How to use the archr.arsenal.DataScoutBow function in archr

To help you get started, we’ve selected a few archr examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github angr / archr / tests / test_bow_datascout.py View on Github external
def shellcode_checks(self, t):
        b = archr.arsenal.DataScoutBow(t)
        with t.shellcode_context(asm_code=b.exit_shellcode(exit_code=123)) as p:
            stdout,_ = p.communicate()
            assert p.wait() == 123

        with t.shellcode_context(asm_code=b.echo_shellcode("TESTING THIS THING!")) as p:
            stdout,_ = p.communicate()
            assert stdout == b"TESTING THIS THING!"

        with t.shellcode_context(asm_code=b.echo_shellcode("TESTING THIS THING!") + b.exit_shellcode()) as p:
            stdout,_ = p.communicate()
            assert stdout == b"TESTING THIS THING!"
            assert p.wait() == 42

        with t.shellcode_context(asm_code=b.sendfile_shellcode("/proc/self/cmdline")) as p:
            stdout,_ = p.communicate()
            assert stdout == t.target_path.encode('utf-8') + b'\0'
github angr / archr / tests / test_bow_datascout.py View on Github external
def test_stacksmash(self):
        with archr.targets.DockerImageTarget('archr-test:vuln_stacksmash', target_arch='i386').build().start() as t:
            b = archr.arsenal.DataScoutBow(t)
            argv, env, aux, maps = b.fire()

            assert b"PWD=/" in env
            assert maps['/lib/i386-linux-gnu/ld-2.27.so'] in struct.unpack("<%dI"%(len(aux)/4), aux)
            assert '[stack-end]' in maps
            assert '[heap]' in maps
            assert '[vvar]' in maps
            assert '[vdso]' in maps
github angr / archr / tests / test_sync.py View on Github external
def test_stack(self):
        import angr

        t = archr.targets.DockerImageTarget('archr-test:stackprinter64').build().start()
        reference_str = t.run_command(aslr=False).stdout.read()

        dsb = archr.arsenal.DataScoutBow(t)
        apb = archr.arsenal.angrProjectBow(t, dsb)
        asb = archr.arsenal.angrStateBow(t, apb)
        project = apb.fire(use_sim_procedures=False)
        state = asb.fire(add_options={angr.sim_options.STRICT_PAGE_ACCESS}) # for now
        simgr = project.factory.simulation_manager(state)
        simgr.run()
        assert len(simgr.errored) == 0
        assert len(simgr.deadended) == 1
        assert len(sum(simgr.stashes.values(), [])) == 1
        #assert simgr.deadended[0].posix.dumps(1) == reference_str

        t.stop()
github angr / rex / rex / crash.py View on Github external
self.target = target # type: archr.targets.Target
        self.constrained_addrs = [ ] if constrained_addrs is None else constrained_addrs
        self.hooks = {} if hooks is None else hooks
        self.explore_steps = explore_steps
        self.use_crash_input = use_crash_input
        self.input_type = input_type
        self.target_port = port
        self.crash = crash
        self.tracer_bow = tracer_bow if tracer_bow is not None else archr.arsenal.QEMUTracerBow(self.target)

        if self.explore_steps > 10:
            raise CannotExploit("Too many steps taken during crash exploration")

        # Initialize an angr Project
        dsb = archr.arsenal.DataScoutBow(self.target)
        self.angr_project_bow = archr.arsenal.angrProjectBow(self.target, dsb)
        self.project = self.angr_project_bow.fire()
        self.binary = self.target.resolve_local_path(self.target.target_path)

        # Add custom hooks
        for addr, proc in self.hooks.items():
            self.project.hook(addr, proc)
            l.debug("Hooking %#x -> %s...", addr, proc.display_name)

        # ROP-related stuff
        if use_rop:
            if angrop_object is not None:
                self.rop = angrop_object
            else:
                if not rop_cache_path:
                    # we search for ROP gadgets now to avoid the memory exhaustion bug in pypy
github angr / rex / rex / crash.py View on Github external
def _initialize(self, rop_obj, rop_cache_path, checkpoint_path, crash_state, prev_state):
        """
        Initialization steps.
        - Create a new angr project.
        - Load or collect ROP gadgets.
        - Restore states from a previous checkpoint if available.

        :return:    None
        """

        # Initialize an angr Project
        dsb = archr.arsenal.DataScoutBow(self.target)
        self.angr_project_bow = archr.arsenal.angrProjectBow(self.target, dsb)
        self.project = self.angr_project_bow.fire()
        self.binary = self.target.resolve_local_path(self.target.target_path)

        # Add custom hooks
        for addr, proc in self.hooks.items():
            self.project.hook(addr, proc)
            l.debug("Hooking %#x -> %s...", addr, proc.display_name)

        # ROP-related stuff
        if self._use_rop:
            if rop_obj is not None:
                self.rop = rop_obj
            else:
                if not rop_cache_path:
                    # we search for ROP gadgets now to avoid the memory exhaustion bug in pypy
github angr / angr-management / angrmanagement / data / jobs / loading.py View on Github external
def run(self, inst):
        self._progress_callback(5)
        with self.target.build().start() as t:
            self._progress_callback(10)
            dsb = archr.arsenal.DataScoutBow(t)
            apb = archr.arsenal.angrProjectBow(t, dsb)
            partial_ld = apb.fire(return_loader=True, perform_relocations=False, load_debug_info=False)
            self._progress_callback(50)
            # is it smart to do this from the worker thread? who knows
            load_options, cfg_args = gui_thread_schedule(LoadBinary.run, (partial_ld,))
            partial_ld.close()
            if cfg_args is None:
                return

            # Create the project, load it, then record the image name on success
            proj = apb.fire(use_sim_procedures=True, load_options=load_options)
            self._progress_callback(95)
            inst.set_project(proj, cfg_args=cfg_args)