Commit Graph

439 Commits

Author SHA1 Message Date
khorben f22afeb235 Work-in-Progress support for NetBSD/amd64 binaries 2018-05-12 17:23:44 +02:00
khorben 07740c2fc7 Merge branch 'khorben/netbsd' 2018-05-09 03:30:15 +02:00
khorben 6b7dfa3a6c Merge branch 'khorben/linux-syscall-fork' 2018-05-09 03:30:09 +02:00
khorben 76072192d6 Merge branch 'khorben/linux-syscall-chroot' 2018-05-09 03:29:40 +02:00
khorben a36ebdc210 Merge branch 'khorben/479-assert-brk' 2018-05-09 03:29:29 +02:00
khorben 42ef3431ea Add support for NetBSD as a host OS
With these changes, I am able to run Manticore on Linux (static)
binaries from a NetBSD host.

Tested with NetBSD/amd64 (7.1_STABLE XEN3_DOM0).
2018-05-09 02:02:58 +02:00
khorben 84fca4cabf Avoid creating memory mappings with a negative size
This should completely fix #479 this time.
2018-05-09 01:26:01 +02:00
khorben 24374e6dea Minor optimization
Only compute perms if actually needed.
2018-05-09 01:25:39 +02:00
khorben 285f1cf8b1 Partially implement chroot(2)
Really this return EPERM (permission denied), which seems to be absolutely fine
since a non-privileged user is currently assumed. This is what would normally
be returned in this scenario.
2018-05-09 01:23:12 +02:00
khorben cacc50abb5 Partially implement fork(2)
Really this return ENOSYS (not implemented), which allows sub-processes to
detect the condition and continue to run (or crash on their own if they did not
expect fork() to fail).
2018-05-09 01:20:46 +02:00
Catena cyber 44ef97ec6c Loads shared ELF to analyze a function (#861)
* Loads shared ELF to analyze a function

See #69

* Bring in recent changes to concolic.py

* Loads shared ELF to analyze a function

* Fix the 'linux' class method prototype
2018-05-08 14:15:03 -04:00
ggrieco-tob b9a515ccfe Added optional message parameter in ConcretizeMemory (#885)
* Added optional message parameter in ConcretizeMemory

In some files (e.g. manticore/core/cpu/abstractcpu.py), ConcretizeMemory is invoked with a message but it is interpreted as the "policy" value now, causing a crash. This commit should fix that issue.

* Small code refactoring to address code review
2018-05-07 09:23:40 -04:00
feeb 109180fc15 Merge pull request #888 from trailofbits/dev-019
Manticore 0.1.9
2018-05-04 16:03:35 -04:00
Mark Mossberg 23a1412e15 Finish changelog 2018-05-04 14:27:41 -04:00
Mark Mossberg 66640c8ed8 Initial changelog 2018-05-04 14:17:47 -04:00
Mark Mossberg 5c9e63555e Bump version 2018-05-04 14:07:20 -04:00
Yan Ivnitskiy 9c258bd68d Update concolic.py (#887)
* Update concolic.py

* update what evt we subscribe to
2018-05-03 18:52:29 -04:00
Arun John Kuruvilla 9307475af5 Raises exception for Solidity compiler not installed. Issue #867 (#877) 2018-04-24 13:36:06 -03:00
Catena cyber fb3c01fe1c Sign extends x86 AND operand (capstone bug) (#852)
* Sign extends x86 AND operand (capstone bug)

Fixes #560

* Regression test for X86 AND with sign extension

For issue #560
2018-04-24 11:32:18 +01:00
Daniel James 4a98110f4a Support Solidity compilation of a file handle (#873)
This preserves the current behavior of using a string value as Solidity
source code, but now also supports instances of the `file` type, and
will use the `name` property of the file object to pass to the
subprocess invocation of solc.

This implementation also now ensures resource cleanup for the stdout and
stderr pipe handles.

Make use of compiling via file handles in multi_tx_analysis

This will enable import statements in Solidity code to work for the
Manticore CLI out of the box

Note, Manticore still wants the source code, so if we compiled using a file
handle, rather than a source string, we need to read in the source

fixes #705
2018-04-20 12:05:04 -03:00
feliam 92cfab3a42 Fix check of solc metadata tail (#848)
* Fix check of solc metasata tail

* Remove debug print

* fix metadat tail removal

* Yet another loose end - fixed

* Better version parsing and review fixes

* Remove debug print

* pep8
2018-04-17 18:58:58 -03:00
khorben 71bf5d4f11 Remove assertion on brk() (#860)
Manticore assumed that new calls to brk(2) were always increasing the
size of the data segment. This is not always true, since programs may
decide to reduce it as well.

Tested with a static Linux/i386 program on macOS/amd64.

(https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/mm/mmap.c?h=v4.17-rc1#n226)
2018-04-17 17:25:40 -04:00
Daniel James 2814723cc8 Support ABI parsing of specs that use function types (#874)
See http://solidity.readthedocs.io/en/v0.4.21/types.html#function-types
This is a special case of `bytes24`, 24 bytes are right zero padded in
a 32 byte word.
2018-04-16 21:44:29 -03:00
Daniel James bfffa78b5f Fix Issue #869 (#872)
* Add testcase for empty types bug

* Fix Issue 869

Bug introduced in
https://github.com/trailofbits/manticore/commit/0fc4bba9ad8ef61f9e1f23bc6d0a88b7a05aa385#diff-6cf4568b5e8712514d226faa04e417fbR450

- Move empty string up to the beginning of the if-else chain.
- Correct test for bool type case

fixes #869
2018-04-13 14:32:17 -06:00
ggrieco-tob aa792588fe Added --txnocoverage option to manticore cli (#849)
* added txnocoverage option to manticore cli

* improved code readability
2018-04-10 09:34:38 -04:00
Mark Mossberg d5a692fc59 Rm the slow solver code (#859) 2018-04-09 10:01:12 -06:00
khorben 4276bd5c7c Remove assertion on brk()
Manticore assumed that new calls to brk(2) were always increasing the
size of the data segment. This is not always true, since programs may
decide to reduce it as well.

Tested with a static Linux/i386 program on macOS/amd64.
2018-04-06 03:22:00 +02:00
ggrieco-tob 0fc4bba9ad Added all the uint types supported by Solidity (#811)
* added all the uint types supported by solidity

* fixed some incorrect indentation

* Added missing space around "+"

* added some proper exceptions and included all the integer parameter types

* improved exception handling

* missing check

* added preliminary version of unit test for ABI

* x

* half finished

* tes

* fixes

* docstr

* Raise exception only once

* cc

* Fix merge bug

* fix merge bug in tests

* Fix bugs introduced in merge
2018-04-05 14:43:15 -06:00
Mark Mossberg 6616b9e05c Ethereum ABI and misc fixes (#855)
* Port most of the less invasive/controversial changes from dev-evm-dynamicarguments

* Port section of fixes from ethereum.py

* Port tests unrelated to concretizing dyn args

* Add remaining changes from evm.py

* clean, fmt, code climate

* rm unnecessary setup

* disable??

* fmt

* remove all the returns

* lol cc

* Rm unused code

* port to .format

* don't use map (for py2/3 compat)

* simplify slicing

* Rm dyn arg code, since it doesn't really even work

and will be included when dev-evm-dynamicarguments is totally resolved

* add address/get_uint test

* Revert "Rm dyn arg code, since it doesn't really even work"

69188da4caf1ff74288b6398e8140f627dc495c4
2018-04-05 13:31:16 -06:00
cclauss af779d8baa Do not forget self (again) (#854) 2018-04-03 16:47:47 -04:00
Mark Mossberg bda9c091b5 Manticore 0.1.8 (#851)
(thanks for 1k)

* Bump version numbers

* initial changelog update

* Add changelog content

* add contribs
2018-03-30 18:26:26 -04:00
Arun John Kuruvilla 2f382a9d1c Added KeyError Exception for offsets not in srcmap. Issue #832 (#839) 2018-03-30 10:44:34 -04:00
ggrieco-tob 03af65e55f A more complete example to initialize and explore a smart contract with manticore (#827)
* A more complete example to initialize and explore a smart contract with manticore

* Removed outdated comments
2018-03-22 09:40:51 -03:00
Disconnect3d 9c19014e4b Fix duplicated armv7 test name (#833)
* Fix duplicate armv7rf test name

* Small refactor of armv7rf

* Proper test classes names
2018-03-21 15:34:19 -04:00
feliam d1051f6c84 Push 0 on internal revert (#830) 2018-03-20 14:30:09 -03:00
Mark Mossberg 2eb002593e evm: add per state trace file (#817)
* Add trace file

* Make ethersplay compatible trace format

* Small cleanup

* Record separate init and rt traces, emit separate trace files

* add todo

* More pythonic

* Add test for end insn in trace file

* Fix test

* Move trace accumulation into will_evm_execute callback

here, we can easily and correctly check the .last_exception field
to see if we were in init code or rt code. from the did_evm_execute hook
the last instruction (end instruction) had a different .last_exception
so this was causing the last instruction to not be recorded in the trace.
2018-03-19 14:22:08 -04:00
ggrieco-tob 8acd2293b8 Added --txaccount parameter to control the caller of the symbolic exploration of smart contracts (#819)
* added --txaccount parameter to control the caller of the symbolic exploration of smart contracts

* Use of the new EthereumError exception
2018-03-19 15:08:22 -03:00
Matthew Roll e97e631d8e port ethereum tests to individual files (issue #809) (#820)
* Add contract keyword arg to IntegrationTest._simple_cli_run

* Remove inline tests from test_eth

* Refactor IntegrationTest.test_eth_regressions to support multi-contract files
2018-03-19 09:24:04 -04:00
Mark Mossberg fb79127bc2 Graceful exit when no states to run (#815)
* rm unnecessary return, change assert to graceful handle

* Add regression test

* Add regression test

* Correct logic

* Rm unnecessary check

This branch is unnecessary, if this condition is true, then ultimately
the executor will do nothing, and we'll simply return anyway.

* Raise NoAliveStates if no alive states to execute

* docstr update

* Update mult_tx_analysis to handle NoAliveStates

* Fancy

* Update test

* Codeclimate fmt

* fmt

* better readability

* add docstr
2018-03-16 17:48:36 -04:00
Mark Mossberg a21c8b6012 Improve evm docs (#816)
* Add docstr for finalize

* prune unnecessary stuff from docs

* Add trace file

* Revert "Add trace file"

4687810e15c2bc6cc3e729c32bdad2f617679d77
2018-03-16 13:32:32 -04:00
Mark Mossberg eaa0e524b4 Fix off by 1 error in codecopy (#812)
* Fix off by 1 in codecopy

* Add regression test

* Improve formatting
2018-03-15 16:41:29 -04:00
Arun John Kuruvilla fb3938bb3e Raises exception for contract with a function without code. Issue #789 (#797) 2018-03-15 16:31:18 -04:00
Yan Ivnitskiy cf789a4291 Introduce concretized_args decorator (#803)
* Introduce concretized_args decorator

* Add docs

* Cleanup

* Add basic expression counter

* Please codeclimate

* pep8

* update docstring

* Use default concretization policy when not provided

* Add concretizer tests
2018-03-14 16:45:12 -04:00
Yan Ivnitskiy 61babdbe21 Fix evm RETURN implementation (#808)
* Fix write_buffer issue (#807)

* Add test for write_buffer fix

* Use Operators.ORD instead of ord (even though were assuming concrete vals)

* Cleanup
2018-03-12 15:27:18 -04:00
Dan Guido bb4a7966a8 Add codeclimate, tox, and pycodestyle configs (#772)
* pep8

autopep8 -r -i -a -a manticore

* tox for testing py3k

* minimal codeclimate

* Add correct Code Climate ID

* unignore max line endings since it's set to 160

* more badges

* turn off pep8 in code climate

* need to remove for codeclimate to work right

* re-enable most checks with looser thresholds

* remove unused imports

autoflake --in-place -r manticore

* revert the autoflakes changes

* set tox to only py27 for now

* cache is hardcoded to python 2.7.13

* Comment cleanup

* Try autoflake again

* Add dev environment dependency management to tox.ini

* Remove count/statistics options from tox.ini

Per Dan, these crash pep8 analysis on codeclimate at present

* Revert setstate initialization

* Re-introduce explicit compare for flags

* add back structural comment

* rm unneeeded ` as e`

* bump py tox
2018-03-12 14:40:06 -04:00
Yan Ivnitskiy fceb48ce0c Update Create (evm exception) arguments (#805)
* Update Create arguments

* Add integration test

* Dial back the procs
2018-03-12 12:19:38 -04:00
ggrieco-tob fbf0823cb6 Very quick fix to avoid STOP instructions to return random values (#792) 2018-03-07 14:57:59 -03:00
ggrieco-tob f4118f4f0f Added a function to generate evm testcases without using callbacks (#791)
* Added a function to generate evm testcases without using callbacks

Possible fix for #782

* The 'message' parameter in generate_testcase should be optional

Requested by @montyly
2018-03-06 18:35:19 -03:00
Disconnect3d fe2538f6bc Add docstring for ARM's operand.is_shifted (#788)
So that people don't have to google that by themselves! lolo
2018-03-05 18:42:48 -05:00
Disconnect3d 328b62350a Change assertion->exception and add msg when target file is not present (#778) 2018-03-02 15:55:13 -05:00