313 Commits

Author SHA1 Message Date
Arun John Kuruvilla
77b0542b83 Fixed Issue #533 (#606)
* Remove Platform._path
2017-11-30 10:16:08 -05:00
feliam
9c777e6d2b
EVM api refactor (#589)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor
2017-11-29 19:00:49 -03:00
feliam
3a63402ae5
EVM assembler/disassembler doc and cleanup (#563)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* EVMasm refactor
2017-11-29 13:22:16 -03:00
awr|arr
e50cc6b9b2 Log unimplemented instructions (issue 163) (#599)
* Remove double printing of exception.

* Pretty print the unimplemented instruction raised by unicorn (UcError).

* Raise exception after unimplemented instruction error logging.

* Ensure the raised exception is actually a unicorn invalid instruction error.

* Resolve conflict
2017-11-28 19:18:12 -05:00
Yan Ivnitskiy
481e41991d
Centralize system call logging (#602)
* Remove per-syscall logging

* Make Cpu.read_string() stop reading at first symbolic byte

* Centralize syscall logging

* Update helper docstring

* Update arg/ret expansion

* Check for issymbolic first

* Tiny hex format change
2017-11-28 18:36:33 -05:00
Yan Ivnitskiy
3c7d92bfcd
Trace following mode (#513)
* WIP New Policy class

* WIP pubsub

* Update Signal tests

* small fixes from github comments

* Fix event decode_instruction signature

* Good merge

* Good good merge

* WIP manticore refactor

* Fix default old-style initial state

* add -> enqueue

* @m.init

* Fix workspace url

* Some test skipped

* Ad Fixme to platform specific stuff in State

* add -> enqueue

* Enqueue created state

* Fix m.init

Use a messy hack to adhere to the spec (callback func receive 1 state argument)

* Add _coverage_file ivar to Manticore

* Fix symbolic files

* remove extra enqueue

* Fixing __main__

* comments

* Experimental plugin system

* tests fixed

* Fix plugins

* Some reporting moved to plugin

* Fix assertions test

* Add published events to classes that publish them

* Update how we verify callbacks

* Update Eventful._publish

* Yet another flavor for event name checking

* really it's a bunch of minimal bugfixes

* Remove get_all_event_names from Plugin

* Update where we get all events

* Use new metaclass-based event registry

* Initial concrete trace follower

* Add extended (json) trace support

* More stubs for condition gather

* Update trace saving to new format

* Produce trace regardless of contents

* Record register deltas in trace

* Move initialization to _start_run so we can call run() multiple times

* Re-fix multiple workspace bug

* Fix it correctly

* Add extended trace and accessors

* make sure did_execute_instruction is always published

* Produce a consistent version

* move extended tracing to separate class

* Reorg of extended tracing plugins

* Add concolic tracing script

* Clean up old hooks

* Sync memory as well; cleanups

* Revert binary tests

* simplify concolic follower

* Move trace follower to plugin.py

* Simplify follower

* Add skip ranges to Follower

* Update concolic.py

* Remove redundant state init

* Clean up driver script

* Update header line

* Move trace follower

* Move Follower to follow_trace.py

* rm unused import

* Remove unnecessary property

* rm ConcreteTraceFollower

* Revert start_run behavior
2017-11-28 18:14:03 -05:00
Garret Reece
88b213de7e
Fixes to thumb mode instruction implementations
* Thumb specific fixes to the SUB, BX, and MOV instruction implementations
* implemented hardcoded result for gettid syscall
2017-11-28 16:46:19 -06:00
Srinivas P G
d98ef22251 Fix Issue: 597 - Remove unused policy argument in function State.solve_n (#598)
* version argument in manticore

* Fix 591 - Exception Handler

* Issue 597 - Remove the unused policy argument
2017-11-27 18:13:13 -05:00
Srinivas P G
ce888766cd Fix for issue 556 and 591 (#590)
* version argument in manticore

* Fix 591 - Exception Handler
2017-11-22 16:18:45 -05:00
cole-lightfighter
fccf451406 Assert valid operand length (#558)
* Assert valid bytecode and operand length

EVM bytecode comes in 32-byte chunks, and contracts require at least one
segment to be created. An example, originally written by @ggrieco-tob in issue #546, is included.
Unsure what expected behavior should be, but initial state has a problem when a contract is
created with a single byte.

Also added some exception handling in `parse_operand()` to catch invalid
instructions, e.g. a PUSH1 instruction followed by no bytes.

Signed-off-by: Cole Lightfighter <cole@onicsla.bz>

* Fix SLOAD invalid memory access

Simple check to ensure address storage is in global_storage before
attempting to load data.

* Remove invalid assertions
2017-11-21 15:56:00 -03:00
Sidhant Gupta
fbe70f1bc5 Updating README with solc binary requirements (#575)
* Updating README with solc binary requirements

* Update README.md
2017-11-20 17:44:19 -05:00
Sidhant Gupta
5c52fcaf54 Updates travis cache to python 2.7.13 (#576) 2017-11-20 16:06:57 -05:00
Dushyanth Chowdary
652c99b471 Manticore prints linux ret code as uint instead of int (#578)
* Fixing raise issue #435

* syncing git

* Fix Bug #570

* syncing

* removed all binaries

* missed one file
2017-11-20 16:04:34 -05:00
Mark Mossberg
1dbf40ea8e
Add UMD simple assert example (#573) 2017-11-20 15:35:32 -05:00
Mark Mossberg
35d8fce9df
Only really fork when there's multiple solutions (#569) 2017-11-17 12:40:30 -05:00
ggrieco-tob
0e4e9a49e2
Added missing syscalls in decree syscall trace (#545)
* added missing syscalls in decree syscall trace

* added missing parameter in callback of BranchLimited policy
2017-11-14 17:18:31 -03:00
awr|arr
352b9ba48d Fix typo per issue #552 - s/arm64/amd64/ (#561) 2017-11-14 15:10:14 -05:00
HighW4y2H3ll
8002a1d682 Add PCMPXSTRX Instructions (#507)
* Add PCMPXSTRX Instructions

* bug fixes

* unittest related fixes

* Full test of pcmpxstrx

* Move tests
2017-11-14 16:39:51 -03:00
feliam
94d2e94bf1
New API for EVM analysis (#551)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes
2017-11-14 12:06:08 -03:00
cole-lightfighter
b13a8c0c24 Fix SLOAD invalid memory access (#562)
Check global_storage includes an entry at address before trying to load
storage.
2017-11-14 10:34:18 -03:00
Mark Mossberg
d9b54675c5
Handle file.tell() error, which will happen for special files (/dev/tty) (#559) 2017-11-13 18:30:23 -05:00
cole-lightfighter
08f86cc892 [fix] Issue #550: generates extra workspace folder (#557)
* [fix] Issue #550: generates extra workspace folder

Signed-off-by: Cole Lightfighter <cole@onicsla.bz>

* Slight workspace and store refactor
2017-11-13 12:20:57 -05:00
Mark Mossberg
9535ec8fd3
Fix all integral type checks that forget long (#555) 2017-11-09 11:28:24 -05:00
Peter Goodman
d341bc94ff
Move inline function definitions out of the AbstractCPU's execute method (#538)
* This change moves from inline function definitions out of the critical path of AbstractCpu's execute method.

* Raise a mcore exception if we fail at emulation
2017-11-08 14:48:23 -05:00
Yan
7c1e5e16fc
Localize log formatting changes (#547)
* Don't add custom format string to root logger

* Fix handler propagation
2017-11-06 18:00:26 -05:00
car bauer
82d1621bfe
Remove win32 support (#535)
* Remove Windows support files
* Remove Windows test files
2017-11-06 16:51:43 -05:00
Yan
baf2d769a6 Various bug fixes. (#530)
* Fixes #503

* Fixes #515

* Fixes 272. Concretize data written to a fd.

* Revert debug hack and fix overly broad exception

* Update did/will_exec_instr semantics

* Clean up imports

* Update logging and improve sys_open return

* Update variable names+doc for consistency
2017-10-25 10:53:11 -04:00
feliam
08e8c3b7d8 Fix coverage calculation vs. metadata (#529)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code
2017-10-23 17:45:01 -03:00
feliam
a9ad183354 Fixes symbolic reentrancy example (#528) 2017-10-20 16:43:22 -03:00
Mark Mossberg
5aa681dc76 0.1.5 Release (#501)
* Update CHANGELOG.md

* Update 0.1.5 README

* Bump version/release date
2017-10-19 15:46:22 -04:00
feliam
23218d724e Simple event signature fixes (#525)
* dev-evm-event-bugfixes

* Better stringifierer
2017-10-18 19:17:26 -03:00
feliam
8591bff45f EVM support (#521)
* WIP New Policy class

* WIP pubsub

* Update Signal tests

* EVM support - Wip

* EVM support - dependencies fixed

* EVM support - fix decree merge

* fix decode instrucion event

* Fix small bugs in evm opcodes (too many arguments + wrong LOG name) (#380)

Fix wrong call parameters + typo

* Fix Create/Call

* Fix depth

* Default fixed point in arithmetic simplifier

* small fixes from github comments

* Fix event decode_instruction signature

* wip wip

* Auto tests for evm

* New EVM tests

* Ran 9556  FAILED (failures=166, errors=8, skipped=62)

* Fix some arithmetic instructions

* Ran 9556  FAILED (failures=136, errors=8, skipped=62)

* More instructions - Optimizing symbolic memory

* Added gas to opcodes description - FIX DELEGATECALL POPS

* Add wip wallet example

* The tests

* Solidity constructors need argument after bytecode

* Simple integer overflow working

* Good merge

* Good good merge

* WIP manticore refactor

* Fix default old-style initial state

* context now working

* Fix context serialization

* Fix test models.  Can not set a state constraints

* typo

* A few typos (constraints setter) and use of public properties in internal methods

* Fix init wallet example

* State __init__ needs to initialize platform constraints

* Internal methods use internal properties

* Better attack modeling

* Better example layout

* Storage backup on CALL is now faster .. and correct

* Add LOG support

* Minimal SE test

* Added examples

* Send ether bugfix

* EVM: Fix wrong balance destination on CALL + decrease caller balance on CREATE

* New balance management

* Trying to maintain known hashes

* Known hash concretization policy

* CALLDATA max size bugfix

* Minimal SE example

* Remove evm tests

* add -> enqueue

* @m.init

* Fix workspace url

* Some test skipped

* Ad Fixme to platform specific stuff in State

* add -> enqueue

* Enqueue created state

* Fix m.init

Use a messy hack to adhere to the spec (callback func receive 1 state argument)

* Add _coverage_file ivar to Manticore

* Fix symbolic files

* remove extra enqueue

* Fixing __main__

* comments

* Fix visitors oddity

* setup merged

* remove duplicates and add pysha3

* Remove EVMTests import

* Refactor platform specific code out of ManticoreOutput (#505)

* Initial moving work

* Clean

* Make linux.generate_workspace_files work

* Fix

* clean

* Add test

* Test workspace for platform files

* Skip EVM cpu pretty print

* Remove bad import

* Fix coverage.py for testing

* Clean comment

* Comment hack

* Print evm cpu

* pretty print evm world instead of platform

* delet old scripts/examples

* delet old tests

* Remove z3 install script

* Array.max_size can be None, include check for that

* Rm unused _symbolic_files

add_symbolic_files was moved to linux, so this is not needed

* Rm unused args

* Import evm

* Rm dup function

* Rm stray prints

* Add docs for new classmethod apis

* minimal

* minimal example

* fix minimal

* Fair symbolic SHA3 handling

* Simple mapping example

* coverage example

* fix tests

* fix minimal

* Some eko fixes

* New SETH

* integer_overflow refactored

* Fixing the examples

* init_bytecode -> init
'

* Concrete reentrancy exampole

* concrete reentrancy selfdestruct

* Update minimal.py

* It's a new Minimal

* Integer overflow example

* New minimal

* minimal fix

* Examples last minute fixes

* Remove debug print

* add plugin.py

* Fixing event subscription

* remove temp params

* Remove param

* Update uncovered will_exec callback prototype

* Clean up debug output

* Automatically generated intruction tests

* Uninplemented instruction test removed

* Unused concretization policy removed

* Fixes enabling default bplugins

* solc from PATH

* Removed unused import

* Logger name updated
2017-10-17 19:47:20 -03:00
feliam
e84c0513a2 Manticore plugins (#506)
* WIP New Policy class

* WIP pubsub

* Update Signal tests

* small fixes from github comments

* Fix event decode_instruction signature

* Good merge

* Good good merge

* WIP manticore refactor

* Fix default old-style initial state

* add -> enqueue

* @m.init

* Fix workspace url

* Some test skipped

* Ad Fixme to platform specific stuff in State

* add -> enqueue

* Enqueue created state

* Fix m.init

Use a messy hack to adhere to the spec (callback func receive 1 state argument)

* Add _coverage_file ivar to Manticore

* Fix symbolic files

* remove extra enqueue

* Fixing __main__

* comments

* Experimental plugin system

* tests fixed

* Fix plugins

* Some reporting moved to plugin

* Fix assertions test

* Add published events to classes that publish them

* Update how we verify callbacks

* Update Eventful._publish

* Dev plugins (#512)

* Yet another flavor for event name checking

* really it's a bunch of minimal bugfixes

* Remove get_all_event_names from Plugin

* Update where we get all events

* Use new metaclass-based event registry

* Define prefixes in one place

* remove debug print

* remove debug print
2017-10-04 15:51:37 -03:00
Yan
1edee15e5f Pythonic logger naming (#511)
* More generic logging

* Clean up logger name gen

* Refactor name summarization
2017-09-25 18:09:18 -04:00
JP Smith
b9333838ad install z3 with pip in Dockerfile (#502) 2017-09-14 11:52:15 -05:00
JP Smith
0efa37933a Fix stderr file creation and test for it going forwards (#495)
* fix stderr file creation and test for it going forwards

* consolidate tests

* clean up imports
2017-09-13 19:17:13 -05:00
Mark Mossberg
58cdee814c Update test_workspace.py (#497) 2017-09-13 18:34:45 -04:00
feliam
23c2585316 Refactor platform details out from Manticore (#421)
* WIP New Policy class

* WIP pubsub

* Update Signal tests

* small fixes from github comments

* Fix event decode_instruction signature

* Good merge

* Good good merge

* WIP manticore refactor

* Fix default old-style initial state

* add -> enqueue

* @m.init

* Fix workspace url

* Some test skipped

* Ad Fixme to platform specific stuff in State

* add -> enqueue

* Enqueue created state

* Fix m.init

Use a messy hack to adhere to the spec (callback func receive 1 state argument)

* Add _coverage_file ivar to Manticore

* Fix symbolic files

* remove extra enqueue

* Fixing __main__

* comments

* Refactor CLI, and Manticore high level interfaces (#498)

* Refactor main,

- classmethod for linux
- refactor manticore ctor - compat with old linux behavior
- changed verbosity API (to allow for this use case: what if you want to set verbosity for the stuff manticore does in its ctor?)

* rm old verbosity

* small

* Add decree classmethod

* Rm checks ; they are redundant anyway

* Misc

* Move add_symbolic_file to linux platform

* rm redundant checks

* Rm explicit args for deprecated interface

* Fix cli bug

* Allow for both linux and decree from cli

* Add back argv positional param for deprecated api compat
2017-09-13 18:37:42 -03:00
Mark Mossberg
f6fea10376 Use z3-solver package (#494)
* Add z3-solver pip dep for z3 install

* Update readme for z3
2017-09-12 15:21:48 -04:00
Mark Mossberg
50923974e2 Fix logger verbosity and test (#491)
* something liekt his

* `will_store_state` does not exist

* slightly better cli verbosity test

* Fix variable

* Rm unused callback fun
2017-09-12 15:08:53 -04:00
John F.X. Galea
a8ef3ecd9f Added implementation for sys_dup and sys_dup2 (#490)
* Added implementation for sys_dup and sys_dup2

* Fixed bug in close functionality.

* Removed unwanted white-space

* Updated implementation of sys_dup and sys_dup2

* Fixed is_open function.

* Handle a newfd in dup2 that extends beyond existing fd table size

* Add a minimal sys_getrlimit() implementation

Thank you @johnfxgalea!
2017-09-12 15:03:01 -04:00
Mark Mossberg
f8a8373e57 Request binaries that cause bugs in contributing.md (#486)
* Request binaries

* Update CONTRIBUTING.md
2017-09-11 13:05:51 -04:00
Mark Mossberg
8b66e58c7b Document cli better (#482)
* Update README.md

* Rewrite -h

* Clearer cli usage

* Fix forgotten variable name changes

* Fix more forgotten variables
2017-09-07 20:15:31 -04:00
John F.X. Galea
60c6813a80 Implemented getcwd sys call, along with a new helper function that wr… (#483)
* Implemented getcwd sys call, along with a new helper function that writes a NULL terminated string to memory.

The reason for this commit is that the sys call was not implemented.

* Fixed logging string for sys_getcwd imp

* Removed semicolon in sys_getcwd function

* Fixed logging string for sys_getcwd imp. The problem was that size is unsigned and the incorrect format symbol was used

* Fixed the following:
1) Included the string param in the doc of the write_string function.
2) Added less verbose code to append a NULL to a string in the write_string function
3) Removed the assert to check if the written string to memory matches with one that is read at a given address in the sys_getcwd function
4) Fixed bug in the return values returned by sys_getcwd

* Fixed error logs in the getcwd function.

* Fixed return values of sys_getcwd function.

* Fixed string format symbol in sys_getcwd function.

* Removed dir exists check from the sys_getcwd function.

* Arranged memory block check in the sys_getcwd function.

* Removed new line after write_string function.

(Thank you @johnfxgalea!)
2017-09-07 16:30:55 -04:00
Mark Mossberg
d83fa737a7 Create CONTRIBUTING.md (#481)
* Create CONTRIBUTING.md

* Update CONTRIBUTING.md

* Update CONTRIBUTING.md
2017-09-06 18:11:22 -04:00
Yan
7679773088 Update examples (#477)
* Use locked_context() in count_instructions example

 * We use this example on the front page, and it currently generates
   a flood of warnings.

* Update example indeces

* Remove dump_stats()

* Remove extra comments

* Remove redundant comments
2017-09-01 17:05:43 -04:00
Yan
9b8ef3cd76 Concretize stdout in state summary (#478) 2017-09-01 16:31:50 -04:00
JP Smith
0cd2560138 Update Manticore docstring (#476)
* update Manticore docstring

* fix type docstring
2017-09-01 11:43:29 -05:00
JP Smith
d5d22a8aaf Allow Manticore initialization with State object (#475) 2017-08-31 16:44:43 -05:00
feliam
f9b02bd194 New Policy class (#368)
* New Policy class

* Move visited to Policy - Fix contexts

* Add BranchLimited

* signals -> events for branchlimited
2017-08-31 12:48:55 -04:00