Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def _update_mappings(self, actual_addr, cnt):
if options.MEMORY_SYMBOLIC_BYTES_MAP in self.state.options:
page_num = actual_addr // self._page_size
page_idx = actual_addr
if self.state.solver.symbolic(cnt):
self._symbolic_addrs[page_num].add(page_idx)
else:
self._symbolic_addrs[page_num].discard(page_idx)
if not (options.REVERSE_MEMORY_NAME_MAP in self.state.options or
options.REVERSE_MEMORY_HASH_MAP in self.state.options):
return
if (options.REVERSE_MEMORY_HASH_MAP not in self.state.options) and \
len(self.state.solver.variables(cnt)) == 0:
return
l.debug("Updating mappings at address 0x%x", actual_addr)
def terminate_execution(statement, state, successors):
l.debug("Returning with an empty stack: ending execution")
# this code is coming by sim_procedure.exit()
state.options.discard(o.AST_DEPS)
state.options.discard(o.AUTO_REFS)
exit_code = 0
if type(statement) is SimSootStmt_Return:
exit_code = statement.return_value
# TODO symbolic exit code?
exit_code = state.solver.BVV(exit_code, state.arch.bits)
state.history.add_event('terminate', exit_code=exit_code)
successors.add_successor(state, state.regs.ip, state.solver.true, 'Ijk_Exit')
successors.processed = True
raise BlockTerminationNotice()
def set_strongref_state(self, state):
if sim_options.EFFICIENT_STATE_MERGING in state.options:
self.strongref_state = state
def remove_preconstraints(self, state, to_composite_solver=True, simplify=True):
if not (self.preconstrain_input or self.preconstrain_flag):
return
# cache key set creation
precon_cache_keys = set()
for con in self.preconstraints:
precon_cache_keys.add(con.cache_key)
# if we used the replacement solver we didn't add constraints we need to remove so keep all constraints
if so.REPLACEMENT_SOLVER in state.options:
new_constraints = state.se.constraints
else:
new_constraints = filter(lambda x: x.cache_key not in precon_cache_keys, state.se.constraints)
if state.has_plugin("zen_plugin"):
new_constraints = state.get_plugin("zen_plugin").filter_constraints(new_constraints)
if to_composite_solver:
state.options.discard(so.REPLACEMENT_SOLVER)
state.options.add(so.COMPOSITE_SOLVER)
state.release_plugin('solver_engine')
state.add_constraints(*new_constraints)
l.debug("downsizing unpreconstrained state")
state.downsize()
if simplify:
for reg, val, is_addr, mem_region in state.arch.default_register_values:
region_base = None # so pycharm does not complain
if is_addr:
if isinstance(mem_region, tuple):
# unpack it
mem_region, region_base = mem_region
elif mem_region == 'global':
# Backward compatibility
region_base = 0
else:
raise AngrSimOSError('You must specify the base address for memory region "%s". ' % mem_region)
if o.ABSTRACT_MEMORY in state.options and is_addr:
address = claripy.ValueSet(state.arch.bits, mem_region, region_base, val)
state.registers.store(reg, address)
else:
state.registers.store(reg, val)
if addr is None: addr = self.project.entry
state.regs.ip = addr
# set up the "root history" node
state.scratch.ins_addr = addr
state.scratch.bbl_addr = addr
state.scratch.stmt_idx = 0
state.history.jumpkind = 'Ijk_Boring'
return state
def _post_process(self):
if self._post_processed: return
self._post_processed = True
if o.SIMPLIFY_EXPRS in self.state.options:
self.expr = self.state.solver.simplify(self.expr)
if self._constraints:
self.state.add_constraints(*self._constraints)
if self.state.solver.symbolic(self.expr) and o.CONCRETIZE in self.state.options:
self.make_concrete()
if self.expr.size() != self.size_bits():
raise SimExpressionError("Inconsistent expression size: should be %d but is %d" % (self.size_bits(), self.expr.size()))
def branch(self):
new_name_mapping = self._name_mapping.branch() if options.REVERSE_MEMORY_NAME_MAP in self.state.options else self._name_mapping
new_hash_mapping = self._hash_mapping.branch() if options.REVERSE_MEMORY_HASH_MAP in self.state.options else self._hash_mapping
new_pages = dict(self._pages)
self._cowed = set()
m = SimPagedMemory(memory_backer=self._memory_backer,
permissions_backer=self._permissions_backer,
pages=new_pages,
initialized=set(self._initialized),
page_size=self._page_size,
name_mapping=new_name_mapping,
hash_mapping=new_hash_mapping,
symbolic_addrs=dict(self._symbolic_addrs),
check_permissions=self._check_perms)
m._preapproved_stack = self._preapproved_stack
return m
# remove this address for the old variables
old_obj = self[actual_addr]
if isinstance(old_obj, SimMemoryObject):
old_obj = old_obj.object
if isinstance(old_obj, claripy.ast.BV):
if options.REVERSE_MEMORY_NAME_MAP in self.state.options:
var_set = self.state.solver.variables(old_obj)
for v in var_set:
self._mark_updated_mapping(self._name_mapping, v)
self._name_mapping[v].discard(actual_addr)
if len(self._name_mapping[v]) == 0:
self._name_mapping.pop(v, None)
if options.REVERSE_MEMORY_HASH_MAP in self.state.options:
h = hash(old_obj)
self._mark_updated_mapping(self._hash_mapping, h)
self._hash_mapping[h].discard(actual_addr)
if len(self._hash_mapping[h]) == 0:
self._hash_mapping.pop(h, None)
except KeyError:
pass
l.debug("... adding new mappings")
if options.REVERSE_MEMORY_NAME_MAP in self.state.options:
# add the new variables to the mapping
var_set = self.state.solver.variables(cnt)
for v in var_set:
self._mark_updated_mapping(self._name_mapping, v)
if v not in self._name_mapping:
self._name_mapping[v] = set()
# data - move the "present" into the "past" by pushing an entry on the history stack.
# nuance: make sure to copy from the PREVIOUS state to the CURRENT one
# to avoid creating a dead link in the history, messing up the statehierarchy
new_state.register_plugin('history', old_state.history.make_child())
new_state.history.recent_bbl_addrs.append(addr)
if new_state.arch.unicorn_support:
new_state.scratch.executed_pages_set = {addr & ~0xFFF}
self.successors = SimSuccessors(addr, old_state)
new_state._inspect('engine_process', when=BP_BEFORE, sim_engine=self, sim_successors=self.successors, address=addr)
self.successors = new_state._inspect_getattr('sim_successors', self.successors)
try:
self.process_successors(self.successors, **kwargs)
except SimException:
if o.EXCEPTION_HANDLING not in old_state.options:
raise
old_state.project.simos.handle_exception(self, *sys.exc_info())
new_state._inspect('engine_process', when=BP_AFTER, sim_successors=self.successors, address=addr)
self.successors = new_state._inspect_getattr('sim_successors', self.successors)
# downsizing
if new_state.supports_inspect:
new_state.inspect.downsize()
# if not TRACK, clear actions on OLD state
#if o.TRACK_ACTION_HISTORY not in old_state.options:
# old_state.history.recent_events = []
# fix up the descriptions...
description = str(self.successors)
l.info("Ticked state: %s", description)
def _categorize_successor(self, state):
"""
Append state into successor lists.
:param state: a SimState instance
:param target: The target (of the jump/call/ret)
:return: The state
"""
self.all_successors.append(state)
target = state.scratch.target
# categorize the state
if o.APPROXIMATE_GUARDS in state.options and state.solver.is_false(state.scratch.guard, exact=False):
if o.VALIDATE_APPROXIMATIONS in state.options:
if state.satisfiable():
raise Exception('WTF')
self.unsat_successors.append(state)
elif o.APPROXIMATE_SATISFIABILITY in state.options and not state.solver.satisfiable(exact=False):
if o.VALIDATE_APPROXIMATIONS in state.options:
if state.solver.satisfiable():
raise Exception('WTF')
self.unsat_successors.append(state)
elif not state.scratch.guard.symbolic and state.solver.is_false(state.scratch.guard):
self.unsat_successors.append(state)
elif o.LAZY_SOLVES not in state.options and not state.satisfiable():
self.unsat_successors.append(state)
elif o.NO_SYMBOLIC_JUMP_RESOLUTION in state.options and state.solver.symbolic(target):
self.unconstrained_successors.append(state)
elif not state.solver.symbolic(target) and not state.history.jumpkind.startswith("Ijk_Sys"):
# a successor with a concrete IP, and it's not a syscall