32 Commits

Author SHA1 Message Date
Mark Mossberg
3f0441148f
Initial eth cli based on solidse.py (#633)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* initially evm cli from solidse.py

* rm prints, make import work

it's just `import seth` because this file runs from the perspective
of being inside the package. `from manticore.seth` doesn't work
because manticore.py gets priority over the manticore package, and
there is no seth entity inside manticore.py

* rm wip cli file

* add excess printing as a big comment

* print minimal report

* require .sol only

* rm solidse again

* rm fluff
2017-12-08 11:15:03 -05:00
feliam
ed29a22fce
EVM refactor and simple UI (#629)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review
2017-12-07 20:19:16 -03:00
feliam
9c777e6d2b
EVM api refactor (#589)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor
2017-11-29 19:00:49 -03:00
feliam
3a63402ae5
EVM assembler/disassembler doc and cleanup (#563)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* EVMasm refactor
2017-11-29 13:22:16 -03:00
cole-lightfighter
fccf451406 Assert valid operand length (#558)
* Assert valid bytecode and operand length

EVM bytecode comes in 32-byte chunks, and contracts require at least one
segment to be created. An example, originally written by @ggrieco-tob in issue #546, is included.
Unsure what expected behavior should be, but initial state has a problem when a contract is
created with a single byte.

Also added some exception handling in `parse_operand()` to catch invalid
instructions, e.g. a PUSH1 instruction followed by no bytes.

Signed-off-by: Cole Lightfighter <cole@onicsla.bz>

* Fix SLOAD invalid memory access

Simple check to ensure address storage is in global_storage before
attempting to load data.

* Remove invalid assertions
2017-11-21 15:56:00 -03:00
Mark Mossberg
1dbf40ea8e
Add UMD simple assert example (#573) 2017-11-20 15:35:32 -05:00
feliam
94d2e94bf1
New API for EVM analysis (#551)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes
2017-11-14 12:06:08 -03:00
feliam
08e8c3b7d8 Fix coverage calculation vs. metadata (#529)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code
2017-10-23 17:45:01 -03:00
feliam
a9ad183354 Fixes symbolic reentrancy example (#528) 2017-10-20 16:43:22 -03:00
feliam
8591bff45f EVM support (#521)
* WIP New Policy class

* WIP pubsub

* Update Signal tests

* EVM support - Wip

* EVM support - dependencies fixed

* EVM support - fix decree merge

* fix decode instrucion event

* Fix small bugs in evm opcodes (too many arguments + wrong LOG name) (#380)

Fix wrong call parameters + typo

* Fix Create/Call

* Fix depth

* Default fixed point in arithmetic simplifier

* small fixes from github comments

* Fix event decode_instruction signature

* wip wip

* Auto tests for evm

* New EVM tests

* Ran 9556  FAILED (failures=166, errors=8, skipped=62)

* Fix some arithmetic instructions

* Ran 9556  FAILED (failures=136, errors=8, skipped=62)

* More instructions - Optimizing symbolic memory

* Added gas to opcodes description - FIX DELEGATECALL POPS

* Add wip wallet example

* The tests

* Solidity constructors need argument after bytecode

* Simple integer overflow working

* Good merge

* Good good merge

* WIP manticore refactor

* Fix default old-style initial state

* context now working

* Fix context serialization

* Fix test models.  Can not set a state constraints

* typo

* A few typos (constraints setter) and use of public properties in internal methods

* Fix init wallet example

* State __init__ needs to initialize platform constraints

* Internal methods use internal properties

* Better attack modeling

* Better example layout

* Storage backup on CALL is now faster .. and correct

* Add LOG support

* Minimal SE test

* Added examples

* Send ether bugfix

* EVM: Fix wrong balance destination on CALL + decrease caller balance on CREATE

* New balance management

* Trying to maintain known hashes

* Known hash concretization policy

* CALLDATA max size bugfix

* Minimal SE example

* Remove evm tests

* add -> enqueue

* @m.init

* Fix workspace url

* Some test skipped

* Ad Fixme to platform specific stuff in State

* add -> enqueue

* Enqueue created state

* Fix m.init

Use a messy hack to adhere to the spec (callback func receive 1 state argument)

* Add _coverage_file ivar to Manticore

* Fix symbolic files

* remove extra enqueue

* Fixing __main__

* comments

* Fix visitors oddity

* setup merged

* remove duplicates and add pysha3

* Remove EVMTests import

* Refactor platform specific code out of ManticoreOutput (#505)

* Initial moving work

* Clean

* Make linux.generate_workspace_files work

* Fix

* clean

* Add test

* Test workspace for platform files

* Skip EVM cpu pretty print

* Remove bad import

* Fix coverage.py for testing

* Clean comment

* Comment hack

* Print evm cpu

* pretty print evm world instead of platform

* delet old scripts/examples

* delet old tests

* Remove z3 install script

* Array.max_size can be None, include check for that

* Rm unused _symbolic_files

add_symbolic_files was moved to linux, so this is not needed

* Rm unused args

* Import evm

* Rm dup function

* Rm stray prints

* Add docs for new classmethod apis

* minimal

* minimal example

* fix minimal

* Fair symbolic SHA3 handling

* Simple mapping example

* coverage example

* fix tests

* fix minimal

* Some eko fixes

* New SETH

* integer_overflow refactored

* Fixing the examples

* init_bytecode -> init
'

* Concrete reentrancy exampole

* concrete reentrancy selfdestruct

* Update minimal.py

* It's a new Minimal

* Integer overflow example

* New minimal

* minimal fix

* Examples last minute fixes

* Remove debug print

* add plugin.py

* Fixing event subscription

* remove temp params

* Remove param

* Update uncovered will_exec callback prototype

* Clean up debug output

* Automatically generated intruction tests

* Uninplemented instruction test removed

* Unused concretization policy removed

* Fixes enabling default bplugins

* solc from PATH

* Removed unused import

* Logger name updated
2017-10-17 19:47:20 -03:00
Yan
7679773088 Update examples (#477)
* Use locked_context() in count_instructions example

 * We use this example on the front page, and it currently generates
   a flood of warnings.

* Update example indeces

* Remove dump_stats()

* Remove extra comments

* Remove redundant comments
2017-09-01 17:05:43 -04:00
Yan
ca0d7b60d2 Add basic socket support (#428)
* Add a descriptor class for socket(2) return values

* Add basic socket(2) and bind(2)

* Basic accept(2)

* Basic recv(2) support

* Debug statements and accept(2)

* Add check for symbolic arg to open(2)

* Fix an example warning

* send/sendfile

* debug->info for some mcore output

* Produce socket data as part of state serialization

* Clean up SLinux.sys_open()

* Document socket(2) peculiarities
2017-08-29 17:00:17 -04:00
JP Smith
5109e2835f Fix building linux examples and test for future failure (#284)
* fix building linux examples and test for future failure

* fix cd back and typo
2017-06-14 11:23:55 -04:00
JP Smith
124c9d6de5 Add manticore-examples to README and remove google challenge (#271)
* add manticore-examples to README and remove google challenge

* re-do usage section and add manticore-examples repo
2017-05-24 16:09:48 -05:00
Mark Mossberg
a10b7bae29 Update parallel processing api (#246)
* Remove m.workers, add run(procs=), update docs

* Update docs
2017-05-10 19:44:55 -04:00
Cory Duplantis
b8991e0c64 Add Google2016 unbreakable challenge to examples repo (#194)
* Add Google2016 unbreakable challenge to examples repo

* Add Google2016 unbreakable challenge to examples repo

state.add instead of state.constraints.add

* Update constraints API
2017-05-09 18:35:38 -04:00
feliam
b19a158b6f Clean and document some example/linux (#176)
* Clean arguments.c

* Increase query timeout from 30 to 120 seconds

* Example documentation updated

* Add ibranch comments

* crackme.py, ibranch, sindex and typos

* indexhell

* visitad typo

* typo

* strncmp example

* Typos
2017-05-02 17:04:07 -04:00
Mark Mossberg
fbe3a197ba Install instructions updates (#171)
* Install instructions updates

* Update README.md

* also need pip

* need to update, plus compact a few things

* add -y

* grammar?

* typos

* Add bountysource link

* consistency

* Point users to the examples dir and wiki

I thought these links were cluttering things a bit, and 2 out of 3 of
them aren’t official documentation yet we’re linking to them in the
first line of the README. I updated the wiki to address these directly
in a way I think is more clear.

* link to Z3 releases

* oops, don't know where that came from

* ensure people run the latest pip

* be more explicit

* Add an Issue Template

* be more explicit

* no longer appropriate here

* unnecessary

* add note about 16.04

* move issue template to hidden folder

* Spelling

* be explicit, makes copy/paste easier
2017-04-24 12:19:10 -04:00
Mark Mossberg
f552383e16 Add example taint usage (#161)
* Add example taint usage

- use new_symbolic_value API instead, because it's making an int symbolic
- add every instruction hook that checks for tainted data in operands

* update readme with taint example
2017-04-21 14:59:06 -04:00
Yan
daab8a5824 Add examples (#145)
* intermediate example commit
* Added more state_explore examples (w/ new_symbolic_buffer)
* Actually comment out verbosity
* rename
* Add comment mentioning symbolicate_buffer
* Update comments
* Fix issue with limited exploration
* Clear up wording
* Update descriptions
* Remove reference to symbolicate_buffer
* Clean up state_explore.c header
* move .c to src/
2017-04-19 14:12:58 -04:00
Yan
5c112e56f3 Add brief example descriptions to README (#120)
* Added brief example descriptions to README
* Update config script
* Update sym.py API usage
* Remove individual example descriptions
* fix mcore init
* consistently document examples
* make basic_sym runnable
* More path fixes
* cleanup; update api
2017-04-10 14:31:51 -04:00
JP Smith
1bcadfed4d Add memory corruption example (#124)
* add memory corruption example

* put binary in proper folder
2017-04-06 10:39:45 -05:00
JP Smith
ccd473b88e add partial solves for multiple-styles (#123) 2017-04-06 10:39:07 -04:00
JP Smith
053cc5ff8d Fix run_simple.py (#102)
`Manticore(None, path)` throws an error
2017-03-23 09:52:39 -05:00
JP Smith
e77628bfe7 Add example crackme (#77)
* add example crackme

* make filename and directory structure more accurate
2017-03-17 14:43:06 -05:00
Mark Mossberg
f0069792c3 Misc cleanup: Rm old script, unused executor hooking functions (#38)
* Rm old irrelevant example script

* Make this easier to copy and paste

* Rm old unused executor hooking
2017-03-01 13:47:46 -05:00
Mark Mossberg
d6393cc8a6 Add hook decorator (#28)
* Add m.add_hook test

* Add @m.hook test

* Add `hook` decorator for convenience

* Update readme and examples

* Update run_callback

* Improve `add_hook` docstring

expound on callback structure

* Rm debug print

* Improve docstring
2017-02-27 15:44:33 -05:00
Mark Mossberg
9d3dfec08b Rm helloworld in make clean (#27) 2017-02-24 15:21:28 -05:00
Mark Mossberg
44bf8745a1 m.start -> m.run (#25) 2017-02-22 10:08:35 -05:00
Yan
724db78907 Assign context object to Manticore itself (#13)
* Make Manticore behave like a dict; slim callback
* Update all sample scripts to not take a context
* Add a sample script (count_instructions.py)
* We no longer need to close over Manticore state; add callback directly
* Move Manticore's context to a public attribute
2017-02-15 14:48:55 -05:00
Yan
dde79a0bab Remove ManticoreControl object [#180] (#4)
* Remove ManticoreControl object
* Some changes were brought in from dev-symbolicate-api
* Add Manticore.terminate()
* Add State.abandon()
* Update sample scripts
* Remove ctl from README
* Fix tests
* Bring in changes from dev-symbolicate-api
* Lower-case wildcard
* string -> cstring
* abandon() docstring
* Rename "name" to "label"
* Remove obsolete comment
* Make NUL a possible value for the last byte of a cstring
* Fix AbandonState and add example binary&script
* name -> label in tests, manticore.py
* Ignore .DS_Store
* Update symbolicate_buffer docstring
2017-02-14 14:54:52 -05:00
yan
badf1ab28e Initial import 2017-02-13 12:04:15 -05:00