319 Commits

Author SHA1 Message Date
Mark Mossberg
d83fa737a7 Create CONTRIBUTING.md (#481)
* Create CONTRIBUTING.md

* Update CONTRIBUTING.md

* Update CONTRIBUTING.md
2017-09-06 18:11:22 -04:00
Yan
7679773088 Update examples (#477)
* Use locked_context() in count_instructions example

 * We use this example on the front page, and it currently generates
   a flood of warnings.

* Update example indeces

* Remove dump_stats()

* Remove extra comments

* Remove redundant comments
2017-09-01 17:05:43 -04:00
Yan
9b8ef3cd76 Concretize stdout in state summary (#478) 2017-09-01 16:31:50 -04:00
JP Smith
0cd2560138 Update Manticore docstring (#476)
* update Manticore docstring

* fix type docstring
2017-09-01 11:43:29 -05:00
JP Smith
d5d22a8aaf Allow Manticore initialization with State object (#475) 2017-08-31 16:44:43 -05:00
feliam
f9b02bd194 New Policy class (#368)
* New Policy class

* Move visited to Policy - Fix contexts

* Add BranchLimited

* signals -> events for branchlimited
2017-08-31 12:48:55 -04:00
JP Smith
c6f8fd1291 initialize executor at manticore initialization (#471) 2017-08-31 10:16:52 -05:00
Yan
ca0d7b60d2 Add basic socket support (#428)
* Add a descriptor class for socket(2) return values

* Add basic socket(2) and bind(2)

* Basic accept(2)

* Basic recv(2) support

* Debug statements and accept(2)

* Add check for symbolic arg to open(2)

* Fix an example warning

* send/sendfile

* debug->info for some mcore output

* Produce socket data as part of state serialization

* Clean up SLinux.sys_open()

* Document socket(2) peculiarities
2017-08-29 17:00:17 -04:00
Theofilos Petsios
a025bda97a Updated visualization plugin with coverage info & live update option (#444)
* plugin rearrangement and UI options

* Live update and clear options

* coverage stats

* added check for xref address

* coverage in separate option as BackgroundTaskThread

* license cleanup
2017-08-23 17:47:23 -04:00
JP Smith
60a99d2f81 Seed random on policy init to make results deterministic (#466)
* seed random on policy init to make results deterministic

* document new random behavior
2017-08-23 16:37:26 -05:00
Theofilos Petsios
1b653be9b3 Basic Caching for Binja IL (#467)
* basic caching (wip)

* moved execute in binja and cleanup of self.instruction refs

* did_emulate_insn and get_current_llil_func renaming

* refactor for hasattr
2017-08-23 14:46:17 -04:00
Theofilos Petsios
b32379d3d4 did_execute_instruction nit (#468) 2017-08-21 23:03:47 -04:00
Mark Mossberg
d3d1e9c924 Manticore 0.1.4 (#462)
* Bump version number

* Changelog updates

* Include changes to undocumented functionality, but mark as experimental

* Function notation

* Update CHANGELOG.md

* thanks!!!
2017-08-18 13:48:33 -04:00
Mark Mossberg
604de56cfd Update readme (#461)
* No more partial arm

* windows unmaintained :(( and bye pip

* Move dev install insns to wiki, no need to clutter README
2017-08-18 11:12:14 -04:00
Theofilos Petsios
715cc436c7 Abstract Disassembler classes and Binja CPU + Platform (#364)
* adding abstract disasm class

* before adding abstract insn

* explicit capstone use

* (wip) removing capstone

* debugging nose

* removed disassembler from constructor

* nits

* capstone->cs and nits

* basic memory (wip)

* tmp

* added binja dissasm

* fixed execution pipeline - calling LLIL instructions

* updated parseargs to select disassembler

* unstable (disassembler at CPU constructor breaks tests)

* disasm fix for tests

* nit for aliases in x86

* added a flag to differentiate disassembly and IL-disassembly for binja

* before merging

* merging with dev-events master

* fixed signal forwarding for binja

* cleaner initialization

* Binja RegisterFile. Dropped Platform

* address fixup

* properly incrementing PC

* some work on XOR, SET_REG, REG, CONST, AND, PUSH, POP

* adding first CALL, JMP, LOAD (wip)

* JUMP fix

* GOTO and misc fixes in PC handling

* adding instructions (wip)

* fixing flags and sizes (wip)

* loading database if exists for faster analysis

* fix for register debug

* fixes for register sizes and flags

* FIX for multiple IL instructions sharing the same PC

* removed CONST_PTR and misc fixes

* RET, SHR, shift left & misc instructions, fixing insn sizes (wip)

* flag fixes

* ctypes 2's complement parsing

* JUMP_TO, SYSCALL

* syscall fixups and flag computation using binja il only

* FLAG, NEG, CMP(family) of LLIL, some unimplemented methods

* MUL, DIV

* cmpxchg

* MUL, IMUL, ROR, ROL

* fallback to capstone for all LLIL_UNIMPL and LLIL_UNIMPL_MEM

* fixes for registers and memory when switching CPUs

* check for binja to disable multiprocessing

* merging

* nit

* hack for serialization

* moved check for disassembler to Manticore from __main__

* removing __class__ refs

* cleanup from __class__.disasm

* size calculation from get_instruction_low_level_il

* fix for NEG, check for empty queue, execute refactor

* fixes for LLIL functions

* removal of redundant regfile writes

* nit fixes

* function overrides in Cpu classes and orphan printf cleanup

* nit

* incomplete merge

* verbosity temp mod

* cleanups of FIXMEs

* 2-stage constructor for disassembler

* cleanup binja refs in abstractcpu

* serialization for platform_cpu

* check for UNIMPL in all the il queue

* typo fix

* fix for arm

* typo correction and starting caching implementation

* restored register printing and fixed import in x86.py
2017-08-17 17:43:27 -04:00
Mark Mossberg
f9489d3249 Document Manticore.locked_context API (#460)
* Add locked_context to documented APIs

* Initial
2017-08-17 16:50:21 -04:00
Mark Mossberg
22974ca65e Add gotchas docs (#459)
* Add gotchas docs

* always
2017-08-17 16:48:59 -04:00
Garret Reece
5d87fc83b3 Instructions and tests to support issue binary for issue #182 (#403)
* orn instruction plus unit test
* uadd8 and it instructions implemented
* SEL instruction implementation
* GE flag set by UADD8
* IT instruction condition code properly no longer prevents its execution
* support for multiple instruction tests added to testing setup
* unit test for SEL instruction
* cleaned up the tests for thumb instructions
* implemented sxth and rev instructions
* implemented tests for sxth and rev instructions
* updated the add implementation to support two operand variant (i.e., add r4, #4)
* added test for itete ne instruction
2017-08-17 10:02:44 -05:00
JP Smith
7bb64fe26e fix trace-saving behavior (#454) 2017-08-15 10:50:46 -05:00
Theofilos Petsios
09bb702fac Implement logging presets (#445)
* logging template nits

* moved logging outside Manticore

* naming fix and exposed API call

* logging -> log renaming

* fix for verbosity test

* restored setter/getter for verbosity

* fixes for warnings in 0 mode and exteneed test_cli_verbosity

* removed print

* relative import, fork message to executor, init function

* verbosity docstring fix

* docstring nit
2017-08-14 16:05:29 -04:00
Mark Mossberg
1d8e051522 Fix state.generate_testcase (#451)
* Use correct event name

* Add test for state.generate_testcase

Test merely tests that this function publishes the 'will_generate_testcase' event

* Properly test; make sure the callback executes and error if not

This is the most convoluted unit test I've ever written.

* "better"
2017-08-14 14:44:53 -04:00
Yan
36a58810f9 Use the same workspace URI in Executor.__init__ (#443)
* Make sure we're using the same workspace

* create_store -> fromdescriptor

* classmethod -> cls variable

* Cache descriptor name

* join -> format

* Update Store docs
2017-08-10 15:07:53 -04:00
Mark Mossberg
e78ae8904e Add Manticore version to issue template (#447)
* Add Manticore version to issue template

* Update ISSUE_TEMPLATE.md
2017-08-10 15:06:51 -04:00
Mark Mossberg
eef3cd20e2 Implement state.generate_testcase (#438)
* ran

* Some dirty work

* Rm unnecessary sanitization

* Fix state.generate_inputs event publishing

We don't need to manually pass `self` because State is automatically
forwarded as an argument. Also correctly specify a message for the state
and expose to the API

* Rename

* Update test for new save_testcase args, make test more robust

* Simplify arguments related to generate_testcase_callback by removing default arg. Add test for this behavior

* Minor test fixup

* Add official API docs

* Remove unnecessary new event type
2017-08-08 18:12:55 -04:00
Mark Mossberg
9ae76a4430 Fix testcase generation output (#436) 2017-08-07 08:08:37 -07:00
Dushyanth Chowdary
68555f5234 Fixing raise issue #435 (#437) 2017-08-04 18:27:15 -07:00
JP Smith
af3020db95 log testcase generation (#430) 2017-08-04 17:18:45 -04:00
Mark Mossberg
7b832724a6 Implement symbolic branch tracking in core, add new fork event (#433)
* Add fork_state event for individual state forks

* Rename to forking_state, add branch tracking to state

* Remove unnecessary locking around event publishing
2017-08-03 14:13:40 -07:00
Yan
5ad18e736c Produce fork-related output at info level from mcore (#429) 2017-08-02 17:31:29 -04:00
feliam
3b57c0d502 Fix context serialization (#425)
* Fix context serialization

* Fix test models.  Can not set a state constraints

* typo

* A few typos (constraints setter) and use of public properties in internal methods

* State __init__ needs to initialize platform constraints

* Internal methods use internal properties

* test_record_branches removed
2017-08-01 14:08:54 -03:00
JP Smith
271400728c remove state.generate_inputs (#385) 2017-07-31 14:39:47 -04:00
Eric Hennenfent
51837df98b Add Taint Parameters (#414)
* Add taint args to buffer creation

Allows the `new_symbolic_buffer` and `symbolicate_buffer` functions to take keyword args for tainting. Defaults to frozenset in both cases.

* Add unit tests and ArrayProxy taint propery

Adds simple unit tests for tainted buffers. Added a property to the ArrayProxy class in smtlib.expression so that it's possible to access the taint of the proxied ArrayVariable.

* Updated docstrings
2017-07-28 11:58:25 -04:00
feliam
76357216da Pub-sub like events (#371)
* WIP New Policy class

* WIP pubsub

* Update Signal tests

* small fixes from github comments

* Fix event decode_instruction signature

* Good merge

* Good good merge

* Eventful class commented

* The million typos

* Code revision

* Fix tests for new mor strict Eventful
2017-07-27 19:41:08 -03:00
JP Smith
a3cf6e7d2c Fix warning during regular analysis (#420)
* only make context warning appear when appropriate

* implement felipe's suggestion
2017-07-27 12:31:58 -04:00
JP Smith
d1ead7a7be remove naked print from executor.py (#410) 2017-07-21 16:03:26 -04:00
JP Smith
8d19dc507d Fix solver call in decree (#409) 2017-07-21 15:34:33 -04:00
JP Smith
d9c226b89d Fix forking state from memory (#407)
* import ForkState before use

* Fix ForkState behavior
2017-07-20 16:02:13 -04:00
JP Smith
7f54a4342c Make makeDecree conform to convention and fix --data (#402)
* fix makeDecree to work with scripting

* fix concrete_data
2017-07-19 10:51:31 -04:00
JP Smith
74bd5ed832 remove grr snapshot support (#400) 2017-07-18 17:25:17 -04:00
JP Smith
344ade98ee Add optional redis dependency to setup.py (#399)
* add optional redis dependency to setup.py

* update installation documentation

* clarify docs and add redis to dev install
2017-07-18 16:34:37 -04:00
Frank Busse
be2494df44 Expose symbolic files to command line interface, implement whence for symbolic seek (#394)
* add --file <symbolic file> flag

* fix seek argument count error, add rudimentary whence support

* symbolic file seek: fix docstring and semantics
2017-07-18 11:38:41 -04:00
JP Smith
47a5d9752f Make save_stream pass through kwargs (#396)
* make save_stream pass through kwargs

* make base save_stream ok with extra [kw]args

* make key argument explicit
2017-07-17 14:06:42 -04:00
JP Smith
ddc3b12848 Fixed CHANGELOG.md typo (#395) 2017-07-17 10:36:31 -04:00
JP Smith
97115212e1 add pypi badge to README.md (#391) 2017-07-14 18:01:14 -04:00
JP Smith
4bb48af199 Manticore 0.1.3 (#390)
* Manticore 0.1.3

* fix compare URL
2017-07-14 11:56:21 -04:00
JP Smith
13964d053b create workspace before running manticore to make memdump tests pass (#388) 2017-07-13 13:57:18 -04:00
Mark Mossberg
03ee876005 Add basic documentation on function modeling (#386)
* Add basic models docs

* Phrasing

* Minor fixes
2017-07-13 11:57:07 -04:00
JP Smith
60fa4c2231 Fix memdump tests broken by dev-events (#377)
* fix memdump tests broken by dev-events

* switch to superset check to account for timeout differences
2017-07-12 18:11:08 -04:00
Yan
45d5b9f6d2 New state serialization (#376)
* Fix naming

* Separate storage from workspace

* Begin removing output generation from manticore.py

* Split up workspace and output

* Create a separation between output and workspace

* Get it to a working (hacky) state

* Start bringing state serialization into workspace

* More mcore->workspace moves

* Remove unused imports

* Update serializers; add interface

* move state saving to workspace

* can now save/load states and testcases

* Add redis as backend

* Implement streams in terms of values and vice versa

* Implement `ls` and move workspace loading to Workspace

* Better workspace initialization

* Fix how --workspace is parsed for tests

* update tests to new workspace indexes

* Fix state storage and handling

* Doc updates and extra error checking

* pep8 style changes

* Add Executor's 'sync'

* Remove previous workspace artifacts from Executor

* Comment out constraints check assert

* Centralize locking to new testcase ids

* Fix testcase generation

* pep8 updates

* propagate descriptor instead of path

* Add an in-memory state store

* Make memory maps be sortable

* Allow to produce an empty state

* Add workspace tests

* Make Memory.__cmp__() more robust
2017-07-12 17:50:24 -04:00
JP Smith
f134ad6fb4 Check for negative fds in fstat (#384)
* check for negative fds in fstat

* use _get_fd
2017-07-11 16:02:32 -04:00