def check_uc(self):
dips = self.compile_dis_list()
self.solver.gen_config('uc',
depth=self.config.depth,
skip=self.config.depth - 1)
attack_comps = AttackComponents(self.org_cir, self.obf_cir,
self.config.enable_async,
self.key_constraints)
if self.config.solver == 'symbiyosys':
attack_comps.get_unique_completion(dips)
else:
attack_comps.get_unique_completion_formal(dips)
write_verilog(attack_comps.main, "main.sv", self.config.exe_path)
results = self.solver.execute_uc()
# check results
if results.assumptions_failed:
# unique key is available
logging.warning("uc passed!")
return True
elif results.passed:
# there is no unique key
logging.warning("there is no unique key!")
return False
else:
logging.critical("something is wrong!")
exit()
def check_umc(self):
dips = self.compile_dis_list()
self.solver.gen_config('umc', depth=0, skip=0)
attack_comps = AttackComponents(self.org_cir, self.obf_cir,
self.config.enable_async,
self.key_constraints)
if self.config.solver == 'symbiyosys':
attack_comps.get_umc(dips)
else:
attack_comps.get_umc_formal(dips)
write_verilog(attack_comps.main, "main.sv", self.config.exe_path)
results = self.solver.execute_umc()
# check results
if results.passed:
logging.warning("umc passed!")
return True
elif results.failed:
logging.warning("umc failed!")
return False
elif results.unknown:
logging.critical("umc returned unknown")
exit()
else:
logging.critical("something is wrong!")
exit()
def check_ce(self):
# check for combinational equivalency
attack_comps = AttackComponents(self.org_cir, self.obf_cir,
self.config.enable_async,
self.key_constraints)
ce, state_count = build_ce(self.obf_cir)
logging.warning('found {} DFFs and LATs'.format(state_count))
f = open(self.config.exe_path + 'obf_ce.v', "w")
f.write(ce)
f.close()
if self.config.solver == 'symbiyosys':
attack_comps.get_combinational_equivalence(self.obf_cir.name,
state_count,
self.dip_list)
else:
attack_comps.get_combinational_equivalence_formal(
self.obf_cir.name, state_count, self.dip_list)
write_verilog(attack_comps.main, "main.sv", self.config.exe_path)
self.solver.gen_config('ce',
depth=self.config.depth + 1,
skip=self.config.depth - 1)
results = self.solver.execute_ce()
# check status
if results.passed:
logging.warning("ce passed!")
return True
else:
logging.warning("ce failed!")
return False
def find_keys(self, equal_keys=False):
attack_comps = AttackComponents(self.org_cir, self.obf_cir,
self.config.enable_async,
self.key_constraints)
dips = self.compile_dis_list()
if self.config.solver == 'symbiyosys':
attack_comps.get_keys_circuit(dips, self.config.depth - 1,
equal_keys)
else:
attack_comps.get_keys_circuit_formal(dips, self.config.depth - 1,
equal_keys)
# ce, state_count = build_ce(self.obf_cir)
# f = open(self.config.exe_path + 'obf_ce.v', "w")
# f.write(ce)
# f.close()
self.solver.gen_config('fk',
skip=self.config.depth - 2,
depth=self.config.depth + 1)
write_verilog(attack_comps.main, "main.sv", self.config.exe_path)
results = self.solver.execute_fk()
# check status
if results.passed:
assumed_keys = self.solver.get_keys()
logging.info("assigned keys: " + str(assumed_keys))
return assumed_keys
else:
logging.critical("something is wrong!")
exit()
def dis_gen(self):
# dis gen with hd, it decreases hd at the boundary
attack_comps = AttackComponents(self.org_cir, self.obf_cir,
self.config.enable_async,
self.key_constraints)
while 1:
dips = self.compile_dis_list()
# update ast and generate Verilog file again
if self.config.solver == 'symbiyosys':
attack_comps.get_dip_gen(dips)
else:
attack_comps.get_dip_gen_formal(dips)
write_verilog(attack_comps.main, "main.sv", self.config.exe_path)
self.solver.gen_config('dis',
depth=self.config.depth,
skip=self.skip - 1)
results = self.solver.execute_dis()
# if self.iteration == 1:
# exit()
# check for termination
if results.passed:
logging.warning("there is no more dis(es) within boundary")
self.save_dips()
return
elif results.assumptions_failed:
logging.warning(
"two different agreeing keys could not be found for the current set of assumptions, checking uc"
)
self.save_dips()
self.config.depth = len(self.dip_list[-1]) + 1
return
else:
dis, keys = self.solver.get_dis()
if self.config.enable_async:
dip_tmp = []
for i in range(len(dis)):
if i % 2 == 0:
dip_tmp.append(dis[i])
self.dip_list.append(dip_tmp)
else:
self.dip_list.append(dis)
logging.info("dip: {}".format(self.dip_list[-1]))
self.iteration = self.iteration + 1
logging.warning("iteration: {}, dip seq length: {}".format(
self.iteration, len(self.dip_list[-1])))
logging.info("keys: {}".format(keys))