227 Commits

Author SHA1 Message Date
Yan
2916d7e3ae Support tracing (#247)
* Script for generating syscall tables

* Add generated syscall table

* Reintroduce tracing script

* Add configuration options needed by verify.py

* Clean up verify; remove dependency on experimental after_hook

* trace experiments

* reorg verify.py

* Update after merge

* Remove Manticore param

* Remove unused vars

* Use regfile api; redo last_instr check

* Fix gdb->mcore name descrepancy

* Move kwargs to explicit args for Linux/SLinux

 * Maintain options in makeLinux to not overcomplicate the Manticore
   class

* Address merge issues

* remove debug stmt

* Reintroduce options

* Revert linux.py/manticore.py from master

* Use the qemu -s and -R flags

* Import syscalls table from master

* And import extract_syscalls.py script

* Fix verify reference

* Move syscall to arg

* Update register references

* Simplify last instruction check

* Add logging filter to TRACE logger as well

* Be consistent with state synchronization

* Be explicit about gdb types

* Improve mmap debug output

* Return error if ioctl is not implemented

* Fix syscall sync

* Make logging more self-contained

* Use errno const in ioctl impl
2017-06-05 16:16:54 -04:00
JP Smith
14499f7ba8 Add solve_buffer to API (#280)
* add solve_buffer to api and update google ctf script to use it

* start adding push/pop_constraints functionality

* remove push/pop constraints, just use with

* add mark's changes

* add solve_buffer to api.rst

* fix typo
2017-06-05 14:49:39 -04:00
Feist Josselin
573d171491 Add input-related features (#248)
* Add input-related features
* Add add_symbolic_file() function to Manticore
      -> Add symbolic file: m.add_symbolic_file('file.txt')
      -> 'symbolic.txt' is not longer a default symb file
* Symb files are generated by Executor.generate_testcase()
* Add generate_inputs() function to State
      -> can be called by an user-level script

* Use of Executor._getFilename to generate symb files in the workspace

* Consolidate the filename of generated symb files

* - replace % with format in executor.generate_testcase / state.generate_inputs
- replace file() with open() in executor.generate_testcase / state.generate_inputs
- replace hasasttr with getattr in executor.generate_testcase / state.generate_inputs
- use None as default arguments for symbolic_files

* file -> open

* Simplify symbolic_files param

* Make filename uniform

* Docstring clean
2017-06-05 12:25:49 -04:00
Mark Mossberg
5b5392e54d Implement user variadic model interface (#276)
* Add variadic decorator

* Add check for _variadic func attribute

* Expose @variadic at top level

* Use variable for the actual name of attr

* Update naming

* Use helper

* Maybe more pythonic?

* Add variadic to public API

* Add variadic decorator tests

* Clean

* Remove variadic parameter

* Add docstrings

* Document parameter

* Clean

* Better use of autodoc

* Update docstring

* Add todo comment
2017-05-31 15:48:19 -04:00
Feist Josselin
aeca64285a Optimizations and bug fixes in smt formulas (#249)
* Remove the use of the incremental mode in get_all_values

* Improvement and bug fixes in visitor.py
* PretyPrinter: Remove dupplicate printed information
* TranslatorSmtLib: Remove dupplicate operands in the generated formulas
* ConstantFolderSimplifier:
  * Add new operators (BitVecZeroExtand / BitVecExtract)
  * Add no-trivial operators into the operations dict
      -> users can known that these operators are handled
* ArithmeticSimplifier:
  * Use of a recursive approach to visit expression (faster)
  * Fix the missing calls to no-trivial operators for constant folding
  * Add new operator (ArraySelect)

* Fix issues on corner cases (tests/travis_test.sh ok)

ArithmeticSimplifier: recursive approach less interesting in travis_test.sh
Use a stack approach, which includes bugfixes of the original

* - Call direclty constant_folder() in ArithmeticSimplifier
- Remove None bindings in ConstantFolderSimplifier.operators
- Move the fixed point thing direclty to the Visitors.visit (new parameter: use_fixed_point)

* - Calling constant_folder only if all operands are constants
- Add None default attribute to getattr
2017-05-26 16:28:22 -03:00
Yan
0b710dd86a Add basic syscalls (#270)
* Add sys_umask and sys_chdir
2017-05-26 11:50:39 -04:00
Mark Mossberg
8354ded7e0 Test hook api (#274) 2017-05-25 16:22:08 -04:00
Mark Mossberg
c2b0617f32 Check returncode of manticore (#273) 2017-05-25 16:04:34 -04:00
David Manouchehri
d87c983b98 Added Dockerfile. (#240)
* Added Dockerfile.

* Changes as requested by @japesinator.
2017-05-24 16:49:37 -05:00
JP Smith
124c9d6de5 Add manticore-examples to README and remove google challenge (#271)
* add manticore-examples to README and remove google challenge

* re-do usage section and add manticore-examples repo
2017-05-24 16:09:48 -05:00
Yan
452c92a340 Update fstat/fstat64, add few syscall wrappers (#261)
* mmap; newstat; exit; sigprocmask syscall wrappers

* Fix fstat and fstat64 implementations

* use st_blocks/st_blksize

* Experiment with fstat structs

* Make uname more verbose

* Fix uname implementation

* Fix newfstat

* Fix fstat64

* Fix fstat

* Refactor uname
2017-05-24 15:15:50 -04:00
Yan
3c977719f0 Linux platform refactoring (#264)
* Clean up model syscall invocation
* Move read_string to Cpu
* move push/pop helpers to Cpu
* Reorg Linux initialization
* Update linux test
* fstat64 test harness
* assert read_string only considers concrete bytes
* Ensure that correct aliases exist during ctor
* Improve alias check
2017-05-23 15:30:58 -04:00
feliam
475f786f21 Fix x86.PUNPCKL emulation (#259)
* Fix x86.PUNPCKL emulation

* trace check wip

* PUNPCKH/L and Readlink /proc

* PUNPCK fixes

* remove debug traceback

* rename arguments insteag of commenting them

* fix comment
2017-05-23 15:21:48 -03:00
JP Smith
ea4f8edfd4 remove default nsolves parameter from solve_n (#266) 2017-05-22 14:14:27 -05:00
JP Smith
0029c8fdc5 refactor the verbosity interface to look cleaner (#265) 2017-05-22 14:14:03 -05:00
Sascha Schirra
b381c4e04d VORPD and VORPS instructions added (#258) 2017-05-19 14:49:22 -05:00
Mark Mossberg
8840e31fc2 Add strlen model (#260)
* add models

* wip strcmp tests

* t

* Add some tests

* Better asserts

* More pythonic

* Add effectivene null test

* init strlen

* pythonic range

* clean

* docstring

* tmp

* stuff

* stuff

* Complete test

* Add another test

* Doc

* clean

* Add symbolic arg check

* Fix tests

* Make arch generic

* Clean comment

* Add basic unconstrained test
2017-05-18 16:59:44 -04:00
JP Smith
10f7531cae Use newer, less broken capstone version (#262)
* use newer, less broken capstone version

* fix documentation
2017-05-18 11:19:14 -05:00
Mark Mossberg
92eaf76236 Add strcmp model (#251)
* add models

* wip strcmp tests

* t

* Add some tests

* Better asserts

* More pythonic

* Add effectivene null test

* Handle symbolic pointer arguments
2017-05-17 11:44:10 -04:00
Mark Mossberg
e5aca50e1f Don't use string=True for symbolic arg/env (#256)
This very strictly constrains the arg/env to the length of the symbolic
string which is too strict for many use cases.

For example:

manticore ./bin +++++

that symbolic string would only be allowed to be strings of length 5,
and no shorter.
2017-05-15 17:38:22 -04:00
Yan
42c28e0256 Handle missing syscalls with correct exception (#255) 2017-05-15 16:07:01 -04:00
Yan
2202b0a27d Generate NRs for ARM-specific syscalls (#254) 2017-05-15 15:11:54 -04:00
Mark Mossberg
42955387a5 Don't make concrete bytes symbolic, only wildcard bytes (#252) 2017-05-12 17:31:59 -04:00
Mark Mossberg
7700112d9e Rm unused Slinux ctor params (#250)
* Rm unused Slinux ctor params

Fixes #109

* Add back constraitns

* Make argv and envp default params

* Use ternary

* nit

* Clean test_unicorn

* Correct envp and docstring
2017-05-12 11:35:59 -04:00
Mark Mossberg
1e76998eb7 Add infrastructure for core models (#244)
* Rename libc.py to models.py

* Clean old unused libc.py code

* Make models top level importable

* Add State level model invocation function

So user is not required to pass in state at to a platform level func

* Explicitly mark what is in the public API

Protects against accidentally making something a public API just because
it has a docstring

* clean

* Move models.py to top level

* Rm models

* Fix docstring typo

* Add default param name, move comment

* Update docstring
2017-05-11 13:25:43 -04:00
Yan
a0717aa661 Syscall table rework (#245)
* Script for generating syscall tables from Linux src (pulled from kernel.org)

* Add generated syscall table

* Update syscall names to match extracted entries

* Move to new syscall dispatcher

* Add machine def to x86 cpus
2017-05-11 12:20:00 -04:00
Mark Mossberg
a10b7bae29 Update parallel processing api (#246)
* Remove m.workers, add run(procs=), update docs

* Update docs
2017-05-10 19:44:55 -04:00
Mark Mossberg
e4a4916597 Rename os model terminology from "models" to "platforms" (#243)
* Rename

* rename in manticore.py

* rename in executor.py

* big rename

* big rename

* update changelog
2017-05-09 19:25:32 -04:00
Cory Duplantis
b8991e0c64 Add Google2016 unbreakable challenge to examples repo (#194)
* Add Google2016 unbreakable challenge to examples repo

* Add Google2016 unbreakable challenge to examples repo

state.add instead of state.constraints.add

* Update constraints API
2017-05-09 18:35:38 -04:00
Yan
3c9653d1d7 Update syscall/funcall implementation (#213)
* Wrap ABI semantics in its own class hierarchy

* Define a model invocation for syscalls and function calls

* Add unit tests for ABI

* Add a common base class for Platform models
2017-05-09 16:13:08 -04:00
Mark Mossberg
3873c3eb5d Document m.context API (#238) 2017-05-08 15:39:18 -04:00
Mark Mossberg
fca086ea45 Add hack for Unicorn YMM registers (#239) 2017-05-08 15:14:37 -04:00
Yan
395a40a646 Add memory tracing (#203)
* implement memory write tracing

* Comment updates

* Add memory trace tests

* make sure we ignore erroring writes

* Address comments

* remove superfluous return annotation
2017-05-08 14:32:54 -04:00
Mark Mossberg
868bdd80ce Manticore 0.1.1 (#234) 2017-05-05 15:21:52 -04:00
Mark Mossberg
44d365ff4c Formalize API for constraining a State (#232)
* Rename state.add to state.constrain

* Update all uses of state.constrain

* Rm check param

* Added changelog

* Update changelog

* Update

* Minor clean
2017-05-05 13:31:43 -04:00
Yan
50fd50ee12 Simplify linux model interfaces (#233) 2017-05-05 13:11:59 -04:00
Tim Deeb-Swihart
aafc0e7284 Fix handling of Z3 result in optimize due to nondeterministic output ordering (#226) (#227) 2017-05-05 13:43:22 -03:00
Samuel Groß
d9baedeeac sys_sigprocmask: the second method parameter has to be the cpu instance (#229) 2017-05-05 13:33:42 -03:00
Yan
64d1ed51f2 Decode instruction early (#205)
* Move PC verification to decode_instruction

* Decode instruction in executor

* Fix unicorn tests

* remove decoded_pc

* use issymbolic()
2017-05-04 17:36:39 -04:00
JP Smith
93f9d77f40 Switch to ssh-style verbosity CLI flags (#222)
* switch to ssh-style verbosity CLI flags

* add register logging to level 4
2017-05-04 14:40:22 -05:00
Tim Deeb-Swihart
538dfea8fe Fix incorrect syscall arg regs for X86 (#224) (#228)
i386 and amd64 had their register sets reversed. This fixes that.
2017-05-03 14:05:03 -04:00
Samuel Groß
af2676402c Implemented sys_readv system call (#217)
* Implemented sys_readv system call

* sys_readv and sys_writev are now independent of the system bitness
2017-05-02 17:33:29 -04:00
feliam
b19a158b6f Clean and document some example/linux (#176)
* Clean arguments.c

* Increase query timeout from 30 to 120 seconds

* Example documentation updated

* Add ibranch comments

* crackme.py, ibranch, sindex and typos

* indexhell

* visitad typo

* typo

* strncmp example

* Typos
2017-05-02 17:04:07 -04:00
Manas George
f4e5bcf53e refactored will_execute_pc hooks (#214)
* Refactored will_execute_pc hooks

* Fixed typos

* Figured out why the simple_parse test was failing

* Figured out why the simple_parse test was failing

* Figured out why the simple_parse test was failing

* Figured out why the simple_parse test was failing

Cleanup

* Cleanup

* removed TODO from executor.py

* refactored line in forking handling in executor.py

* removed extraneous space in manticore.py

* removed --exe flag from nosetests command
2017-05-02 14:55:02 -04:00
Simon Bourne
0061ee5c48 CPUID now reports that extended features are unsupported (as unicorn doesn't support them). (#211) 2017-05-02 09:49:49 -04:00
Feist Josselin
0583162133 Fix wrong variable name in SymbolicFile (#220) 2017-05-01 21:07:45 -04:00
Samuel Groß
9e87d1dfa6 Added sys_ioctl to 64-bit syscall table (#218) 2017-05-01 20:54:27 -04:00
Samuel Groß
aabf5777ee Use correct value for AT_PHENT (#216) 2017-05-01 19:03:52 -04:00
Samuel Groß
94e6e76919 Fixed wrong syscall number for sys_faccessat (#215) 2017-05-01 18:23:00 -04:00
JP Smith
f7598e53c0 Only make registers appear on verbosity level 5 (#198)
* make --verbose output more useful

* refactor and rename rendering functions

* refactor to use join

* make sure str returns a value
2017-04-28 12:17:17 -05:00