41 Commits

Author SHA1 Message Date
ggrieco-tob
03af65e55f
A more complete example to initialize and explore a smart contract with manticore (#827)
* A more complete example to initialize and explore a smart contract with manticore

* Removed outdated comments
2018-03-22 09:40:51 -03:00
39370ccf3c Let the Python interpreter be specified externally (#774) 2018-02-27 12:33:25 -05:00
feliam
2f2de29d36
Better plugin context management. (#730)
* Better plugin context management. Example UseDef logging plugin for evm

* Example plugin to log use-def

* Better plugin name checking hints

* Better plugin name checking hints2

* Fix uninititalize-plugins (found via the warning)

* Remove redundant variables in example

* Typo

* Better warning print (class name)

* better safety check + context fix

* better variabke naming

* Update manticore.py
2018-02-14 17:13:40 -03:00
Yan Ivnitskiy
60d2b61fb3
Run linux examples in Travis (#668)
* Update makefile; add a list target for testing

* simplify nostdlib example

* Make sendmail example return success

* Add tests to run all examples

* Add some targets to exclude

* Run example scripts; temporarily add a workspace accsesor to mcore

* Optionally read end of main from argv

* Make concolic test more robust

* Clean up Makefile

* Be better with phony targets

* Add run_simple and state_control tests

* verbosity++

* Make sure we fail when we intend to

* Simplify travis_test.sh

* Remove multi_arch_sym
2018-01-18 15:50:13 -05:00
Mark Mossberg
7875aaf5fd
Rename manticore.seth to manticore.ethereum (#665)
* Rename file

* Fixup refs

* update logging

* Update docs

* Update docstr

* Clean docs
2017-12-22 14:05:37 -05:00
Mark Mossberg
7aa85f13bb
Clean examples/evm (#661)
* Clean examples/evm, add a new one

integer_overflow.py -> simple_int_overflow.sol
simple_functions.py -> simple_multi_func.sol
simple_transaction.py -> simple_value_check.sol

* Add umd example
2017-12-22 12:23:17 -05:00
Yan Ivnitskiy
6896c227ef
Initial implementation of concolic algorithm (#653)
* WIP New Policy class

* WIP pubsub

* Update Signal tests

* small fixes from github comments

* Fix event decode_instruction signature

* Good merge

* Good good merge

* WIP manticore refactor

* Fix default old-style initial state

* add -> enqueue

* @m.init

* Fix workspace url

* Some test skipped

* Ad Fixme to platform specific stuff in State

* add -> enqueue

* Enqueue created state

* Fix m.init

Use a messy hack to adhere to the spec (callback func receive 1 state argument)

* Add _coverage_file ivar to Manticore

* Fix symbolic files

* remove extra enqueue

* Fixing __main__

* comments

* Experimental plugin system

* tests fixed

* Fix plugins

* Some reporting moved to plugin

* Fix assertions test

* Add published events to classes that publish them

* Update how we verify callbacks

* Update Eventful._publish

* Yet another flavor for event name checking

* really it's a bunch of minimal bugfixes

* Remove get_all_event_names from Plugin

* Update where we get all events

* Use new metaclass-based event registry

* Initial concrete trace follower

* Add extended (json) trace support

* More stubs for condition gather

* Update trace saving to new format

* Produce trace regardless of contents

* Record register deltas in trace

* Move initialization to _start_run so we can call run() multiple times

* Re-fix multiple workspace bug

* Fix it correctly

* Add extended trace and accessors

* make sure did_execute_instruction is always published

* Produce a consistent version

* move extended tracing to separate class

* Reorg of extended tracing plugins

* Add concolic tracing script

* Clean up old hooks

* Sync memory as well; cleanups

* Revert binary tests

* simplify concolic follower

* Move trace follower to plugin.py

* Simplify follower

* Add skip ranges to Follower

* Update concolic.py

* Remove redundant state init

* Clean up driver script

* Update header line

* Move trace follower

* Move Follower to follow_trace.py

* rm unused import

* Remove unnecessary property

* rm ConcreteTraceFollower

* Revert start_run behavior

* Initial implementation of concolic algorithm (#574)

* Fix coverage calculation vs. metadata (#529)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* Various bug fixes. (#530)

* Fixes #503

* Fixes #515

* Fixes 272. Concretize data written to a fd.

* Revert debug hack and fix overly broad exception

* Update did/will_exec_instr semantics

* Clean up imports

* Update logging and improve sys_open return

* Update variable names+doc for consistency

* Remove win32 support (#535)

* Remove Windows support files
* Remove Windows test files

* Localize log formatting changes (#547)

* Don't add custom format string to root logger

* Fix handler propagation

* Move inline function definitions out of the AbstractCPU's execute method (#538)

* This change moves from inline function definitions out of the critical path of AbstractCpu's execute method.

* Raise a mcore exception if we fail at emulation

* Fix all integral type checks that forget long (#555)

* [fix] Issue #550: generates extra workspace folder (#557)

* [fix] Issue #550: generates extra workspace folder

Signed-off-by: Cole Lightfighter <cole@onicsla.bz>

* Slight workspace and store refactor

* Handle file.tell() error, which will happen for special files (/dev/tty) (#559)

* Fix SLOAD invalid memory access (#562)

Check global_storage includes an entry at address before trying to load
storage.

* New API for EVM analysis (#551)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Add PCMPXSTRX Instructions (#507)

* Add PCMPXSTRX Instructions

* bug fixes

* unittest related fixes

* Full test of pcmpxstrx

* Move tests

* Fix typo per issue #552 - s/arm64/amd64/ (#561)

* Added missing syscalls in decree syscall trace (#545)

* added missing syscalls in decree syscall trace

* added missing parameter in callback of BranchLimited policy

* progress

* can flip constraint set

* hack around double decl issue

* can gen input

* what is this, a coding interview?

* did it?

* clean

* finish

* pretty log messages

* comment, clean

* more cleaning

* cmt

* Only really fork when there's multiple solutions (#569)

* Update comment and path

* Add UMD simple assert example (#573)

* Manticore prints linux ret code as uint instead of int (#578)

* Fixing raise issue #435

* syncing git

* Fix Bug #570

* syncing

* removed all binaries

* missed one file

* Updates travis cache to python 2.7.13 (#576)

* Updating README with solc binary requirements (#575)

* Updating README with solc binary requirements

* Update README.md

* Assert valid operand length (#558)

* Assert valid bytecode and operand length

EVM bytecode comes in 32-byte chunks, and contracts require at least one
segment to be created. An example, originally written by @ggrieco-tob in issue #546, is included.
Unsure what expected behavior should be, but initial state has a problem when a contract is
created with a single byte.

Also added some exception handling in `parse_operand()` to catch invalid
instructions, e.g. a PUSH1 instruction followed by no bytes.

Signed-off-by: Cole Lightfighter <cole@onicsla.bz>

* Fix SLOAD invalid memory access

Simple check to ensure address storage is in global_storage before
attempting to load data.

* Remove invalid assertions

* Fix for issue 556 and 591 (#590)

* version argument in manticore

* Fix 591 - Exception Handler

* Fix Issue: 597 - Remove unused policy argument in function State.solve_n (#598)

* version argument in manticore

* Fix 591 - Exception Handler

* Issue 597 - Remove the unused policy argument

* Fixes to thumb mode instruction implementations

* Thumb specific fixes to the SUB, BX, and MOV instruction implementations
* implemented hardcoded result for gettid syscall

* Trace following mode (#513)

* WIP New Policy class

* WIP pubsub

* Update Signal tests

* small fixes from github comments

* Fix event decode_instruction signature

* Good merge

* Good good merge

* WIP manticore refactor

* Fix default old-style initial state

* add -> enqueue

* @m.init

* Fix workspace url

* Some test skipped

* Ad Fixme to platform specific stuff in State

* add -> enqueue

* Enqueue created state

* Fix m.init

Use a messy hack to adhere to the spec (callback func receive 1 state argument)

* Add _coverage_file ivar to Manticore

* Fix symbolic files

* remove extra enqueue

* Fixing __main__

* comments

* Experimental plugin system

* tests fixed

* Fix plugins

* Some reporting moved to plugin

* Fix assertions test

* Add published events to classes that publish them

* Update how we verify callbacks

* Update Eventful._publish

* Yet another flavor for event name checking

* really it's a bunch of minimal bugfixes

* Remove get_all_event_names from Plugin

* Update where we get all events

* Use new metaclass-based event registry

* Initial concrete trace follower

* Add extended (json) trace support

* More stubs for condition gather

* Update trace saving to new format

* Produce trace regardless of contents

* Record register deltas in trace

* Move initialization to _start_run so we can call run() multiple times

* Re-fix multiple workspace bug

* Fix it correctly

* Add extended trace and accessors

* make sure did_execute_instruction is always published

* Produce a consistent version

* move extended tracing to separate class

* Reorg of extended tracing plugins

* Add concolic tracing script

* Clean up old hooks

* Sync memory as well; cleanups

* Revert binary tests

* simplify concolic follower

* Move trace follower to plugin.py

* Simplify follower

* Add skip ranges to Follower

* Update concolic.py

* Remove redundant state init

* Clean up driver script

* Update header line

* Move trace follower

* Move Follower to follow_trace.py

* rm unused import

* Remove unnecessary property

* rm ConcreteTraceFollower

* Revert start_run behavior

* Centralize system call logging (#602)

* Remove per-syscall logging

* Make Cpu.read_string() stop reading at first symbolic byte

* Centralize syscall logging

* Update helper docstring

* Update arg/ret expansion

* Check for issymbolic first

* Tiny hex format change

* Log unimplemented instructions (issue 163) (#599)

* Remove double printing of exception.

* Pretty print the unimplemented instruction raised by unicorn (UcError).

* Raise exception after unimplemented instruction error logging.

* Ensure the raised exception is actually a unicorn invalid instruction error.

* Resolve conflict

* EVM assembler/disassembler doc and cleanup (#563)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* EVMasm refactor

* EVM api refactor (#589)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Fixed Issue #533 (#606)

 * Remove Platform._path

* Amend pr guidelines (#615)

* Fixed Issue #619 (#623)

Add newlines in .trace file generation

* Hide legacy cli flags from cli help (#622)

* Fixed Issue #533

* Removed --replay argument from cli help. Issue #617

* Update help description

* Remove unused --size flag

* Emit .input instead of .txt files in workspace (#625)

Related: #612 

* Update workspace.py

Changed extension to .input

* Update test_workspace.py

* changed key value pair in test_workspace bc of change of extension to .input in workspace.py, fixed issue #618

* removed unwanted directories

* Update seth.py

* Update seth.py

Change in Documentation issue #612

* EVM refactor and simple UI (#629)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* Initial eth cli based on solidse.py (#633)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* initially evm cli from solidse.py

* rm prints, make import work

it's just `import seth` because this file runs from the perspective
of being inside the package. `from manticore.seth` doesn't work
because manticore.py gets priority over the manticore package, and
there is no seth entity inside manticore.py

* rm wip cli file

* add excess printing as a big comment

* print minimal report

* require .sol only

* rm solidse again

* rm fluff

* evm: Make 'not enough funds' states finalized states (#636)

* print on every

* terminate not enough fund states

* Better check

* revert debug change

* Implement initial evm workspace, fix small bugs (#638)

* print on every

* save the bytecode to look at later

* update tuple

* wip workspace files

* wip

* generate tx files

* rm unused event handler

* clean up solving for tx.data

* Revert "print on every"

0caaae3658a169c9763c51544aa3c79a4e3940ca

* Detectors () (#637)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* Code review

* Code review

* Code review

* Initial detector plugin. integer overflow and unitialized mem

* Better metadata handling and new events for detectors

* detectors wip

* Better name for internal findings context

* Explicit detector register

* review

* Refactor concolic implementation (#601)

* Refactor concolic.py

* make arg name more descriptive

* A few cleanups

* Keep track of traces

* Added perm() description

* Rm meaningless paths variable

* little comment

* rm bug comment

trace set is the correct solution; we need to filter out satisfiable but
redundant paths that are generated by the dumb permuter

* clean comments, debug stuff

* Better EVM workspace output (#641)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* Code review

* Code review

* Code review

* Initial detector plugin. integer overflow and unitialized mem

* Better metadata handling and new events for detectors

* detectors wip

* Better name for internal findings context

* Explicit detector register

* review

* New workspace output

* Fix examples

* wrog merge fix

* Fix examples/new api

* Fix examples/new api/output

* More output

* More doc

* Broken examples deleted

* Debug code removed

* Wrong docstring

* Update evm __main__

* Update evm __main__

* Update evm __main__

* Update evm __main__

* Update evm __main__

* Fix TODO

* Fix for issue #642 (#643)

* version argument in manticore

* Fix 591 - Exception Handler

* Issue 597 - Remove the unused policy argument

* fix issue 642

* Fix z3 oddity: reset vs optimization (#627)

* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Mitigates the wrong objectives print in z3 4.4.x

* Exception to SolveException

* Fix compilation bug (#645)

* fix for #608 using a local definition (#644)

* refactor logs files content (#646)

- if no logs just print nothing
- output any printable bytes in the memlog as a convenience in case they logged strings
2017-12-21 17:02:44 -05:00
feliam
db80685758
Better EVM workspace output (#641)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* Code review

* Code review

* Code review

* Initial detector plugin. integer overflow and unitialized mem

* Better metadata handling and new events for detectors

* detectors wip

* Better name for internal findings context

* Explicit detector register

* review

* New workspace output

* Fix examples

* wrog merge fix

* Fix examples/new api

* Fix examples/new api/output

* More output

* More doc

* Broken examples deleted

* Debug code removed

* Wrong docstring

* Update evm __main__

* Update evm __main__

* Update evm __main__

* Update evm __main__

* Update evm __main__

* Fix TODO
2017-12-15 02:17:41 -03:00
feliam
4b79711b92
Detectors () (#637)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* Code review

* Code review

* Code review

* Initial detector plugin. integer overflow and unitialized mem

* Better metadata handling and new events for detectors

* detectors wip

* Better name for internal findings context

* Explicit detector register

* review
2017-12-12 14:56:39 -03:00
Mark Mossberg
3f0441148f
Initial eth cli based on solidse.py (#633)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review

* initially evm cli from solidse.py

* rm prints, make import work

it's just `import seth` because this file runs from the perspective
of being inside the package. `from manticore.seth` doesn't work
because manticore.py gets priority over the manticore package, and
there is no seth entity inside manticore.py

* rm wip cli file

* add excess printing as a big comment

* print minimal report

* require .sol only

* rm solidse again

* rm fluff
2017-12-08 11:15:03 -05:00
feliam
ed29a22fce
EVM refactor and simple UI (#629)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor

* Various refactors. Auxiliar for calculating % coverage

* Change report in examples

* Detailed transactions and reporting accessible to the user2

* Fix on Expression Array

* Some documentation

* Get full ABI from solc compiler

* evm/examples -> bugfixes

* Clarify try/except blocks

* Code review

* Code review
2017-12-07 20:19:16 -03:00
feliam
9c777e6d2b
EVM api refactor (#589)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Initial seth in place refactor

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* refactors

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* WIP seth doc

* WIP move seth

* seth moved to manticore module

* Fixed DUP and typo

* Slightly better evm reporting

* review

* review

* Removed unfinished refactor
2017-11-29 19:00:49 -03:00
feliam
3a63402ae5
EVM assembler/disassembler doc and cleanup (#563)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes

* Doc and cleanups in evm assembler

* EVMInstruction -> Instruction

* cleanups

* typo

* deepcopy in Constant

* Better EVM-asm api and doc

* some docs

* More evm asm docs

* Fix import *

* typo

* newline between text and param

* similar phrasing to all the other flags

* typo

* typo

* fix function name in comment

* sphinx newline

* documentation fixes

* documentation fixes

* EVMAssembler to EVMAsm

* Fix evm @hook signature

* EVMAsm

* EVMasm refactor
2017-11-29 13:22:16 -03:00
cole-lightfighter
fccf451406 Assert valid operand length (#558)
* Assert valid bytecode and operand length

EVM bytecode comes in 32-byte chunks, and contracts require at least one
segment to be created. An example, originally written by @ggrieco-tob in issue #546, is included.
Unsure what expected behavior should be, but initial state has a problem when a contract is
created with a single byte.

Also added some exception handling in `parse_operand()` to catch invalid
instructions, e.g. a PUSH1 instruction followed by no bytes.

Signed-off-by: Cole Lightfighter <cole@onicsla.bz>

* Fix SLOAD invalid memory access

Simple check to ensure address storage is in global_storage before
attempting to load data.

* Remove invalid assertions
2017-11-21 15:56:00 -03:00
Mark Mossberg
1dbf40ea8e
Add UMD simple assert example (#573) 2017-11-20 15:35:32 -05:00
feliam
94d2e94bf1
New API for EVM analysis (#551)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code

* New solidity biased API and reporting

* Updated examples to new api WIP

* simple_mapping FIXED. new api

* Simple transaction example added. msg.value can be symbolic now

* Reentrancy symbolic now updated to new API + bugfixes
2017-11-14 12:06:08 -03:00
feliam
08e8c3b7d8 Fix coverage calculation vs. metadata (#529)
* Fixes symbolic reentrancy example

* Fix coverage Issue# 527

* Remove  debug unused code
2017-10-23 17:45:01 -03:00
feliam
a9ad183354 Fixes symbolic reentrancy example (#528) 2017-10-20 16:43:22 -03:00
feliam
8591bff45f EVM support (#521)
* WIP New Policy class

* WIP pubsub

* Update Signal tests

* EVM support - Wip

* EVM support - dependencies fixed

* EVM support - fix decree merge

* fix decode instrucion event

* Fix small bugs in evm opcodes (too many arguments + wrong LOG name) (#380)

Fix wrong call parameters + typo

* Fix Create/Call

* Fix depth

* Default fixed point in arithmetic simplifier

* small fixes from github comments

* Fix event decode_instruction signature

* wip wip

* Auto tests for evm

* New EVM tests

* Ran 9556  FAILED (failures=166, errors=8, skipped=62)

* Fix some arithmetic instructions

* Ran 9556  FAILED (failures=136, errors=8, skipped=62)

* More instructions - Optimizing symbolic memory

* Added gas to opcodes description - FIX DELEGATECALL POPS

* Add wip wallet example

* The tests

* Solidity constructors need argument after bytecode

* Simple integer overflow working

* Good merge

* Good good merge

* WIP manticore refactor

* Fix default old-style initial state

* context now working

* Fix context serialization

* Fix test models.  Can not set a state constraints

* typo

* A few typos (constraints setter) and use of public properties in internal methods

* Fix init wallet example

* State __init__ needs to initialize platform constraints

* Internal methods use internal properties

* Better attack modeling

* Better example layout

* Storage backup on CALL is now faster .. and correct

* Add LOG support

* Minimal SE test

* Added examples

* Send ether bugfix

* EVM: Fix wrong balance destination on CALL + decrease caller balance on CREATE

* New balance management

* Trying to maintain known hashes

* Known hash concretization policy

* CALLDATA max size bugfix

* Minimal SE example

* Remove evm tests

* add -> enqueue

* @m.init

* Fix workspace url

* Some test skipped

* Ad Fixme to platform specific stuff in State

* add -> enqueue

* Enqueue created state

* Fix m.init

Use a messy hack to adhere to the spec (callback func receive 1 state argument)

* Add _coverage_file ivar to Manticore

* Fix symbolic files

* remove extra enqueue

* Fixing __main__

* comments

* Fix visitors oddity

* setup merged

* remove duplicates and add pysha3

* Remove EVMTests import

* Refactor platform specific code out of ManticoreOutput (#505)

* Initial moving work

* Clean

* Make linux.generate_workspace_files work

* Fix

* clean

* Add test

* Test workspace for platform files

* Skip EVM cpu pretty print

* Remove bad import

* Fix coverage.py for testing

* Clean comment

* Comment hack

* Print evm cpu

* pretty print evm world instead of platform

* delet old scripts/examples

* delet old tests

* Remove z3 install script

* Array.max_size can be None, include check for that

* Rm unused _symbolic_files

add_symbolic_files was moved to linux, so this is not needed

* Rm unused args

* Import evm

* Rm dup function

* Rm stray prints

* Add docs for new classmethod apis

* minimal

* minimal example

* fix minimal

* Fair symbolic SHA3 handling

* Simple mapping example

* coverage example

* fix tests

* fix minimal

* Some eko fixes

* New SETH

* integer_overflow refactored

* Fixing the examples

* init_bytecode -> init
'

* Concrete reentrancy exampole

* concrete reentrancy selfdestruct

* Update minimal.py

* It's a new Minimal

* Integer overflow example

* New minimal

* minimal fix

* Examples last minute fixes

* Remove debug print

* add plugin.py

* Fixing event subscription

* remove temp params

* Remove param

* Update uncovered will_exec callback prototype

* Clean up debug output

* Automatically generated intruction tests

* Uninplemented instruction test removed

* Unused concretization policy removed

* Fixes enabling default bplugins

* solc from PATH

* Removed unused import

* Logger name updated
2017-10-17 19:47:20 -03:00
Yan
7679773088 Update examples (#477)
* Use locked_context() in count_instructions example

 * We use this example on the front page, and it currently generates
   a flood of warnings.

* Update example indeces

* Remove dump_stats()

* Remove extra comments

* Remove redundant comments
2017-09-01 17:05:43 -04:00
Yan
ca0d7b60d2 Add basic socket support (#428)
* Add a descriptor class for socket(2) return values

* Add basic socket(2) and bind(2)

* Basic accept(2)

* Basic recv(2) support

* Debug statements and accept(2)

* Add check for symbolic arg to open(2)

* Fix an example warning

* send/sendfile

* debug->info for some mcore output

* Produce socket data as part of state serialization

* Clean up SLinux.sys_open()

* Document socket(2) peculiarities
2017-08-29 17:00:17 -04:00
JP Smith
5109e2835f Fix building linux examples and test for future failure (#284)
* fix building linux examples and test for future failure

* fix cd back and typo
2017-06-14 11:23:55 -04:00
JP Smith
124c9d6de5 Add manticore-examples to README and remove google challenge (#271)
* add manticore-examples to README and remove google challenge

* re-do usage section and add manticore-examples repo
2017-05-24 16:09:48 -05:00
Mark Mossberg
a10b7bae29 Update parallel processing api (#246)
* Remove m.workers, add run(procs=), update docs

* Update docs
2017-05-10 19:44:55 -04:00
Cory Duplantis
b8991e0c64 Add Google2016 unbreakable challenge to examples repo (#194)
* Add Google2016 unbreakable challenge to examples repo

* Add Google2016 unbreakable challenge to examples repo

state.add instead of state.constraints.add

* Update constraints API
2017-05-09 18:35:38 -04:00
feliam
b19a158b6f Clean and document some example/linux (#176)
* Clean arguments.c

* Increase query timeout from 30 to 120 seconds

* Example documentation updated

* Add ibranch comments

* crackme.py, ibranch, sindex and typos

* indexhell

* visitad typo

* typo

* strncmp example

* Typos
2017-05-02 17:04:07 -04:00
Mark Mossberg
fbe3a197ba Install instructions updates (#171)
* Install instructions updates

* Update README.md

* also need pip

* need to update, plus compact a few things

* add -y

* grammar?

* typos

* Add bountysource link

* consistency

* Point users to the examples dir and wiki

I thought these links were cluttering things a bit, and 2 out of 3 of
them aren’t official documentation yet we’re linking to them in the
first line of the README. I updated the wiki to address these directly
in a way I think is more clear.

* link to Z3 releases

* oops, don't know where that came from

* ensure people run the latest pip

* be more explicit

* Add an Issue Template

* be more explicit

* no longer appropriate here

* unnecessary

* add note about 16.04

* move issue template to hidden folder

* Spelling

* be explicit, makes copy/paste easier
2017-04-24 12:19:10 -04:00
Mark Mossberg
f552383e16 Add example taint usage (#161)
* Add example taint usage

- use new_symbolic_value API instead, because it's making an int symbolic
- add every instruction hook that checks for tainted data in operands

* update readme with taint example
2017-04-21 14:59:06 -04:00
Yan
daab8a5824 Add examples (#145)
* intermediate example commit
* Added more state_explore examples (w/ new_symbolic_buffer)
* Actually comment out verbosity
* rename
* Add comment mentioning symbolicate_buffer
* Update comments
* Fix issue with limited exploration
* Clear up wording
* Update descriptions
* Remove reference to symbolicate_buffer
* Clean up state_explore.c header
* move .c to src/
2017-04-19 14:12:58 -04:00
Yan
5c112e56f3 Add brief example descriptions to README (#120)
* Added brief example descriptions to README
* Update config script
* Update sym.py API usage
* Remove individual example descriptions
* fix mcore init
* consistently document examples
* make basic_sym runnable
* More path fixes
* cleanup; update api
2017-04-10 14:31:51 -04:00
JP Smith
1bcadfed4d Add memory corruption example (#124)
* add memory corruption example

* put binary in proper folder
2017-04-06 10:39:45 -05:00
JP Smith
ccd473b88e add partial solves for multiple-styles (#123) 2017-04-06 10:39:07 -04:00
JP Smith
053cc5ff8d Fix run_simple.py (#102)
`Manticore(None, path)` throws an error
2017-03-23 09:52:39 -05:00
JP Smith
e77628bfe7 Add example crackme (#77)
* add example crackme

* make filename and directory structure more accurate
2017-03-17 14:43:06 -05:00
Mark Mossberg
f0069792c3 Misc cleanup: Rm old script, unused executor hooking functions (#38)
* Rm old irrelevant example script

* Make this easier to copy and paste

* Rm old unused executor hooking
2017-03-01 13:47:46 -05:00
Mark Mossberg
d6393cc8a6 Add hook decorator (#28)
* Add m.add_hook test

* Add @m.hook test

* Add `hook` decorator for convenience

* Update readme and examples

* Update run_callback

* Improve `add_hook` docstring

expound on callback structure

* Rm debug print

* Improve docstring
2017-02-27 15:44:33 -05:00
Mark Mossberg
9d3dfec08b Rm helloworld in make clean (#27) 2017-02-24 15:21:28 -05:00
Mark Mossberg
44bf8745a1 m.start -> m.run (#25) 2017-02-22 10:08:35 -05:00
Yan
724db78907 Assign context object to Manticore itself (#13)
* Make Manticore behave like a dict; slim callback
* Update all sample scripts to not take a context
* Add a sample script (count_instructions.py)
* We no longer need to close over Manticore state; add callback directly
* Move Manticore's context to a public attribute
2017-02-15 14:48:55 -05:00
Yan
dde79a0bab Remove ManticoreControl object [#180] (#4)
* Remove ManticoreControl object
* Some changes were brought in from dev-symbolicate-api
* Add Manticore.terminate()
* Add State.abandon()
* Update sample scripts
* Remove ctl from README
* Fix tests
* Bring in changes from dev-symbolicate-api
* Lower-case wildcard
* string -> cstring
* abandon() docstring
* Rename "name" to "label"
* Remove obsolete comment
* Make NUL a possible value for the last byte of a cstring
* Fix AbandonState and add example binary&script
* name -> label in tests, manticore.py
* Ignore .DS_Store
* Update symbolicate_buffer docstring
2017-02-14 14:54:52 -05:00
yan
badf1ab28e Initial import 2017-02-13 12:04:15 -05:00