Python SimState.merge方法代码示例

# 需要导入模块: from simuvex import SimState [as 别名]
# 或者: from simuvex.SimState import merge [as 别名]
def test_state_merge_static():
    # With abstract memory
    # Aligned memory merging
    a = SimState(mode='static')
    se = a.se

    addr = a.se.ValueSet(region='global', bits=32, val=8)
    a.memory.store(addr, a.se.BitVecVal(42, 32))

    b = a.copy()
    c = a.copy()
    a.memory.store(addr, a.se.BitVecVal(50, 32), endness='Iend_LE')
    b.memory.store(addr, a.se.BitVecVal(60, 32), endness='Iend_LE')
    c.memory.store(addr, a.se.BitVecVal(70, 32), endness='Iend_LE')

    merged, _, _ = a.merge(b, c)
    nose.tools.assert_true(merged.memory.load(addr, 4).identical(a.se.SI(bits=32, stride=10, lower_bound=50, upper_bound=70)))

# 需要导入模块: from simuvex import SimState [as 别名]
# 或者: from simuvex.SimState import merge [as 别名]
def test_state_merge_static():
    # With abstract memory
    # Aligned memory merging
    a = SimState(mode='static')

    addr = a.se.ValueSet(region='global', bits=32, val=8)
    a.memory.store(addr, a.se.BVV(42, 32))
    # Clear a_locs, so further writes will not try to merge with value 42
    a.memory.regions['global']._alocs = { }

    b = a.copy()
    c = a.copy()
    a.memory.store(addr, a.se.BVV(50, 32), endness='Iend_LE')
    b.memory.store(addr, a.se.BVV(60, 32), endness='Iend_LE')
    c.memory.store(addr, a.se.BVV(70, 32), endness='Iend_LE')

    merged, _, _ = a.merge(b, c)
    actual = claripy.backends.vsa.convert(merged.memory.load(addr, 4))
    expected = claripy.backends.vsa.convert(a.se.SI(bits=32, stride=10, lower_bound=50, upper_bound=70))
    nose.tools.assert_true(actual.identical(expected))

# 需要导入模块: from simuvex import SimState [as 别名]
# 或者: from simuvex.SimState import merge [as 别名]
def test_state_merge_static():
    # With abstract memory
    # Aligned memory merging
    a = SimState(mode="static")
    se = a.se

    addr = a.se.ValueSet(region="global", bits=32, val=8)
    a.memory.store(addr, a.se.BitVecVal(42, 32))
    # Clear a_locs, so further writes will not try to merge with value 42
    a.memory.regions["global"]._alocs = {}

    b = a.copy()
    c = a.copy()
    a.memory.store(addr, a.se.BitVecVal(50, 32), endness="Iend_LE")
    b.memory.store(addr, a.se.BitVecVal(60, 32), endness="Iend_LE")
    c.memory.store(addr, a.se.BitVecVal(70, 32), endness="Iend_LE")

    merged, _, _ = a.merge(b, c)
    nose.tools.assert_true(
        merged.memory.load(addr, 4).identical(a.se.SI(bits=32, stride=10, lower_bound=50, upper_bound=70))
    )

# 需要导入模块: from simuvex import SimState [as 别名]
# 或者: from simuvex.SimState import merge [as 别名]
def test_abstract_memory():
    from claripy.vsa import TrueResult

    initial_memory = {0: 'A', 1: 'B', 2: 'C', 3: 'D'}

    s = SimState(mode='static',
                 arch="AMD64",
                 memory_backer=initial_memory,
                 add_options={simuvex.o.ABSTRACT_SOLVER, simuvex.o.ABSTRACT_MEMORY})
    se = s.se

    def to_vs(region, offset):
        return s.se.VS(region=region, bits=s.arch.bits, val=offset)

    # Load a single-byte constant from global region
    expr = s.memory.load(to_vs('global', 2), 1)
    nose.tools.assert_equal(s.se.any_int(expr), 0x43)
    nose.tools.assert_equal(s.se.max_int(expr), 0x43)
    nose.tools.assert_equal(s.se.min_int(expr), 0x43)

    # Store a single-byte constant to global region
    s.memory.store(to_vs('global', 1), s.se.BitVecVal(ord('D'), 8), 1)
    expr = s.memory.load(to_vs('global', 1), 1)
    nose.tools.assert_equal(s.se.any_int(expr), 0x44)

    # Store a single-byte StridedInterval to global region
    si_0 = s.se.StridedInterval(bits=8, stride=2, lower_bound=10, upper_bound=20)
    s.memory.store(to_vs('global', 4), si_0)

    # Load the single-byte StridedInterval from global region
    expr = s.memory.load(to_vs('global', 4), 1)
    nose.tools.assert_equal(s.se.min_int(expr), 10)
    nose.tools.assert_equal(s.se.max_int(expr), 20)
    nose.tools.assert_equal(s.se.any_n_int(expr, 100), [10, 12, 14, 16, 18, 20])

    # Store a two-byte StridedInterval object to global region
    si_1 = s.se.StridedInterval(bits=16, stride=2, lower_bound=10, upper_bound=20)
    s.memory.store(to_vs('global', 5), si_1)

    # Load the two-byte StridedInterval object from global region
    expr = s.memory.load(to_vs('global', 5), 2)
    nose.tools.assert_true(expr.identical(si_1))

    # Store a four-byte StridedInterval object to global region
    si_2 = s.se.StridedInterval(bits=32, stride=2, lower_bound=8000, upper_bound=9000)
    s.memory.store(to_vs('global', 7), si_2)

    # Load the four-byte StridedInterval object from global region
    expr = s.memory.load(to_vs('global', 7), 4)
    nose.tools.assert_true(expr.identical(s.se.StridedInterval(bits=32, stride=2, lower_bound=8000, upper_bound=9000)))

    # Test default values
    s.options.remove(simuvex.o.SYMBOLIC_INITIAL_VALUES)
    expr = s.memory.load(to_vs('global', 100), 4)
    nose.tools.assert_true(expr.identical(s.se.StridedInterval(bits=32, stride=0, lower_bound=0, upper_bound=0)))

    # Test default values (symbolic)
    s.options.add(simuvex.o.SYMBOLIC_INITIAL_VALUES)
    expr = s.memory.load(to_vs('global', 104), 4)
    nose.tools.assert_true(expr.identical(s.se.StridedInterval(bits=32, stride=1, lower_bound=0, upper_bound=0xffffffff)))
    nose.tools.assert_true(expr.identical(s.se.StridedInterval(bits=32, stride=1, lower_bound=-0x80000000, upper_bound=0x7fffffff)))

    #
    # Merging
    #

    # Merging two one-byte values
    s.memory.store(to_vs('function_merge', 0), s.se.StridedInterval(bits=8, stride=0, lower_bound=0x10, upper_bound=0x10))
    a = s.copy()
    a.memory.store(to_vs('function_merge', 0), s.se.StridedInterval(bits=8, stride=0, lower_bound=0x20, upper_bound=0x20))

    b = s.merge(a)[0]
    expr = b.memory.load(to_vs('function_merge', 0), 1)
    nose.tools.assert_true(expr.identical(s.se.StridedInterval(bits=8, stride=0x10, lower_bound=0x10, upper_bound=0x20)))

    #  |  MO(value_0)  |
    #  |  MO(value_1)  |
    # 0x20          0x24
    # Merge one byte in value_0/1 means merging the entire MemoryObject
    a = s.copy()
    a.memory.store(to_vs('function_merge', 0x20), se.SI(bits=32, stride=0, lower_bound=0x100000, upper_bound=0x100000))
    b = s.copy()
    b.memory.store(to_vs('function_merge', 0x20), se.SI(bits=32, stride=0, lower_bound=0x100001, upper_bound=0x100001))
    c = a.merge(b)[0]
    expr = c.memory.load(to_vs('function_merge', 0x20), 4)
    nose.tools.assert_true(expr.identical(se.SI(bits=32, stride=1, lower_bound=0x100000, upper_bound=0x100001)))
    c_mem = c.memory.regions['function_merge'].memory.mem
    object_set = set([ c_mem[0x20], c_mem[0x20], c_mem[0x22], c_mem[0x23]])
    nose.tools.assert_equal(len(object_set), 1)

    a = s.copy()
    a.memory.store(to_vs('function_merge', 0x20), se.SI(bits=32, stride=0x100000, lower_bound=0x100000, upper_bound=0x200000))
    b = s.copy()
    b.memory.store(to_vs('function_merge', 0x20), se.SI(bits=32, stride=0, lower_bound=0x300000, upper_bound=0x300000))
    c = a.merge(b)[0]
    expr = c.memory.load(to_vs('function_merge', 0x20), 4)
    nose.tools.assert_true(expr.identical(se.SI(bits=32, stride=0x100000, lower_bound=0x100000, upper_bound=0x300000)))
    object_set = set([c_mem[0x20], c_mem[0x20], c_mem[0x22], c_mem[0x23]])
    nose.tools.assert_equal(len(object_set), 1)

#.........这里部分代码省略.........

# 需要导入模块: from simuvex import SimState [as 别名]
# 或者: from simuvex.SimState import merge [as 别名]
def test_state_merge():
    a = SimState(mode='symbolic')
    a.memory.store(1, a.se.BVV(42, 8))

    b = a.copy()
    c = b.copy()
    a.memory.store(2, a.memory.load(1, 1)+1)
    b.memory.store(2, b.memory.load(1, 1)*2)
    c.memory.store(2, c.memory.load(1, 1)/2)

    # make sure the byte at 1 is right
    nose.tools.assert_equal(a.se.any_int(a.memory.load(1, 1)), 42)
    nose.tools.assert_equal(b.se.any_int(b.memory.load(1, 1)), 42)
    nose.tools.assert_equal(c.se.any_int(c.memory.load(1, 1)), 42)

    # make sure the byte at 2 is right
    nose.tools.assert_equal(a.se.any_int(a.memory.load(2, 1)), 43)
    nose.tools.assert_equal(b.se.any_int(b.memory.load(2, 1)), 84)
    nose.tools.assert_equal(c.se.any_int(c.memory.load(2, 1)), 21)

    # the byte at 2 should be unique for all before the merge
    nose.tools.assert_true(a.se.unique(a.memory.load(2, 1)))
    nose.tools.assert_true(b.se.unique(b.memory.load(2, 1)))
    nose.tools.assert_true(c.se.unique(c.memory.load(2, 1)))

    logging.getLogger('simuvex.plugins.symbolic_memory').setLevel(logging.DEBUG)
    m, merge_flag, merging_occurred = a.merge(b, c)
    logging.getLogger('simuvex.plugins.symbolic_memory').setLevel(logging.WARNING)

    nose.tools.assert_true(merging_occurred)
    nose.tools.assert_equals(sorted(m.se.any_n_int(merge_flag, 10)), [ 0,1,2 ])

    # the byte at 2 should now *not* be unique for a
    nose.tools.assert_false(m.se.unique(m.memory.load(2, 1)))
    nose.tools.assert_true(a.se.unique(a.memory.load(2, 1)))
    nose.tools.assert_true(b.se.unique(b.memory.load(2, 1)))
    nose.tools.assert_true(c.se.unique(c.memory.load(2, 1)))

    # the byte at 2 should have the three values
    nose.tools.assert_items_equal(m.se.any_n_int(m.memory.load(2, 1), 10), (43, 84, 21))

    # we should be able to select them by adding constraints
    a_a = m.copy()
    a_a.add_constraints(merge_flag == 0)
    nose.tools.assert_true(a_a.se.unique(a_a.memory.load(2, 1)))
    nose.tools.assert_equal(a_a.se.any_int(a_a.memory.load(2, 1)), 43)

    a_b = m.copy()
    a_b.add_constraints(merge_flag == 1)
    nose.tools.assert_true(a_b.se.unique(a_b.memory.load(2, 1)))
    nose.tools.assert_equal(a_b.se.any_int(a_b.memory.load(2, 1)), 84)

    a_c = m.copy()
    a_c.add_constraints(merge_flag == 2)
    nose.tools.assert_true(a_c.se.unique(a_c.memory.load(2, 1)))
    nose.tools.assert_equal(a_c.se.any_int(a_c.memory.load(2, 1)), 21)

    # test different sets of plugins
    a = SimState(mode='symbolic')
    nose.tools.assert_true(a.has_plugin('memory'))
    nose.tools.assert_true(a.has_plugin('registers'))
    nose.tools.assert_false(a.has_plugin('libc'))

    b = a.copy()
    a.get_plugin('libc')
    nose.tools.assert_true(a.has_plugin('libc'))
    nose.tools.assert_false(b.has_plugin('libc'))
    c = a.copy().merge(b.copy())[0]
    d = b.copy().merge(a.copy())[0]
    nose.tools.assert_true(c.has_plugin('libc'))
    nose.tools.assert_true(d.has_plugin('libc'))

    # test merging posix with different open files
    a = SimState(mode='symbolic')
    b = a.copy()
    a.posix.get_file(3)
    nose.tools.assert_equal(len(a.posix.files), 4)
    nose.tools.assert_equal(len(b.posix.files), 3)
    c = a.copy().merge(b.copy())[0]
    d = b.copy().merge(a.copy())[0]
    nose.tools.assert_equal(len(c.posix.files), 4)
    nose.tools.assert_equal(len(d.posix.files), 4)