Initial import

examples/script/guide_exec.py

@@ -0,0 +1,32 @@
+import sys
+from manticore import Manticore
+
+# This example demonstrates guiding Manticore's analysis
+# by ignoring all branches to libc
+
+def find_lib(m, name):
+    for vmmap in m.memory:
+        if vmmap.name == 'libc.so.6':
+            return vmmap
+
+if __name__ == '__main__':
+    path = sys.argv[1]
+    # Create a new Manticore object
+    m = Manticore(path)
+
+    # Now that binary is loaded, pull out where libc is mapped
+    lib = find_lib(m, 'libc')
+    if lib is None:
+        sys.exit(1)
+
+    # Ensure that we ignore all possible branches to libc
+    # This hook returns False if we should abandon exploration
+    # or True to continue
+    def fork_hook(new_pc):
+        _from, _to = lib.start, lib.start + lib.size
+        return not (_from <= new_pc < _to)
+    m.add_fork_hook(fork_hook)
+
+    # Start path exploration. start() returns when Manticore
+    # finishes
+    m.start()

examples/script/lads-baby-re.py

@@ -0,0 +1,30 @@
+'''
+API v0.1.0
+Solves modified version of baby-re, compiled for arm.
+'''
+
+import sys
+
+from manticore import Manticore
+
+if __name__ == '__main__':
+    path = sys.argv[1]
+    m = Manticore(path)
+
+    def myhook(ctx, state, ctl):
+        flag = ''
+        cpu = state.cpu
+        arraytop = cpu.R11
+        base = arraytop - 0x18
+        for i in xrange(4):
+            symbolic_input = cpu.read_int(base + i*4)
+            # TODO apis to contrain input to ascii
+            concrete_input = state.solve_one(symbolic_input)
+            flag += chr(concrete_input & 0xff)
+        print 'flag is:', flag
+        ctl.exit()
+
+    m.add_hook(0x109f0, myhook)
+
+    m.start()
+    print 'done'

examples/script/manticore_config.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python
+
+import sys
+from manticore import Manticore
+
+# This example demonstrates the basic high level config
+# interface
+
+def get_args():
+    class Args(object): pass
+    args = Args()
+    args.replay = None; args.data = ''; args.dumpafter = 0; args.maxstates = 0;
+    args.maxstorage = 0; args.stats = True; args.verbose = False; args.log = '-';
+    return args
+
+if __name__ == '__main__':
+    path = sys.argv[1]
+    args = get_args()
+
+    args.programs = sys.argv[1:]
+    # Create a new Manticore object
+    m = Manticore(None, path, args)
+
+    # Set a few settings
+    m.procs = 4
+    m.solver = 'z3'
+
+    # Start path exploration. start() returns when Manticore
+    # finishes
+    m.start()
+
+    # Print high level statistics
+    m.dump_stats()
+

examples/script/run_callback.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python
+
+import sys
+from manticore import Manticore
+
+# This example demonstrates a basic hook (PC register)
+
+def get_args():
+    class Args(object): pass
+    args = Args()
+    args.replay = None; args.data = ''; args.dumpafter = 0; args.maxstates = 0;
+    args.maxstorage = 0; args.stats = True; args.verbose = False; args.log = '-';
+    return args
+
+if __name__ == '__main__':
+    path = sys.argv[1]
+    args = get_args()
+
+    args.programs = sys.argv[1:]
+    # Create a new Manticore object
+    m = Manticore(None, path, args)
+
+    # Trigger an event when PC reaches a certain value
+    def reached_goal(state):
+        cpu = state.cpu
+
+        assert cpu.pc == 0x10858
+
+        instruction = cpu.read(cpu.pc, 4)
+        print "Execution goal reached."
+        print "Instruction bytes: {:08x}".format(cpu.pc)
+
+    m.add_pc_hook(0x10858, reached_goal)
+
+    # Start path exploration. start() returns when Manticore
+    # finishes
+    m.start()
+

examples/script/run_simple.py

@@ -0,0 +1,18 @@
+import sys
+from manticore import Manticore
+
+# This example demonstrates loading a simple binary in Manticore,
+# running it to completion without any callbacks or instrumentation
+# and producing basic information about the paths explored
+
+
+if __name__ == '__main__':
+    path = sys.argv[1]
+    # Create a new Manticore object
+    m = Manticore(None, path)
+    # Start path exploration. start() returns when Manticore
+    # finishes
+    m.start()
+    # Print high level statistics
+    m.dump_stats()
+

examples/script/sym.py

@@ -0,0 +1,52 @@
+#!/usr/bin/env python
+
+import sys
+from core.smtlib.expression import *
+from capstone.arm import *
+from capstone.x86 import *
+from manticore import Manticore
+
+# This example demonstrates creating hooks on arbitrary values of the program
+# counter.
+
+def get_args():
+    class Args(object): pass
+    args = Args()
+    args.replay = None; args.data = ''; args.dumpafter = 0; args.maxstates = 0;
+    args.maxstorage = 0; args.stats = True; args.verbose = False; args.log = '-';
+    return args
+
+if __name__ == '__main__':
+    path = sys.argv[1]
+    args = get_args()
+
+    args.programs = sys.argv[1:]
+    # Create a new Manticore object
+    m = Manticore(None, path, args)
+
+    if m.arch == 'arm':
+        target = (0x1082c, 'R4')
+    else:
+        target = (0x400a83, 'EBX')
+
+    def entered_func(state):
+        '''For ARM, Make R4 symbolic at 0x1082c, as r4 is used in a branch right
+           after.
+        '''
+
+        cpu = state.cpu
+
+        sym_var = BitVecVariable(32, 'from_callback', taint=())
+
+        # Make destination register symbolic
+        setattr(cpu, target[1], sym_var)
+
+
+    m.add_pc_hook(target[0], entered_func)
+
+    # Start path exploration. start() returns when Manticore finishes
+    m.start()
+
+    # Print high level statistics
+    #m.dump_stats()
+