def emulate(pc, index, y, targetadd):
Triton.concretizeAllRegister()
Triton.concretizeAllMemory()
flag = 0
Triton.setConcreteRegisterValue(Triton.registers.ebp, 0x6ffffffb)
Triton.setConcreteRegisterValue(Triton.registers.ebp, 0x6fffffff)
esp = Triton.buildSymbolicRegister(Triton.registers.ebp).evaluate()
address = 28
addressv = 200
Triton.setConcreteMemoryValue(esp + 12, address)
Triton.setConcreteMemoryValue(address, addressv)
for i in range(index + 1):
Triton.setConcreteMemoryValue(addressv, ord('S'))
addressv = addressv + 1
if (y == 1):
#strin= ""
for j in range(index):
print 'F'
#strin = strin+'F'
#print strin,hex(targetadd)
print hex(targetadd)
while pc:
opcodes = Triton.getConcreteMemoryAreaValue(pc, 16)
instruction = Instruction()
instruction.setOpcode(opcodes)
instruction.setAddress(pc)
Triton.processing(instruction)
if (instruction.isControlFlow()):
flag = flag + 1
if instruction.getType() == OPCODE.INT:
pc = instruction.getNextAddress()
y = Triton.buildSymbolicRegister(Triton.registers.eax).evaluate()
if y == 1:
break
continue
pc = Triton.buildSymbolicRegister(Triton.registers.eip).evaluate()
if (pc == 28):
return 5
return 1
class TestInstruction(unittest.TestCase):
"""Testing the Instruction class."""
def setUp(self):
"""Define and process the instruction to test."""
self.Triton = TritonContext()
self.Triton.setArchitecture(ARCH.X86_64)
self.inst = Instruction()
self.inst.setOpcode("\x48\x01\xd8") # add rax, rbx
self.inst.setAddress(0x400000)
self.Triton.setConcreteRegisterValue(self.Triton.registers.rax, 0x1122334455667788)
self.Triton.setConcreteRegisterValue(self.Triton.registers.rbx, 0x8877665544332211)
self.Triton.processing(self.inst)
def test_address(self):
"""Check instruction current and next address."""
self.assertEqual(self.inst.getAddress(), 0x400000)
self.assertEqual(self.inst.getNextAddress(), 0x400003)
def test_memory(self):
"""Check memory access."""
self.assertListEqual(self.inst.getLoadAccess(), [])
self.assertListEqual(self.inst.getStoreAccess(), [])
self.assertFalse(self.inst.isMemoryWrite())
self.assertFalse(self.inst.isMemoryRead())
def test_registers(self):
"""Check register access."""
self.assertEqual(len(self.inst.getReadRegisters()), 2, "access RAX and RBX")
self.assertEqual(len(self.inst.getWrittenRegisters()), 8, "write in RAX, RIP, AF, XF, OF, PF, SF and ZF")
def test_taints(self):
"""Check taints attributes."""
self.assertFalse(self.inst.isTainted())
def test_prefix(self):
"""Check prefix data."""
self.assertFalse(self.inst.isPrefixed())
self.assertEqual(self.inst.getPrefix(), PREFIX.INVALID)
def test_control_flow(self):
"""Check control flow flags."""
self.assertFalse(self.inst.isControlFlow(), "It is not a jmp, ret or call")
self.assertFalse(self.inst.isBranch(), "It is not a jmp")
def test_condition(self):
"""Check condition flags."""
self.assertFalse(self.inst.isConditionTaken())
def test_opcode(self):
"""Check opcode informations."""
self.assertEqual(self.inst.getOpcode(), "\x48\x01\xd8")
self.assertEqual(self.inst.getType(), OPCODE.ADD)
def test_thread(self):
"""Check threads information."""
self.assertEqual(self.inst.getThreadId(), 0)
def test_operand(self):
"""Check operand information."""
self.assertEqual(len(self.inst.getOperands()), 2)
self.assertEqual(self.inst.getOperands()[0].getName(), "rax")
self.assertEqual(self.inst.getOperands()[1].getName(), "rbx")
with self.assertRaises(Exception):
self.inst.getOperands()[2]
def test_symbolic(self):
"""Check symbolic information."""
self.assertEqual(len(self.inst.getSymbolicExpressions()), 8)
def test_size(self):
"""Check size information."""
self.assertEqual(self.inst.getSize(), 3)
def test_disassembly(self):
"""Check disassembly equivalent."""
self.assertEqual(self.inst.getDisassembly(), "add rax, rbx")
class TestInstruction(unittest.TestCase):
"""Testing the Instruction class."""
def setUp(self):
"""Define and process the instruction to test."""
self.Triton = TritonContext()
self.Triton.setArchitecture(ARCH.X86_64)
self.inst = Instruction()
self.inst.setOpcode(b"\x48\x01\xd8") # add rax, rbx
self.inst.setAddress(0x400000)
self.Triton.setConcreteRegisterValue(self.Triton.registers.rax, 0x1122334455667788)
self.Triton.setConcreteRegisterValue(self.Triton.registers.rbx, 0x8877665544332211)
self.Triton.processing(self.inst)
def test_address(self):
"""Check instruction current and next address."""
self.assertEqual(self.inst.getAddress(), 0x400000)
self.assertEqual(self.inst.getNextAddress(), 0x400003)
inst = Instruction()
inst.setAddress(-1)
self.assertEqual(inst.getAddress(), 0xffffffffffffffff)
inst.setAddress(-2)
self.assertEqual(inst.getAddress(), 0xfffffffffffffffe)
inst.setAddress(-3)
self.assertEqual(inst.getAddress(), 0xfffffffffffffffd)
def test_memory(self):
"""Check memory access."""
self.assertListEqual(self.inst.getLoadAccess(), [])
self.assertListEqual(self.inst.getStoreAccess(), [])
self.assertFalse(self.inst.isMemoryWrite())
self.assertFalse(self.inst.isMemoryRead())
def test_registers(self):
"""Check register access."""
self.assertEqual(len(self.inst.getReadRegisters()), 2, "access RAX and RBX")
self.assertEqual(len(self.inst.getWrittenRegisters()), 8, "write in RAX, RIP, AF, XF, OF, PF, SF and ZF")
def test_taints(self):
"""Check taints attributes."""
self.assertFalse(self.inst.isTainted())
def test_prefix(self):
"""Check prefix data."""
self.assertFalse(self.inst.isPrefixed())
self.assertEqual(self.inst.getPrefix(), PREFIX.X86.INVALID)
def test_control_flow(self):
"""Check control flow flags."""
self.assertFalse(self.inst.isControlFlow(), "It is not a jmp, ret or call")
self.assertFalse(self.inst.isBranch(), "It is not a jmp")
def test_condition(self):
"""Check condition flags."""
self.assertFalse(self.inst.isConditionTaken())
def test_opcode(self):
"""Check opcode informations."""
self.assertEqual(self.inst.getOpcode(), b"\x48\x01\xd8")
self.assertEqual(self.inst.getType(), OPCODE.X86.ADD)
def test_thread(self):
"""Check threads information."""
self.assertEqual(self.inst.getThreadId(), 0)
def test_operand(self):
"""Check operand information."""
self.assertEqual(len(self.inst.getOperands()), 2)
self.assertEqual(self.inst.getOperands()[0].getName(), "rax")
self.assertEqual(self.inst.getOperands()[1].getName(), "rbx")
with self.assertRaises(Exception):
self.inst.getOperands()[2]
def test_symbolic(self):
"""Check symbolic information."""
self.assertEqual(len(self.inst.getSymbolicExpressions()), 8)
def test_size(self):
"""Check size information."""
self.assertEqual(self.inst.getSize(), 3)
def test_disassembly(self):
"""Check disassembly equivalent."""
self.assertEqual(self.inst.getDisassembly(), "add rax, rbx")
def emulate(pc, index, y, targetadd):
Triton.concretizeAllRegister()
Triton.concretizeAllMemory()
x = 0
#Triton.buildSymbolicRegister(Triton.registers.eax).evaluate()
Triton.setConcreteRegisterValue(Triton.registers.ebp, 0x6ffffffb)
Triton.setConcreteRegisterValue(Triton.registers.ebp, 0x6fffffff)
esp = Triton.buildSymbolicRegister(Triton.registers.ebp).evaluate()
address = 28
addressv = 234
Triton.setConcreteMemoryValue(esp + 12, address)
Triton.setConcreteMemoryValue(address, addressv)
#Triton.setConcreteMemoryAreaValue(address,CPUSIZE.WORD,addressv)
#print 'index',index
for i in range(index + 1):
#index=index-1
Triton.setConcreteMemoryValue(addressv, ord('A'))
#print 'A'
addressv = addressv + 1
if (y == 1):
print 'This Input its is going to given/invalid address'
strin = ""
for j in range(index):
strin = strin + 'A'
print strin, hex(targetadd) #, type(targetadd)
#Triton.setConcreteMemoryValue(MemoryAccess(addressv,CPUSIZE.DWORD),targetadd)
#inte = int(targetadd[2:3])
#print unichr(inte)
#+ targetadd[0]+targetadd[1]+targetadd[2]+targetadd[3]+targetadd[4]+targetadd[5]+targetadd[6]
#Triton.setConcreteMemoryAreaValue(address,CPUSIZE.WORD,addressv)
while pc:
# Fetch opcodes
opcodes = Triton.getConcreteMemoryAreaValue(pc, 16)
# Create the Triton instruction
instruction = Instruction()
instruction.setOpcode(opcodes)
instruction.setAddress(pc)
# Process
Triton.processing(instruction)
#print instruction
if (instruction.isControlFlow()):
x = x + 1
if instruction.getType() == OPCODE.INT:
pc = instruction.getNextAddress()
y = Triton.buildSymbolicRegister(Triton.registers.eax).evaluate()
#y = getConcreteRegisterValue(REG.EAX)
if y == 1:
break
continue
# Next
pc = Triton.buildSymbolicRegister(Triton.registers.eip).evaluate()
#print pc
if (pc == 28):
#print "reached"
return 5
#print 'The number of control transfer instructions are :'
#print x
return 1
def emulate(pc, sgx_ocall, sgx_free, is_threaded):
count = 0
policies.init_emulator()
policies.init_thread_env()
while pc and count < MAX_INST_CNT:
if (not policies.is_thread_unlocked()):
continue
if is_threaded:
emul_thread_lock.acquire()
opcode = Triton.getConcreteMemoryAreaValue(pc, 16)
instruction = Instruction()
instruction.setOpcode(opcode)
instruction.setAddress(pc)
try:
ret = Triton.processing(instruction)
if not ret:
if WARN_DEBUG:
print(
'[LIMITATION] unsupported instruction at 0x%x' % (pc))
Triton.setConcreteRegisterValue(Triton.registers.rip,
instruction.getNextAddress())
except:
if WARN_DEBUG:
print('[EXCEPTION] instruction process error ...')
if('\xf3\x0f\x1e\xfa' in opcode):
Triton.setConcreteRegisterValue(Triton.registers.rip,
pc + 0x4)
else:
break
count += 1
inst_ring_buffer[instruction.getAddress()] = True
if (PRINT_INST_DEBUG and instruction.getType() == OPCODE.X86.RET):
ret_addr = Triton.getConcreteRegisterValue(Triton.registers.rip)
print('[INSTRUCTION] return instruction: ', instruction)
print('[INSTRUCTION] return to: 0x%x' % ret_addr)
if (PRINT_INST_DEBUG and instruction.getType() == OPCODE.X86.CALL):
print('[INSTRUCTION] call instruction: ', instruction)
policies.push_inst_to_ring_buffer(instruction)
policies.inspection(instruction)
if (instruction.getDisassembly() == sgx_ocall
or instruction.getDisassembly() == sgx_free):
force_return_to_callsite(0x0)
if (instruction.getType() == OPCODE.X86.XGETBV):
Triton.setConcreteRegisterValue(Triton.registers.rip,
instruction.getNextAddress())
if instruction.getType() == OPCODE.X86.HLT:
if is_threaded:
emul_thread_lock.release()
break
if (not hook_process_inst(instruction)):
if is_threaded:
emul_thread_lock.release()
break
if (policies.is_report_avl()):
print_report()
policies.clear_last_report()
if is_threaded:
emul_thread_lock.release()
break
pc = Triton.getConcreteRegisterValue(Triton.registers.rip)
del instruction
if is_threaded:
emul_thread_lock.release()
if (count % 10000 == 0):
gc.collect()
policies.exit_emulator()
policies.destroy_thread_env()
return (count)
