Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def setUp(self):
"""Define the arch and modes."""
self.Triton = TritonContext()
self.Triton.setArchitecture(ARCH.X86_64)
self.Triton.enableMode(MODE.ALIGNED_MEMORY, True)
self.Triton.enableMode(MODE.AST_OPTIMIZATIONS, True)
super(TestSymbolicEngineAlignedSymOpti, self).setUp()
# This function initializes the context memory.
def initContext():
Triton.setConcreteRegisterValue(Triton.registers.rsp, 0x7fffffff)
Triton.setConcreteRegisterValue(Triton.registers.rbp, 0x99999999)
return
if __name__ == '__main__':
# Set the architecture
Triton.setArchitecture(ARCH.X86_64)
# Symbolic optimization
Triton.setMode(MODE.ALIGNED_MEMORY, True)
# Define entry point
ENTRY = 0x40056d
# Init context memory
initContext()
# Emulate
run(ENTRY)
sys.exit(0)
break
return
def debug(s):
if DEBUG:
print('[Triton] %s' %(s))
return
if __name__ == '__main__':
# Set the architecture
Triton.setArchitecture(ARCH.X86_64)
# Set a symbolic optimization mode
Triton.enableMode(MODE.ALIGNED_MEMORY, True)
# AST representation as Python syntax
#setAstRepresentationMode(AST_REPRESENTATION.PYTHON)
if len(sys.argv) < 2:
debug('Syntax: %s [arg1, arg2, ...]' %(sys.argv[0]))
sys.exit(1)
# Load the binary
binary = loadBinary(sys.argv[1])
# Perform our own relocations
makeRelocation(binary)
# Define a fake stack
Triton.setConcreteRegisterValue(Triton.registers.rbp, BASE_STACK)
0x4005c1: b"\x7e\xbb", # jle 40057e
0x4005c3: b"\xb8\x00\x00\x00\x00", # mov eax,0x0
0x4005c8: b"\x5d", # pop rbp
0x4005c9: b"\xc3", # ret
}
if __name__ == '__main__':
Triton = TritonContext()
# Set the architecture
Triton.setArchitecture(ARCH.X86_64)
# Symbolic optimization
Triton.setMode(MODE.ALIGNED_MEMORY, True)
# Define entry point
pc = 0x40056d
# Define our input context
Triton.setConcreteMemoryValue(0x1000, ord('e'))
Triton.setConcreteMemoryValue(0x1001, ord('l'))
Triton.setConcreteMemoryValue(0x1002, ord('i'))
Triton.setConcreteMemoryValue(0x1003, ord('t'))
Triton.setConcreteMemoryValue(0x1004, ord('e'))
# Define the serial pointer
Triton.setConcreteMemoryValue(0x601040, 0x00)
Triton.setConcreteMemoryValue(0x601041, 0x00)
Triton.setConcreteMemoryValue(0x601042, 0x90)
def reset(self):
triton.resetEngines()
triton.clearPathConstraints()
triton.setArchitecture(self.arch)
triton.enableMode(triton.MODE.ALIGNED_MEMORY, True)
triton.enableMode(triton.MODE.ONLY_ON_SYMBOLIZED, True)
triton.addCallback(self.memoryCaching,
triton.CALLBACK.GET_CONCRETE_MEMORY_VALUE)
triton.addCallback(self.constantFolding,
triton.CALLBACK.SYMBOLIC_SIMPLIFICATION)
for r in self.regs:
if r in self.triton_regs:
triton.setConcreteRegisterValue(
triton.Register(self.triton_regs[r], self.regs[r] & ((1 << self.triton_regs[r].getBitSize()) - 1))
)
for m in cache:
self.write_mem(m['start'], m["data"])
def reset(self):
self.triton.reset()
self.triton.clearPathConstraints()
self.triton.setArchitecture(self.arch)
self.triton.enableMode(triton.MODE.ALIGNED_MEMORY, True)
self.triton.enableMode(triton.MODE.ONLY_ON_SYMBOLIZED, True)
self.triton.addCallback(self.memoryCaching,
triton.CALLBACK.GET_CONCRETE_MEMORY_VALUE)
self.triton.addCallback(self.constantFolding,
triton.CALLBACK.SYMBOLIC_SIMPLIFICATION)
for r in self.triton_regs:
if r in self.regs:
self.triton.setConcreteRegisterValue(
self.triton_regs[r], self.regs[r] & 0xffffffffffffffff
)
for m in cache:
self.write_mem(m['start'], m["data"])
binary = lief.parse(path)
phdrs = binary.segments
for phdr in phdrs:
size = phdr.physical_size
vaddr = phdr.virtual_address
print('[+] Loading 0x%06x - 0x%06x' %(vaddr, vaddr+size))
Triton.setConcreteMemoryAreaValue(vaddr, phdr.content)
return
if __name__ == '__main__':
# Define the target architecture
Triton.setArchitecture(ARCH.X86_64)
# Define symbolic optimizations
Triton.enableMode(MODE.ALIGNED_MEMORY, True)
Triton.enableMode(MODE.ONLY_ON_SYMBOLIZED, True)
# Load the binary
loadBinary(os.path.join(os.path.dirname(__file__), 'r100.bin'))
# Define a fake stack
Triton.setConcreteRegisterValue(Triton.registers.rbp, 0x7fffffff)
Triton.setConcreteRegisterValue(Triton.registers.rsp, 0x6fffffff)
# Define an user input
Triton.setConcreteRegisterValue(Triton.registers.rdi, 0x10000000)
# Symbolize user inputs (30 bytes)
for index in range(30):
Triton.convertMemoryToSymbolicVariable(MemoryAccess(0x10000000+index, CPUSIZE.BYTE))
Triton.concretizeAllRegister()
Triton.concretizeAllMemory()
for address, value in list(seed.items()):
Triton.setConcreteMemoryValue(address, value)
Triton.convertMemoryToSymbolicVariable(MemoryAccess(address, CPUSIZE.BYTE))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(address+1, CPUSIZE.BYTE))
return
if __name__ == '__main__':
# Set the architecture
Triton.setArchitecture(ARCH.X86_64)
# Symbolic optimization
Triton.enableMode(MODE.ALIGNED_MEMORY, True)
# Define entry point
ENTRY = 0x40056d
# We start the execution with a random value located at 0x1000.
lastInput = list()
worklist = list([{0x1000:1}])
while worklist:
# Take the first seed
seed = worklist[0]
print('Seed injected:', seed)
# Symbolize inputs
symbolizeInputs(seed)
def initialize():
Triton = TritonContext()
# Define the target architecture
Triton.setArchitecture(ARCH.X86_64)
# Define symbolic optimizations
Triton.enableMode(MODE.ALIGNED_MEMORY, True)
Triton.enableMode(MODE.ONLY_ON_SYMBOLIZED, True)
# Define internal callbacks.
Triton.addCallback(memoryCaching, CALLBACK.GET_CONCRETE_MEMORY_VALUE)
Triton.addCallback(constantFolding, CALLBACK.SYMBOLIC_SIMPLIFICATION)
# Load the meory dump
load_dump(Triton, os.path.join(os.path.dirname(__file__), "baby-re.dump"))
# Symbolize user inputs
symbolizeInputs(Triton)
return Triton