EVM refactor and simple UI (#629)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

examples/evm/coverage.py

@@ -30,7 +30,7 @@ seth.transaction(  caller=user_account,
 print "[+] There are %d reverted states now"% len(seth.final_state_ids)
 print "[+] There are %d alive states now"% len(seth.running_state_ids)
 for state_id in seth.running_state_ids:
-    seth.report(state_id)
+    print seth.report(state_id)
 
 print "[+] Global coverage: %x"% contract_account
 print seth.coverage(contract_account)

examples/evm/integer_overflow.py

@@ -27,11 +27,11 @@ contract_account.add(seth.SValue)
 
 print "[+] There are %d reverted states now"% len(seth.final_state_ids)
 for state_id in seth.final_state_ids:
-    seth.report(state_id)
+    print seth.report(state_id)
 
 print "[+] There are %d alive states now"% len(seth.running_state_ids)
 for state_id in seth.running_state_ids:
-    seth.report(state_id)
+    print seth.report(state_id)
 
 print "[+] Global coverage: %x"% contract_account
 print seth.coverage(contract_account)

examples/evm/minimal.py

@@ -2,7 +2,6 @@ from manticore.seth import ManticoreEVM
 ################ Script #######################
 
 seth = ManticoreEVM()
-seth.verbosity(0)
 #And now make the contract account to analyze
 # cat  | solc --bin 
 source_code = '''
@@ -42,7 +41,7 @@ print "[+] There are %d reverted states now"% len(seth.final_state_ids)
 
 print "[+] There are %d alive states now"% len(seth.running_state_ids)
 for state_id in seth.running_state_ids:
-    seth.report(state_id)
+    print seth.report(state_id)
 
 print "[+] Global coverage:"
 print seth.coverage(contract_account)

examples/evm/reentrancy_concrete.py

@@ -127,11 +127,11 @@ print " contract_account %x balance: %d"%  (contract_account, seth.get_balance(c
 
 print "[+] There are %d reverted states now"% len(seth.final_state_ids)
 for state_id in seth.final_state_ids:
-     seth.report(state_id)
+    print seth.report(state_id)
 
 print "[+] There are %d alive states now"% (len(seth.running_state_ids))
 for state_id in seth.running_state_ids:
-    seth.report(state_id)
+    print seth.report(state_id)
 
 print "[+] Global coverage:"
 print seth.coverage(contract_account)

examples/evm/reentrancy_symbolic.py

@@ -119,7 +119,7 @@ exploit_account.get_money()
 
 print "[+] There are %d alive states now"% (len(seth.running_state_ids))
 for state_id in seth.running_state_ids:
-    seth.report(state_id)
+    world = seth.get_world(state_id)
 
 print "[+] Global coverage:"
 print seth.coverage(contract_account, ty='SUICIDE')

examples/evm/simple_functions.py

@@ -35,11 +35,11 @@ seth.transaction(  caller=user_account,
 
 print "[+] There are %d reverted states now"% len(seth.final_state_ids)
 for state_id in seth.final_state_ids:
-    seth.report(state_id)
+    print seth.report(state_id)
 
 print "[+] There are %d alive states now"% len(seth.running_state_ids)
 for state_id in seth.running_state_ids:
-    seth.report(state_id)
+    print seth.report(state_id)
 
 print "[+] Global coverage:"
 print seth.coverage(contract_account)

examples/evm/simple_mapping.py

@@ -45,11 +45,11 @@ seth.transaction(  caller=user_account,
 
 print "[+] There are %d reverted states now"% len(seth.final_state_ids)
 for state_id in seth.final_state_ids:
-    seth.report(state_id)
+    print seth.report(state_id)
 
 print "[+] There are %d alive states now"% len(seth.running_state_ids)
 for state_id in seth.running_state_ids:
-    seth.report(state_id)
+    print seth.report(state_id)
 
 print "[+] Global coverage:"
 print seth.coverage(contract_account)

examples/evm/simple_transaction.py

@@ -31,11 +31,11 @@ contract_account.target(value=seth.SValue)
 
 print "[+] There are %d reverted states now"% len(seth.final_state_ids)
 for state_id in seth.final_state_ids:
-    seth.report(state_id)
+    print seth.report(state_id)
 
 print "[+] There are %d alive states now"% len(seth.running_state_ids)
 for state_id in seth.running_state_ids:
-    seth.report(state_id)
+    print seth.report(state_id)
 
 print "[+] Global coverage:"
 print seth.coverage(contract_account)

examples/evm/solidse.py

@@ -0,0 +1,92 @@
+from manticore.seth import ManticoreEVM, calculate_coverage, ABI
+import sys
+################ Script #######################
+seth = ManticoreEVM(procs=8)
+seth.verbosity(0)
+#And now make the contract account to analyze
+# cat  | solc --bin 
+source_code = file(sys.argv[1],'rb').read()
+
+user_account = seth.create_account(balance=1000)
+print "[+] Creating a user account", user_account
+
+
+contract_account = seth.solidity_create_contract(source_code, owner=user_account)
+print "[+] Creating a contract account", contract_account
+
+attacker_account = seth.create_account(balance=1000)
+print "[+] Creating a attacker account", attacker_account
+
+
+last_coverage = None 
+new_coverage = 0
+tx_count = 0
+while new_coverage != last_coverage and new_coverage < 100:
+
+    symbolic_data = seth.make_symbolic_buffer(320)
+    symbolic_value = seth.make_symbolic_value() 
+
+    seth.transaction(caller=attacker_account,
+                    address=contract_account,
+                    data=symbolic_data,
+                    value=symbolic_value )
+
+    tx_count += 1
+    last_coverage = new_coverage
+    new_coverage = seth.global_coverage(contract_account)
+    
+    print "[+] Coverage after %d transactions: %d%%"%(tx_count, new_coverage)
+    print "[+] There are %d reverted states now"% len(seth.terminated_state_ids)
+    print "[+] There are %d alive states now"% len(seth.running_state_ids)
+
+for state in seth.all_states:
+    blockchain = state.platform
+    for tx in blockchain.transactions: #external transactions
+        print "Transaction:"
+        print "\tsort %s" % tx.sort    #Last instruction or type? TBD
+        print "\tcaller 0x%x" % state.solve_one(tx.caller)  #The caller as by the yellow paper
+        print "\taddress 0x%x" % state.solve_one(tx.address) #The address as by the yellow paper
+        print "\tvalue: %d" % state.solve_one(tx.value)   #The value as by the yellow paper
+        print "\tcalldata: %r" % state.solve_one(tx.data)
+        print "\tresult: %s" % tx.result  #The result if any RETURN or REVERT
+        print "\treturn_data: %r" % state.solve_one(tx.return_data)  #The returned data if RETURN or REVERT
+
+        if tx.sort == 'Call':
+            metadata = seth.get_metadata(tx.address)
+            if metadata is not None:
+                function_id = tx.data[:4]  #hope there is enough data
+                function_id = state.solve_one(function_id).encode('hex')
+                signature = metadata.get_func_signature(function_id)
+                print "\tparsed calldata", ABI.parse(signature, tx.data) #func_id, *function arguments
+                if tx.result == 'RETURN':
+                    ret_types = metadata.get_func_return_types(function_id)
+                    print '\tparsed return_data', ABI.parse(ret_types, tx.return_data) #function return
+
+    #the logs
+    for log_item in blockchain.logs:
+        print "log address", log_item.address
+        print "memlog", log_item.memlog
+        for topic in log_item.topics:
+            print "topic", topic
+
+    for address in blockchain.deleted_addresses:
+        print "deleted address", address #selfdestructed address
+
+    #accounts alive in this state
+    for address in blockchain.contract_accounts: 
+        code = blockchain.get_code(address)
+        balance = blockchain.get_balance(address)
+        trace = set(( offset for address_i, offset in state.context['seth.trace'] if address == address_i))        
+        print calculate_coverage(code, trace) #coverage % for address in this state
+
+# All accounts ever created by the script 
+# (may not all be alife in all states)
+# (accounts created by contract code are not in this list )
+print "[+] Global coverage:"
+for address in seth.contract_accounts: 
+    print address, seth.global_coverage(address) #coverage % for address in this state
+
+
+
+
+