For the first kind, it can take any AstNode. For the second one, an
# integer is forced.
ops = (
(TAst.bvlshr, operator.rshift),
(TAst.bvshl, operator.lshift),
)
for op in ops:
for s in range(9):
self.astEquals(op[0](self.x8_t, TAst.bv(s, 8)), op[1](self.x8,
s))
ops = ((TAst.bvrol, lambda x, n: x.rol(n)), (TAst.bvror,
lambda x, n: x.ror(n)))
for op in ops:
for s in range(9):
self.astEquals(op[0](s, self.x8_t), op[1](self.x8, s))
def test_bind_expr_to_multi_memory(self):
"""Check symbolic expression binded to multiple memory location."""
# Bind expr to multi memory location (0x100, 0x101, 0x102, 0x103)
expr1 = newSymbolicExpression(ast.bv(0x11223344, 32))
mem = MemoryAccess(0x100, CPUSIZE.DWORD)
assignSymbolicExpressionToMemory(expr1, mem)
# Check we can get back the same values
expr2 = getSymbolicExpressionFromId(getSymbolicMemoryId(0x100))
expr3 = getSymbolicExpressionFromId(getSymbolicMemoryId(0x101))
expr4 = getSymbolicExpressionFromId(getSymbolicMemoryId(0x102))
expr5 = getSymbolicExpressionFromId(getSymbolicMemoryId(0x103))
self.assertEqual(expr2.getAst().evaluate(), 0x44)
self.assertEqual(expr3.getAst().evaluate(), 0x33)
self.assertEqual(expr4.getAst().evaluate(), 0x22)
self.assertEqual(expr5.getAst().evaluate(), 0x11)
self.assertEqual(getSymbolicMemoryValue(mem), 0x11223344)
def emulate(self, pc):
"""
Emulate every opcodes from pc.
* Process instruction until the end and search for constraint
resolution on cmp eax, 1 then set the new correct value and keep going.
"""
while pc:
# Fetch opcodes
opcodes = getConcreteMemoryAreaValue(pc, 16)
# Create the Triton instruction
instruction = Instruction()
instruction.setOpcodes(opcodes)
instruction.setAddress(pc)
# Process
processing(instruction)
# 40078B: cmp eax, 1
# eax must be equal to 1 at each round.
if instruction.getAddress() == 0x40078B:
# Slice expressions
rax = getSymbolicExpressionFromId(
getSymbolicRegisterId(REG.RAX))
eax = ast.extract(31, 0, rax.getAst())
# Define constraint
cstr = ast.assert_(
ast.land(getPathConstraintsAst(),
ast.equal(eax, ast.bv(1, 32))))
model = getModel(cstr)
solution = str()
for k, v in model.items():
value = v.getValue()
solution += chr(value)
getSymbolicVariableFromId(k).setConcreteValue(value)
# Next
pc = getConcreteRegisterValue(REG.RIP)
return solution
def emulate(self, pc):
"""
Emulate every opcodes from pc.
* Process instruction until the end and search for constraint
resolution on cmp eax, 1 then set the new correct value and keep going.
"""
while pc:
# Fetch opcodes
opcodes = getConcreteMemoryAreaValue(pc, 16)
# Create the Triton instruction
instruction = Instruction()
instruction.setOpcodes(opcodes)
instruction.setAddress(pc)
# Process
processing(instruction)
# 40078B: cmp eax, 1
# eax must be equal to 1 at each round.
if instruction.getAddress() == 0x40078B:
# Slice expressions
rax = getSymbolicExpressionFromId(getSymbolicRegisterId(REG.RAX))
eax = ast.extract(31, 0, rax.getAst())
# Define constraint
cstr = ast.assert_(ast.land(getPathConstraintsAst(), ast.equal(eax, ast.bv(1, 32))))
model = getModel(cstr)
solution = str()
for k, v in model.items():
value = v.getValue()
solution += chr(value)
getSymbolicVariableFromId(k).setConcreteValue(value)
# Next
pc = getConcreteRegisterValue(REG.RIP)
return solution
def test_build_register(self):
"""Check symbolic register has correct size and location."""
expr1 = newSymbolicExpression(ast.bv(0x1122334455667788, CPUSIZE.QWORD_BIT))
assignSymbolicExpressionToRegister(expr1, REG.RAX)
node = buildSymbolicRegister(REG.RAX)
self.assertEqual(node.evaluate(), 0x1122334455667788)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.QWORD_BIT)
node = buildSymbolicRegister(REG.EAX)
self.assertEqual(node.evaluate(), 0x55667788)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.DWORD_BIT)
node = buildSymbolicRegister(REG.AX)
self.assertEqual(node.evaluate(), 0x7788)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.WORD_BIT)
node = buildSymbolicRegister(REG.AH)
self.assertEqual(node.evaluate(), 0x77)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.BYTE_BIT)
node = buildSymbolicRegister(REG.AL)
self.assertEqual(node.evaluate(), 0x88)
self.assertEqual(node.getBitvectorSize(), CPUSIZE.BYTE_BIT)
def test_ror(self):
"""Check ror operations."""
tests = [
bvror(0x88888888, bv(0x99999999, 32)),
bvror(0x12345678, bv(0, 32)),
bvror(0x12345678, bv(1, 32)),
bvror(0x12345678, bv(2, 32)),
bvror(0x12345678, bv(3, 32)),
bvror(0x12345678, bv(32, 32)),
bvror(0x12345678, bv(64, 32)),
bvror(0x12345678, bv(0x12345678, 32)),
bvror(0xf2345678, bv(0, 32)),
bvror(0xf2345678, bv(1, 32)),
bvror(0xf2345678, bv(2, 32)),
bvror(0xf2345678, bv(3, 32)),
bvror(0xf2345678, bv(32, 32)),
bvror(0xf2345678, bv(64, 32)),
bvror(0xf2345678, bv(0x12345678, 32)),
bvror(0x99999999, bv(0x88888888, 32)),
bvror(0, bv(0x12345678, 32)),
bvror(1, bv(0x12345678, 32)),
bvror(2, bv(0x12345678, 32)),
bvror(3, bv(0x12345678, 32)),
bvror(32, bv(0x12345678, 32)),
bvror(64, bv(0x12345678, 32)),
bvror(0x12345678, bv(0x12345678, 32)),
bvror(0, bv(0xf2345678, 32)),
bvror(1, bv(0xf2345678, 32)),
bvror(2, bv(0xf2345678, 32)),
bvror(3, bv(0xf2345678, 32)),
bvror(32, bv(0xf2345678, 32)),
bvror(64, bv(0xf2345678, 32)),
bvror(0x12345678, bv(0xf2345678, 32)),
]
self.check_ast(tests)
def test_lshr(self):
"""Check lshr operations."""
tests = [
bvlshr(bv(0x88888888, 32), bv(0x99999999, 32)),
bvlshr(bv(0x12345678, 32), bv(0, 32)),
bvlshr(bv(0x12345678, 32), bv(1, 32)),
bvlshr(bv(0x12345678, 32), bv(2, 32)),
bvlshr(bv(0x12345678, 32), bv(3, 32)),
bvlshr(bv(0x12345678, 32), bv(32, 32)),
bvlshr(bv(0x12345678, 32), bv(64, 32)),
bvlshr(bv(0x12345678, 32), bv(0x12345678, 32)),
bvlshr(bv(0xf2345678, 32), bv(0, 32)),
bvlshr(bv(0xf2345678, 32), bv(1, 32)),
bvlshr(bv(0xf2345678, 32), bv(2, 32)),
bvlshr(bv(0xf2345678, 32), bv(3, 32)),
bvlshr(bv(0xf2345678, 32), bv(4, 32)),
bvlshr(bv(0xf2345678, 32), bv(5, 32)),
bvlshr(bv(0xf2345678, 32), bv(6, 32)),
bvlshr(bv(0xf2345678, 32), bv(32, 32)),
bvlshr(bv(0xf2345678, 32), bv(64, 32)),
bvlshr(bv(0xf2345678, 32), bv(0x12345678, 32)),
bvlshr(bv(0b10000000, 8), bv(0, 8)),
bvlshr(bv(0b10000000, 8), bv(1, 8)),
bvlshr(bv(0b10000000, 8), bv(2, 8)),
bvlshr(bv(0b10000000, 8), bv(3, 8)),
bvlshr(bv(0b10000000, 8), bv(4, 8)),
bvlshr(bv(0b10000000, 8), bv(5, 8)),
bvlshr(bv(0b10000000, 8), bv(6, 8)),
bvlshr(bv(0b10000000, 8), bv(7, 8)),
bvlshr(bv(0b10000000, 8), bv(8, 8)),
bvlshr(bv(0b10000000, 8), bv(9, 8)),
bvlshr(bv(0b10000000, 8), bv(123, 8)),
bvlshr(bv(0b10001000, 8), bv(0, 8)),
bvlshr(bv(0b10001000, 8), bv(1, 8)),
bvlshr(bv(0b10001000, 8), bv(2, 8)),
bvlshr(bv(0b10001000, 8), bv(3, 8)),
bvlshr(bv(0b10001000, 8), bv(4, 8)),
bvlshr(bv(0b10001000, 8), bv(5, 8)),
bvlshr(bv(0b10001000, 8), bv(6, 8)),
bvlshr(bv(0b10001000, 8), bv(7, 8)),
bvlshr(bv(0b10001000, 8), bv(8, 8)),
bvlshr(bv(0b10001000, 8), bv(9, 8)),
bvlshr(bv(0b10001000, 8), bv(123, 8)),
]
self.check_ast(tests)
def test_shl(self):
"""Check shl operations."""
tests = [
bvshl(bv(0x88888888, 32), bv(0x99999999, 32)),
bvshl(bv(0x12345678, 32), bv(0, 32)),
bvshl(bv(0x12345678, 32), bv(1, 32)),
bvshl(bv(0x12345678, 32), bv(2, 32)),
bvshl(bv(0x12345678, 32), bv(3, 32)),
bvshl(bv(0x12345678, 32), bv(32, 32)),
bvshl(bv(0x12345678, 32), bv(64, 32)),
bvshl(bv(0x12345678, 32), bv(0x12345678, 32)),
bvshl(bv(0xf2345678, 32), bv(0, 32)),
bvshl(bv(0xf2345678, 32), bv(1, 32)),
bvshl(bv(0xf2345678, 32), bv(2, 32)),
bvshl(bv(0xf2345678, 32), bv(3, 32)),
bvshl(bv(0xf2345678, 32), bv(32, 32)),
bvshl(bv(0xf2345678, 32), bv(64, 32)),
bvshl(bv(0xf2345678, 32), bv(0x12345678, 32)),
bvshl(bv(0b00000001, 8), bv(0, 8)),
bvshl(bv(0b00000001, 8), bv(1, 8)),
bvshl(bv(0b00000001, 8), bv(2, 8)),
bvshl(bv(0b00000001, 8), bv(3, 8)),
bvshl(bv(0b00000001, 8), bv(4, 8)),
bvshl(bv(0b00000001, 8), bv(5, 8)),
bvshl(bv(0b00000001, 8), bv(6, 8)),
bvshl(bv(0b00000001, 8), bv(7, 8)),
bvshl(bv(0b00000001, 8), bv(8, 8)),
bvshl(bv(0b00000001, 8), bv(9, 8)),
bvshl(bv(0b00000001, 8), bv(123, 8)),
bvshl(bv(0b00000001, 8), bv(0, 8)),
bvshl(bv(0b00000011, 8), bv(1, 8)),
bvshl(bv(0b00000101, 8), bv(2, 8)),
bvshl(bv(0b00001001, 8), bv(3, 8)),
bvshl(bv(0b00010001, 8), bv(4, 8)),
bvshl(bv(0b00100001, 8), bv(5, 8)),
bvshl(bv(0b01000001, 8), bv(6, 8)),
bvshl(bv(0b10000011, 8), bv(7, 8)),
bvshl(bv(0b01000101, 8), bv(8, 8)),
bvshl(bv(0b00101001, 8), bv(9, 8)),
bvshl(bv(0b00010001, 8), bv(123, 8)),
]
self.check_ast(tests)
def test_not(self):
"""Check not operations."""
tests = [
bvnot(bv(0x88888888, 32)),
bvnot(bv(0x12345678, 32)),
bvnot(bv(0x22345678, 32)),
bvnot(bv(0x32345678, 32)),
bvnot(bv(0x42345678, 32)),
bvnot(bv(0x52345678, 32)),
bvnot(bv(0x62345678, 32)),
bvnot(bv(0x72345678, 32)),
bvnot(bv(0x82345678, 32)),
bvnot(bv(0x92345678, 32)),
bvnot(bv(0xa2345678, 32)),
bvnot(bv(0xb2345678, 32)),
bvnot(bv(0xc2345678, 32)),
bvnot(bv(0xd345678, 32)),
bvnot(bv(0xe2345678, 32)),
bvnot(bv(0xf2345678, 32)),
bvnot(bv(0x1, 32)),
bvnot(bv(0x2, 32)),
bvnot(bv(0x3, 32)),
bvnot(bv(0x4, 32)),
bvnot(bv(0x5, 32)),
bvnot(bv(0x6, 32)),
bvnot(bv(0xa, 32)),
bvnot(bv(0xe, 32)),
bvnot(bv(0xf, 32)),
bvnot(bv(0x1f, 32)),
bvnot(bv(0x2f, 32)),
bvnot(bv(0x3e, 32)),
bvnot(bv(0xffff, 32)),
]
self.check_ast(tests)
def test_ashr(self):
"""Check ashr operations."""
tests = [
bvashr(bv(0x88888888, 32), bv(0x99999999, 32)),
bvashr(bv(0x12345678, 32), bv(0, 32)),
bvashr(bv(0x12345678, 32), bv(1, 32)),
bvashr(bv(0x12345678, 32), bv(2, 32)),
bvashr(bv(0x12345678, 32), bv(3, 32)),
bvashr(bv(0x12345678, 32), bv(32, 32)),
bvashr(bv(0x12345678, 32), bv(64, 32)),
bvashr(bv(0x12345678, 32), bv(0x12345678, 32)),
bvashr(bv(0xf2345678, 32), bv(0, 32)),
bvashr(bv(0xf2345678, 32), bv(1, 32)),
bvashr(bv(0xf2345678, 32), bv(2, 32)),
bvashr(bv(0xf2345678, 32), bv(3, 32)),
bvashr(bv(0xf2345678, 32), bv(32, 32)),
bvashr(bv(0xf2345678, 32), bv(64, 32)),
bvashr(bv(0xf2345678, 32), bv(0x12345678, 32)),
bvashr(bv(0b10000000, 8), bv(0, 8)),
bvashr(bv(0b10000000, 8), bv(1, 8)),
bvashr(bv(0b10000000, 8), bv(2, 8)),
bvashr(bv(0b10000000, 8), bv(3, 8)),
bvashr(bv(0b10000000, 8), bv(4, 8)),
bvashr(bv(0b10000000, 8), bv(5, 8)),
bvashr(bv(0b10000000, 8), bv(6, 8)),
bvashr(bv(0b10000000, 8), bv(7, 8)),
bvashr(bv(0b10000000, 8), bv(8, 8)),
bvashr(bv(0b10000000, 8), bv(9, 8)),
bvashr(bv(0b10000000, 8), bv(123, 8)),
bvashr(bv(0b10001000, 8), bv(0, 8)),
bvashr(bv(0b10001000, 8), bv(1, 8)),
bvashr(bv(0b10001000, 8), bv(2, 8)),
bvashr(bv(0b10001000, 8), bv(3, 8)),
bvashr(bv(0b10001000, 8), bv(4, 8)),
bvashr(bv(0b10001000, 8), bv(5, 8)),
bvashr(bv(0b10001000, 8), bv(6, 8)),
bvashr(bv(0b10001000, 8), bv(7, 8)),
bvashr(bv(0b10001000, 8), bv(8, 8)),
bvashr(bv(0b10001000, 8), bv(9, 8)),
bvashr(bv(0b10001000, 8), bv(123, 8)),
bvashr(bv(0b00010001, 8), bv(0b00000001, 8)),
bvashr(bv(0b00010010, 8), bv(0b00000010, 8)),
bvashr(bv(0b00010100, 8), bv(0b00000100, 8)),
bvashr(bv(0b00001000, 8), bv(0b00001000, 8)),
bvashr(bv(0b00010000, 8), bv(0b00010000, 8)),
bvashr(bv(0b00100000, 8), bv(0b00100000, 8)),
bvashr(bv(0b01000000, 8), bv(0b01000001, 8)),
bvashr(bv(0b10000000, 8), bv(0b10000010, 8)),
bvashr(bv(0b01000000, 8), bv(0b00000011, 8)),
bvashr(bv(0b00100000, 8), bv(0b00000101, 8)),
bvashr(bv(0b00010000, 8), bv(0b00000110, 8)),
bvashr(bv(0b0010001, 7), bv(0b0000001, 7)),
bvashr(bv(0b0010010, 7), bv(0b0000010, 7)),
bvashr(bv(0b0010100, 7), bv(0b0000100, 7)),
bvashr(bv(0b0001000, 7), bv(0b0001000, 7)),
bvashr(bv(0b0010000, 7), bv(0b0010000, 7)),
bvashr(bv(0b0100000, 7), bv(0b0100000, 7)),
bvashr(bv(0b0000000, 7), bv(0b0000001, 7)),
bvashr(bv(0b1000000, 7), bv(0b1000010, 7)),
bvashr(bv(0b0000000, 7), bv(0b0000100, 7)),
bvashr(bv(0b0100000, 7), bv(0b0000110, 7)),
bvashr(bv(0b0010000, 7), bv(0b0000111, 7)),
bvashr(bv(0xfe00000000000000, 64), bv(8, 64)),
]
self.check_ast(tests)
def test_ashr(self):
"""Check ashr operations."""
tests = [
bvashr(bv(0x88888888, 32), bv(0x99999999, 32)),
bvashr(bv(0x12345678, 32), bv(0, 32)),
bvashr(bv(0x12345678, 32), bv(1, 32)),
bvashr(bv(0x12345678, 32), bv(2, 32)),
bvashr(bv(0x12345678, 32), bv(3, 32)),
bvashr(bv(0x12345678, 32), bv(32, 32)),
bvashr(bv(0x12345678, 32), bv(64, 32)),
bvashr(bv(0x12345678, 32), bv(0x12345678, 32)),
bvashr(bv(0xf2345678, 32), bv(0, 32)),
bvashr(bv(0xf2345678, 32), bv(1, 32)),
bvashr(bv(0xf2345678, 32), bv(2, 32)),
bvashr(bv(0xf2345678, 32), bv(3, 32)),
bvashr(bv(0xf2345678, 32), bv(32, 32)),
bvashr(bv(0xf2345678, 32), bv(64, 32)),
bvashr(bv(0xf2345678, 32), bv(0x12345678, 32)),
bvashr(bv(0b10000000, 8), bv(0, 8)),
bvashr(bv(0b10000000, 8), bv(1, 8)),
bvashr(bv(0b10000000, 8), bv(2, 8)),
bvashr(bv(0b10000000, 8), bv(3, 8)),
bvashr(bv(0b10000000, 8), bv(4, 8)),
bvashr(bv(0b10000000, 8), bv(5, 8)),
bvashr(bv(0b10000000, 8), bv(6, 8)),
bvashr(bv(0b10000000, 8), bv(7, 8)),
bvashr(bv(0b10000000, 8), bv(8, 8)),
bvashr(bv(0b10000000, 8), bv(9, 8)),
bvashr(bv(0b10000000, 8), bv(123, 8)),
bvashr(bv(0b10001000, 8), bv(0, 8)),
bvashr(bv(0b10001000, 8), bv(1, 8)),
bvashr(bv(0b10001000, 8), bv(2, 8)),
bvashr(bv(0b10001000, 8), bv(3, 8)),
bvashr(bv(0b10001000, 8), bv(4, 8)),
bvashr(bv(0b10001000, 8), bv(5, 8)),
bvashr(bv(0b10001000, 8), bv(6, 8)),
bvashr(bv(0b10001000, 8), bv(7, 8)),
bvashr(bv(0b10001000, 8), bv(8, 8)),
bvashr(bv(0b10001000, 8), bv(9, 8)),
bvashr(bv(0b10001000, 8), bv(123, 8)),
bvashr(bv(0b00010001, 8), bv(0b00000001, 8)),
bvashr(bv(0b00010010, 8), bv(0b00000010, 8)),
bvashr(bv(0b00010100, 8), bv(0b00000100, 8)),
bvashr(bv(0b00001000, 8), bv(0b00001000, 8)),
bvashr(bv(0b00010000, 8), bv(0b00010000, 8)),
bvashr(bv(0b00100000, 8), bv(0b00100000, 8)),
bvashr(bv(0b01000000, 8), bv(0b01000001, 8)),
bvashr(bv(0b10000000, 8), bv(0b10000010, 8)),
bvashr(bv(0b01000000, 8), bv(0b00000011, 8)),
bvashr(bv(0b00100000, 8), bv(0b00000101, 8)),
bvashr(bv(0b00010000, 8), bv(0b00000110, 8)),
bvashr(bv(0b0010001, 7), bv(0b0000001, 7)),
bvashr(bv(0b0010010, 7), bv(0b0000010, 7)),
bvashr(bv(0b0010100, 7), bv(0b0000100, 7)),
bvashr(bv(0b0001000, 7), bv(0b0001000, 7)),
bvashr(bv(0b0010000, 7), bv(0b0010000, 7)),
bvashr(bv(0b0100000, 7), bv(0b0100000, 7)),
bvashr(bv(0b0000000, 7), bv(0b0000001, 7)),
bvashr(bv(0b1000000, 7), bv(0b1000010, 7)),
bvashr(bv(0b0000000, 7), bv(0b0000100, 7)),
bvashr(bv(0b0100000, 7), bv(0b0000110, 7)),
bvashr(bv(0b0010000, 7), bv(0b0000111, 7)),
bvashr(bv(0xfe00000000000000, 64), bv(8, 64)),
]
self.check_ast(tests)
def test_not(self):
"""Check not operations."""
tests = [
bvnot(bv(0x88888888, 32)),
bvnot(bv(0x12345678, 32)),
bvnot(bv(0x22345678, 32)),
bvnot(bv(0x32345678, 32)),
bvnot(bv(0x42345678, 32)),
bvnot(bv(0x52345678, 32)),
bvnot(bv(0x62345678, 32)),
bvnot(bv(0x72345678, 32)),
bvnot(bv(0x82345678, 32)),
bvnot(bv(0x92345678, 32)),
bvnot(bv(0xa2345678, 32)),
bvnot(bv(0xb2345678, 32)),
bvnot(bv(0xc2345678, 32)),
bvnot(bv(0xd345678, 32)),
bvnot(bv(0xe2345678, 32)),
bvnot(bv(0xf2345678, 32)),
bvnot(bv(0x1, 32)),
bvnot(bv(0x2, 32)),
bvnot(bv(0x3, 32)),
bvnot(bv(0x4, 32)),
bvnot(bv(0x5, 32)),
bvnot(bv(0x6, 32)),
bvnot(bv(0xa, 32)),
bvnot(bv(0xe, 32)),
bvnot(bv(0xf, 32)),
bvnot(bv(0x1f, 32)),
bvnot(bv(0x2f, 32)),
bvnot(bv(0x3e, 32)),
bvnot(bv(0xffff, 32)),
]
self.check_ast(tests)
def test_shl(self):
"""Check shl operations."""
tests = [
bvshl(bv(0x88888888, 32), bv(0x99999999, 32)),
bvshl(bv(0x12345678, 32), bv(0, 32)),
bvshl(bv(0x12345678, 32), bv(1, 32)),
bvshl(bv(0x12345678, 32), bv(2, 32)),
bvshl(bv(0x12345678, 32), bv(3, 32)),
bvshl(bv(0x12345678, 32), bv(32, 32)),
bvshl(bv(0x12345678, 32), bv(64, 32)),
bvshl(bv(0x12345678, 32), bv(0x12345678, 32)),
bvshl(bv(0xf2345678, 32), bv(0, 32)),
bvshl(bv(0xf2345678, 32), bv(1, 32)),
bvshl(bv(0xf2345678, 32), bv(2, 32)),
bvshl(bv(0xf2345678, 32), bv(3, 32)),
bvshl(bv(0xf2345678, 32), bv(32, 32)),
bvshl(bv(0xf2345678, 32), bv(64, 32)),
bvshl(bv(0xf2345678, 32), bv(0x12345678, 32)),
bvshl(bv(0b00000001, 8), bv(0, 8)),
bvshl(bv(0b00000001, 8), bv(1, 8)),
bvshl(bv(0b00000001, 8), bv(2, 8)),
bvshl(bv(0b00000001, 8), bv(3, 8)),
bvshl(bv(0b00000001, 8), bv(4, 8)),
bvshl(bv(0b00000001, 8), bv(5, 8)),
bvshl(bv(0b00000001, 8), bv(6, 8)),
bvshl(bv(0b00000001, 8), bv(7, 8)),
bvshl(bv(0b00000001, 8), bv(8, 8)),
bvshl(bv(0b00000001, 8), bv(9, 8)),
bvshl(bv(0b00000001, 8), bv(123, 8)),
bvshl(bv(0b00000001, 8), bv(0, 8)),
bvshl(bv(0b00000011, 8), bv(1, 8)),
bvshl(bv(0b00000101, 8), bv(2, 8)),
bvshl(bv(0b00001001, 8), bv(3, 8)),
bvshl(bv(0b00010001, 8), bv(4, 8)),
bvshl(bv(0b00100001, 8), bv(5, 8)),
bvshl(bv(0b01000001, 8), bv(6, 8)),
bvshl(bv(0b10000011, 8), bv(7, 8)),
bvshl(bv(0b01000101, 8), bv(8, 8)),
bvshl(bv(0b00101001, 8), bv(9, 8)),
bvshl(bv(0b00010001, 8), bv(123, 8)),
]
self.check_ast(tests)
def test_lshr(self):
"""Check lshr operations."""
tests = [
bvlshr(bv(0x88888888, 32), bv(0x99999999, 32)),
bvlshr(bv(0x12345678, 32), bv(0, 32)),
bvlshr(bv(0x12345678, 32), bv(1, 32)),
bvlshr(bv(0x12345678, 32), bv(2, 32)),
bvlshr(bv(0x12345678, 32), bv(3, 32)),
bvlshr(bv(0x12345678, 32), bv(32, 32)),
bvlshr(bv(0x12345678, 32), bv(64, 32)),
bvlshr(bv(0x12345678, 32), bv(0x12345678, 32)),
bvlshr(bv(0xf2345678, 32), bv(0, 32)),
bvlshr(bv(0xf2345678, 32), bv(1, 32)),
bvlshr(bv(0xf2345678, 32), bv(2, 32)),
bvlshr(bv(0xf2345678, 32), bv(3, 32)),
bvlshr(bv(0xf2345678, 32), bv(4, 32)),
bvlshr(bv(0xf2345678, 32), bv(5, 32)),
bvlshr(bv(0xf2345678, 32), bv(6, 32)),
bvlshr(bv(0xf2345678, 32), bv(32, 32)),
bvlshr(bv(0xf2345678, 32), bv(64, 32)),
bvlshr(bv(0xf2345678, 32), bv(0x12345678, 32)),
bvlshr(bv(0b10000000, 8), bv(0, 8)),
bvlshr(bv(0b10000000, 8), bv(1, 8)),
bvlshr(bv(0b10000000, 8), bv(2, 8)),
bvlshr(bv(0b10000000, 8), bv(3, 8)),
bvlshr(bv(0b10000000, 8), bv(4, 8)),
bvlshr(bv(0b10000000, 8), bv(5, 8)),
bvlshr(bv(0b10000000, 8), bv(6, 8)),
bvlshr(bv(0b10000000, 8), bv(7, 8)),
bvlshr(bv(0b10000000, 8), bv(8, 8)),
bvlshr(bv(0b10000000, 8), bv(9, 8)),
bvlshr(bv(0b10000000, 8), bv(123, 8)),
bvlshr(bv(0b10001000, 8), bv(0, 8)),
bvlshr(bv(0b10001000, 8), bv(1, 8)),
bvlshr(bv(0b10001000, 8), bv(2, 8)),
bvlshr(bv(0b10001000, 8), bv(3, 8)),
bvlshr(bv(0b10001000, 8), bv(4, 8)),
bvlshr(bv(0b10001000, 8), bv(5, 8)),
bvlshr(bv(0b10001000, 8), bv(6, 8)),
bvlshr(bv(0b10001000, 8), bv(7, 8)),
bvlshr(bv(0b10001000, 8), bv(8, 8)),
bvlshr(bv(0b10001000, 8), bv(9, 8)),
bvlshr(bv(0b10001000, 8), bv(123, 8)),
]
self.check_ast(tests)
def test_zx_sx(self):
self.astEquals(TAst.zx(8, TAst.bv(0xff, 8)),
self.mba16.from_cst(0x00ff))
self.astEquals(TAst.sx(8, TAst.bv(0xff, 8)),
self.mba16.from_cst(0xffff))
def test_ror(self):
"""Check ror operations."""
tests = [
bvror(0x88888888, bv(0x99999999, 32)),
bvror(0x12345678, bv(0, 32)),
bvror(0x12345678, bv(1, 32)),
bvror(0x12345678, bv(2, 32)),
bvror(0x12345678, bv(3, 32)),
bvror(0x12345678, bv(32, 32)),
bvror(0x12345678, bv(64, 32)),
bvror(0x12345678, bv(0x12345678, 32)),
bvror(0xf2345678, bv(0, 32)),
bvror(0xf2345678, bv(1, 32)),
bvror(0xf2345678, bv(2, 32)),
bvror(0xf2345678, bv(3, 32)),
bvror(0xf2345678, bv(32, 32)),
bvror(0xf2345678, bv(64, 32)),
bvror(0xf2345678, bv(0x12345678, 32)),
bvror(0x99999999, bv(0x88888888, 32)),
bvror(0, bv(0x12345678, 32)),
bvror(1, bv(0x12345678, 32)),
bvror(2, bv(0x12345678, 32)),
bvror(3, bv(0x12345678, 32)),
bvror(32, bv(0x12345678, 32)),
bvror(64, bv(0x12345678, 32)),
bvror(0x12345678, bv(0x12345678, 32)),
bvror(0, bv(0xf2345678, 32)),
bvror(1, bv(0xf2345678, 32)),
bvror(2, bv(0xf2345678, 32)),
bvror(3, bv(0xf2345678, 32)),
bvror(32, bv(0xf2345678, 32)),
bvror(64, bv(0xf2345678, 32)),
bvror(0x12345678, bv(0xf2345678, 32)),
]
self.check_ast(tests)
def test_srem(self):
"""Check srem operations."""
tests = [
bvsrem(bv(0x88888888, 32), bv(0x99999999, 32)),
bvsrem(bv(0x12345678, 32), bv(0, 32)),
bvsrem(bv(0x12345678, 32), bv(1, 32)),
bvsrem(bv(0x12345678, 32), bv(2, 32)),
bvsrem(bv(0x12345678, 32), bv(3, 32)),
bvsrem(bv(0x12345678, 32), bv(32, 32)),
bvsrem(bv(0x12345678, 32), bv(64, 32)),
bvsrem(bv(0x12345678, 32), bv(0x12345678, 32)),
bvsrem(bv(0xf2345678, 32), bv(0, 32)),
bvsrem(bv(0xf2345678, 32), bv(1, 32)),
bvsrem(bv(0xf2345678, 32), bv(2, 32)),
bvsrem(bv(0xf2345678, 32), bv(3, 32)),
bvsrem(bv(0xf2345678, 32), bv(32, 32)),
bvsrem(bv(0xf2345678, 32), bv(64, 32)),
bvsrem(bv(0xf2345678, 32), bv(0x12345678, 32)),
bvsrem(bv(0b10000000, 8), bv(0, 8)),
bvsrem(bv(0b10000000, 8), bv(1, 8)),
bvsrem(bv(0b10000000, 8), bv(2, 8)),
bvsrem(bv(0b10000000, 8), bv(3, 8)),
bvsrem(bv(0b10000000, 8), bv(4, 8)),
bvsrem(bv(0b10000000, 8), bv(5, 8)),
bvsrem(bv(0b10000000, 8), bv(6, 8)),
bvsrem(bv(0b10000000, 8), bv(7, 8)),
bvsrem(bv(0b10000000, 8), bv(8, 8)),
bvsrem(bv(0b10000000, 8), bv(9, 8)),
bvsrem(bv(0b10000000, 8), bv(123, 8)),
bvsrem(bv(0b10001000, 8), bv(0, 8)),
bvsrem(bv(0b10001000, 8), bv(1, 8)),
bvsrem(bv(0b10001000, 8), bv(2, 8)),
bvsrem(bv(0b10001000, 8), bv(3, 8)),
bvsrem(bv(0b10001000, 8), bv(4, 8)),
bvsrem(bv(0b10001000, 8), bv(5, 8)),
bvsrem(bv(0b10001000, 8), bv(6, 8)),
bvsrem(bv(0b10001000, 8), bv(7, 8)),
bvsrem(bv(0b10001000, 8), bv(8, 8)),
bvsrem(bv(0b10001000, 8), bv(9, 8)),
bvsrem(bv(0b10001000, 8), bv(123, 8)),
bvsrem(bv(0b00010001, 8), bv(0b00000001, 8)),
bvsrem(bv(0b00010010, 8), bv(0b00000010, 8)),
bvsrem(bv(0b00010100, 8), bv(0b00000100, 8)),
bvsrem(bv(0b00001000, 8), bv(0b00001000, 8)),
bvsrem(bv(0b00010000, 8), bv(0b00010000, 8)),
bvsrem(bv(0b00100000, 8), bv(0b00100000, 8)),
bvsrem(bv(0b01000000, 8), bv(0b01000001, 8)),
bvsrem(bv(0b10000000, 8), bv(0b10000010, 8)),
bvsrem(bv(0b01000000, 8), bv(0b00000011, 8)),
bvsrem(bv(0b00100000, 8), bv(0b00000101, 8)),
bvsrem(bv(0b00010000, 8), bv(0b00000110, 8)),
bvsrem(bv(0b0010001, 7), bv(0b0000001, 7)),
bvsrem(bv(0b0010010, 7), bv(0b0000010, 7)),
bvsrem(bv(0b0010100, 7), bv(0b0000100, 7)),
bvsrem(bv(0b0001000, 7), bv(0b0001000, 7)),
bvsrem(bv(0b0010000, 7), bv(0b0010000, 7)),
bvsrem(bv(0b0100000, 7), bv(0b0100000, 7)),
bvsrem(bv(0b0000000, 7), bv(0b0000001, 7)),
bvsrem(bv(0b1000000, 7), bv(0b1000010, 7)),
bvsrem(bv(0b0000000, 7), bv(0b0000100, 7)),
bvsrem(bv(0b0100000, 7), bv(0b0000110, 7)),
bvsrem(bv(0b0010000, 7), bv(0b0000111, 7)),
bvsrem(bv(291, 16), sx(8, bv(251, 8))),
bvsrem(bv(4, 16), sx(8, bv(255, 8))),
bvsrem(zx(16, bv(42313, 16)), sx(16, bv(65491, 16))),
bvsrem(zx(16, bv(32768, 16)), sx(16, bv(65535, 16))),
bvsrem(zx(32, bv(4294734073, 32)), sx(32, bv(4294967251, 32))),
bvsrem(zx(32, bv(2147483648, 32)), sx(32, bv(4294967295, 32))),
bvsrem(zx(64, bv(18446744073709318393, 64)),
sx(64, bv(18446744073709551571, 64))),
bvsrem(zx(64, bv(9223372036854775808, 64)),
sx(64, bv(18446744073709551615, 64))),
]
self.check_ast(tests)
def test_srem(self):
"""Check srem operations."""
tests = [
bvsrem(bv(0x88888888, 32), bv(0x99999999, 32)),
bvsrem(bv(0x12345678, 32), bv(0, 32)),
bvsrem(bv(0x12345678, 32), bv(1, 32)),
bvsrem(bv(0x12345678, 32), bv(2, 32)),
bvsrem(bv(0x12345678, 32), bv(3, 32)),
bvsrem(bv(0x12345678, 32), bv(32, 32)),
bvsrem(bv(0x12345678, 32), bv(64, 32)),
bvsrem(bv(0x12345678, 32), bv(0x12345678, 32)),
bvsrem(bv(0xf2345678, 32), bv(0, 32)),
bvsrem(bv(0xf2345678, 32), bv(1, 32)),
bvsrem(bv(0xf2345678, 32), bv(2, 32)),
bvsrem(bv(0xf2345678, 32), bv(3, 32)),
bvsrem(bv(0xf2345678, 32), bv(32, 32)),
bvsrem(bv(0xf2345678, 32), bv(64, 32)),
bvsrem(bv(0xf2345678, 32), bv(0x12345678, 32)),
bvsrem(bv(0b10000000, 8), bv(0, 8)),
bvsrem(bv(0b10000000, 8), bv(1, 8)),
bvsrem(bv(0b10000000, 8), bv(2, 8)),
bvsrem(bv(0b10000000, 8), bv(3, 8)),
bvsrem(bv(0b10000000, 8), bv(4, 8)),
bvsrem(bv(0b10000000, 8), bv(5, 8)),
bvsrem(bv(0b10000000, 8), bv(6, 8)),
bvsrem(bv(0b10000000, 8), bv(7, 8)),
bvsrem(bv(0b10000000, 8), bv(8, 8)),
bvsrem(bv(0b10000000, 8), bv(9, 8)),
bvsrem(bv(0b10000000, 8), bv(123, 8)),
bvsrem(bv(0b10001000, 8), bv(0, 8)),
bvsrem(bv(0b10001000, 8), bv(1, 8)),
bvsrem(bv(0b10001000, 8), bv(2, 8)),
bvsrem(bv(0b10001000, 8), bv(3, 8)),
bvsrem(bv(0b10001000, 8), bv(4, 8)),
bvsrem(bv(0b10001000, 8), bv(5, 8)),
bvsrem(bv(0b10001000, 8), bv(6, 8)),
bvsrem(bv(0b10001000, 8), bv(7, 8)),
bvsrem(bv(0b10001000, 8), bv(8, 8)),
bvsrem(bv(0b10001000, 8), bv(9, 8)),
bvsrem(bv(0b10001000, 8), bv(123, 8)),
bvsrem(bv(0b00010001, 8), bv(0b00000001, 8)),
bvsrem(bv(0b00010010, 8), bv(0b00000010, 8)),
bvsrem(bv(0b00010100, 8), bv(0b00000100, 8)),
bvsrem(bv(0b00001000, 8), bv(0b00001000, 8)),
bvsrem(bv(0b00010000, 8), bv(0b00010000, 8)),
bvsrem(bv(0b00100000, 8), bv(0b00100000, 8)),
bvsrem(bv(0b01000000, 8), bv(0b01000001, 8)),
bvsrem(bv(0b10000000, 8), bv(0b10000010, 8)),
bvsrem(bv(0b01000000, 8), bv(0b00000011, 8)),
bvsrem(bv(0b00100000, 8), bv(0b00000101, 8)),
bvsrem(bv(0b00010000, 8), bv(0b00000110, 8)),
bvsrem(bv(0b0010001, 7), bv(0b0000001, 7)),
bvsrem(bv(0b0010010, 7), bv(0b0000010, 7)),
bvsrem(bv(0b0010100, 7), bv(0b0000100, 7)),
bvsrem(bv(0b0001000, 7), bv(0b0001000, 7)),
bvsrem(bv(0b0010000, 7), bv(0b0010000, 7)),
bvsrem(bv(0b0100000, 7), bv(0b0100000, 7)),
bvsrem(bv(0b0000000, 7), bv(0b0000001, 7)),
bvsrem(bv(0b1000000, 7), bv(0b1000010, 7)),
bvsrem(bv(0b0000000, 7), bv(0b0000100, 7)),
bvsrem(bv(0b0100000, 7), bv(0b0000110, 7)),
bvsrem(bv(0b0010000, 7), bv(0b0000111, 7)),
bvsrem(bv(291, 16), sx(8, bv(251, 8))),
bvsrem(bv(4, 16), sx(8, bv(255, 8))),
bvsrem(zx(16, bv(42313, 16)), sx(16, bv(65491, 16))),
bvsrem(zx(16, bv(32768, 16)), sx(16, bv(65535, 16))),
bvsrem(zx(32, bv(4294734073, 32)), sx(32, bv(4294967251, 32))),
bvsrem(zx(32, bv(2147483648, 32)), sx(32, bv(4294967295, 32))),
bvsrem(zx(64, bv(18446744073709318393, 64)), sx(64, bv(18446744073709551571, 64))),
bvsrem(zx(64, bv(9223372036854775808, 64)), sx(64, bv(18446744073709551615, 64))),
]
self.check_ast(tests)
def test_or(self):
"""Check or operations."""
tests = [
bvor(bv(0x88888888, 32), bv(0x99999999, 32)),
bvor(bv(0x12345678, 32), bv(0, 32)),
bvor(bv(0x12345678, 32), bv(1, 32)),
bvor(bv(0x12345678, 32), bv(2, 32)),
bvor(bv(0x12345678, 32), bv(3, 32)),
bvor(bv(0x12345678, 32), bv(32, 32)),
bvor(bv(0x12345678, 32), bv(64, 32)),
bvor(bv(0x12345678, 32), bv(0x12345678, 32)),
bvor(bv(0xf2345678, 32), bv(0, 32)),
bvor(bv(0xf2345678, 32), bv(1, 32)),
bvor(bv(0xf2345678, 32), bv(2, 32)),
bvor(bv(0xf2345678, 32), bv(3, 32)),
bvor(bv(0xf2345678, 32), bv(32, 32)),
bvor(bv(0xf2345678, 32), bv(64, 32)),
bvor(bv(0xf2345678, 32), bv(0x12345678, 32)),
]
self.check_ast(tests)
def test_or(self):
"""Check or operations."""
tests = [
bvor(bv(0x88888888, 32), bv(0x99999999, 32)),
bvor(bv(0x12345678, 32), bv(0, 32)),
bvor(bv(0x12345678, 32), bv(1, 32)),
bvor(bv(0x12345678, 32), bv(2, 32)),
bvor(bv(0x12345678, 32), bv(3, 32)),
bvor(bv(0x12345678, 32), bv(32, 32)),
bvor(bv(0x12345678, 32), bv(64, 32)),
bvor(bv(0x12345678, 32), bv(0x12345678, 32)),
bvor(bv(0xf2345678, 32), bv(0, 32)),
bvor(bv(0xf2345678, 32), bv(1, 32)),
bvor(bv(0xf2345678, 32), bv(2, 32)),
bvor(bv(0xf2345678, 32), bv(3, 32)),
bvor(bv(0xf2345678, 32), bv(32, 32)),
bvor(bv(0xf2345678, 32), bv(64, 32)),
bvor(bv(0xf2345678, 32), bv(0x12345678, 32)),
]
self.check_ast(tests)
def test_leaves(self):
c = random.choice(range(0xff))
self.astEquals(TAst.bv(c, 8), self.mba8.from_cst(c))
self.astEquals(self.x8_t, self.x8)
