示例#1
0
def test_arm_postprocess_ret():

    for i in xrange(3):
        # e91ba8f0
        # ldmdb  R11, {R4,R11,SP,PC}
        irsb = pyvex.IRSB(data=b'\xe9\x1b\xa8\xf0',
                          mem_addr=0xed4028,
                          arch=archinfo.ArchARMEL(endness=archinfo.Endness.BE),
                          num_inst=1,
                          opt_level=i)
        nose.tools.assert_equal(irsb.jumpkind, 'Ijk_Ret')

        # e91badf0
        # ldmdb  R11, {R4-R8,R10,R11,SP,PC}
        irsb = pyvex.IRSB(data=b'\xe9\x1b\xa8\xf0',
                          mem_addr=0x4d4028,
                          arch=archinfo.ArchARMEL(endness=archinfo.Endness.BE),
                          num_inst=1,
                          opt_level=i)
        nose.tools.assert_equal(irsb.jumpkind, 'Ijk_Ret')

        # 00a89de8
        # ldmfd SP, {R11,SP,PC}
        # Fixed by Fish in the VEX fork, commit 43c78f608490f9a5c71c7fca87c04759c1b93741
        irsb = pyvex.IRSB(data=b'\x00\xa8\x9d\xe8',
                          mem_addr=0xc800b57c,
                          arch=archinfo.ArchARMEL(endness=archinfo.Endness.LE),
                          num_inst=1,
                          opt_level=1)
        nose.tools.assert_equal(irsb.jumpkind, 'Ijk_Ret')
示例#2
0
def test_memory():
    arches = ['VexArchX86', 'VexArchPPC32', 'VexArchAMD64', 'VexArchARM']
    # we're not including VexArchMIPS32 cause it segfaults sometimes

    for i in xrange(10000):
        try:
            s = hex(random.randint(2**100, 2**100 * 16))[2:]
            a = random.choice(arches)
            p = pyvex.IRSB(bytes=s, arch=a)
        except pyvex.PyVEXError:
            pass

    kb_start = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss

    for i in xrange(20000):
        try:
            s = hex(random.randint(2**100, 2**100 * 16))[2:]
            a = random.choice(arches)
            p = pyvex.IRSB(bytes=s, arch=a)
        except pyvex.PyVEXError:
            pass
    del p
    gc.collect()

    kb_end = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss

    # allow a 2mb leeway
    nose.tools.assert_less(kb_end - kb_start, 2000)
示例#3
0
def test_arm_postprocess_ret():
    for i in range(3):
        # e91ba8f0
        # ldmdb  R11, {R4,R11,SP,PC}
        irsb = pyvex.IRSB(
            data=b"\xe9\x1b\xa8\xf0",
            mem_addr=0xED4028,
            arch=archinfo.ArchARMEL(endness=archinfo.Endness.BE),
            num_inst=1,
            opt_level=i,
        )
        assert irsb.jumpkind == "Ijk_Ret"

        # e91badf0
        # ldmdb  R11, {R4-R8,R10,R11,SP,PC}
        irsb = pyvex.IRSB(
            data=b"\xe9\x1b\xa8\xf0",
            mem_addr=0x4D4028,
            arch=archinfo.ArchARMEL(endness=archinfo.Endness.BE),
            num_inst=1,
            opt_level=i,
        )
        assert irsb.jumpkind == "Ijk_Ret"

        # 00a89de8
        # ldmfd SP, {R11,SP,PC}
        # Fixed by Fish in the VEX fork, commit 43c78f608490f9a5c71c7fca87c04759c1b93741
        irsb = pyvex.IRSB(
            data=b"\x00\xa8\x9d\xe8",
            mem_addr=0xC800B57C,
            arch=archinfo.ArchARMEL(endness=archinfo.Endness.LE),
            num_inst=1,
            opt_level=1,
        )
        assert irsb.jumpkind == "Ijk_Ret"
示例#4
0
    def test_two_irsb(self):
        irsb1 = pyvex.IRSB(bytes='\x5d\xc3')
        irsb2 = pyvex.IRSB(bytes='\x5d\x5d\x5d\x5d')

        stmts1 = irsb1.statements()
        stmts2 = irsb2.statements()

        self.assertNotEqual(len(stmts1), len(stmts2))
示例#5
0
def test_two_irsb():
    irsb1 = pyvex.IRSB(bytes='\x5d\xc3')
    irsb2 = pyvex.IRSB(bytes='\x5d\x5d\x5d\x5d')

    stmts1 = irsb1.statements
    stmts2 = irsb2.statements

    nose.tools.assert_not_equal(len(stmts1), len(stmts2))
示例#6
0
文件: test.py 项目: zyc1314/pyvex
def test_two_irsb():
    irsb1 = pyvex.IRSB(data=b'\x5d\xc3', mem_addr=0, arch=ArchAMD64())
    irsb2 = pyvex.IRSB(data=b'\x5d\x5d\x5d\x5d', mem_addr=0, arch=ArchAMD64())

    stmts1 = irsb1.statements
    stmts2 = irsb2.statements

    nose.tools.assert_not_equal(len(stmts1), len(stmts2))
示例#7
0
def test_irsb_tyenv():
    irsb = pyvex.IRSB(bytes='\x5d\xc3')
    print irsb.tyenv
    print "Orig"
    print irsb.tyenv
    print "Copy"
    print irsb.tyenv.deepCopy()

    print "Empty"
    irsb2 = pyvex.IRSB()
    print irsb2.tyenv

    print "Unwrapped"
    irsb2.tyenv = irsb.tyenv.deepCopy()
    print irsb2.tyenv
示例#8
0
    def get_irsbs(self, code, address):
        irsbs = []
        code_address = address
        while code_address <= address + len(
                code) - self.arch.instruction_alignment:
            try:
                irsb = pyvex.IRSB(code[code_address - address:],
                                  code_address,
                                  self.arch,
                                  opt_level=0)
                irsbs.append(irsb)
            except:  # If decoding fails, we can't use this gadget
                traceback.print_exc()
                return []  # So just return an empty list

            if (self.arch.name not in extra_archinfo.ENDS_EARLY_ARCHS
                    or irsb.jumpkind != 'Ijk_Boring'
                    or not self.irsb_ends_with_constant_pc(irsb)):
                break

            # Find the last address that was translated (For some architectures, pyvex stops before the end of a block)
            last_addr = None
            for stmt in irsb.statements:
                if stmt.tag == 'Ist_IMark':
                    last_addr = stmt.addr

            # If we couldn't get any statements from the instructions, there was a problem.
            if last_addr == None:  # So just return an empty list
                return []

            # And move the code address forward to the next untranslated instruction
            code_address = last_addr + self.arch.instruction_alignment

        return irsbs
示例#9
0
    def test_irsb_deepCopy(self):
        irsb = pyvex.IRSB(bytes='\x5d\xc3')
        stmts = irsb.statements()

        irsb2 = irsb.deepCopy()
        stmts2 = irsb2.statements()
        self.assertEqual(len(stmts), len(stmts2))
示例#10
0
 def test_irstmt_pp(self):
     irsb = pyvex.IRSB(bytes='\x5d\xc3')
     stmts = irsb.statements()
     for i in stmts:
         print "STMT: ",
         i.pp()
         print
示例#11
0
    def ret(self, expr=None):
        if expr is not None: self.set_return_expr(expr)
        if self.arguments is not None:
            l.debug("Returning without setting exits due to 'internal' call.")
            return
        elif self.ret_to is not None:
            self.state.log.add_action(SimActionExit(self.state, self.ret_to))
            self.add_successor(self.state, self.ret_to, self.state.se.true,
                               'Ijk_Ret')
        else:
            if self.cleanup:
                self.state.options.discard(o.AST_DEPS)
                self.state.options.discard(o.AUTO_REFS)

            ret_irsb = pyvex.IRSB(arch=self.state.arch,
                                  bytes=self.state.arch.ret_instruction,
                                  mem_addr=self.addr)
            ret_simirsb = SimIRSB(self.state,
                                  ret_irsb,
                                  inline=True,
                                  addr=self.addr)
            if not ret_simirsb.flat_successors + ret_simirsb.unsat_successors:
                ret_state = ret_simirsb.default_exit
            else:
                ret_state = (ret_simirsb.flat_successors +
                             ret_simirsb.unsat_successors)[0]

            if self.cleanup:
                self.state.options.add(o.AST_DEPS)
                self.state.options.add(o.AUTO_REFS)

            self.add_successor(ret_state, ret_state.scratch.target,
                               ret_state.scratch.guard,
                               ret_state.scratch.jumpkind)
示例#12
0
    def ret(self, expr=None):
        if expr is not None: self.set_return_expr(expr)
        if self.arguments is not None:
            l.debug("Returning without setting exits due to 'internal' call.")
            return
        elif self.ret_to is not None:
            self.state.log.add_action(SimActionExit(self.state, self.ret_to))
            self.add_successor(self.state, self.ret_to, self.state.se.true, 'Ijk_Ret')
        else:
            if self.cleanup:
                self.state.options.discard(o.AST_DEPS)
                self.state.options.discard(o.AUTO_REFS)

            if o.KEEP_IP_SYMBOLIC in self.state.options and isinstance(self.addr, claripy.ast.Base):
                # TODO maybe i want to keep address symbolic
                s = claripy.Solver()
                addrs = s.eval(self.state.regs.ip, 257, extra_constraints=tuple(self.state.ip_constraints))
                if len(addrs) > 256:
                    addrs = self.state.se.any_n_int(self.state.regs.ip, 1)

                self.addr = addrs[0]

            ret_irsb = pyvex.IRSB(self.state.arch.ret_instruction, self.addr, self.state.arch)
            ret_simirsb = SimIRSB(self.state, ret_irsb, inline=True, addr=self.addr)
            if not ret_simirsb.flat_successors + ret_simirsb.unsat_successors:
                ret_state = ret_simirsb.default_exit
            else:
                ret_state = (ret_simirsb.flat_successors + ret_simirsb.unsat_successors)[0]

            if self.cleanup:
                self.state.options.add(o.AST_DEPS)
                self.state.options.add(o.AUTO_REFS)

            self._add_successor_state(ret_state, ret_state.scratch.target)
示例#13
0
文件: metaelf.py 项目: ocean1/cle
 def _block(self, addr):
     # for sanity checking. we live in the world of heuristics now.
     thumb = self.arch.name.startswith("ARM") and addr % 2 == 1
     realaddr = addr
     if thumb: realaddr -= 1
     dat = ''.join(self.memory.read_bytes(realaddr, 40))
     return pyvex.IRSB(dat, addr, self.arch, bytes_offset=1 if thumb else 0)
示例#14
0
 def _block(self, addr, skip_stmts=False):
     # for sanity checking. we live in the world of heuristics now.
     thumb = self.arch.name.startswith("ARM") and addr % 2 == 1
     realaddr = addr
     if thumb: realaddr -= 1
     dat = self._block_bytes(realaddr, 40)
     return pyvex.IRSB(dat, addr, self.arch, bytes_offset=1 if thumb else 0, opt_level=1, skip_stmts=skip_stmts)
示例#15
0
文件: test.py 项目: zyc1314/pyvex
def test_irexpr_rdtmp():
    m = pyvex.IRExpr.RdTmp.get_instance(123)
    nose.tools.assert_equal(m.tag, "Iex_RdTmp")
    nose.tools.assert_equal(m.tmp, 123)

    irsb = pyvex.IRSB(b'\x90\x5d\xc3', mem_addr=0x0, arch=ArchAMD64())
    print("TMP:",irsb.next.tmp)
示例#16
0
def test_inspect_exit():
    class counts:  #pylint:disable=no-init
        exit_before = 0
        exit_after = 0

    def handle_exit_before(state):
        counts.exit_before += 1
        exit_target = state.inspect.exit_target
        nose.tools.assert_equal(state.solver.eval(exit_target), 0x3f8)
        # change exit target
        state.inspect.exit_target = 0x41414141
        nose.tools.assert_equal(state.inspect.exit_jumpkind, "Ijk_Boring")
        nose.tools.assert_true(state.inspect.exit_guard.is_true())

    def handle_exit_after(state):  #pylint:disable=unused-argument
        counts.exit_after += 1

    s = SimState(arch="AMD64", mode="symbolic")
    irsb = pyvex.IRSB(b"\x90\x90\x90\x90\xeb\x0a",
                      mem_addr=1000,
                      arch=archinfo.ArchAMD64())

    # break on exit
    s.inspect.b('exit', BP_BEFORE, action=handle_exit_before)
    s.inspect.b('exit', BP_AFTER, action=handle_exit_after)

    # step it
    succ = SimEngineVEX().process(s, irsb).flat_successors

    # check
    nose.tools.assert_equal(succ[0].solver.eval(succ[0].ip), 0x41414141)
    nose.tools.assert_equal(counts.exit_before, 1)
    nose.tools.assert_equal(counts.exit_after, 1)
示例#17
0
文件: test.py 项目: zyc1314/pyvex
def test_irsb_deepCopy():
    irsb = pyvex.IRSB(data=b'\x5d\xc3', mem_addr=0, arch=ArchAMD64())
    stmts = irsb.statements

    irsb2 = copy.deepcopy(irsb)
    stmts2 = irsb2.statements
    nose.tools.assert_equal(len(stmts), len(stmts2))
示例#18
0
def test_irsb_deepCopy():
    irsb = pyvex.IRSB(bytes='\x5d\xc3')
    stmts = irsb.statements

    irsb2 = irsb.deepCopy()
    stmts2 = irsb2.statements
    nose.tools.assert_equal(len(stmts), len(stmts2))
示例#19
0
文件: metaelf.py 项目: mephi42/cle
 def _block(self, addr):
     # for sanity checking. we live in the world of heuristics now.
     thumb = self.arch.name.startswith("ARM") and addr % 2 == 1
     realaddr = addr
     if thumb: realaddr -= 1
     dat = self.memory.load(AT.from_lva(realaddr, self).to_rva(), 40)
     return pyvex.IRSB(dat, addr, self.arch, bytes_offset=1 if thumb else 0, opt_level=1)
示例#20
0
    def lift(self, insn):
        try:
            self.irsb = pyvex.IRSB(insn.decode('hex'), self.addr, self.arch)
            if self.irsb.instructions != 1:
                raise InvalidInstruction
            if self.irsb.jumpkind == 'Ijk_NoDecode':
                return JSONize(Uninterpretable().to_JSON())
            self.tyenv = self.irsb.tyenv
        except pyvex.errors.PyVEXError:
            return JSONize(Uninterpretable().to_JSON())

        try:
            for stmt in self.irsb.statements:
                parsed = self.fetch_stmt(stmt)
                self.deal_stmt(parsed)

            if isinstance(self.irsb.next, pyvex.expr.RdTmp):
                tmp = self.irsb.next.tmp
                name = Basic('t%d' % tmp)
                size = Basic(self._get_size(self.irsb.next))
                addr = Var(name, size)
            else:
                addr = Number(self.irsb.next.con.value, 32)
            self.statements.append(End(addr))
            return JSONize(Stmts(self.statements).to_JSON())
        except IncapableError:
            return JSONize(Incapable().to_JSON())
示例#21
0
def test_memory():

    try:
        import resource
    except ImportError:
        print(
            "Cannot import the resource package. Are you using Windows? Skip test_memory()."
        )
        return

    arches = [ArchX86(), ArchPPC32(endness=Endness.BE), ArchAMD64(), ArchARM()]
    # we're not including ArchMIPS32 cause it segfaults sometimes

    # disable logging, as that may fill up log buffers somewhere
    logging.disable(logging.ERROR)

    for _ in range(10000):
        try:
            s = os.urandom(32)
            a = random.choice(arches)
            p = pyvex.IRSB(data=s, mem_addr=0, arch=a)
        except pyvex.PyVEXError:
            pass

    kb_start = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss

    for _ in range(20000):
        try:
            s = os.urandom(32)
            a = random.choice(arches)
            p = pyvex.IRSB(data=s, mem_addr=0, arch=a)
        except pyvex.PyVEXError:
            pass
    del p
    gc.collect()

    logging.disable(logging.NOTSET)

    kb_end = resource.getrusage(resource.RUSAGE_SELF).ru_maxrss

    pyvex.pvc.clear_log()
    pyvex.pvc.LibVEX_ShowAllocStats()
    print(LibVEXLifter.get_vex_log())

    # allow a 5mb leeway
    nose.tools.assert_less(kb_end - kb_start, 5000)
示例#22
0
    def __init__(self, bytes, address=0x0, arch_str='x64'):
        if arch_str == 'x64':
            arch = archinfo.ArchAMD64()
        else:
            pass  #TODO:

        self.Address = address
        self.irsb = pyvex.IRSB(bytes, address, arch)
示例#23
0
def test_irstmt_noop():
    irsb = pyvex.IRSB(bytes='\x90\x5d\xc3')
    irnop = irsb.statements[0]
    irnop2 = pyvex.IRStmt.NoOp()
    irnop3 = irnop2.deepCopy()

    nose.tools.assert_equal(irnop.tag, "Ist_NoOp")
    nose.tools.assert_equal(type(irnop), type(irnop2))
    nose.tools.assert_equal(type(irnop), type(irnop3))
示例#24
0
    def test_irstmt_noop(self):
        irsb = pyvex.IRSB(bytes='\x90\x5d\xc3')
        irnop = irsb.statements()[0]
        irnop2 = pyvex.IRStmt.NoOp()
        irnop3 = irnop2.deepCopy()

        self.assertEqual(irnop.tag, "Ist_NoOp")
        self.assertEqual(type(irnop), type(irnop2))
        self.assertEqual(type(irnop), type(irnop3))
示例#25
0
    def vex(self):
        if not self._vex:
            offset = 1 if self._thumb else 0
            self._vex = pyvex.IRSB(self.bytes,
                                   self.addr,
                                   self._arch,
                                   bytes_offset=offset)
            self._parse_vex_info()

        return self._vex
示例#26
0
def translate_to_irsb(block_bytes, block_dsm, start_index, end_index,
                      start_address, arch, file_path, opt_level):
    end_is_fake = False
    if not end_index:
        end_index = len(block_bytes)
        end_is_fake = True
    assert isinstance(block_bytes[start_index:end_index], (str, bytes))
    end_address = start_address + (end_index - start_index)
    instruction_size = len(arch.nop_instruction)
    if isinstance(arch, archinfo.ArchMIPS32):
        end_address -= instruction_size

    assert 0 <= start_index < end_index
    try:
        # we need to get the real (inside the indexes) last dsm instruction, unless its fake then we -1 it.
        irsb = pyvex.IRSB(block_bytes[start_index:end_index],
                          start_address,
                          arch,
                          opt_level=opt_level)
        succs = irsb.constant_jump_targets
    except pyvex.PyVEXError as e:
        logging.warning(
            'Error `{}` when trying to translate:\n {}\nBytes: {}\nArch: {}\nPath={}'
            .format(
                e, '\n'.join([
                    '{} {} {}'.format(hex(a_d_s[0]), a_d_s[1], a_d_s[2])
                    for a_d_s in block_dsm
                ]), [hex(ord(c)) for c in block_bytes[start_index:end_index]],
                arch, file_path))
        return

    if irsb.jumpkind == 'Ijk_NoDecode':
        logging.debug("Block at {} is NoDecode, dropping.".format(
            hex(start_address)))
        return

    # remove the cluttering NoOp that the VEX translation adds
    irsb.statements = [
        s for s in irsb.statements if type(s) is not pyvex.stmt.NoOp
    ]

    if irsb.jumpkind == 'Ijk_Boring' and irsb.direct_next and len(succs) == 1:
        next_block_addr = succs.pop()
        if start_address < next_block_addr < end_address:
            logging.debug('\n'.join([
                '{} {} {}'.format(hex(a_d_s2[0]), a_d_s2[1], a_d_s2[2])
                for a_d_s2 in block_dsm
            ]))
            logging.debug(irsb._pp_str())
            logging.debug({'binary': block_bytes[start_index:end_index]})
            logging.error("Block at [{},{}] cut off at {}.".format(
                hex(start_address), hex(end_address), hex(next_block_addr)))
            assert False

    return irsb
示例#27
0
def test_irexpr_rdtmp():
    m = pyvex.IRExpr.RdTmp(123)
    nose.tools.assert_equal(m.tag, "Iex_RdTmp")
    nose.tools.assert_equal(m.tmp, 123)

    m.tmp = 1337
    nose.tools.assert_equal(m.tmp, 1337)
    nose.tools.assert_raises(Exception, pyvex.IRExpr.RdTmp)

    irsb = pyvex.IRSB('\x90\x5d\xc3', mem_addr=0x0, arch=ArchAMD64())
    print("TMP:", irsb.next.tmp)
示例#28
0
def test_store_simplification():
    state = SimState(arch='X86')
    state.regs.esp = state.solver.BVS('stack_pointer', 32)
    state.regs.ebp = state.solver.BVS('base_pointer', 32)
    state.regs.eax = state.solver.BVS('base_eax', 32)

    irsb = pyvex.IRSB(b'PT]\xc2\x10\x00', 0x4000, state.arch)
    sim_successors = HeavyVEXMixin(None).process(state.copy(), irsb=irsb)
    exit_state = sim_successors.all_successors[0]

    nose.tools.assert_true(claripy.backends.z3.is_true(exit_state.regs.ebp == state.regs.esp - 4))
示例#29
0
def test_arm_postprocess_ret():

    for i in xrange(3):
        # e91ba8f0
        # ldmdb  R11, {R4,R11,SP,PC}
        irsb = pyvex.IRSB(data='\xe9\x1b\xa8\xf0',
                          mem_addr=0xed4028,
                          arch=archinfo.ArchARMEL(endness=archinfo.Endness.BE),
                          num_inst=1,
                          opt_level=i)
        nose.tools.assert_equal(irsb.jumpkind, 'Ijk_Ret')

        # e91badf0
        # ldmdb  R11, {R4-R8,R10,R11,SP,PC}
        irsb = pyvex.IRSB(data='\xe9\x1b\xa8\xf0',
                          mem_addr=0x4d4028,
                          arch=archinfo.ArchARMEL(endness=archinfo.Endness.BE),
                          num_inst=1,
                          opt_level=i)
        nose.tools.assert_equal(irsb.jumpkind, 'Ijk_Ret')
示例#30
0
def test_convert_from_vex_irsb():

    arch = archinfo.arch_from_id('AMD64')

    manager = ailment.Manager(arch=arch)

    irsb = pyvex.IRSB(block_bytes, block_addr, arch, opt_level=0)

    ablock = ailment.IRSBConverter.convert(irsb, manager)

    print(str(ablock))