441 Commits

Author SHA1 Message Date
1cb83b41d6 Merge branch 'master' of github.com:trailofbits/manticore 2018-05-12 17:18:28 +02:00
6747c437b1 Partially implement fork(2) (#892)
* Partially implement fork(2)

Really this return ENOSYS (not implemented), which allows sub-processes to
detect the condition and continue to run (or crash on their own if they did not
expect fork() to fail).

* Move sys_fork to correct class; add a basic docstring
2018-05-11 11:52:07 -04:00
f6d0cd4e8e Partially implement chroot(2) (#891)
* Partially implement chroot(2)

Really this return EPERM (permission denied), which seems to be absolutely fine
since a non-privileged user is currently assumed. This is what would normally
be returned in this scenario.

* update chroot implementation
2018-05-11 11:43:27 -04:00
07740c2fc7 Merge branch 'khorben/netbsd' 2018-05-09 03:30:15 +02:00
6b7dfa3a6c Merge branch 'khorben/linux-syscall-fork' 2018-05-09 03:30:09 +02:00
76072192d6 Merge branch 'khorben/linux-syscall-chroot' 2018-05-09 03:29:40 +02:00
a36ebdc210 Merge branch 'khorben/479-assert-brk' 2018-05-09 03:29:29 +02:00
42ef3431ea Add support for NetBSD as a host OS
With these changes, I am able to run Manticore on Linux (static)
binaries from a NetBSD host.

Tested with NetBSD/amd64 (7.1_STABLE XEN3_DOM0).
2018-05-09 02:02:58 +02:00
84fca4cabf Avoid creating memory mappings with a negative size
This should completely fix #479 this time.
2018-05-09 01:26:01 +02:00
24374e6dea Minor optimization
Only compute perms if actually needed.
2018-05-09 01:25:39 +02:00
285f1cf8b1 Partially implement chroot(2)
Really this return EPERM (permission denied), which seems to be absolutely fine
since a non-privileged user is currently assumed. This is what would normally
be returned in this scenario.
2018-05-09 01:23:12 +02:00
cacc50abb5 Partially implement fork(2)
Really this return ENOSYS (not implemented), which allows sub-processes to
detect the condition and continue to run (or crash on their own if they did not
expect fork() to fail).
2018-05-09 01:20:46 +02:00
Catena cyber
44ef97ec6c Loads shared ELF to analyze a function (#861)
* Loads shared ELF to analyze a function

See #69

* Bring in recent changes to concolic.py

* Loads shared ELF to analyze a function

* Fix the 'linux' class method prototype
2018-05-08 14:15:03 -04:00
ggrieco-tob
b9a515ccfe Added optional message parameter in ConcretizeMemory (#885)
* Added optional message parameter in ConcretizeMemory

In some files (e.g. manticore/core/cpu/abstractcpu.py), ConcretizeMemory is invoked with a message but it is interpreted as the "policy" value now, causing a crash. This commit should fix that issue.

* Small code refactoring to address code review
2018-05-07 09:23:40 -04:00
feeb
109180fc15
Merge pull request #888 from trailofbits/dev-019
Manticore 0.1.9
2018-05-04 16:03:35 -04:00
Mark Mossberg
23a1412e15 Finish changelog 2018-05-04 14:27:41 -04:00
Mark Mossberg
66640c8ed8 Initial changelog 2018-05-04 14:17:47 -04:00
Mark Mossberg
5c9e63555e Bump version 2018-05-04 14:07:20 -04:00
Yan Ivnitskiy
9c258bd68d
Update concolic.py (#887)
* Update concolic.py

* update what evt we subscribe to
2018-05-03 18:52:29 -04:00
Arun John Kuruvilla
9307475af5 Raises exception for Solidity compiler not installed. Issue #867 (#877) 2018-04-24 13:36:06 -03:00
Catena cyber
fb3c01fe1c Sign extends x86 AND operand (capstone bug) (#852)
* Sign extends x86 AND operand (capstone bug)

Fixes #560

* Regression test for X86 AND with sign extension

For issue #560
2018-04-24 11:32:18 +01:00
Daniel James
4a98110f4a Support Solidity compilation of a file handle (#873)
This preserves the current behavior of using a string value as Solidity
source code, but now also supports instances of the `file` type, and
will use the `name` property of the file object to pass to the
subprocess invocation of solc.

This implementation also now ensures resource cleanup for the stdout and
stderr pipe handles.

Make use of compiling via file handles in multi_tx_analysis

This will enable import statements in Solidity code to work for the
Manticore CLI out of the box

Note, Manticore still wants the source code, so if we compiled using a file
handle, rather than a source string, we need to read in the source

fixes #705
2018-04-20 12:05:04 -03:00
feliam
92cfab3a42
Fix check of solc metadata tail (#848)
* Fix check of solc metasata tail

* Remove debug print

* fix metadat tail removal

* Yet another loose end - fixed

* Better version parsing and review fixes

* Remove debug print

* pep8
2018-04-17 18:58:58 -03:00
71bf5d4f11 Remove assertion on brk() (#860)
Manticore assumed that new calls to brk(2) were always increasing the
size of the data segment. This is not always true, since programs may
decide to reduce it as well.

Tested with a static Linux/i386 program on macOS/amd64.

(https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/mm/mmap.c?h=v4.17-rc1#n226)
2018-04-17 17:25:40 -04:00
Daniel James
2814723cc8 Support ABI parsing of specs that use function types (#874)
See http://solidity.readthedocs.io/en/v0.4.21/types.html#function-types
This is a special case of `bytes24`, 24 bytes are right zero padded in
a 32 byte word.
2018-04-16 21:44:29 -03:00
Daniel James
bfffa78b5f Fix Issue #869 (#872)
* Add testcase for empty types bug

* Fix Issue 869

Bug introduced in
0fc4bba9ad (diff-6cf4568b5e8712514d226faa04e417fbR450)

- Move empty string up to the beginning of the if-else chain.
- Correct test for bool type case

fixes #869
2018-04-13 14:32:17 -06:00
ggrieco-tob
aa792588fe Added --txnocoverage option to manticore cli (#849)
* added txnocoverage option to manticore cli

* improved code readability
2018-04-10 09:34:38 -04:00
Mark Mossberg
d5a692fc59
Rm the slow solver code (#859) 2018-04-09 10:01:12 -06:00
4276bd5c7c Remove assertion on brk()
Manticore assumed that new calls to brk(2) were always increasing the
size of the data segment. This is not always true, since programs may
decide to reduce it as well.

Tested with a static Linux/i386 program on macOS/amd64.
2018-04-06 03:22:00 +02:00
ggrieco-tob
0fc4bba9ad Added all the uint types supported by Solidity (#811)
* added all the uint types supported by solidity

* fixed some incorrect indentation

* Added missing space around "+"

* added some proper exceptions and included all the integer parameter types

* improved exception handling

* missing check

* added preliminary version of unit test for ABI

* x

* half finished

* tes

* fixes

* docstr

* Raise exception only once

* cc

* Fix merge bug

* fix merge bug in tests

* Fix bugs introduced in merge
2018-04-05 14:43:15 -06:00
Mark Mossberg
6616b9e05c
Ethereum ABI and misc fixes (#855)
* Port most of the less invasive/controversial changes from dev-evm-dynamicarguments

* Port section of fixes from ethereum.py

* Port tests unrelated to concretizing dyn args

* Add remaining changes from evm.py

* clean, fmt, code climate

* rm unnecessary setup

* disable??

* fmt

* remove all the returns

* lol cc

* Rm unused code

* port to .format

* don't use map (for py2/3 compat)

* simplify slicing

* Rm dyn arg code, since it doesn't really even work

and will be included when dev-evm-dynamicarguments is totally resolved

* add address/get_uint test

* Revert "Rm dyn arg code, since it doesn't really even work"

69188da4caf1ff74288b6398e8140f627dc495c4
2018-04-05 13:31:16 -06:00
cclauss
af779d8baa Do not forget self (again) (#854) 2018-04-03 16:47:47 -04:00
Mark Mossberg
bda9c091b5
Manticore 0.1.8 (#851)
(thanks for 1k)

* Bump version numbers

* initial changelog update

* Add changelog content

* add contribs
2018-03-30 18:26:26 -04:00
Arun John Kuruvilla
2f382a9d1c Added KeyError Exception for offsets not in srcmap. Issue #832 (#839) 2018-03-30 10:44:34 -04:00
ggrieco-tob
03af65e55f
A more complete example to initialize and explore a smart contract with manticore (#827)
* A more complete example to initialize and explore a smart contract with manticore

* Removed outdated comments
2018-03-22 09:40:51 -03:00
Disconnect3d
9c19014e4b Fix duplicated armv7 test name (#833)
* Fix duplicate armv7rf test name

* Small refactor of armv7rf

* Proper test classes names
2018-03-21 15:34:19 -04:00
feliam
d1051f6c84
Push 0 on internal revert (#830) 2018-03-20 14:30:09 -03:00
Mark Mossberg
2eb002593e
evm: add per state trace file (#817)
* Add trace file

* Make ethersplay compatible trace format

* Small cleanup

* Record separate init and rt traces, emit separate trace files

* add todo

* More pythonic

* Add test for end insn in trace file

* Fix test

* Move trace accumulation into will_evm_execute callback

here, we can easily and correctly check the .last_exception field
to see if we were in init code or rt code. from the did_evm_execute hook
the last instruction (end instruction) had a different .last_exception
so this was causing the last instruction to not be recorded in the trace.
2018-03-19 14:22:08 -04:00
ggrieco-tob
8acd2293b8
Added --txaccount parameter to control the caller of the symbolic exploration of smart contracts (#819)
* added --txaccount parameter to control the caller of the symbolic exploration of smart contracts

* Use of the new EthereumError exception
2018-03-19 15:08:22 -03:00
Matthew Roll
e97e631d8e port ethereum tests to individual files (issue #809) (#820)
* Add contract keyword arg to IntegrationTest._simple_cli_run

* Remove inline tests from test_eth

* Refactor IntegrationTest.test_eth_regressions to support multi-contract files
2018-03-19 09:24:04 -04:00
Mark Mossberg
fb79127bc2
Graceful exit when no states to run (#815)
* rm unnecessary return, change assert to graceful handle

* Add regression test

* Add regression test

* Correct logic

* Rm unnecessary check

This branch is unnecessary, if this condition is true, then ultimately
the executor will do nothing, and we'll simply return anyway.

* Raise NoAliveStates if no alive states to execute

* docstr update

* Update mult_tx_analysis to handle NoAliveStates

* Fancy

* Update test

* Codeclimate fmt

* fmt

* better readability

* add docstr
2018-03-16 17:48:36 -04:00
Mark Mossberg
a21c8b6012
Improve evm docs (#816)
* Add docstr for finalize

* prune unnecessary stuff from docs

* Add trace file

* Revert "Add trace file"

4687810e15c2bc6cc3e729c32bdad2f617679d77
2018-03-16 13:32:32 -04:00
Mark Mossberg
eaa0e524b4
Fix off by 1 error in codecopy (#812)
* Fix off by 1 in codecopy

* Add regression test

* Improve formatting
2018-03-15 16:41:29 -04:00
Arun John Kuruvilla
fb3938bb3e Raises exception for contract with a function without code. Issue #789 (#797) 2018-03-15 16:31:18 -04:00
Yan Ivnitskiy
cf789a4291
Introduce concretized_args decorator (#803)
* Introduce concretized_args decorator

* Add docs

* Cleanup

* Add basic expression counter

* Please codeclimate

* pep8

* update docstring

* Use default concretization policy when not provided

* Add concretizer tests
2018-03-14 16:45:12 -04:00
Yan Ivnitskiy
61babdbe21
Fix evm RETURN implementation (#808)
* Fix write_buffer issue (#807)

* Add test for write_buffer fix

* Use Operators.ORD instead of ord (even though were assuming concrete vals)

* Cleanup
2018-03-12 15:27:18 -04:00
Dan Guido
bb4a7966a8
Add codeclimate, tox, and pycodestyle configs (#772)
* pep8

autopep8 -r -i -a -a manticore

* tox for testing py3k

* minimal codeclimate

* Add correct Code Climate ID

* unignore max line endings since it's set to 160

* more badges

* turn off pep8 in code climate

* need to remove for codeclimate to work right

* re-enable most checks with looser thresholds

* remove unused imports

autoflake --in-place -r manticore

* revert the autoflakes changes

* set tox to only py27 for now

* cache is hardcoded to python 2.7.13

* Comment cleanup

* Try autoflake again

* Add dev environment dependency management to tox.ini

* Remove count/statistics options from tox.ini

Per Dan, these crash pep8 analysis on codeclimate at present

* Revert setstate initialization

* Re-introduce explicit compare for flags

* add back structural comment

* rm unneeeded ` as e`

* bump py tox
2018-03-12 14:40:06 -04:00
Yan Ivnitskiy
fceb48ce0c
Update Create (evm exception) arguments (#805)
* Update Create arguments

* Add integration test

* Dial back the procs
2018-03-12 12:19:38 -04:00
ggrieco-tob
fbf0823cb6
Very quick fix to avoid STOP instructions to return random values (#792) 2018-03-07 14:57:59 -03:00
ggrieco-tob
f4118f4f0f
Added a function to generate evm testcases without using callbacks (#791)
* Added a function to generate evm testcases without using callbacks

Possible fix for #782

* The 'message' parameter in generate_testcase should be optional

Requested by @montyly
2018-03-06 18:35:19 -03:00