From 827e4cbe8258ed31e4e624e955ed034acc3e3775 Mon Sep 17 00:00:00 2001 From: Alex Groce Date: Wed, 5 Dec 2018 17:31:45 -0700 Subject: [PATCH 1/9] switch to wrapping ranges --- src/include/deepstate/DeepState.h | 35 ++++++++++++++++--------------- 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/src/include/deepstate/DeepState.h b/src/include/deepstate/DeepState.h index fd61563..ba0afb7 100644 --- a/src/include/deepstate/DeepState.h +++ b/src/include/deepstate/DeepState.h @@ -232,23 +232,8 @@ DEEPSTATE_INLINE static void DeepState_Check(int expr) { } } -/* Return a symbolic value in a the range `[low_inc, high_inc]`. - * - * Current implementation saturates values. An alternative implementation - * worth exploring, and perhaps supporting in addition to saturation, is - * something like: - * - * x = symbolic_value; - * size = (high - low) + 1 - * if (symbolic mode) { - * assume 0 <= x and x < size - * return low + x - * } else { - * return low + (x % size) - * } - * - * This type of version lets a reducer drive toward zero. - */ +/* Return a symbolic value in a the range `[low_inc, high_inc]`. */ +/* Saturating version here is an alternative, but worse for fuzzing: #define DEEPSTATE_MAKE_SYMBOLIC_RANGE(Tname, tname) \ DEEPSTATE_INLINE static tname DeepState_ ## Tname ## InRange( \ tname low, tname high) { \ @@ -268,6 +253,22 @@ DEEPSTATE_INLINE static void DeepState_Check(int expr) { return x; \ } \ } +*/ +#define DEEPSTATE_MAKE_SYMBOLIC_RANGE(Tname, tname) \ + DEEPSTATE_INLINE static tname DeepState_ ## Tname ## InRange( \ + tname low, tname high) { \ + if (low > high) { \ + return DeepState_ ## Tname ## InRange(high, low); \ + } \ + const tname x = DeepState_ ## Tname(); \ + const tname size = (high - low) + 1; \ + if (DeepState_UsingSymExec) { \ + (void) DeepState_Assume(0 <= x && x < size); \ + return low + x; \ + } else { \ + return low + (x % size); \ + } \ + } DEEPSTATE_MAKE_SYMBOLIC_RANGE(Size, size_t) DEEPSTATE_MAKE_SYMBOLIC_RANGE(Int64, int64_t) From c04168437b5d093f5d72297ea348cc98c0506850 Mon Sep 17 00:00:00 2001 From: Alex Groce Date: Wed, 5 Dec 2018 20:54:11 -0700 Subject: [PATCH 2/9] go back to simple fix, but wrap when out of bounds and not symbolic --- src/include/deepstate/DeepState.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/include/deepstate/DeepState.h b/src/include/deepstate/DeepState.h index ba0afb7..bbcf1bb 100644 --- a/src/include/deepstate/DeepState.h +++ b/src/include/deepstate/DeepState.h @@ -261,13 +261,14 @@ DEEPSTATE_INLINE static void DeepState_Check(int expr) { return DeepState_ ## Tname ## InRange(high, low); \ } \ const tname x = DeepState_ ## Tname(); \ - const tname size = (high - low) + 1; \ if (DeepState_UsingSymExec) { \ - (void) DeepState_Assume(0 <= x && x < size); \ - return low + x; \ + (void) DeepState_Assume(low <= x && x <= high); \ } else { \ - return low + (x % size); \ + if ((x < low) || (x > high)) { \ + const tname size = (high - low) + 1; \ + x = low + (x % size); \ } \ + return x; \ } DEEPSTATE_MAKE_SYMBOLIC_RANGE(Size, size_t) From a608857d52e5f613a50f83a411cd17f8b10540f8 Mon Sep 17 00:00:00 2001 From: Alex Groce Date: Wed, 5 Dec 2018 20:57:10 -0700 Subject: [PATCH 3/9] x can't be const now --- src/include/deepstate/DeepState.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/include/deepstate/DeepState.h b/src/include/deepstate/DeepState.h index bbcf1bb..d500837 100644 --- a/src/include/deepstate/DeepState.h +++ b/src/include/deepstate/DeepState.h @@ -260,7 +260,7 @@ DEEPSTATE_INLINE static void DeepState_Check(int expr) { if (low > high) { \ return DeepState_ ## Tname ## InRange(high, low); \ } \ - const tname x = DeepState_ ## Tname(); \ + tname x = DeepState_ ## Tname(); \ if (DeepState_UsingSymExec) { \ (void) DeepState_Assume(low <= x && x <= high); \ } else { \ From 478e5fd9b451a2ee722156ce9590d7e3d7da7901 Mon Sep 17 00:00:00 2001 From: Alex Groce Date: Wed, 5 Dec 2018 21:00:53 -0700 Subject: [PATCH 4/9] fix bad indentation --- src/include/deepstate/DeepState.h | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/include/deepstate/DeepState.h b/src/include/deepstate/DeepState.h index d500837..11c4329 100644 --- a/src/include/deepstate/DeepState.h +++ b/src/include/deepstate/DeepState.h @@ -263,10 +263,9 @@ DEEPSTATE_INLINE static void DeepState_Check(int expr) { tname x = DeepState_ ## Tname(); \ if (DeepState_UsingSymExec) { \ (void) DeepState_Assume(low <= x && x <= high); \ - } else { \ - if ((x < low) || (x > high)) { \ - const tname size = (high - low) + 1; \ - x = low + (x % size); \ + } else if ((x < low) || (x > high)) { \ + const tname size = (high - low) + 1; \ + x = low + (x % size); \ } \ return x; \ } From e7cb3ce8cde3df8068502535daf6fe7faf07328f Mon Sep 17 00:00:00 2001 From: Alex Groce Date: Thu, 6 Dec 2018 05:09:23 -0700 Subject: [PATCH 5/9] try immediate return for manticore --- src/include/deepstate/DeepState.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/include/deepstate/DeepState.h b/src/include/deepstate/DeepState.h index 11c4329..ed8ecf8 100644 --- a/src/include/deepstate/DeepState.h +++ b/src/include/deepstate/DeepState.h @@ -260,12 +260,13 @@ DEEPSTATE_INLINE static void DeepState_Check(int expr) { if (low > high) { \ return DeepState_ ## Tname ## InRange(high, low); \ } \ - tname x = DeepState_ ## Tname(); \ + const tname x = DeepState_ ## Tname(); \ if (DeepState_UsingSymExec) { \ (void) DeepState_Assume(low <= x && x <= high); \ + return x; } else if ((x < low) || (x > high)) { \ const tname size = (high - low) + 1; \ - x = low + (x % size); \ + return low + (x % size); \ } \ return x; \ } From 5cc17b00edefc41b787b6a37821bdf41011a2ee9 Mon Sep 17 00:00:00 2001 From: Alex Groce Date: Thu, 6 Dec 2018 05:15:42 -0700 Subject: [PATCH 6/9] fix if --- src/include/deepstate/DeepState.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/include/deepstate/DeepState.h b/src/include/deepstate/DeepState.h index ed8ecf8..c103a72 100644 --- a/src/include/deepstate/DeepState.h +++ b/src/include/deepstate/DeepState.h @@ -263,8 +263,9 @@ DEEPSTATE_INLINE static void DeepState_Check(int expr) { const tname x = DeepState_ ## Tname(); \ if (DeepState_UsingSymExec) { \ (void) DeepState_Assume(low <= x && x <= high); \ - return x; - } else if ((x < low) || (x > high)) { \ + return x; \ + } \ + if ((x < low) || (x > high)) { \ const tname size = (high - low) + 1; \ return low + (x % size); \ } \ From 062e62106cbb5fccc8f0d18dbb63ff1959316817 Mon Sep 17 00:00:00 2001 From: Alex Groce Date: Thu, 6 Dec 2018 15:13:52 -0700 Subject: [PATCH 7/9] Try writing symexec in do_run_test --- bin/deepstate/main_manticore.py | 1 + 1 file changed, 1 insertion(+) diff --git a/bin/deepstate/main_manticore.py b/bin/deepstate/main_manticore.py index b7de01d..2ec04ca 100644 --- a/bin/deepstate/main_manticore.py +++ b/bin/deepstate/main_manticore.py @@ -335,6 +335,7 @@ def do_run_test(state, apis, test, hook_test=False): state = m.initial_state mc = DeepManticore(state) + mc.write_uint32_t(apis["UsingSymExec"], 8589934591) mc.begin_test(test) del mc From c2745be88234aebd5a8e1dbcee1c963f2d82e956 Mon Sep 17 00:00:00 2001 From: Alex Groce Date: Thu, 6 Dec 2018 17:16:38 -0700 Subject: [PATCH 8/9] move setting UsingSymExec to right place --- bin/deepstate/main_angr.py | 7 ++++--- bin/deepstate/main_manticore.py | 8 ++++---- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/bin/deepstate/main_angr.py b/bin/deepstate/main_angr.py index b122d49..46e3b66 100644 --- a/bin/deepstate/main_angr.py +++ b/bin/deepstate/main_angr.py @@ -281,6 +281,10 @@ def do_run_test(project, test, apis, run_state, should_call_state): test_state = run_state mc = DeepAngr(state=test_state) + + # Tell the system that we're using symbolic execution. + mc.write_uint32_t(apis["UsingSymExec"], 1) + mc.begin_test(test) del mc @@ -340,9 +344,6 @@ def hook_apis(args, project, run_state): mc = DeepAngr(state=run_state) apis = mc.read_api_table(ea_of_api_table) - # Tell the system that we're using symbolic execution. - mc.write_uint32_t(apis["UsingSymExec"], 1) - # Hook various functions. hook_function(project, apis['IsSymbolicUInt'], IsSymbolicUInt) hook_function(project, apis['ConcretizeData'], ConcretizeData) diff --git a/bin/deepstate/main_manticore.py b/bin/deepstate/main_manticore.py index 2ec04ca..1621963 100644 --- a/bin/deepstate/main_manticore.py +++ b/bin/deepstate/main_manticore.py @@ -335,7 +335,10 @@ def do_run_test(state, apis, test, hook_test=False): state = m.initial_state mc = DeepManticore(state) - mc.write_uint32_t(apis["UsingSymExec"], 8589934591) + + # Tell the system that we're using symbolic execution. + mc.write_uint32_t(apis["UsingSymExec"], 1) + mc.begin_test(test) del mc @@ -424,9 +427,6 @@ def main_takeover(m, args, takeover_symbol): base = get_base(m) apis = mc.read_api_table(ea_of_api_table, base) - # Tell the system that we're using symbolic execution. - mc.write_uint32_t(apis["UsingSymExec"], 1) - del mc fake_test = TestInfo(takeover_ea, '_takeover_test', '_takeover_file', 0) From 2f6dd8e047ef052838eda878cc2a49a2d13ebdca Mon Sep 17 00:00:00 2001 From: Alex Groce Date: Thu, 6 Dec 2018 17:20:52 -0700 Subject: [PATCH 9/9] use all 1s just in case other-endian --- bin/deepstate/main_angr.py | 2 +- bin/deepstate/main_manticore.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/deepstate/main_angr.py b/bin/deepstate/main_angr.py index 46e3b66..a35bd58 100644 --- a/bin/deepstate/main_angr.py +++ b/bin/deepstate/main_angr.py @@ -283,7 +283,7 @@ def do_run_test(project, test, apis, run_state, should_call_state): mc = DeepAngr(state=test_state) # Tell the system that we're using symbolic execution. - mc.write_uint32_t(apis["UsingSymExec"], 1) + mc.write_uint32_t(apis["UsingSymExec"], 8589934591) mc.begin_test(test) del mc diff --git a/bin/deepstate/main_manticore.py b/bin/deepstate/main_manticore.py index 1621963..26d6672 100644 --- a/bin/deepstate/main_manticore.py +++ b/bin/deepstate/main_manticore.py @@ -337,7 +337,7 @@ def do_run_test(state, apis, test, hook_test=False): mc = DeepManticore(state) # Tell the system that we're using symbolic execution. - mc.write_uint32_t(apis["UsingSymExec"], 1) + mc.write_uint32_t(apis["UsingSymExec"], 8589934591) mc.begin_test(test) del mc