def test_ExprSlice_strcst(self):
from miasm.expression.expression import ExprInt, ExprOp
from miasm.ir.translators.translator import Translator
translator_smt2 = Translator.to_language("smt2")
args = [ExprInt(i, 32) for i in range(9)]
self.assertEqual(
translator_smt2.from_expr(args[0][1:2]), r'((_ extract 1 1) (_ bv0 32))')
self.assertRaises(ValueError, args[0].__getitem__, slice(1,7,2))
def test_ExprSlice_strcst(self):
from miasm.expression.expression import ExprInt, ExprOp
from miasm.ir.translators.translator import Translator
translator_smt2 = Translator.to_language("smt2")
args = [ExprInt(i, 32) for i in range(9)]
self.assertEqual(translator_smt2.from_expr(args[0][1:2]),
r'((_ extract 1 1) (_ bv0 32))')
self.assertRaises(ValueError, args[0].__getitem__, slice(1, 7, 2))
def test_ExprOp_strcst(self):
from miasm.expression.expression import ExprInt, ExprOp
from miasm.ir.translators.translator import Translator
translator_smt2 = Translator.to_language("smt2")
args = [ExprInt(i, 32) for i in range(9)]
self.assertEqual(
translator_smt2.from_expr(ExprOp('|', *args[:2])), r'(bvor (_ bv0 32) (_ bv1 32))')
self.assertEqual(
translator_smt2.from_expr(ExprOp('-', *args[:2])), r'(bvsub (_ bv0 32) (_ bv1 32))')
self.assertEqual(
translator_smt2.from_expr(ExprOp('+', *args[:3])), r'(bvadd (bvadd (_ bv0 32) (_ bv1 32)) (_ bv2 32))')
self.assertRaises(NotImplementedError, translator_smt2.from_expr, ExprOp('X', *args[:1]))
def test_ExprOp_strcst(self):
from miasm.expression.expression import ExprInt, ExprOp
from miasm.ir.translators.translator import Translator
translator_smt2 = Translator.to_language("smt2")
args = [ExprInt(i, 32) for i in range(9)]
self.assertEqual(translator_smt2.from_expr(ExprOp('|', *args[:2])),
r'(bvor (_ bv0 32) (_ bv1 32))')
self.assertEqual(translator_smt2.from_expr(ExprOp('-', *args[:2])),
r'(bvsub (_ bv0 32) (_ bv1 32))')
self.assertEqual(translator_smt2.from_expr(ExprOp('+', *args[:3])),
r'(bvadd (bvadd (_ bv0 32) (_ bv1 32)) (_ bv2 32))')
self.assertRaises(NotImplementedError, translator_smt2.from_expr,
ExprOp('X', *args[:1]))
res = z3.If(src == 0, size, src)
for i in range(size - 1, -1, -1):
res = z3.If((src & (1 << i)) != 0, i, res)
elif expr.op == "cntleadzeros":
size = expr.size
src = res
res = z3.If(src == 0, size, src)
for i in range(size, 0, -1):
index = -i % size
out = size - (index + 1)
res = z3.If((src & (1 << index)) != 0, out, res)
elif expr.op.startswith("zeroExt"):
arg, = expr.args
res = z3.ZeroExt(expr.size - arg.size, self.from_expr(arg))
elif expr.op.startswith("signExt"):
arg, = expr.args
res = z3.SignExt(expr.size - arg.size, self.from_expr(arg))
else:
raise NotImplementedError("Unsupported OP yet: %s" % expr.op)
return res
def from_ExprAssign(self, expr):
src = self.from_expr(expr.src)
dst = self.from_expr(expr.dst)
return (src == dst)
# Register the class
Translator.register(TranslatorZ3)
res = z3.If(src == 0, size, src)
for i in range(size - 1, -1, -1):
res = z3.If((src & (1 << i)) != 0, i, res)
elif expr.op == "cntleadzeros":
size = expr.size
src = res
res = z3.If(src == 0, size, src)
for i in range(size, 0, -1):
index = - i % size
out = size - (index + 1)
res = z3.If((src & (1 << index)) != 0, out, res)
elif expr.op.startswith("zeroExt"):
arg, = expr.args
res = z3.ZeroExt(expr.size - arg.size, self.from_expr(arg))
elif expr.op.startswith("signExt"):
arg, = expr.args
res = z3.SignExt(expr.size - arg.size, self.from_expr(arg))
else:
raise NotImplementedError("Unsupported OP yet: %s" % expr.op)
return res
def from_ExprAssign(self, expr):
src = self.from_expr(expr.src)
dst = self.from_expr(expr.dst)
return (src == dst)
# Register the class
Translator.register(TranslatorZ3)
states_todo.add((addr_b, symbexec.symbols.copy(), tuple(list(conds) + list(viewitems(cond_group_b)))))
elif addr == ret_addr:
print('Return address reached')
continue
elif addr.is_int():
addr = int(addr.arg)
states_todo.add((addr, symbexec.symbols.copy(), tuple(conds)))
elif addr.is_loc():
states_todo.add((addr, symbexec.symbols.copy(), tuple(conds)))
else:
raise ValueError("Unsupported destination")
if __name__ == '__main__':
loc_db = LocationDB()
translator_smt2 = Translator.to_language("smt2")
addr = int(options.address, 16)
cont = Container.from_stream(open(args[0], 'rb'), loc_db)
mdis = machine.dis_engine(cont.bin_stream, loc_db=loc_db)
lifter = machine.lifter(mdis.loc_db)
ircfg = lifter.new_ircfg()
symbexec = SymbolicExecutionEngine(lifter)
asmcfg = parse_asm.parse_txt(
machine.mn, 32, '''
init:
PUSH argv
PUSH argc
PUSH ret_addr
dst_cast = "uint%d_t" % size
for index, arg in expr.iter_args():
out.append("(((%s)(%s & %s)) << %d)" %
(dst_cast, self.from_expr(arg),
self._size2mask(arg.size), index))
out = ' | '.join(out)
return '(' + out + ')'
else:
# Convert all parts to bignum
args = []
for index, arg in expr.iter_args():
arg_str = self.from_expr(arg)
if arg.size <= self.NATIVE_INT_MAX_SIZE:
arg_str = '((%s) & %s)' % (arg_str,
self._size2mask(arg.size))
arg_str = 'bignum_from_uint64(%s)' % arg_str
else:
arg_str = 'bignum_mask(%s, %d)' % (arg_str, arg.size)
arg_str = 'bignum_lshift(%s, %d)' % (arg_str, index)
args.append(arg_str)
out = args.pop()
while args:
arg = args.pop()
out = "bignum_or(%s, %s)" % (out, arg)
return out
# Register the class
Translator.register(TranslatorC)
states_todo.add((addr_b, symbexec.symbols.copy(), tuple(list(conds) + list(viewitems(cond_group_b)))))
elif addr == ret_addr:
print('Return address reached')
continue
elif addr.is_int():
addr = int(addr.arg)
states_todo.add((addr, symbexec.symbols.copy(), tuple(conds)))
elif addr.is_loc():
states_todo.add((addr, symbexec.symbols.copy(), tuple(conds)))
else:
raise ValueError("Unsupported destination")
if __name__ == '__main__':
translator_smt2 = Translator.to_language("smt2")
addr = int(options.address, 16)
cont = Container.from_stream(open(args[0], 'rb'))
mdis = machine.dis_engine(cont.bin_stream, loc_db=cont.loc_db)
ir_arch = machine.ir(mdis.loc_db)
ircfg = ir_arch.new_ircfg()
symbexec = SymbolicExecutionEngine(ir_arch)
asmcfg, loc_db = parse_asm.parse_txt(machine.mn, 32, '''
init:
PUSH argv
PUSH argc
PUSH ret_addr
''',
"""
ret = ""
ret += "(set-logic {})\n".format(logic)
# define bit vectors
for bv in self._bitvectors:
size = self._bitvectors[bv]
ret += "{}\n".format(declare_bv(bv, size))
# define memory arrays
for size in self._mem.mems:
mem = self._mem.mems[size]
ret += "{}\n".format(declare_array(mem, bit_vec(size), bit_vec(8)))
# merge SMT2 expressions
for expr in exprs:
ret += expr + "\n"
# define action
ret += "(check-sat)\n"
# enable model generation
if model:
ret += "(get-model)\n"
return ret
# Register the class
Translator.register(TranslatorSMT2)
def from_ExprCond(self, expr):
return "ExprCond(%s, %s, %s)" % (self.from_expr(expr.cond),
self.from_expr(expr.src1),
self.from_expr(expr.src2))
def from_ExprSlice(self, expr):
return "ExprSlice(%s, %d, %d)" % (self.from_expr(expr.arg),
expr.start,
expr.stop)
def from_ExprOp(self, expr):
return "ExprOp(%s, %s)" % (
repr(expr.op),
", ".join(map(self.from_expr, expr.args))
)
def from_ExprCompose(self, expr):
args = ["%s" % self.from_expr(arg) for arg in expr.args]
return "ExprCompose(%s)" % ", ".join(args)
def from_ExprAssign(self, expr):
return "ExprAssign(%s, %s)" % (self.from_expr(expr.dst),
self.from_expr(expr.src))
def from_ExprMem(self, expr):
return "ExprMem(%s, size=%d)" % (self.from_expr(expr.ptr), expr.size)
# Register the class
Translator.register(TranslatorMiasm)
return "((%s) & 0x%x)" % ((" %s " % expr.op).join(args),
(1 << expr.size) - 1)
elif expr.op == "parity":
return "(%s & 0x1)" % self.from_expr(expr.args[0])
elif expr.op == "==":
return self.from_expr(
ExprCond(expr.args[0] - expr.args[1], ExprInt(0, 1),
ExprInt(1, 1)))
elif expr.op in ["<<<", ">>>"]:
amount_raw = expr.args[1]
amount = expr.args[1] % ExprInt(amount_raw.size, expr.size)
amount_inv = ExprInt(expr.size, expr.size) - amount
if expr.op == "<<<":
amount, amount_inv = amount_inv, amount
part1 = "(%s >> %s)" % (self.from_expr(
expr.args[0]), self.from_expr(amount))
part2 = "(%s << %s)" % (self.from_expr(
expr.args[0]), self.from_expr(amount_inv))
return "((%s | %s) &0x%x)" % (part1, part2, int(expr.mask))
raise NotImplementedError("Unknown operator: %s" % expr.op)
def from_ExprAssign(self, expr):
return "%s = %s" % (self.from_expr(expr.dst), self.from_expr(expr.src))
# Register the class
Translator.register(TranslatorPython)
for index, arg in expr.iter_args():
out.append("(((%s)(%s & %s)) << %d)" % (
dst_cast,
self.from_expr(arg),
self._size2mask(arg.size),
index)
)
out = ' | '.join(out)
return '(' + out + ')'
else:
# Convert all parts to bignum
args = []
for index, arg in expr.iter_args():
arg_str = self.from_expr(arg)
if arg.size <= self.NATIVE_INT_MAX_SIZE:
arg_str = '((%s) & %s)' % (arg_str, self._size2mask(arg.size))
arg_str = 'bignum_from_uint64(%s)' % arg_str
else:
arg_str = 'bignum_mask(%s, %d)' % (arg_str, arg.size)
arg_str = 'bignum_lshift(%s, %d)' % (arg_str, index)
args.append(arg_str)
out = args.pop()
while args:
arg = args.pop()
out = "bignum_or(%s, %s)" % (out, arg)
return out
# Register the class
Translator.register(TranslatorC)
(" %s " % expr.op).join(args),
(1 << expr.size) - 1
)
elif expr.op == "parity":
return "(%s & 0x1)" % self.from_expr(expr.args[0])
elif expr.op in ["<<<", ">>>"]:
amount_raw = expr.args[1]
amount = expr.args[1] % ExprInt(amount_raw.size, expr.size)
amount_inv = ExprInt(expr.size, expr.size) - amount
if expr.op == "<<<":
amount, amount_inv = amount_inv, amount
part1 = "(%s >> %s)"% (self.from_expr(expr.args[0]),
self.from_expr(amount))
part2 = "(%s << %s)"% (self.from_expr(expr.args[0]),
self.from_expr(amount_inv))
return "((%s | %s) &0x%x)" % (part1, part2, int(expr.mask))
raise NotImplementedError("Unknown operator: %s" % expr.op)
def from_ExprAssign(self, expr):
return "%s = %s" % (
self.from_expr(expr.dst),
self.from_expr(expr.src)
)
# Register the class
Translator.register(TranslatorPython)
"""
ret = ""
ret += "(set-logic {})\n".format(logic)
# define bit vectors
for bv in self._bitvectors:
size = self._bitvectors[bv]
ret += "{}\n".format(declare_bv(bv, size))
# define memory arrays
for size in self._mem.mems:
mem = self._mem.mems[size]
ret += "{}\n".format(declare_array(mem, bit_vec(size), bit_vec(8)))
# merge SMT2 expressions
for expr in exprs:
ret += expr + "\n"
# define action
ret += "(check-sat)\n"
# enable model generation
if model:
ret += "(get-model)\n"
return ret
# Register the class
Translator.register(TranslatorSMT2)
result = ExprCompose(result, arg)
return result
def from_ExprAssign(self, expr: Expr) -> Expr:
"""
Translates an ExprAssign.
Args:
expr: Expression to translate.
Returns:
Expression as ExprAssign.
"""
return ExprAssign(self.from_expr(expr.dst), self.from_expr(expr.src))
def from_ExprMem(self, expr: Expr) -> Expr:
"""
Translates an ExprMem.
Args:
expr: Expression to translate.
Returns:
Expression as ExprMem.
"""
return ExprMem(self.from_expr(expr.ptr), expr.size)
# Register the class
Translator.register(AbstractSyntaxTreeTranslator)