Python claripy.Concat方法代码示例

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def raw(self, arch=None):

        register = self.register
        value = self.value
        ip = self.pc

        if isinstance(value, int):
            value = claripy.BVV(value, 32)
        if isinstance(ip, int):
            ip = claripy.BVV(ip, 32)

        try:
            code_row = [claripy.BVV(x) for x in self.codes[register]]
        except KeyError:
            raise ValueError("register '%s' does not exist" % register)

        return claripy.Concat(code_row[0], value.reversed, code_row[1], ip.reversed,  code_row[2]) 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def __init__(self, crash, register, reg_bitmask, ip_bitmask, reg_mem, value_var, ip_var):
        '''
        :param crash: a crash object which has been modified to exploit a vulnerability
        :param register: the register set by the exploit
        :param reg_bitmask: the bitmask indicating the bits of the register can be controlled
        :param ip_bitmask: the bitmask indicating the bits of the ip can be controlled
        :param reg_mem: memory containing the register setting content
        :param value_var: claripy variable representing the value to set the register to
        :param ip_var: claripy variable representing the value to set ip to
        '''
        super(CGCType1CircumstantialExploit, self).__init__(crash, register, bypasses_nx=True, bypasses_aslr=True,
                                                            reg_bitmask=reg_bitmask, ip_bitmask=ip_bitmask)

        self.method_name = 'circumstantial'

        self._arg_vars = [value_var, ip_var]

        self._mem = claripy.Concat(reg_mem[0], reg_mem[1])

        self._generate_formula() 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def x86g_dirtyhelper_loadF80le(state, addr):
    tbyte = state.memory.load(addr, size=10, endness='Iend_LE')
    sign = tbyte[79]
    exponent = tbyte[78:64]
    mantissa = tbyte[62:0]

    normalized_exponent = exponent[10:0] - 16383 + 1023
    zero_exponent = state.solver.BVV(0, 11)
    inf_exponent = state.solver.BVV(-1, 11)
    final_exponent = claripy.If(exponent == 0, zero_exponent, claripy.If(exponent == -1, inf_exponent, normalized_exponent))

    normalized_mantissa = tbyte[62:11]
    zero_mantissa = claripy.BVV(0, 52)
    inf_mantissa = claripy.BVV(-1, 52)
    final_mantissa = claripy.If(exponent == 0, zero_mantissa, claripy.If(exponent == -1, claripy.If(mantissa == 0, zero_mantissa, inf_mantissa), normalized_mantissa))

    qword = claripy.Concat(sign, final_exponent, final_mantissa)
    assert len(qword) == 64
    return qword, [] 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def x86g_dirtyhelper_storeF80le(state, addr, qword):
    sign = qword[63]
    exponent = qword[62:52]
    mantissa = qword[51:0]

    normalized_exponent = exponent.zero_extend(4) - 1023 + 16383
    zero_exponent = state.solver.BVV(0, 15)
    inf_exponent = state.solver.BVV(-1, 15)
    final_exponent = claripy.If(exponent == 0, zero_exponent, claripy.If(exponent == -1, inf_exponent, normalized_exponent))

    normalized_mantissa = claripy.Concat(claripy.BVV(1, 1), mantissa, claripy.BVV(0, 11))
    zero_mantissa = claripy.BVV(0, 64)
    inf_mantissa = claripy.BVV(-1, 64)
    final_mantissa = claripy.If(exponent == 0, zero_mantissa, claripy.If(exponent == -1, claripy.If(mantissa == 0, zero_mantissa, inf_mantissa), normalized_mantissa))

    tbyte = claripy.Concat(sign, final_exponent, final_mantissa)
    assert len(tbyte) == 80
    state.memory.store(addr, tbyte, endness='Iend_LE')
    return None, [] 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def generic_compare(self, args, comparison):
        if self._vector_size is not None:
            res_comps = []
            for i in reversed(range(self._vector_count)):
                a_comp = claripy.Extract((i+1) * self._vector_size - 1,
                                          i * self._vector_size,
                                          args[0])
                b_comp = claripy.Extract((i+1) * self._vector_size - 1,
                                          i * self._vector_size,
                                          args[1])
                res_comps.append(claripy.If(comparison(a_comp, b_comp),
                                         claripy.BVV(-1, self._vector_size),
                                         claripy.BVV(0, self._vector_size)))
            return claripy.Concat(*res_comps)
        else:
            return claripy.If(comparison(args[0], args[1]), claripy.BVV(1, 1), claripy.BVV(0, 1)) 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def _op_generic_QAdd(self, args):
        """
        Saturating add.
        """
        components = []
        for a, b in self.vector_args(args):
            top_a = a[self._vector_size-1]
            top_b = b[self._vector_size-1]
            res = a + b
            top_r = res[self._vector_size-1]
            if self.is_signed:
                big_top_r = (~top_r).zero_extend(self._vector_size-1)
                cap = (claripy.BVV(-1, self._vector_size)//2) + big_top_r
                cap_cond = ((~(top_a ^ top_b)) & (top_a ^ top_r)) == 1
            else:
                cap = claripy.BVV(-1, self._vector_size)
                cap_cond = claripy.ULT(res, a)
            components.append(claripy.If(cap_cond, cap, res))
        return claripy.Concat(*components) 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def _op_generic_QSub(self, args):
        """
        Saturating subtract.
        """
        components = []
        for a, b in self.vector_args(args):
            top_a = a[self._vector_size-1]
            top_b = b[self._vector_size-1]
            res = a - b
            top_r = res[self._vector_size-1]
            if self.is_signed:
                big_top_r = (~top_r).zero_extend(self._vector_size-1)
                cap = (claripy.BVV(-1, self._vector_size)//2) + big_top_r
                cap_cond = ((top_a ^ top_b) & (top_a ^ top_r)) == 1
            else:
                cap = claripy.BVV(0, self._vector_size)
                cap_cond = claripy.UGT(res, a)
            components.append(claripy.If(cap_cond, cap, res))
        return claripy.Concat(*components) 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def _op_divmod(self, args):
        if self.is_signed:
            quotient = (args[0].SDiv(claripy.SignExt(self._from_size - self._to_size, args[1])))
            remainder = (args[0].SMod(claripy.SignExt(self._from_size - self._to_size, args[1])))
            quotient_size = self._to_size
            remainder_size = self._to_size
            return claripy.Concat(
                claripy.Extract(remainder_size - 1, 0, remainder),
                claripy.Extract(quotient_size - 1, 0, quotient)
            )
        else:
            quotient = (args[0] // claripy.ZeroExt(self._from_size - self._to_size, args[1]))
            remainder = (args[0] % claripy.ZeroExt(self._from_size - self._to_size, args[1]))
            quotient_size = self._to_size
            remainder_size = self._to_size
            return claripy.Concat(
                claripy.Extract(remainder_size - 1, 0, remainder),
                claripy.Extract(quotient_size - 1, 0, quotient)
            )

    #pylint:enable=no-self-use,unused-argument

    # FP! 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def _auto_vectorize(self, f, args, rm=None, rm_passed=False):
        if rm is not None:
            rm = self._translate_rm(rm)
            if rm_passed:
                f = partial(f, rm)

        if self._vector_size is None:
            return f(args)

        if self._vector_zero:
            chopped = [arg[(self._vector_size - 1):0].raw_to_fp() for arg in args]
            result = f(*chopped).raw_to_bv()
            return claripy.Concat(args[0][(args[0].length - 1):self._vector_size], result)
        else:
            # I'm changing this behavior because I think this branch was never used otherwise
            # before it only chopped the first argument but I'm going to make it chop all of them
            result = []
            for lane_args in self.vector_args(args):
                if self._float:
                    # HACK HACK HACK
                    # this is such a weird divergence. why do the fp generics take several args and the int generics take a list?
                    result.append(f(*lane_args))
                else:
                    result.append(f(lane_args))
            return claripy.Concat(*result) 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def regression_test_memcmp_strlen_simprocedure_interaction():
    # import logging
    # logging.getLogger('angr.manager').setLevel(logging.DEBUG)

    bin_path = os.path.join(test_location, 'i386', 'cpp_regression_test_ch25')
    p = angr.Project(bin_path, auto_load_libs=True)  # this binary requires the loading of libstdc++.so.6
    argv1 = cp.Concat(*[cp.BVS('argv%d' % i, 8) for i in range(48)])

    state = p.factory.full_init_state(args=[bin_path, argv1],
                                      add_options=angr.sim_options.unicorn
                                      )

    sm = p.factory.simulation_manager(state)
    x = sm.explore(find=0x8048b9b, num_find=3)

    nose.tools.assert_equal(len(x.found), 1)
    for state in x.found:
        solution = state.solver.eval_one(argv1, cast_to=bytes).strip(b"\x00")
        nose.tools.assert_equal(solution, b"Here_you_have_to_understand_a_little_C++_stuffs") 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def test_reversed_concat():
    a = claripy.SI('a', 32, lower_bound=10, upper_bound=0x80, stride=10)
    b = claripy.SI('b', 32, lower_bound=1, upper_bound=0xff, stride=1)

    reversed_a = claripy.Reverse(a)
    reversed_b = claripy.Reverse(b)

    # First let's check if the reversing makes sense
    nose.tools.assert_equal(claripy.backends.vsa.min(reversed_a), 0xa000000)
    nose.tools.assert_equal(claripy.backends.vsa.max(reversed_a), 0x80000000)
    nose.tools.assert_equal(claripy.backends.vsa.min(reversed_b), 0x1000000)
    nose.tools.assert_equal(claripy.backends.vsa.max(reversed_b), 0xff000000)

    a_concat_b = claripy.Concat(a, b)
    nose.tools.assert_equal(a_concat_b._model_vsa._reversed, False)

    ra_concat_b = claripy.Concat(reversed_a, b)
    nose.tools.assert_equal(ra_concat_b._model_vsa._reversed, False)

    a_concat_rb = claripy.Concat(a, reversed_b)
    nose.tools.assert_equal(a_concat_rb._model_vsa._reversed, False)

    ra_concat_rb = claripy.Concat(reversed_a, reversed_b)
    nose.tools.assert_equal(ra_concat_rb._model_vsa._reversed, False) 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def raw(self, arch=None):

        address, length = self.address, self.length

        if isinstance(self.address, int):
            address = claripy.BVV(address, 32)
        if isinstance(length, int):
            length = claripy.BVV(length, 32)

        bv_codes = [claripy.BVV(x) for x in self.code]

        return claripy.Concat(bv_codes[0], address.reversed, bv_codes[1], length.reversed, bv_codes[2]) 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def x86g_dirtyhelper_LGDT_LIDT(state, addr, op):
    if not op.concrete:
        # resolved failed
        return None, [ ]

    limit = state.memory.load(addr, 2, endness='Iend_LE')
    base = state.memory.load(addr + 2, 4, endness='Iend_LE')

    if op._model_concrete.value == 2:
        state.regs.gdt = state.solver.Concat(base, limit).zero_extend(16)
    elif op._model_concrete.value == 3:
        # LIDT is a nop
        pass

    return None, [ ] 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def pc_calculate_rdata_c(state, cc_op, cc_dep1, cc_dep2, cc_ndep, platform=None):
    cc_op = op_concretize(cc_op)

    if cc_op == data[platform]['OpTypes']['G_CC_OP_COPY']:
        return claripy.LShR(cc_dep1, data[platform]['CondBitOffsets']['G_CC_SHIFT_C']) & 1 # TODO: actual constraints
    elif cc_op in ( data[platform]['OpTypes']['G_CC_OP_LOGICQ'], data[platform]['OpTypes']['G_CC_OP_LOGICL'], data[platform]['OpTypes']['G_CC_OP_LOGICW'], data[platform]['OpTypes']['G_CC_OP_LOGICB'] ):
        return claripy.BVV(0, data[platform]['size']) # TODO: actual constraints

    rdata_all = pc_calculate_rdata_all_WRK(state, cc_op,cc_dep1,cc_dep2,cc_ndep, platform=platform)

    if isinstance(rdata_all, tuple):
        cf, pf, af, zf, sf, of = rdata_all
        return claripy.Concat(claripy.BVV(0, data[platform]['size']-1), cf & 1)
    else:
        return claripy.LShR(rdata_all, data[platform]['CondBitOffsets']['G_CC_SHIFT_C']) & 1 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Concat [as 别名]
def get_segdescr_base(state, descriptor):
    lo = descriptor[31:16]
    mid = descriptor[39:32]
    hi = descriptor[63:56]
    return claripy.Concat(hi, mid, lo)