Added prime polynomial example, new Pumping function to address scalability challenges with primality testing, and some improvements to the streaming interface, where if you don't stream in values, then the python side doesn't end up printing out some 'empty' stream infos.

This commit is contained in:
Peter Goodman
2017-12-09 16:43:43 -05:00
parent 3aaaf71b85
commit 188d4517d8
11 changed files with 271 additions and 17 deletions
+25 -3
View File
@@ -377,6 +377,16 @@ class DeepState(object):
"""Notify the symbolic executor that this test has been abandoned due to
some critical error and stop executing the current state."""
self.context['abandoned'] = True
def api_min_uint(self, arg):
"""Implements the `DeepState_MinUInt` API function, which returns the
minimum satisfiable value for `arg`."""
return self.concretize_min(arg, constrain=False)
def api_min_int(self, arg):
"""Implements the `DeepState_MinInt` API function, which returns the
minimum satisfiable value for `arg`."""
return self.concretize_min(arg + 2**31, constrain=False)
def api_is_symbolic_uint(self, arg):
"""Implements the `DeepState_IsSymbolicUInt` API, which returns whether or
@@ -391,13 +401,17 @@ class DeepState(object):
else:
return 1
def api_assume(self, arg):
def api_assume(self, arg, expr_ea, file_ea, line):
"""Implements the `DeepState_Assume` API function, which injects a
constraint into the solver."""
constraint = arg != 0
if not self.add_constraint(constraint):
self.log_message(LOG_LEVEL_FATAL,
"Failed to add assumption {}".format(constraint))
expr, _ = self.read_c_string(expr_ea, concretize=False)
file, _ = self.read_c_string(file_ea, concretize=False)
line = self.concretize(line, constrain=True)
self.log_message(
LOG_LEVEL_FATAL, "Failed to add assumption {} in {}:{}".format(
expr, file, line))
self.abandon_test()
def api_concretize_data(self, begin_ea, end_ea):
@@ -529,6 +543,14 @@ class DeepState(object):
stream.append((str, format_str, None, print_str))
self.context[stream_id] = stream
def api_clear_stream(self, level):
"""Implements DeepState_ClearStream, which clears the contents of a stream
for level `level`."""
level = self.concretize(level, constrain=True)
assert level in LOG_LEVEL_TO_LOGGER
stream_id = 'stream_{}'.format(level)
self.context[stream_id] = []
def api_log_stream(self, level):
"""Implements DeepState_LogStream, which converts the contents of a stream
for level `level` into a log for level `level`."""
+26 -2
View File
@@ -147,8 +147,8 @@ class IsSymbolicUInt(angr.SimProcedure):
class Assume(angr.SimProcedure):
"""Implements _DeepState_Assume, which tries to inject a constraint."""
def run(self, arg):
DeepAngr(procedure=self).api_assume(arg)
def run(self, arg, expr_ea, file_ea, line):
DeepAngr(procedure=self).api_assume(arg, expr_ea, file_ea, line)
class Pass(angr.SimProcedure):
@@ -190,6 +190,20 @@ class ConcretizeCStr(angr.SimProcedure):
return DeepAngr(procedure=self).api_concretize_cstr(begin_ea)
class MinUInt(angr.SimProcedure):
"""Implements the `Deeptate_MinUInt` API function, which lets the
programmer ask for the minimum satisfiable value of an unsigned integer."""
def run(self, val):
return DeepAngr(procedure=self).api_min_uint(val)
class MinInt(angr.SimProcedure):
"""Implements the `Deeptate_MinUInt` API function, which lets the
programmer ask for the minimum satisfiable value of a signed integer."""
def run(self, val):
return DeepAngr(procedure=self).api_min_int(val)
class StreamInt(angr.SimProcedure):
"""Implements _DeepState_StreamInt, which gives us an integer to stream, and
the format to use for streaming."""
@@ -212,6 +226,13 @@ class StreamString(angr.SimProcedure):
DeepAngr(procedure=self).api_stream_string(level, format_ea, str_ea)
class ClearStream(angr.SimProcedure):
"""Implements DeepState_ClearStream, which clears the contents of a stream for
level `level`."""
def run(self, level):
DeepAngr(procedure=self).api_clear_stream(level)
class LogStream(angr.SimProcedure):
"""Implements DeepState_LogStream, which converts the contents of a stream for
level `level` into a log for level `level`."""
@@ -318,6 +339,8 @@ def main():
hook_function(project, apis['IsSymbolicUInt'], IsSymbolicUInt)
hook_function(project, apis['ConcretizeData'], ConcretizeData)
hook_function(project, apis['ConcretizeCStr'], ConcretizeCStr)
hook_function(project, apis['MinUInt'], MinUInt)
hook_function(project, apis['MinInt'], MinInt)
hook_function(project, apis['Assume'], Assume)
hook_function(project, apis['Pass'], Pass)
hook_function(project, apis['Fail'], Fail)
@@ -327,6 +350,7 @@ def main():
hook_function(project, apis['StreamInt'], StreamInt)
hook_function(project, apis['StreamFloat'], StreamFloat)
hook_function(project, apis['StreamString'], StreamString)
hook_function(project, apis['ClearStream'], ClearStream)
hook_function(project, apis['LogStream'], LogStream)
# Find the test cases that we want to run.
+23 -2
View File
@@ -137,9 +137,9 @@ def hook_IsSymbolicUInt(state, arg):
return DeepManticore(state).api_is_symbolic_uint(arg)
def hook_Assume(state, arg):
def hook_Assume(state, arg, expr_ea, file_ea, line):
"""Implements _DeepState_Assume, which tries to inject a constraint."""
DeepManticore(state).api_assume(arg)
DeepManticore(state).api_assume(arg, expr_ea, file_ea, line)
def hook_StreamInt(state, level, format_ea, unpack_ea, uint64_ea):
@@ -160,6 +160,12 @@ def hook_StreamString(state, level, format_ea, str_ea):
DeepManticore(state).api_stream_string(level, format_ea, str_ea)
def hook_ClearStream(state, level):
"""Implements DeepState_ClearStream, which clears the contents of a stream
for level `level`."""
DeepManticore(state).api_clear_stream(level)
def hook_LogStream(state, level):
"""Implements DeepState_LogStream, which converts the contents of a stream for
level `level` into a log for level `level`."""
@@ -200,6 +206,18 @@ def hook_ConcretizeCStr(state, begin_ea):
return DeepManticore(state).api_concretize_cstr(begin_ea)
def hook_MinUInt(self, val):
"""Implements the `Deeptate_MinUInt` API function, which lets the
programmer ask for the minimum satisfiable value of an unsigned integer."""
return DeepAngr(procedure=self).api_min_uint(val)
def hook_MinInt(self, val):
"""Implements the `Deeptate_MinUInt` API function, which lets the
programmer ask for the minimum satisfiable value of a signed integer."""
return DeepAngr(procedure=self).api_min_int(val)
def hook_Log(state, level, ea):
"""Implements DeepState_Log, which lets Manticore intercept and handle the
printing of log messages from the simulated tests."""
@@ -234,6 +252,8 @@ def do_run_test(state, apis, test):
m.add_hook(apis['IsSymbolicUInt'], hook(hook_IsSymbolicUInt))
m.add_hook(apis['ConcretizeData'], hook(hook_ConcretizeData))
m.add_hook(apis['ConcretizeCStr'], hook(hook_ConcretizeCStr))
m.add_hook(apis['MinUInt'], hook(hook_MinUInt))
m.add_hook(apis['MinInt'], hook(hook_MinInt))
m.add_hook(apis['Assume'], hook(hook_Assume))
m.add_hook(apis['Pass'], hook(hook_Pass))
m.add_hook(apis['Fail'], hook(hook_Fail))
@@ -243,6 +263,7 @@ def do_run_test(state, apis, test):
m.add_hook(apis['StreamInt'], hook(hook_StreamInt))
m.add_hook(apis['StreamFloat'], hook(hook_StreamFloat))
m.add_hook(apis['StreamString'], hook(hook_StreamString))
m.add_hook(apis['ClearStream'], hook(hook_ClearStream))
m.add_hook(apis['LogStream'], hook(hook_LogStream))
m.subscribe('will_terminate_state', done_test)