Python claripy.Solver方法代码示例

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def run_manyfloatsum_symbolic(arch):
    global type_cache
    if type_cache is None:
        type_cache = parse_defns(open(os.path.join(location, 'tests_src', 'manyfloatsum.c')).read())

    p = angr.Project(os.path.join(location, 'tests', arch, 'manyfloatsum'))
    function = 'sum_doubles'
    cc = p.factory.cc(func_ty=type_cache[function])
    args = [claripy.FPS('arg_%d' % i, claripy.FSORT_DOUBLE) for i in range(len(type_cache[function].args))]
    addr = p.loader.main_object.get_symbol(function).rebased_addr
    my_callable = p.factory.callable(addr, cc=cc)
    result = my_callable(*args)
    nose.tools.assert_true(result.symbolic)

    s = claripy.Solver(timeout=15*60*1000)
    for arg in args:
        s.add(arg > claripy.FPV(1.0, claripy.FSORT_DOUBLE))
    s.add(result == claripy.FPV(27.7, claripy.FSORT_DOUBLE))

    args_conc = s.batch_eval(args, 1)[0]
    nose.tools.assert_equal(s.eval(result, 1)[0], 27.7)
    # not almost equal!! totally equal!!! z3 is magic, if kinda slow!!!!!
    for arg_conc in args_conc:
        nose.tools.assert_greater(arg_conc, 1.0)
    nose.tools.assert_equal(sum(args_conc), 27.7) 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def combine(self, others):
        other_claripy_solvers = [i.solver for i in others]
        combined = Solver(
            claripy_solver=self.solver.combine(other_claripy_solvers),
            hashes=self.hashes,
        )

        for other in others:
            for k, v in self.hashes.items():
                # Make sure the hash symbols are distinct
                if any(v is v2 for v2 in other.hashes.values()):
                    # Call regenerate_hash_symbols() on one of them first?
                    raise ValueError("Cannot combine with equivalent hashes.")

                # TODO: If some hash input are equal, we should merge the hash
                # symols here, it would be more efficient.
            combined.hashes.update(other.hashes)

        return combined 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def __init__(self, plock=None, q=None, kernel_path=None):
        """
        :param kernel_path: the vmlinux path to the kernel
        """
        if plock is not None:
            self.lock = plock  # this is the lock because all instances of osok share a qemu instance
        else:
            self.lock = None
        self.queue = q

        self.kernel_path = kernel_path
        if os.path.isfile('angr_project.cache'):
            with open('angr_project.cache', 'rb') as f:
                print('[+] load kernel vmlinux binary from pickle dump')
                self.b = pickle.load(f)
        else:
            self.b = angr.Project(kernel_path)
            with open('angr_project.cache', 'wb') as f:
                pickle.dump(self.b, f)
        self.r = None
        self.statebroker = statebroker.StateBroker()
        self.claripy = claripy
        self.sol = claripy.Solver()
        self.md = Cs(CS_ARCH_X86, CS_MODE_64)
        self.md.detail = True
        self.debug_bloom_verbose = False
        self.vm = None
        self.reproduce_mode = False  # reproduce exploit and generate payload
        self.custom_rop_gadget_number = 10  # length of the rop payload we want to use 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def reachable(self):
        if self._satisfiable is not None:
            pass
        elif self.state is not None:
            self._satisfiable = self.state.solver.satisfiable()
        else:
            solver = claripy.Solver()
            solver.add(self._all_constraints)
            self._satisfiable = solver.satisfiable()

        return self._satisfiable

    #
    # Log handling
    # 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def get_claripy_solver():
    # TODO: What about SolverComposite? Tried, and seems slower.
    return claripy.Solver() 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def branch(self):
        return Solver(claripy_solver=self.solver.branch(), hashes=self.hashes.copy()) 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def test_ite():
    yield raw_ite, claripy.Solver
    yield raw_ite, claripy.SolverHybrid
    yield raw_ite, claripy.SolverComposite 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def test_extract_concat_simplify():
    a = claripy.BVS("a", 32)
    assert a[31:0] is a
    assert a[31:8].concat(a[7:0]) is a  # pylint:disable=no-member
    assert a[31:16].concat(a[15:8], a[7:0]) is a  # pylint:disable=no-member
    assert a[31:24].concat(a[23:16], a[15:8], a[7:0]) is a  # pylint:disable=no-member

    a = claripy.BVS("a", 32)
    b = a + 100
    b_concat = b[31:8].concat(b[7:0])
    a100 = a + 100
    assert claripy.is_false(b_concat == a100) is False
    assert list(claripy.Solver().eval(b_concat == a100, 2)) == [ True ]
    assert b_concat is a100
    assert claripy.is_true(b_concat == a100) 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def test_signed_symbolic():
    solver = claripy.Solver()
    a = claripy.BVS("a", 32)
    b = claripy.BVS("b", 32)
    c = claripy.BVS("c", 32)
    d = claripy.BVS("d", 32)
    solver.add(a == 5)
    solver.add(b == -5)
    solver.add(c == 3)
    solver.add(d == -3)

    # test unsigned
    assert list(solver.eval(a / c, 2)) == [1]
    assert list(solver.eval(a / d, 2)) == [0]
    assert list(solver.eval(b / c, 2)) == [0x55555553]
    assert list(solver.eval(b / d, 2)) == [0]
    assert list(solver.eval(a % c, 2)) == [2]
    assert list(solver.eval(a % d, 2)) == [5]
    assert list(solver.eval(b % c, 2)) == [2]
    assert list(solver.eval(b % d, 2)) == [2**32-5]

    # test unsigned
    assert list(solver.eval(a.SDiv(c), 2)) == [1]
    assert list(solver.eval(a.SDiv(d), 2)) == [2**32-1]
    assert list(solver.eval(b.SDiv(c), 2)) == [2**32-1]
    assert list(solver.eval(b.SDiv(d), 2)) == [1]
    assert list(solver.eval(a.SMod(c), 2)) == [2]
    assert list(solver.eval(a.SMod(d), 2)) == [2]
    assert list(solver.eval(b.SMod(c), 2)) == [2**32-2]
    assert list(solver.eval(b.SMod(d), 2)) == [2**32-2] 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def test_arith_shift():
    bc = claripy.backends.concrete
    a = claripy.BVV(-4, 32)
    assert bc.convert(a >> 1) == -2

    solver = claripy.Solver()
    a = claripy.BVS("a", 32)
    solver.add(a == -4)
    assert list(solver.eval(a >> 1, 2)) == [2**32-2] 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def raw_minmax(reuse_z3_solver):
    claripy._backend_z3.reuse_z3_solver = reuse_z3_solver

    s = claripy.Solver()
    x = claripy.BVS("x", 32)

    nose.tools.assert_equal(s.max(x), 2**32-1)
    nose.tools.assert_equal(s.min(x), 0)
    nose.tools.assert_true(s.satisfiable()) 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def test_model():
    x = claripy.BVS("x", 32)
    y = claripy.BVS("y", 32)
    s = claripy.Solver()

    s.add(x < 10)
    assert sorted(s.eval(x, 20)) == list(range(10))
    s.add(y == 1337)
    assert sorted(s.eval(x, 20)) == list(range(10)) 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def test_unsatness():
    x = claripy.BVS("x", 32)

    s = claripy.Solver()
    s.add(x == 10)
    assert s.satisfiable()
    s.add(claripy.false)
    assert not s.satisfiable() 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def test_simplification_annotations():
    s = claripy.Solver()
    x = claripy.BVS("x", 32)

    s.add(x > 10)
    s.add(x > 11)
    s.add((x > 12).annotate(claripy.SimplificationAvoidanceAnnotation()))

    assert len(s.constraints) == 3
    s.simplify()
    assert len(s.constraints) == 2 

# 需要导入模块: import claripy [as 别名]
# 或者: from claripy import Solver [as 别名]
def test_unsat_core():
    for s in (claripy.Solver, claripy.SolverComposite, claripy.SolverCacheless, claripy.SolverHybrid):
        yield raw_unsat_core, s, True
        yield raw_unsat_core, s, False