Saturating version of InRange, new variable UsingSymExec

bin/deepstate/common.py

@@ -87,6 +87,9 @@ class DeepState(object):
   def write_uint8_t(self, ea, val):
     raise NotImplementedError("Must be implemented by engine.")
 
+  def write_uint32_t(self, ea, val):
+    raise NotImplementedError("Must be implemented by engine.")
+
   def concretize(self, val, constrain=False):
     raise NotImplementedError("Must be implemented by engine.")
 

bin/deepstate/main_angr.py

@@ -84,6 +84,10 @@ class DeepAngr(DeepState):
     self.state.memory.store(ea, val, size=1)
     return ea + 1
 
+  def write_uint32_t(self, ea, val):
+    self.state.memory.store(ea, val, size=4)
+    return ea + 4
+
   def concretize(self, val, constrain=False):
     if isinstance(val, (int, long)):
       return val
@@ -336,6 +340,9 @@ def hook_apis(args, project, run_state):
   mc = DeepAngr(state=run_state)
   apis = mc.read_api_table(ea_of_api_table)
 
+  # Tell the system that we're using symbolic execution.
+  mc.write_uint32_t(apis["UsingSymExec"], 1)
+
   # Hook various functions.
   hook_function(project, apis['IsSymbolicUInt'], IsSymbolicUInt)
   hook_function(project, apis['ConcretizeData'], ConcretizeData)

bin/deepstate/main_manticore.py

@@ -87,6 +87,10 @@ class DeepManticore(DeepState):
     self.state.cpu.write_int(ea, val, size=8)
     return ea + 1
 
+  def write_uint32_t(self, ea, val):
+    self.state.cpu.write_int(ea, val, size=32)
+    return ea + 1
+
   def concretize(self, val, constrain=False):
     if isinstance(val, (int, long)):
       return val
@@ -418,6 +422,10 @@ def main_takeover(m, args, takeover_symbol):
 
   base = get_base(m)
   apis = mc.read_api_table(ea_of_api_table, base)
+
+  # Tell the system that we're using symbolic execution.
+  mc.write_uint32_t(apis["UsingSymExec"], 1)
+  
   del mc
 
   fake_test = TestInfo(takeover_ea, '_takeover_test', '_takeover_file', 0)