Permalink
Browse files

Lots of fixs, features and improvements

[Bindings]      New ast attribute into the SymExpression class (Based on #94)
[Bindings]      New class SmtAstAbstractNode (Based on #94)
[Bindings]      New getFullExpression(node) function (Based on #94)
[Bindings]      New smt2lib string function (Based on #94)
[Bindings]      Remove the display syntax function
[Bindings]      Remove the expression attribute from the SymExpression class (Based on #94)
[Bindings]      Remove the getBacktrackedSymExpr function (Based on #94 and #95)
[Bindings]      Remove the saveTrace feature
[Bindings]      Remove the simplify syntax function
[Bindings]      Update the Sx and Zx functions takes the sizeExt as first argument
[Bindings]      Update the create{Reg,Sym,Expr}ToSymVar() functions take a varSize as bits granularity (#125)
[Bindings]      Update the extract function takes now only one convention
[Core]          Replace the string manipulation to an AST for all SMT expressions (#94)
[Semantics]     Modification of the PF expression (#124)
[SymEngine]     Mofification of the SymbolicExpression class (Based on #94)
[SymEngine]     Reduce the time of the SMT reconstruction (#95)
[SymExpression] Remove the dst attribute (Based on #94)
[SymExpression] Remove the source attribute (Based on #94)
  • Loading branch information...
JonathanSalwan committed Jul 8, 2015
1 parent c0f81c2 commit 474fe240e66ff6ab3e3501f8d7fc88ce1fcb3ef6
Showing with 6,341 additions and 4,618 deletions.
  1. +1 −1 .build_number
  2. +1 −1 examples/callback_after.py
  3. +1 −1 examples/callback_before.py
  4. +1 −1 examples/callback_signals.py
  5. +15 −31 examples/crackme_hash_collision.py
  6. +0 −47 examples/get_model.py
  7. +2 −2 examples/inject_model_with_snapshot.py
  8. +2 −2 examples/taint_runtime_memory.py
  9. +76 −81 src/analysisProcessor/analysisProcessor.cpp
  10. +762 −0 src/bindings/python/modules/smt2libCallbacks.cpp
  11. +20 −46 src/bindings/python/{ → modules}/tritonCallbacks.cpp
  12. 0 src/bindings/python/{ → namespaces}/initCallbackEnv.cpp
  13. 0 src/bindings/python/{ → namespaces}/initCpuSizeEnv.cpp
  14. 0 src/bindings/python/{ → namespaces}/initFlagEnv.cpp
  15. 0 src/bindings/python/{ → namespaces}/initLinux64Env.cpp
  16. 0 src/bindings/python/{ → namespaces}/initMiscEnv.cpp
  17. 0 src/bindings/python/{ → namespaces}/initOpcodeCategoryEnv.cpp
  18. 0 src/bindings/python/{ → namespaces}/initOpcodeEnv.cpp
  19. 0 src/bindings/python/{ → namespaces}/initOperandEnv.cpp
  20. 0 src/bindings/python/{ → namespaces}/initRegEnv.cpp
  21. 0 src/bindings/python/{ → namespaces}/initSymVarEnv.cpp
  22. 0 src/bindings/python/{ → namespaces}/initSyscallEnv.cpp
  23. 0 src/bindings/python/{ → namespaces}/initVersionEnv.cpp
  24. +6 −109 src/bindings/python/{tritonPyObject.cpp → objects/PyInstruction.cpp}
  25. +38 −0 src/bindings/python/objects/PyOperand.cpp
  26. +130 −0 src/bindings/python/objects/PySmtAstNode.cpp
  27. +39 −0 src/bindings/python/objects/PySymbolicExpression.cpp
  28. +43 −0 src/bindings/python/objects/PySymbolicVariable.cpp
  29. +0 −755 src/bindings/python/smt2libCallbacks.cpp
  30. +0 −2 src/components/Stats.cpp
  31. +0 −40 src/components/Trace.cpp
  32. +18 −18 src/includes/AnalysisProcessor.h
  33. +30 −30 src/includes/EflagsBuilder.h
  34. +38 −38 src/includes/EflagsExpressions.h
  35. +618 −176 src/includes/SMT2Lib.h
  36. +3 −2 src/includes/SolverEngine.h
  37. +4 −8 src/includes/SymbolicEngine.h
  38. +13 −18 src/includes/SymbolicExpression.h
  39. +0 −3 src/includes/Trace.h
  40. +14 −0 src/includes/TritonPyObject.h
  41. +53 −53 src/ir/builders/AdcIRBuilder.cpp
  42. +48 −48 src/ir/builders/AddIRBuilder.cpp
  43. +48 −48 src/ir/builders/AndIRBuilder.cpp
  44. +18 −18 src/ir/builders/AndnpdIRBuilder.cpp
  45. +18 −18 src/ir/builders/AndnpsIRBuilder.cpp
  46. +18 −18 src/ir/builders/AndpdIRBuilder.cpp
  47. +18 −18 src/ir/builders/AndpsIRBuilder.cpp
  48. +0 −2 src/ir/builders/BaseIRBuilder.cpp
  49. +15 −15 src/ir/builders/BswapIRBuilder.cpp
  50. +27 −27 src/ir/builders/CallIRBuilder.cpp
  51. +4 −4 src/ir/builders/CbwIRBuilder.cpp
  52. +4 −4 src/ir/builders/CdqeIRBuilder.cpp
  53. +3 −3 src/ir/builders/CmcIRBuilder.cpp
  54. +26 −26 src/ir/builders/CmovbIRBuilder.cpp
  55. +30 −30 src/ir/builders/CmovbeIRBuilder.cpp
  56. +28 −28 src/ir/builders/CmovlIRBuilder.cpp
  57. +30 −30 src/ir/builders/CmovleIRBuilder.cpp
  58. +26 −26 src/ir/builders/CmovnbIRBuilder.cpp
  59. +30 −30 src/ir/builders/CmovnbeIRBuilder.cpp
  60. +30 −30 src/ir/builders/CmovnlIRBuilder.cpp
  61. +30 −30 src/ir/builders/CmovnleIRBuilder.cpp
  62. +26 −26 src/ir/builders/CmovnoIRBuilder.cpp
  63. +26 −26 src/ir/builders/CmovnpIRBuilder.cpp
  64. +26 −26 src/ir/builders/CmovnsIRBuilder.cpp
  65. +26 −26 src/ir/builders/CmovnzIRBuilder.cpp
  66. +26 −26 src/ir/builders/CmovoIRBuilder.cpp
  67. +26 −26 src/ir/builders/CmovpIRBuilder.cpp
  68. +26 −26 src/ir/builders/CmovsIRBuilder.cpp
  69. +26 −26 src/ir/builders/CmovzIRBuilder.cpp
  70. +48 −48 src/ir/builders/CmpIRBuilder.cpp
  71. +4 −4 src/ir/builders/ControlFlow.cpp
  72. +6 −6 src/ir/builders/CqoIRBuilder.cpp
  73. +4 −4 src/ir/builders/CwdeIRBuilder.cpp
  74. +16 −16 src/ir/builders/DecIRBuilder.cpp
  75. +40 −40 src/ir/builders/DivIRBuilder.cpp
  76. +162 −161 src/ir/builders/EflagsBuilder.cpp
  77. +273 −254 src/ir/builders/EflagsExpressions.cpp
  78. +40 −40 src/ir/builders/IdivIRBuilder.cpp
  79. +42 −42 src/ir/builders/ImulIRBuilder.cpp
  80. +16 −16 src/ir/builders/IncIRBuilder.cpp
  81. +6 −6 src/ir/builders/JbIRBuilder.cpp
  82. +8 −8 src/ir/builders/JbeIRBuilder.cpp
  83. +7 −7 src/ir/builders/JlIRBuilder.cpp
  84. +8 −8 src/ir/builders/JleIRBuilder.cpp
  85. +13 −13 src/ir/builders/JmpIRBuilder.cpp
  86. +6 −6 src/ir/builders/JnbIRBuilder.cpp
  87. +8 −8 src/ir/builders/JnbeIRBuilder.cpp
  88. +8 −8 src/ir/builders/JnlIRBuilder.cpp
  89. +8 −8 src/ir/builders/JnleIRBuilder.cpp
  90. +6 −6 src/ir/builders/JnoIRBuilder.cpp
  91. +6 −6 src/ir/builders/JnpIRBuilder.cpp
  92. +6 −6 src/ir/builders/JnsIRBuilder.cpp
  93. +6 −6 src/ir/builders/JnzIRBuilder.cpp
  94. +6 −6 src/ir/builders/JoIRBuilder.cpp
  95. +6 −6 src/ir/builders/JpIRBuilder.cpp
  96. +6 −6 src/ir/builders/JsIRBuilder.cpp
  97. +6 −6 src/ir/builders/JzIRBuilder.cpp
  98. +15 −15 src/ir/builders/LeaIRBuilder.cpp
  99. +12 −12 src/ir/builders/LeaveIRBuilder.cpp
  100. +33 −33 src/ir/builders/MovIRBuilder.cpp
  101. +21 −21 src/ir/builders/MovapdIRBuilder.cpp
  102. +21 −21 src/ir/builders/MovapsIRBuilder.cpp
  103. +21 −21 src/ir/builders/MovdqaIRBuilder.cpp
  104. +21 −21 src/ir/builders/MovdquIRBuilder.cpp
  105. +11 −11 src/ir/builders/MovhlpsIRBuilder.cpp
  106. +19 −20 src/ir/builders/MovhpdIRBuilder.cpp
  107. +19 −20 src/ir/builders/MovhpsIRBuilder.cpp
  108. +11 −11 src/ir/builders/MovlhpsIRBuilder.cpp
  109. +19 −20 src/ir/builders/MovlpdIRBuilder.cpp
  110. +19 −20 src/ir/builders/MovlpsIRBuilder.cpp
  111. +16 −16 src/ir/builders/MovsxIRBuilder.cpp
  112. +16 −16 src/ir/builders/MovzxIRBuilder.cpp
  113. +50 −50 src/ir/builders/MulIRBuilder.cpp
  114. +14 −14 src/ir/builders/NegIRBuilder.cpp
  115. +12 −12 src/ir/builders/NotIRBuilder.cpp
  116. +48 −48 src/ir/builders/OrIRBuilder.cpp
  117. +18 −18 src/ir/builders/OrpdIRBuilder.cpp
  118. +18 −18 src/ir/builders/OrpsIRBuilder.cpp
  119. +20 −20 src/ir/builders/PopIRBuilder.cpp
  120. +27 −27 src/ir/builders/PushIRBuilder.cpp
  121. +46 −46 src/ir/builders/RclIRBuilder.cpp
  122. +46 −46 src/ir/builders/RcrIRBuilder.cpp
  123. +23 −23 src/ir/builders/RetIRBuilder.cpp
  124. +30 −30 src/ir/builders/RolIRBuilder.cpp
  125. +30 −30 src/ir/builders/RorIRBuilder.cpp
  126. +24 −23 src/ir/builders/SarIRBuilder.cpp
  127. +53 −53 src/ir/builders/SbbIRBuilder.cpp
  128. +14 −16 src/ir/builders/SetbIRBuilder.cpp
  129. +18 −20 src/ir/builders/SetbeIRBuilder.cpp
  130. +16 −18 src/ir/builders/SetlIRBuilder.cpp
  131. +18 −20 src/ir/builders/SetleIRBuilder.cpp
  132. +14 −16 src/ir/builders/SetnbIRBuilder.cpp
  133. +18 −20 src/ir/builders/SetnbeIRBuilder.cpp
  134. +18 −20 src/ir/builders/SetnlIRBuilder.cpp
  135. +18 −20 src/ir/builders/SetnleIRBuilder.cpp
  136. +14 −16 src/ir/builders/SetnoIRBuilder.cpp
  137. +14 −16 src/ir/builders/SetnpIRBuilder.cpp
  138. +14 −16 src/ir/builders/SetnsIRBuilder.cpp
  139. +14 −16 src/ir/builders/SetnzIRBuilder.cpp
  140. +14 −16 src/ir/builders/SetoIRBuilder.cpp
  141. +14 −16 src/ir/builders/SetpIRBuilder.cpp
  142. +14 −16 src/ir/builders/SetsIRBuilder.cpp
  143. +14 −16 src/ir/builders/SetzIRBuilder.cpp
  144. +24 −23 src/ir/builders/ShlIRBuilder.cpp
  145. +24 −23 src/ir/builders/ShrIRBuilder.cpp
  146. +48 −48 src/ir/builders/SubIRBuilder.cpp
  147. +38 −38 src/ir/builders/TestIRBuilder.cpp
  148. +26 −26 src/ir/builders/XaddIRBuilder.cpp
  149. +36 −36 src/ir/builders/XchgIRBuilder.cpp
  150. +48 −48 src/ir/builders/XorIRBuilder.cpp
  151. +18 −18 src/ir/builders/XorpdIRBuilder.cpp
  152. +18 −18 src/ir/builders/XorpsIRBuilder.cpp
  153. +1,681 −319 src/smt2lib/smt2lib.cpp
  154. +6 −7 src/solverEngine/solverEngine.cpp
  155. +23 −76 src/symbolicEngine/symbolicEngine.cpp
  156. +13 −46 src/symbolicEngine/symbolicExpression.cpp
  157. +1 −1 tools/generate_db.py
View
@@ -1 +1 @@
-628
+633
@@ -152,7 +152,7 @@ def my_callback_after(instruction):
print '%#x: %s' %(instruction.address, instruction.assembly)
for se in instruction.symbolicExpressions:
- print '\t -> %s %s' %(se.expression, (('; ' + se.comment) if se.comment is not None else ''))
+ print '\t -> #%d = %s %s' %(se.id, se.ast, (('; ' + se.comment) if se.comment is not None else ''))
print
@@ -22,7 +22,7 @@
# TID (0) 0x400597 mov ecx, eax
# TID (0) 0x400599 mov rdx, qword ptr [rip+0x200aa0]
# TID (0) 0x4005a0 mov eax, dword ptr [rbp-0x4]
-# TID (0) 0x4005a3 cdqe
+# TID (0) 0x4005a3 cdqe
# TID (0) 0x4005a5 add rax, rdx
# TID (0) 0x4005a8 movzx eax, byte ptr [rax]
# TID (0) 0x4005ab movsx eax, al
@@ -58,7 +58,7 @@ def signals(threadId, sig):
for reg, data in regs.items():
value = data['concreteValue']
seid = data['symbolicExpr']
- print '%s:\t%#016x\t%s' %(getRegName(reg), value, (getSymExpr(seid).expression if seid != IDREF.MISC.UNSET else 'UNSET'))
+ print '%s:\t%#016x\t%s' %(getRegName(reg), value, (getSymExpr(seid).ast if seid != IDREF.MISC.UNSET else 'UNSET'))
return
@@ -51,45 +51,29 @@ def cafter(instruction):
# RAX points on the user password
if instruction.address == 0x400572:
rsiId = getRegSymbolicID(IDREF.REG.RSI)
- convertExprToSymVar(rsiId, 8)
+ convertExprToSymVar(rsiId, 64)
# mov eax,DWORD PTR [rbp-0x4]
# RAX must be equal to 0xad6d to win
if instruction.address == 0x4005c5:
print '[+] Please wait, computing in progress...'
raxId = getRegSymbolicID(IDREF.REG.RAX)
- raxExpr = getBacktrackedSymExpr(raxId)
- expr = str()
+ raxExpr = getFullExpression(getSymExpr(raxId).ast)
# We want printable characters
- # (assert (bvsgt SymVar_0 96)
- # (assert (bvslt SymVar_0 123)
- expr += smt2lib.smtAssert(smt2lib.bvugt('SymVar_0', smt2lib.bv(96, 64)))
- expr += smt2lib.smtAssert(smt2lib.bvult('SymVar_0', smt2lib.bv(123, 64)))
-
- # (assert (bvsgt SymVar_1 96)
- # (assert (bvslt SymVar_1 123)
- expr += smt2lib.smtAssert(smt2lib.bvugt('SymVar_1', smt2lib.bv(96, 64)))
- expr += smt2lib.smtAssert(smt2lib.bvult('SymVar_1', smt2lib.bv(123, 64)))
-
- # (assert (bvsgt SymVar_2 96)
- # (assert (bvslt SymVar_2 123)
- expr += smt2lib.smtAssert(smt2lib.bvugt('SymVar_2', smt2lib.bv(96, 64)))
- expr += smt2lib.smtAssert(smt2lib.bvult('SymVar_2', smt2lib.bv(123, 64)))
-
- # (assert (bvsgt SymVar_3 96)
- # (assert (bvslt SymVar_3 123)
- expr += smt2lib.smtAssert(smt2lib.bvugt('SymVar_3', smt2lib.bv(96, 64)))
- expr += smt2lib.smtAssert(smt2lib.bvult('SymVar_3', smt2lib.bv(123, 64)))
-
- # (assert (bvsgt SymVar_4 96)
- # (assert (bvslt SymVar_4 123)
- expr += smt2lib.smtAssert(smt2lib.bvugt('SymVar_4', smt2lib.bv(96, 64)))
- expr += smt2lib.smtAssert(smt2lib.bvult('SymVar_4', smt2lib.bv(123, 64)))
-
- # We want the collision
- # (assert (= rax 0xad6d)
- expr += smt2lib.smtAssert(smt2lib.equal(raxExpr, smt2lib.bv(0xad6d, 64)))
+ expr = smt2lib.compound([
+ smt2lib.smtAssert(smt2lib.bvugt(smt2lib.string('SymVar_0'), smt2lib.bv(96, 64))),
+ smt2lib.smtAssert(smt2lib.bvult(smt2lib.string('SymVar_0'), smt2lib.bv(123, 64))),
+ smt2lib.smtAssert(smt2lib.bvugt(smt2lib.string('SymVar_1'), smt2lib.bv(96, 64))),
+ smt2lib.smtAssert(smt2lib.bvult(smt2lib.string('SymVar_1'), smt2lib.bv(123, 64))),
+ smt2lib.smtAssert(smt2lib.bvugt(smt2lib.string('SymVar_2'), smt2lib.bv(96, 64))),
+ smt2lib.smtAssert(smt2lib.bvult(smt2lib.string('SymVar_2'), smt2lib.bv(123, 64))),
+ smt2lib.smtAssert(smt2lib.bvugt(smt2lib.string('SymVar_3'), smt2lib.bv(96, 64))),
+ smt2lib.smtAssert(smt2lib.bvult(smt2lib.string('SymVar_3'), smt2lib.bv(123, 64))),
+ smt2lib.smtAssert(smt2lib.bvugt(smt2lib.string('SymVar_4'), smt2lib.bv(96, 64))),
+ smt2lib.smtAssert(smt2lib.bvult(smt2lib.string('SymVar_4'), smt2lib.bv(123, 64))),
+ smt2lib.smtAssert(smt2lib.equal(raxExpr, smt2lib.bv(0xad6d, 64))) # collision: (assert (= rax 0xad6d)
+ ])
# Get max 20 different models
models = getModels(expr, 20)
View
@@ -1,47 +0,0 @@
-
-import smt2lib
-from triton import *
-
-# $ ./triton ./examples/get_model.py ./samples/crackmes/crackme_xor elite
-# {'SymVar_0': "0x65, 'e'"}
-# {'SymVar_1': "0x6c, 'l'"}
-# {'SymVar_2': "0x69, 'i'"}
-# {'SymVar_3': "0x74, 't'"}
-# {'SymVar_4': "0x65, 'e'"}
-# Win
-# $
-
-# 0x40058b: movzx eax, byte ptr [rax]
-#
-# When the instruction located in 0x40058b is executed,
-# we taint the memory that RAX holds.
-def cbeforeSymProc(instruction):
-
- if instruction.address == 0x40058b:
- rax = getRegValue(IDREF.REG.RAX)
- taintMem(rax)
-
-
-# 0x4005ae: cmp ecx, eax
-def cafter(instruction):
-
- if instruction.address == 0x40058b:
- convertExprToSymVar(getRegSymbolicID(IDREF.REG.RAX), 4)
-
- if instruction.address == 0x4005ae:
- zfId = getRegSymbolicID(IDREF.FLAG.ZF)
- zfExpr = getBacktrackedSymExpr(zfId)
- expr = smt2lib.smtAssert(smt2lib.equal(zfExpr, smt2lib.bvtrue())) # (assert (= zf True))
- print {k: "0x%x, '%c'" % (v, v) for k, v in getModel(expr).items()}
-
-
-if __name__ == '__main__':
-
- # Start the symbolic analysis from the 'check' function
- startAnalysisFromSymbol('check')
-
- addCallback(cbeforeSymProc, IDREF.CALLBACK.BEFORE_SYMPROC)
- addCallback(cafter, IDREF.CALLBACK.AFTER)
-
- # Run the instrumentation - Never returns
- runProgram()
@@ -45,12 +45,12 @@ def cafter(instruction):
# 0x40058b: movzx eax, byte ptr [rax]
if instruction.address == 0x40058b:
- convertRegToSymVar(IDREF.REG.RAX, 4)
+ convertRegToSymVar(IDREF.REG.RAX, 32)
# 0x4005ae: cmp ecx, eax
if instruction.address == 0x4005ae:
zfId = getRegSymbolicID(IDREF.FLAG.ZF)
- zfExpr = getBacktrackedSymExpr(zfId)
+ zfExpr = getFullExpression(getSymExpr(zfId).ast)
expr = smt2lib.smtAssert(smt2lib.equal(zfExpr, smt2lib.bvtrue())) # (assert (= zf True))
models = getModel(expr)
global password
@@ -19,9 +19,9 @@ def cafter(instruction):
print '%#x: %s' %(instruction.address, instruction.assembly)
for se in instruction.symbolicExpressions:
if se.isTainted == True:
- print '\t -> %s%s%s' %(GREEN, se.expression, ENDC)
+ print '\t -> %s%s%s' %(GREEN, se.ast, ENDC)
else:
- print '\t -> %s' %(se.expression)
+ print '\t -> %s' %(se.ast)
print
Oops, something went wrong.

0 comments on commit 474fe24

Please sign in to comment.