* adding abstract disasm class
* before adding abstract insn
* explicit capstone use
* (wip) removing capstone
* debugging nose
* removed disassembler from constructor
* nits
* capstone->cs and nits
* basic memory (wip)
* tmp
* added binja dissasm
* fixed execution pipeline - calling LLIL instructions
* updated parseargs to select disassembler
* unstable (disassembler at CPU constructor breaks tests)
* disasm fix for tests
* nit for aliases in x86
* added a flag to differentiate disassembly and IL-disassembly for binja
* before merging
* merging with dev-events master
* fixed signal forwarding for binja
* cleaner initialization
* Binja RegisterFile. Dropped Platform
* address fixup
* properly incrementing PC
* some work on XOR, SET_REG, REG, CONST, AND, PUSH, POP
* adding first CALL, JMP, LOAD (wip)
* JUMP fix
* GOTO and misc fixes in PC handling
* adding instructions (wip)
* fixing flags and sizes (wip)
* loading database if exists for faster analysis
* fix for register debug
* fixes for register sizes and flags
* FIX for multiple IL instructions sharing the same PC
* removed CONST_PTR and misc fixes
* RET, SHR, shift left & misc instructions, fixing insn sizes (wip)
* flag fixes
* ctypes 2's complement parsing
* JUMP_TO, SYSCALL
* syscall fixups and flag computation using binja il only
* FLAG, NEG, CMP(family) of LLIL, some unimplemented methods
* MUL, DIV
* cmpxchg
* MUL, IMUL, ROR, ROL
* fallback to capstone for all LLIL_UNIMPL and LLIL_UNIMPL_MEM
* fixes for registers and memory when switching CPUs
* check for binja to disable multiprocessing
* merging
* nit
* hack for serialization
* moved check for disassembler to Manticore from __main__
* removing __class__ refs
* cleanup from __class__.disasm
* size calculation from get_instruction_low_level_il
* fix for NEG, check for empty queue, execute refactor
* fixes for LLIL functions
* removal of redundant regfile writes
* nit fixes
* function overrides in Cpu classes and orphan printf cleanup
* nit
* incomplete merge
* verbosity temp mod
* cleanups of FIXMEs
* 2-stage constructor for disassembler
* cleanup binja refs in abstractcpu
* serialization for platform_cpu
* check for UNIMPL in all the il queue
* typo fix
* fix for arm
* typo correction and starting caching implementation
* restored register printing and fixed import in x86.py
* orn instruction plus unit test
* uadd8 and it instructions implemented
* SEL instruction implementation
* GE flag set by UADD8
* IT instruction condition code properly no longer prevents its execution
* support for multiple instruction tests added to testing setup
* unit test for SEL instruction
* cleaned up the tests for thumb instructions
* implemented sxth and rev instructions
* implemented tests for sxth and rev instructions
* updated the add implementation to support two operand variant (i.e., add r4, #4)
* added test for itete ne instruction
* Use correct event name
* Add test for state.generate_testcase
Test merely tests that this function publishes the 'will_generate_testcase' event
* Properly test; make sure the callback executes and error if not
This is the most convoluted unit test I've ever written.
* "better"
* ran
* Some dirty work
* Rm unnecessary sanitization
* Fix state.generate_inputs event publishing
We don't need to manually pass `self` because State is automatically
forwarded as an argument. Also correctly specify a message for the state
and expose to the API
* Rename
* Update test for new save_testcase args, make test more robust
* Simplify arguments related to generate_testcase_callback by removing default arg. Add test for this behavior
* Minor test fixup
* Add official API docs
* Remove unnecessary new event type
* Fix context serialization
* Fix test models. Can not set a state constraints
* typo
* A few typos (constraints setter) and use of public properties in internal methods
* State __init__ needs to initialize platform constraints
* Internal methods use internal properties
* test_record_branches removed
* Add taint args to buffer creation
Allows the `new_symbolic_buffer` and `symbolicate_buffer` functions to take keyword args for tainting. Defaults to frozenset in both cases.
* Add unit tests and ArrayProxy taint propery
Adds simple unit tests for tainted buffers. Added a property to the ArrayProxy class in smtlib.expression so that it's possible to access the taint of the proxied ArrayVariable.
* Updated docstrings
* WIP New Policy class
* WIP pubsub
* Update Signal tests
* small fixes from github comments
* Fix event decode_instruction signature
* Good merge
* Good good merge
* Eventful class commented
* The million typos
* Code revision
* Fix tests for new mor strict Eventful
* Fix naming
* Separate storage from workspace
* Begin removing output generation from manticore.py
* Split up workspace and output
* Create a separation between output and workspace
* Get it to a working (hacky) state
* Start bringing state serialization into workspace
* More mcore->workspace moves
* Remove unused imports
* Update serializers; add interface
* move state saving to workspace
* can now save/load states and testcases
* Add redis as backend
* Implement streams in terms of values and vice versa
* Implement `ls` and move workspace loading to Workspace
* Better workspace initialization
* Fix how --workspace is parsed for tests
* update tests to new workspace indexes
* Fix state storage and handling
* Doc updates and extra error checking
* pep8 style changes
* Add Executor's 'sync'
* Remove previous workspace artifacts from Executor
* Comment out constraints check assert
* Centralize locking to new testcase ids
* Fix testcase generation
* pep8 updates
* propagate descriptor instead of path
* Add an in-memory state store
* Make memory maps be sortable
* Allow to produce an empty state
* Add workspace tests
* Make Memory.__cmp__() more robust
* remove md5 tests and replace with comparison
* fix directory path issue
* remove exact check as test is not deterministic
* fix argument assertion test and remove cdet_visited.txt
* allow extra addresses in actual to account for inter-machine differences
* initial
* Clean, only store address in message if not symbolic
If it's symbolic,it renders like
Generating testcase No. 2 - Invalid symbolic memory access (mode:r) <<manticore.core.smtlib.expression.BitVecAnd object at 0x7fd6dcd14410>>
which is not useful output to the user.
* Format as hex
* Fix tests
* Rm comments
- blx <Rm> swaps mode appropriately
- asr.w and lsr.w in thumb mode handle immediates for op2 correctly
- unit tests for thumb mode behavior for shifting instructions
- unit tests check for correct mode on BX and BLX instructions
* Wip refactoring
* Executor and exceptions refactor wip wip
* Fixing all_insts auto tests
* Visited and generate testcase now at manticore api level
* Aggregating state statistics into executor statistics
* Wip refactoring
* Executor and exceptions refactor wip wip
* Fixing all_insts auto tests
* Visited and generate testcase now at manticore api level
* Aggregating state statistics into executor statistics
* forwarding events wip
* state setstate fix and setup_stack merge fix
* will_terminate_state fix and tests skipped
* Update all ConcretizeRegister and ConcretizeMemory
* Wip refactoring
* Executor and exceptions refactor wip wip
* Fixing all_insts auto tests
* Visited and generate testcase now at manticore api level
* Aggregating state statistics into executor statistics
* Wip refactoring
* Executor and exceptions refactor wip wip
* Fixing all_insts auto tests
* Visited and generate testcase now at manticore api level
* Aggregating state statistics into executor statistics
* forwarding events wip
* state setstate fix and setup_stack merge fix
* will_terminate_state fix and tests skipped
* Update all ConcretizeRegister and ConcretizeMemory
* Exceptions are crazy crazy crazy
* fix last merge
* Merge merge until it pass
* Instructions count default to 0
* will/did execute/emulate
* Delayed keybpoard interrupt now shutdowns nicely
* fix auto test generator x86
* Undo bad merge
* utterly hopeless
* basic working
* Fix merge bugs and github comments
* Remove unnecesary comment - github comments
* trace_item not used there
* model-platform and system.py fixed
* backup/restore to store/load -- cpu.instruction property
* Slightly better did/will naming and dynamic signal forwarding
* platform.constraints and cpu.instruction as properties
* Fix forward signals getattr
* set las decoded pc at decode_instruction() / reenable instruction_cache
* Signals name convention: did/will/on
* Forward normal signals
* Maintain last decoded pc in abstractcpu
* Changed context manager so it just wont raise interrupt
* Decree now forwards signals and sets constraints
* linux.SymbolicFile does not need to maintain constraints
* remove debbug print
* Assimilating some PR commets
* size_total == size
* better merge of manticore.py
* typo
* Forwarding only specified objects in signal arguments
* Fix few broken tests
* revert + merge
* remove some unused stuff from manticore()
* manticore context <-> executor context
* manticore context <-> executor context2
* context context context
* forgotten return
* Fix basix.arm
* arm bitwise fix
* fix context
* Comment 1
* Comment 2
* Comment 3
* Comment 4
* Comment 5
* Comment 6
* Fix (still needs refactor but it works) profiling
* Fix (still needs refactor but it works) profiling
* The forgotten bit
* Update tests to reflect current output
* Verbosity fix
* Fix verbosity test
* Add MOVT instruction
* Add new ARM operand types for MRC
* mrc implementation seems to work
* UXTB inst implemented, provisional implementations of LDREX and STREX
* Added unit tests for MRC, MOVT, and UXTB
* Added mode swapping from blx instruction on arm cpu
* Make tests pass
* Add variadic decorator
* Add check for _variadic func attribute
* Expose @variadic at top level
* Use variable for the actual name of attr
* Update naming
* Use helper
* Maybe more pythonic?
* Add variadic to public API
* Add variadic decorator tests
* Clean
* Remove variadic parameter
* Add docstrings
* Document parameter
* Clean
* Better use of autodoc
* Update docstring
* Add todo comment
* Clean up model syscall invocation
* Move read_string to Cpu
* move push/pop helpers to Cpu
* Reorg Linux initialization
* Update linux test
* fstat64 test harness
* assert read_string only considers concrete bytes
* Ensure that correct aliases exist during ctor
* Improve alias check
* Wrap ABI semantics in its own class hierarchy
* Define a model invocation for syscalls and function calls
* Add unit tests for ABI
* Add a common base class for Platform models
* begin refactoring logging to use manticore object
* fix verbosity things
* fix logging when in scripts
* remove m.log_file now that it's no longer used
* remove unnecessary init_logging usage and unused log_debug variable
* accidentally deleted the wrong line
* re-hide init_logging
* remove old log_debug
* remove unnecessary API stuff and refactor around that
* re-introduce logging PR
* fix Popen
* lost a line in merge
* fix test_binaries
* Log to stdout instead of stderr
* implement mark's changes
* Configure Z3 depending on installed version
* Mocking for subprocess.check_output
* change get_value_fmt to private attribute _get_value_fmt
* Move memoized to utils
* Remove minimal version and simplify
* Re-add invalid versions/sanity checks
* Z3 version format checked on github
* New tests. Version is future proof
* Better logging
* Enable simple ARM register concretization for Unicorn
* Add canonical_registers property to abstractcpu
* cpu to self
* Check for regs_access better
* Emulate a single instruction
* Bypass capstone 3.0.4 arm bug
* Dealing with capstone
* Temporary disable ASR and remobe BitVec.Bool from test
* WIP WIP debug prints WIP WIP
* Unicorn fallback working (using unicorn master)
* HAck to support unicorn 1.0.0
* WIP
* Unicorn hack to handle PC updates
* [WIP] do not do anything with this commit; for debugging only
* Adding before clean up
* emulation more or less works; need to work out more unicorn bugs
* clean up emulate() caller code
* move hooks to methods; cleanup
* Concretize memory when emulating
* Re-add Bool()
* Update tests to start at offset 4
When an instruction branches to the previous instruction,
Unicorn attempts to dereference that memory. We'd like to use
unit tests to also make sure Unicorn emulation is in line with
our own semantics. If we start all tests at offset 4, we can
jump to a previous instruction and not fault when Unicorn
dereferences it.
* Fix concretization
* Clean up test imports; upper-case Cpu
* Unicorn tests
* Add tests for all the ARM semantics, but make sure they're equivalent
on unicorn.
* Add a few tests to make sure unicorn correctly concretizes the memory
it references
* Fix broken import
* Add symbolic register tests
* Re-introduce the unicorn hack
* Add the 'ONE' concretization policy
* Rm unused function
* Update concretization; add comments
* Add ONE policy test
* Create a base class for all concretization exceptions
* Remove Armv7Cpu._concretize_registers
* Check for enabled logging in a more idiomatic way
* [wip] intermediate testing commit
* Reimplement hooks and execution with unicorn
* Add a DMB (mem barrier) instruction; nop
* simplify instruction resolution
* improve unicorn error handling
* explicitly delete emu
* Handle ARM helpers inline
* map fetched memory
* Narrow exception handling
* Update DMB docs; make __kuser_dmb match real implementation
* Fix typo; add comment; remove extraneous parameter
* typos++
* Fix interpreter load
* turn off some debug
* cuack
* Correct loader condition (#111)
* Rm unnecessary condition
We always want to run this code if there is an interpreter present, not
just if the exe is ET_DYN
* Add correct interp header type check
* no-mp not uset and redundant
* Add timeout
* Unused args reremoved timeout readded
* no-mp not uset and redundant
* Add timeout
* Unused args reremoved timeout readded
* Move import to the top op op op
* Re enable skipped test
* Re enable skipped test
* Hack so we can use upstream Elftool
* pr comments
* pr comments - staticmethod
* pr comments - implicit > explicit
Theofilos Petsios
Garret Reece
Mark Mossberg
feliam
Eric Hennenfent
JP Smith
Yan