From a9ad183354cbeda0780e5b8cc8c652d1a27803f3 Mon Sep 17 00:00:00 2001 From: feliam Date: Fri, 20 Oct 2017 16:43:22 -0300 Subject: [PATCH] Fixes symbolic reentrancy example (#528) --- examples/evm/reentrancy_symbolic.py | 2 ++ examples/evm/seth.py | 4 ++-- manticore/core/workspace.py | 2 +- manticore/manticore.py | 8 ++++---- manticore/platforms/evm.py | 13 ++++++++----- 5 files changed, 17 insertions(+), 12 deletions(-) diff --git a/examples/evm/reentrancy_symbolic.py b/examples/evm/reentrancy_symbolic.py index aff6920..f091b82 100644 --- a/examples/evm/reentrancy_symbolic.py +++ b/examples/evm/reentrancy_symbolic.py @@ -129,12 +129,14 @@ seth.transaction( caller=attacker_account, data=seth.make_function_call('delegate(bytes)', seth.SByte(64)), value=10) + print "[+] Attacker tx2 via exploit contract" seth.transaction( caller=attacker_account, address=exploit_account, data=seth.make_function_call('delegate(bytes)', seth.SByte(64)), value=0) + print "[+] Attacker tx3 via exploit contract" seth.transaction( caller=attacker_account, address=exploit_account, diff --git a/examples/evm/seth.py b/examples/evm/seth.py index f4b6b44..9609074 100644 --- a/examples/evm/seth.py +++ b/examples/evm/seth.py @@ -156,8 +156,8 @@ class ManticoreEVM(Manticore): self._executor.subscribe('will_terminate_state', self.terminate_state_callback) self._executor.subscribe('will_execute_instruction', self.will_execute_instruction_callback) self._executor.subscribe('did_read_code', self.did_read_code) - self._executor.subscribe('symbolic_sha3', self.symbolic_sha3) - self._executor.subscribe('concrete_sha3', self.concrete_sha3) + self._executor.subscribe('on_symbolic_sha3', self.symbolic_sha3) + self._executor.subscribe('on_concrete_sha3', self.concrete_sha3) @property def world(self): diff --git a/manticore/core/workspace.py b/manticore/core/workspace.py index a3ae5c9..926ffa6 100644 --- a/manticore/core/workspace.py +++ b/manticore/core/workspace.py @@ -44,7 +44,7 @@ class PickleSerializer(StateSerializer): except RuntimeError: # recursion exceeded. try a slower, iterative solution from ..utils import iterpickle - logger.warning("Using iterpickle to dump state") + logger.debug("Using iterpickle to dump state") f.write(iterpickle.dumps(state, 2)) def deserialize(self, f): diff --git a/manticore/manticore.py b/manticore/manticore.py index a42488d..9946478 100644 --- a/manticore/manticore.py +++ b/manticore/manticore.py @@ -657,11 +657,11 @@ class Manticore(Eventful): def _start_run(self): assert not self.running - #FIXME this will be self.publish - self._publish('will_start_run', self._initial_state) + if self._initial_state is not None: + self._publish('will_start_run', self._initial_state) - self.enqueue(self._initial_state) - self._initial_state = None + self.enqueue(self._initial_state) + self._initial_state = None #Copy the local main context to the shared conext self._executor._shared_context.update(self._context) diff --git a/manticore/platforms/evm.py b/manticore/platforms/evm.py index e273dfb..a7474eb 100644 --- a/manticore/platforms/evm.py +++ b/manticore/platforms/evm.py @@ -27,7 +27,7 @@ TT255 = 2 ** 255 TOOHIGHMEM = 0x1000 def ceil32(x): - return Operators.ITE(x % 32 == 0, x , x + 32 - (x % 32)) + return Operators.ITEBV(256, (x % 32) == 0, x , x + 32 - (x % 32)) def to_signed(i): return Operators.ITEBV(256, i %x", buf, value) return value @@ -1396,6 +1396,8 @@ class EVM(Eventful): ################################################################################ ################################################################################ class EVMWorld(Platform): + _published_events = {'read_code', 'decode_instruction', 'execute_instruction', 'concrete_sha3', 'symbolic_sha3'} + def __init__(self, constraints, storage=None, **kwargs): super(EVMWorld, self).__init__(path="NOPATH", **kwargs) self._global_storage = {} if storage is None else storage @@ -1431,7 +1433,7 @@ class EVMWorld(Platform): def _do_events(self): if self.current is not None: self.forward_events_from(self.current) - self.subscribe('concrete_sha3', self._concrete_sha3_callback) + self.subscribe('on_concrete_sha3', self._concrete_sha3_callback) def _concrete_sha3_callback(self,buf, value): if buf in self._sha3: @@ -1502,7 +1504,8 @@ class EVMWorld(Platform): self._callstack.append(vm) self.current.depth = self.depth self.current.constraints = self.constraints - self.forward_events_from(self.current) + #self.forward_events_from(self.current) + self._do_events() if self.depth > 1024: while self.depth >0: self._pop(rollback=True) @@ -1790,7 +1793,7 @@ class EVMWorld(Platform): logger.info("SHA3 Searching over %d known hashes", len(self._sha3)) logger.info("SHA3 TODO save this state for future explorations with more known hashes") #Broadcast the signal - self._publish( 'symbolic_sha3', data, self._sha3.items()) + self._publish( 'on_symbolic_sha3', data, self._sha3.items()) results = [] known_hashes = False