441 Commits

Author SHA1 Message Date
Mark Mossberg
6499c0e281
Add --tx flag to control symbolic tx (#667)
* Add --tx argument that must be a positive int

* Add simple tx_count mode

* Help updates

* Add None default arg

* Implement as upper bound, rather than absolute tx num

* rename to positive
2017-12-22 18:11:14 -05:00
Yan Ivnitskiy
2e578acf9d
Fix Unicorn exception handling; add a symbolic wrapper for exit(2) (#616)
* Fix unicorn tests and exception handling; add a sym wrapper for sys_exit

* Add debug output when solving for exit() arg

* Update how sys_exit(expr) is handled
2017-12-22 16:24:56 -05:00
Mark Mossberg
8413f7e947
Rm unused evm workspace function (#666)
* Rm unused function

Since this func was added, _generate_testcase_callback was overrided
in ManticoreEVM totally bypassing this function, which is now unused

* add comment
2017-12-22 16:24:21 -05:00
Mark Mossberg
7875aaf5fd
Rename manticore.seth to manticore.ethereum (#665)
* Rename file

* Fixup refs

* update logging

* Update docs

* Update docstr

* Clean docs
2017-12-22 14:05:37 -05:00
Mark Mossberg
c200aeefec
output the actual exit status when finalizing evm states (#664)
* Instead of 'Still Running' use the actual state exit status

* Throw states are terminated now

* More accurate phrasing, since 'throw' and 'not enough funds' are here too
2017-12-22 13:14:09 -05:00
Mark Mossberg
7aa85f13bb
Clean examples/evm (#661)
* Clean examples/evm, add a new one

integer_overflow.py -> simple_int_overflow.sol
simple_functions.py -> simple_multi_func.sol
simple_transaction.py -> simple_value_check.sol

* Add umd example
2017-12-22 12:23:17 -05:00
Yan Ivnitskiy
6896c227ef
Initial implementation of concolic algorithm (#653)
* WIP New Policy class

* WIP pubsub

* Update Signal tests

* small fixes from github comments

* Fix event decode_instruction signature

* Good merge

* Good good merge

* WIP manticore refactor

* Fix default old-style initial state

* add -> enqueue

* @m.init

* Fix workspace url

* Some test skipped

* Ad Fixme to platform specific stuff in State

* add -> enqueue

* Enqueue created state

* Fix m.init

Use a messy hack to adhere to the spec (callback func receive 1 state argument)

* Add _coverage_file ivar to Manticore

* Fix symbolic files

* remove extra enqueue

* Fixing __main__

* comments

* Experimental plugin system

* tests fixed

* Fix plugins

* Some reporting moved to plugin

* Fix assertions test

* Add published events to classes that publish them

* Update how we verify callbacks

* Update Eventful._publish

* Yet another flavor for event name checking

* really it's a bunch of minimal bugfixes

* Remove get_all_event_names from Plugin

* Update where we get all events

* Use new metaclass-based event registry

* Initial concrete trace follower

* Add extended (json) trace support

* More stubs for condition gather

* Update trace saving to new format

* Produce trace regardless of contents

* Record register deltas in trace

* Move initialization to _start_run so we can call run() multiple times

* Re-fix multiple workspace bug

* Fix it correctly

* Add extended trace and accessors

* make sure did_execute_instruction is always published

* Produce a consistent version

* move extended tracing to separate class

* Reorg of extended tracing plugins

* Add concolic tracing script

* Clean up old hooks

* Sync memory as well; cleanups

* Revert binary tests

* simplify concolic follower

* Move trace follower to plugin.py

* Simplify follower

* Add skip ranges to Follower

* Update concolic.py

* Remove redundant state init

* Clean up driver script

* Update header line

* Move trace follower

* Move Follower to follow_trace.py

* rm unused import

* Remove unnecessary property

* rm ConcreteTraceFollower

* Revert start_run behavior

* Initial implementation of concolic algorithm (#574)

* Fix coverage calculation vs. metadata (#529)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* Various bug fixes. (#530)

* Fixes #503

* Fixes #515

* Fixes 272. Concretize data written to a fd.

* Revert debug hack and fix overly broad exception

* Update did/will_exec_instr semantics

* Clean up imports

* Update logging and improve sys_open return

* Update variable names+doc for consistency

* Remove win32 support (#535)

* Remove Windows support files
* Remove Windows test files

* Localize log formatting changes (#547)

* Don't add custom format string to root logger

* Fix handler propagation

* Move inline function definitions out of the AbstractCPU's execute method (#538)

* This change moves from inline function definitions out of the critical path of AbstractCpu's execute method.

* Raise a mcore exception if we fail at emulation

* Fix all integral type checks that forget long (#555)

* [fix] Issue #550: generates extra workspace folder (#557)

* [fix] Issue #550: generates extra workspace folder

Signed-off-by: Cole Lightfighter <cole@onicsla.bz>

* Slight workspace and store refactor

* Handle file.tell() error, which will happen for special files (/dev/tty) (#559)

* Fix SLOAD invalid memory access (#562)

Check global_storage includes an entry at address before trying to load
storage.

* New API for EVM analysis (#551)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Add PCMPXSTRX Instructions (#507)

* Add PCMPXSTRX Instructions

* bug fixes

* unittest related fixes

* Full test of pcmpxstrx

* Move tests

* Fix typo per issue #552 - s/arm64/amd64/ (#561)

* Added missing syscalls in decree syscall trace (#545)

* added missing syscalls in decree syscall trace

* added missing parameter in callback of BranchLimited policy

* progress

* can flip constraint set

* hack around double decl issue

* can gen input

* what is this, a coding interview?

* did it?

* clean

* finish

* pretty log messages

* comment, clean

* more cleaning

* cmt

* Only really fork when there's multiple solutions (#569)

* Update comment and path

* Add UMD simple assert example (#573)

* Manticore prints linux ret code as uint instead of int (#578)

* Fixing raise issue #435

* syncing git

* Fix Bug #570

* syncing

* removed all binaries

* missed one file

* Updates travis cache to python 2.7.13 (#576)

* Updating README with solc binary requirements (#575)

* Updating README with solc binary requirements

* Update README.md

* Assert valid operand length (#558)

* Assert valid bytecode and operand length

EVM bytecode comes in 32-byte chunks, and contracts require at least one
segment to be created. An example, originally written by @ggrieco-tob in issue #546, is included.
Unsure what expected behavior should be, but initial state has a problem when a contract is
created with a single byte.

Also added some exception handling in `parse_operand()` to catch invalid
instructions, e.g. a PUSH1 instruction followed by no bytes.

Signed-off-by: Cole Lightfighter <cole@onicsla.bz>

* Fix SLOAD invalid memory access

Simple check to ensure address storage is in global_storage before
attempting to load data.

* Remove invalid assertions

* Fix for issue 556 and 591 (#590)

* version argument in manticore

* Fix 591 - Exception Handler

* Fix Issue: 597 - Remove unused policy argument in function State.solve_n (#598)

* version argument in manticore

* Fix 591 - Exception Handler

* Issue 597 - Remove the unused policy argument

* Fixes to thumb mode instruction implementations

* Thumb specific fixes to the SUB, BX, and MOV instruction implementations
* implemented hardcoded result for gettid syscall

* Trace following mode (#513)

* WIP New Policy class

* WIP pubsub

* Update Signal tests

* small fixes from github comments

* Fix event decode_instruction signature

* Good merge

* Good good merge

* WIP manticore refactor

* Fix default old-style initial state

* add -> enqueue

* @m.init

* Fix workspace url

* Some test skipped

* Ad Fixme to platform specific stuff in State

* add -> enqueue

* Enqueue created state

* Fix m.init

Use a messy hack to adhere to the spec (callback func receive 1 state argument)

* Add _coverage_file ivar to Manticore

* Fix symbolic files

* remove extra enqueue

* Fixing __main__

* comments

* Experimental plugin system

* tests fixed

* Fix plugins

* Some reporting moved to plugin

* Fix assertions test

* Add published events to classes that publish them

* Update how we verify callbacks

* Update Eventful._publish

* Yet another flavor for event name checking

* really it's a bunch of minimal bugfixes

* Remove get_all_event_names from Plugin

* Update where we get all events

* Use new metaclass-based event registry

* Initial concrete trace follower

* Add extended (json) trace support

* More stubs for condition gather

* Update trace saving to new format

* Produce trace regardless of contents

* Record register deltas in trace

* Move initialization to _start_run so we can call run() multiple times

* Re-fix multiple workspace bug

* Fix it correctly

* Add extended trace and accessors

* make sure did_execute_instruction is always published

* Produce a consistent version

* move extended tracing to separate class

* Reorg of extended tracing plugins

* Add concolic tracing script

* Clean up old hooks

* Sync memory as well; cleanups

* Revert binary tests

* simplify concolic follower

* Move trace follower to plugin.py

* Simplify follower

* Add skip ranges to Follower

* Update concolic.py

* Remove redundant state init

* Clean up driver script

* Update header line

* Move trace follower

* Move Follower to follow_trace.py

* rm unused import

* Remove unnecessary property

* rm ConcreteTraceFollower

* Revert start_run behavior

* Centralize system call logging (#602)

* Remove per-syscall logging

* Make Cpu.read_string() stop reading at first symbolic byte

* Centralize syscall logging

* Update helper docstring

* Update arg/ret expansion

* Check for issymbolic first

* Tiny hex format change

* Log unimplemented instructions (issue 163) (#599)

* Remove double printing of exception.

* Pretty print the unimplemented instruction raised by unicorn (UcError).

* Raise exception after unimplemented instruction error logging.

* Ensure the raised exception is actually a unicorn invalid instruction error.

* Resolve conflict

* EVM assembler/disassembler doc and cleanup (#563)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* EVMasm refactor

* EVM api refactor (#589)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Fixed Issue #533 (#606)

 * Remove Platform._path

* Amend pr guidelines (#615)

* Fixed Issue #619 (#623)

Add newlines in .trace file generation

* Hide legacy cli flags from cli help (#622)

* Fixed Issue #533

* Removed --replay argument from cli help. Issue #617

* Update help description

* Remove unused --size flag

* Emit .input instead of .txt files in workspace (#625)

Related: #612 

* Update workspace.py

Changed extension to .input

* Update test_workspace.py

* changed key value pair in test_workspace bc of change of extension to .input in workspace.py, fixed issue #618

* removed unwanted directories

* Update seth.py

* Update seth.py

Change in Documentation issue #612

* EVM refactor and simple UI (#629)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* Initial eth cli based on solidse.py (#633)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* initially evm cli from solidse.py

* rm prints, make import work

it's just `import seth` because this file runs from the perspective
of being inside the package. `from manticore.seth` doesn't work
because manticore.py gets priority over the manticore package, and
there is no seth entity inside manticore.py

* rm wip cli file

* add excess printing as a big comment

* print minimal report

* require .sol only

* rm solidse again

* rm fluff

* evm: Make 'not enough funds' states finalized states (#636)

* print on every

* terminate not enough fund states

* Better check

* revert debug change

* Implement initial evm workspace, fix small bugs (#638)

* print on every

* save the bytecode to look at later

* update tuple

* wip workspace files

* wip

* generate tx files

* rm unused event handler

* clean up solving for tx.data

* Revert "print on every"

0caaae3658a169c9763c51544aa3c79a4e3940ca

* Detectors () (#637)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* Code review

* Code review

* Code review

* Initial detector plugin. integer overflow and unitialized mem

* Better metadata handling and new events for detectors

* detectors wip

* Better name for internal findings context

* Explicit detector register

* review

* Refactor concolic implementation (#601)

* Refactor concolic.py

* make arg name more descriptive

* A few cleanups

* Keep track of traces

* Added perm() description

* Rm meaningless paths variable

* little comment

* rm bug comment

trace set is the correct solution; we need to filter out satisfiable but
redundant paths that are generated by the dumb permuter

* clean comments, debug stuff

* Better EVM workspace output (#641)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* Code review

* Code review

* Code review

* Initial detector plugin. integer overflow and unitialized mem

* Better metadata handling and new events for detectors

* detectors wip

* Better name for internal findings context

* Explicit detector register

* review

* New workspace output

* Fix examples

* wrog merge fix

* Fix examples/new api

* Fix examples/new api/output

* More output

* More doc

* Broken examples deleted

* Debug code removed

* Wrong docstring

* Update evm __main__

* Update evm __main__

* Update evm __main__

* Update evm __main__

* Update evm __main__

* Fix TODO

* Fix for issue #642 (#643)

* version argument in manticore

* Fix 591 - Exception Handler

* Issue 597 - Remove the unused policy argument

* fix issue 642

* Fix z3 oddity: reset vs optimization (#627)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Mitigates the wrong objectives print in z3 4.4.x

* Exception to SolveException

* Fix compilation bug (#645)

* fix for #608 using a local definition (#644)

* refactor logs files content (#646)

- if no logs just print nothing
- output any printable bytes in the memlog as a convenience in case they logged strings
2017-12-21 17:02:44 -05:00
Yan Ivnitskiy
b8ea5226d7
0.1.6-related cleanups (#659)
* rename .runtime_bytecode to .bytecode

* init_bytecode -> init.bytecode

* clearer language

* Consistent returns, arguments; added address property

* docstring cleanup

* Fix spelling; remove extra result capture
2017-12-21 14:18:09 -05:00
Mark Mossberg
6b794fecaa
eth int overflow: tests, mul support (#656)
* Move algorithm into ManticoreEVM

* Rm buggy unused line

* Initial eth testing setup

* Check for overflow in mul also

* clarifying comment

* Install solc for travis

* Add sudo

* x

* Rm travis_retry, since we rarely actually use it, and it's not available in this script for some reason

* Check for specific findings

* Fix test

* Clean up transaction firing logic

* Use less strict check, better for floating point
2017-12-21 12:54:24 -05:00
Mark Mossberg
aac83ada10
Add error handling to solc wrapper (#651) 2017-12-20 13:55:17 -05:00
Mark Mossberg
cc8ee5685e
Improve evm cli output (#652)
* Replace starting text

* Use warning logger for detector warnings!

* Uniformity bt linux and evm

* clean up suppress hack

* Prettify output

* minor
2017-12-20 13:54:56 -05:00
Feist Josselin
95967f84df Seth: Fix uninitialized address in _generate_testcase_callback (#650) 2017-12-19 12:47:10 -05:00
Yan Ivnitskiy
591d7b81d5 EVM logging cleanup (#647)
* make init_logging() idempotent

* Update logger names; add plugin logger

* Add logging support to main

* Start tracking completed transactions as part of ManticoreEVM

* Make evm and non evm output more consistent

* Remove redundant start_workers

* make debug output conditional in Manticore

* Improve seth logging

* Add seth to logger lists and make sure new loggers are initialized

* Make completed_transactions not lie during the processing of one

* Print coverage after processing a transaction

* Demote starting msg to debug
2017-12-18 16:06:44 -05:00
Mark Mossberg
6dd50da350
refactor logs files content (#646)
- if no logs just print nothing
- output any printable bytes in the memlog as a convenience in case they logged strings
2017-12-18 12:00:01 -05:00
ggrieco-tob
833ef4af2f fix for #608 using a local definition (#644) 2017-12-15 16:57:02 -05:00
cole-lightfighter
670076c855 Fix compilation bug (#645) 2017-12-15 16:53:54 -05:00
feliam
9839cbdbb0 Fix z3 oddity: reset vs optimization (#627)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Mitigates the wrong objectives print in z3 4.4.x

* Exception to SolveException
2017-12-15 14:45:30 -05:00
Srinivas P G
aabfecfe77 Fix for issue #642 (#643)
* version argument in manticore

* Fix 591 - Exception Handler

* Issue 597 - Remove the unused policy argument

* fix issue 642
2017-12-15 12:13:00 -05:00
feliam
db80685758
Better EVM workspace output (#641)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* Code review

* Code review

* Code review

* Initial detector plugin. integer overflow and unitialized mem

* Better metadata handling and new events for detectors

* detectors wip

* Better name for internal findings context

* Explicit detector register

* review

* New workspace output

* Fix examples

* wrog merge fix

* Fix examples/new api

* Fix examples/new api/output

* More output

* More doc

* Broken examples deleted

* Debug code removed

* Wrong docstring

* Update evm __main__

* Update evm __main__

* Update evm __main__

* Update evm __main__

* Update evm __main__

* Fix TODO
2017-12-15 02:17:41 -03:00
feliam
4b79711b92
Detectors () (#637)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* Code review

* Code review

* Code review

* Initial detector plugin. integer overflow and unitialized mem

* Better metadata handling and new events for detectors

* detectors wip

* Better name for internal findings context

* Explicit detector register

* review
2017-12-12 14:56:39 -03:00
Mark Mossberg
df9af1fd12
Implement initial evm workspace, fix small bugs (#638)
* print on every

* save the bytecode to look at later

* update tuple

* wip workspace files

* wip

* generate tx files

* rm unused event handler

* clean up solving for tx.data

* Revert "print on every"

0caaae3658a169c9763c51544aa3c79a4e3940ca
2017-12-11 16:14:06 -05:00
Mark Mossberg
7ea30192a1
evm: Make 'not enough funds' states finalized states (#636)
* print on every

* terminate not enough fund states

* Better check

* revert debug change
2017-12-11 11:36:30 -05:00
Mark Mossberg
3f0441148f
Initial eth cli based on solidse.py (#633)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* initially evm cli from solidse.py

* rm prints, make import work

it's just `import seth` because this file runs from the perspective
of being inside the package. `from manticore.seth` doesn't work
because manticore.py gets priority over the manticore package, and
there is no seth entity inside manticore.py

* rm wip cli file

* add excess printing as a big comment

* print minimal report

* require .sol only

* rm solidse again

* rm fluff
2017-12-08 11:15:03 -05:00
feliam
ed29a22fce
EVM refactor and simple UI (#629)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review
2017-12-07 20:19:16 -03:00
Daniel Bolognino
764151de71 Emit .input instead of .txt files in workspace (#625)
Related: #612 

* Update workspace.py

Changed extension to .input

* Update test_workspace.py

* changed key value pair in test_workspace bc of change of extension to .input in workspace.py, fixed issue #618

* removed unwanted directories

* Update seth.py

* Update seth.py

Change in Documentation issue #612
2017-12-06 18:51:20 -05:00
Arun John Kuruvilla
c6902d7265 Hide legacy cli flags from cli help (#622)
* Fixed Issue #533

* Removed --replay argument from cli help. Issue #617

* Update help description

* Remove unused --size flag
2017-12-05 10:41:38 -05:00
Arun John Kuruvilla
e63838d204 Fixed Issue #619 (#623)
Add newlines in .trace file generation
2017-12-04 17:53:19 -05:00
Yan Ivnitskiy
be0141e501
Amend pr guidelines (#615) 2017-12-01 16:14:56 -05:00
Arun John Kuruvilla
77b0542b83 Fixed Issue #533 (#606)
* Remove Platform._path
2017-11-30 10:16:08 -05:00
feliam
9c777e6d2b
EVM api refactor (#589)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor
2017-11-29 19:00:49 -03:00
feliam
3a63402ae5
EVM assembler/disassembler doc and cleanup (#563)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* EVMasm refactor
2017-11-29 13:22:16 -03:00
awr|arr
e50cc6b9b2 Log unimplemented instructions (issue 163) (#599)
* Remove double printing of exception.

* Pretty print the unimplemented instruction raised by unicorn (UcError).

* Raise exception after unimplemented instruction error logging.

* Ensure the raised exception is actually a unicorn invalid instruction error.

* Resolve conflict
2017-11-28 19:18:12 -05:00
Yan Ivnitskiy
481e41991d
Centralize system call logging (#602)
* Remove per-syscall logging

* Make Cpu.read_string() stop reading at first symbolic byte

* Centralize syscall logging

* Update helper docstring

* Update arg/ret expansion

* Check for issymbolic first

* Tiny hex format change
2017-11-28 18:36:33 -05:00
Yan Ivnitskiy
3c7d92bfcd
Trace following mode (#513)
* WIP New Policy class

* WIP pubsub

* Update Signal tests

* small fixes from github comments

* Fix event decode_instruction signature

* Good merge

* Good good merge

* WIP manticore refactor

* Fix default old-style initial state

* add -> enqueue

* @m.init

* Fix workspace url

* Some test skipped

* Ad Fixme to platform specific stuff in State

* add -> enqueue

* Enqueue created state

* Fix m.init

Use a messy hack to adhere to the spec (callback func receive 1 state argument)

* Add _coverage_file ivar to Manticore

* Fix symbolic files

* remove extra enqueue

* Fixing __main__

* comments

* Experimental plugin system

* tests fixed

* Fix plugins

* Some reporting moved to plugin

* Fix assertions test

* Add published events to classes that publish them

* Update how we verify callbacks

* Update Eventful._publish

* Yet another flavor for event name checking

* really it's a bunch of minimal bugfixes

* Remove get_all_event_names from Plugin

* Update where we get all events

* Use new metaclass-based event registry

* Initial concrete trace follower

* Add extended (json) trace support

* More stubs for condition gather

* Update trace saving to new format

* Produce trace regardless of contents

* Record register deltas in trace

* Move initialization to _start_run so we can call run() multiple times

* Re-fix multiple workspace bug

* Fix it correctly

* Add extended trace and accessors

* make sure did_execute_instruction is always published

* Produce a consistent version

* move extended tracing to separate class

* Reorg of extended tracing plugins

* Add concolic tracing script

* Clean up old hooks

* Sync memory as well; cleanups

* Revert binary tests

* simplify concolic follower

* Move trace follower to plugin.py

* Simplify follower

* Add skip ranges to Follower

* Update concolic.py

* Remove redundant state init

* Clean up driver script

* Update header line

* Move trace follower

* Move Follower to follow_trace.py

* rm unused import

* Remove unnecessary property

* rm ConcreteTraceFollower

* Revert start_run behavior
2017-11-28 18:14:03 -05:00
Garret Reece
88b213de7e
Fixes to thumb mode instruction implementations
* Thumb specific fixes to the SUB, BX, and MOV instruction implementations
* implemented hardcoded result for gettid syscall
2017-11-28 16:46:19 -06:00
Srinivas P G
d98ef22251 Fix Issue: 597 - Remove unused policy argument in function State.solve_n (#598)
* version argument in manticore

* Fix 591 - Exception Handler

* Issue 597 - Remove the unused policy argument
2017-11-27 18:13:13 -05:00
Srinivas P G
ce888766cd Fix for issue 556 and 591 (#590)
* version argument in manticore

* Fix 591 - Exception Handler
2017-11-22 16:18:45 -05:00
cole-lightfighter
fccf451406 Assert valid operand length (#558)
* Assert valid bytecode and operand length

EVM bytecode comes in 32-byte chunks, and contracts require at least one
segment to be created. An example, originally written by @ggrieco-tob in issue #546, is included.
Unsure what expected behavior should be, but initial state has a problem when a contract is
created with a single byte.

Also added some exception handling in `parse_operand()` to catch invalid
instructions, e.g. a PUSH1 instruction followed by no bytes.

Signed-off-by: Cole Lightfighter <cole@onicsla.bz>

* Fix SLOAD invalid memory access

Simple check to ensure address storage is in global_storage before
attempting to load data.

* Remove invalid assertions
2017-11-21 15:56:00 -03:00
Sidhant Gupta
fbe70f1bc5 Updating README with solc binary requirements (#575)
* Updating README with solc binary requirements

* Update README.md
2017-11-20 17:44:19 -05:00
Sidhant Gupta
5c52fcaf54 Updates travis cache to python 2.7.13 (#576) 2017-11-20 16:06:57 -05:00
Dushyanth Chowdary
652c99b471 Manticore prints linux ret code as uint instead of int (#578)
* Fixing raise issue #435

* syncing git

* Fix Bug #570

* syncing

* removed all binaries

* missed one file
2017-11-20 16:04:34 -05:00
Mark Mossberg
1dbf40ea8e
Add UMD simple assert example (#573) 2017-11-20 15:35:32 -05:00
Mark Mossberg
35d8fce9df
Only really fork when there's multiple solutions (#569) 2017-11-17 12:40:30 -05:00
ggrieco-tob
0e4e9a49e2
Added missing syscalls in decree syscall trace (#545)
* added missing syscalls in decree syscall trace

* added missing parameter in callback of BranchLimited policy
2017-11-14 17:18:31 -03:00
awr|arr
352b9ba48d Fix typo per issue #552 - s/arm64/amd64/ (#561) 2017-11-14 15:10:14 -05:00
HighW4y2H3ll
8002a1d682 Add PCMPXSTRX Instructions (#507)
* Add PCMPXSTRX Instructions

* bug fixes

* unittest related fixes

* Full test of pcmpxstrx

* Move tests
2017-11-14 16:39:51 -03:00
feliam
94d2e94bf1
New API for EVM analysis (#551)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes
2017-11-14 12:06:08 -03:00
cole-lightfighter
b13a8c0c24 Fix SLOAD invalid memory access (#562)
Check global_storage includes an entry at address before trying to load
storage.
2017-11-14 10:34:18 -03:00
Mark Mossberg
d9b54675c5
Handle file.tell() error, which will happen for special files (/dev/tty) (#559) 2017-11-13 18:30:23 -05:00
cole-lightfighter
08f86cc892 [fix] Issue #550: generates extra workspace folder (#557)
* [fix] Issue #550: generates extra workspace folder

Signed-off-by: Cole Lightfighter <cole@onicsla.bz>

* Slight workspace and store refactor
2017-11-13 12:20:57 -05:00