Fixes symbolic reentrancy example (#528)

examples/evm/reentrancy_symbolic.py

@@ -129,12 +129,14 @@ seth.transaction(  caller=attacker_account,
                     data=seth.make_function_call('delegate(bytes)', seth.SByte(64)),
                     value=10)
 
+        
 print "[+] Attacker tx2 via exploit contract"
 seth.transaction(  caller=attacker_account,
                     address=exploit_account,
                     data=seth.make_function_call('delegate(bytes)', seth.SByte(64)),
                     value=0)
 
+
 print "[+] Attacker tx3 via exploit contract"
 seth.transaction(  caller=attacker_account,
                     address=exploit_account,

examples/evm/seth.py

@@ -156,8 +156,8 @@ class ManticoreEVM(Manticore):
         self._executor.subscribe('will_terminate_state', self.terminate_state_callback)
         self._executor.subscribe('will_execute_instruction', self.will_execute_instruction_callback)
         self._executor.subscribe('did_read_code', self.did_read_code)
-        self._executor.subscribe('symbolic_sha3', self.symbolic_sha3)
-        self._executor.subscribe('concrete_sha3', self.concrete_sha3)
+        self._executor.subscribe('on_symbolic_sha3', self.symbolic_sha3)
+        self._executor.subscribe('on_concrete_sha3', self.concrete_sha3)
 
     @property
     def world(self):

manticore/core/workspace.py

@@ -44,7 +44,7 @@ class PickleSerializer(StateSerializer):
         except RuntimeError:
             # recursion exceeded. try a slower, iterative solution
             from ..utils import iterpickle
-            logger.warning("Using iterpickle to dump state")
+            logger.debug("Using iterpickle to dump state")
             f.write(iterpickle.dumps(state, 2))
 
     def deserialize(self, f):

manticore/manticore.py

@@ -657,11 +657,11 @@ class Manticore(Eventful):
 
     def _start_run(self):
         assert not self.running
-        #FIXME this will be self.publish 
-        self._publish('will_start_run', self._initial_state)
+        if self._initial_state is not None:
+            self._publish('will_start_run', self._initial_state)
 
-        self.enqueue(self._initial_state)
-        self._initial_state = None
+            self.enqueue(self._initial_state)
+            self._initial_state = None
 
         #Copy the local main context to the shared conext
         self._executor._shared_context.update(self._context)

manticore/platforms/evm.py

@@ -27,7 +27,7 @@ TT255 = 2 ** 255
 TOOHIGHMEM = 0x1000
 
 def ceil32(x):
-    return Operators.ITE(x % 32 == 0, x , x + 32 - (x % 32))
+    return Operators.ITEBV(256, (x % 32) == 0, x , x + 32 - (x % 32))
 
 def to_signed(i):
     return Operators.ITEBV(256, i<TT255, i, i-TT256) #i if i < TT255 else i - TT256
@@ -1038,7 +1038,7 @@ class EVM(Eventful):
         buf = ''.join(data)
         value = sha3.keccak_256(buf).hexdigest()
         value = int('0x'+value,0)
-        self._publish('concrete_sha3', buf, value)
+        self._publish('on_concrete_sha3', buf, value)
         logger.info("Found new SHA3 example %r -> %x", buf, value)
         return value
 
@@ -1396,6 +1396,8 @@ class EVM(Eventful):
 ################################################################################
 ################################################################################
 class EVMWorld(Platform):
+    _published_events = {'read_code', 'decode_instruction', 'execute_instruction', 'concrete_sha3', 'symbolic_sha3'} 
+
     def __init__(self, constraints, storage=None, **kwargs):
         super(EVMWorld, self).__init__(path="NOPATH", **kwargs)
         self._global_storage = {} if storage is None else storage
@@ -1431,7 +1433,7 @@ class EVMWorld(Platform):
     def _do_events(self):
         if self.current is not None:
             self.forward_events_from(self.current)
-        self.subscribe('concrete_sha3', self._concrete_sha3_callback)
+            self.subscribe('on_concrete_sha3', self._concrete_sha3_callback)
 
     def _concrete_sha3_callback(self,buf, value):
         if buf in self._sha3:
@@ -1502,7 +1504,8 @@ class EVMWorld(Platform):
         self._callstack.append(vm)
         self.current.depth = self.depth
         self.current.constraints = self.constraints
-        self.forward_events_from(self.current)
+        #self.forward_events_from(self.current)
+        self._do_events()
         if self.depth > 1024:
             while self.depth >0:
                 self._pop(rollback=True)
@@ -1790,7 +1793,7 @@ class EVMWorld(Platform):
         logger.info("SHA3 Searching over %d known hashes", len(self._sha3))
         logger.info("SHA3 TODO save this state for future explorations with more known hashes")
         #Broadcast the signal 
-        self._publish( 'symbolic_sha3', data, self._sha3.items())
+        self._publish( 'on_symbolic_sha3', data, self._sha3.items())
 
         results = []
         known_hashes = False