Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def test_taint_assignement_memory_register(self):
"""Check tainting assignment memory <- register."""
Triton = TritonContext()
Triton.setArchitecture(ARCH.X86_64)
Triton.taintMemory(MemoryAccess(0x2000, 8))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 8)))
Triton.taintAssignmentMemoryRegister(MemoryAccess(0x2002, 2), Triton.registers.ax)
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2004, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2005, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2006, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2007, 1)))
Triton.taintMemory(MemoryAccess(0x2000, 8))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 8)))
Triton.taintAssignmentMemoryRegister(MemoryAccess(0x1fff, 8), Triton.registers.rax)
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x1fff, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2004, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2005, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2006, 1)))
def test_taint_memory(self):
"""Check tainting memory."""
Triton = TritonContext()
Triton.setArchitecture(ARCH.X86_64)
self.assertFalse(Triton.isMemoryTainted(0x1000))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2000, 4)))
Triton.taintMemory(0x1000)
Triton.taintMemory(MemoryAccess(0x2000, 4))
self.assertTrue(Triton.isMemoryTainted(0x1000))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 2)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2002, 2)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2003, 2)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x1fff, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2004, 1)))
self.assertFalse(Triton.isMemoryTainted(0x1001))
self.assertFalse(Triton.isMemoryTainted(0x0fff))
def test_overlaping(self):
"""Check overlaping."""
self.assertTrue(MemoryAccess(0x1000, 2).isOverlapWith(MemoryAccess(0x1001, 2)))
self.assertTrue(MemoryAccess(0xfff, 2).isOverlapWith(MemoryAccess(0x1000, 2)))
self.assertTrue(MemoryAccess(0x1000, 4).isOverlapWith(MemoryAccess(0x1003, 2)))
self.assertTrue(MemoryAccess(0x1000, 4).isOverlapWith(MemoryAccess(0x1002, 1)))
self.assertTrue(MemoryAccess(0x1002, 1).isOverlapWith(MemoryAccess(0x1000, 4)))
self.assertFalse(MemoryAccess(0x1000, 4).isOverlapWith(MemoryAccess(0x1004, 4)))
self.assertFalse(MemoryAccess(0x1000, 4).isOverlapWith(MemoryAccess(0x10000, 4)))
self.assertFalse(MemoryAccess(0x10000, 4).isOverlapWith(MemoryAccess(0x1000, 4)))
def test_taint_memory(self):
"""Check tainting memory."""
Triton = TritonContext()
Triton.setArchitecture(ARCH.X86_64)
self.assertFalse(Triton.isMemoryTainted(0x1000))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2000, 4)))
Triton.taintMemory(0x1000)
Triton.taintMemory(MemoryAccess(0x2000, 4))
self.assertTrue(Triton.isMemoryTainted(0x1000))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 4)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 2)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2002, 2)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2003, 2)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x1fff, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2004, 1)))
self.assertFalse(Triton.isMemoryTainted(0x1001))
self.assertFalse(Triton.isMemoryTainted(0x0fff))
Triton.untaintMemory(0x1000)
Triton.untaintMemory(MemoryAccess(0x2000, 4))
Triton.taintAssignmentMemoryRegister(MemoryAccess(0x2002, 2), Triton.registers.ax)
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2004, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2005, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2006, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2007, 1)))
Triton.taintMemory(MemoryAccess(0x2000, 8))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2000, 8)))
Triton.taintAssignmentMemoryRegister(MemoryAccess(0x1fff, 8), Triton.registers.rax)
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x1fff, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2000, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2001, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2002, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2003, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2004, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2005, 1)))
self.assertFalse(Triton.isMemoryTainted(MemoryAccess(0x2006, 1)))
self.assertTrue(Triton.isMemoryTainted(MemoryAccess(0x2007, 1)))
triton.CALLBACK.GET_CONCRETE_MEMORY_VALUE)
triton.addCallback(self.constantFolding,
triton.CALLBACK.SYMBOLIC_SIMPLIFICATION)
for r in self.regs:
if r in self.triton_regs:
triton.setConcreteRegisterValue(
triton.Register(self.triton_regs[r], self.regs[r] & ((1 << self.triton_regs[r].getBitSize()) - 1))
)
for m in cache:
self.write_mem(m['start'], m["data"])
for address in self.inputs:
self.inputs[address] = triton.convertMemoryToSymbolicVariable(
triton.MemoryAccess(
address,
triton.CPUSIZE.BYTE
)
Triton.setConcreteMemoryValue(MemoryAccess(user_input+8, CPUSIZE.DWORD), variables[0x02])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+12, CPUSIZE.DWORD), variables[0x03])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+16, CPUSIZE.DWORD), variables[0x04])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+20, CPUSIZE.DWORD), variables[0x05])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+24, CPUSIZE.DWORD), variables[0x06])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+28, CPUSIZE.DWORD), variables[0x07])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+32, CPUSIZE.DWORD), variables[0x08])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+36, CPUSIZE.DWORD), variables[0x09])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+40, CPUSIZE.DWORD), variables[0x0a])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+44, CPUSIZE.DWORD), variables[0x0b])
Triton.setConcreteMemoryValue(MemoryAccess(user_input+48, CPUSIZE.DWORD), variables[0x0c])
# Create symbolic variables.
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+0, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+4, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+8, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+12, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+16, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+20, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+24, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+28, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+32, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+36, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+40, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+44, CPUSIZE.DWORD))
Triton.convertMemoryToSymbolicVariable(MemoryAccess(user_input+48, CPUSIZE.DWORD))
return
def poke(self, addr, size, value):
return triton.setConcreteMemoryValue(triton.MemoryAccess(addr, size, value))
def makeRelocation(binary):
# Setup plt
for pltIndex in range(len(customRelocation)):
customRelocation[pltIndex][2] = BASE_PLT + pltIndex
# Perform our own relocations
for rel in binary.pltgot_relocations:
symbolName = rel.symbol.name
symbolRelo = rel.address
for crel in customRelocation:
if symbolName == crel[0]:
debug('Hooking %s' %(symbolName))
Triton.setConcreteMemoryValue(MemoryAccess(symbolRelo, CPUSIZE.QWORD), crel[2])
break
return