diff options
| author | Theofilos Augoustis <theofilos.augoustis@gmail.com> | 2023-12-08 16:17:35 +0100 |
|---|---|---|
| committer | Theofilos Augoustis <theofilos.augoustis@gmail.com> | 2023-12-08 16:17:35 +0100 |
| commit | 4a5584d8f69d8ff511285387971d8cbf803f16b7 (patch) | |
| tree | 11c9e104fadc9b47f3f423f4be3bf0be34edf4f8 /run.py | |
| parent | 0cf4f736fd5d7cd99f00d6c5896af9a608d2df8b (diff) | |
| download | focaccia-4a5584d8f69d8ff511285387971d8cbf803f16b7.tar.gz focaccia-4a5584d8f69d8ff511285387971d8cbf803f16b7.zip | |
Adapt symbolic compare to new transform interface
Also implement a `MiasmSymbolicTransform.concat` function that concatenates two transformations. Some minor adaptions to the eval_expr code was necessary to remove some assumptions that don't work if the resolver state returns symbols instead of concrete values. Remove obsolete utilities that were used for angr. Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
Diffstat (limited to 'run.py')
| -rw-r--r-- | run.py | 105 |
1 files changed, 0 insertions, 105 deletions
diff --git a/run.py b/run.py deleted file mode 100644 index 768a73d..0000000 --- a/run.py +++ /dev/null @@ -1,105 +0,0 @@ -"""Functionality to execute native programs and collect snapshots via lldb.""" - -import platform -import sys -import lldb -from typing import Callable - -# TODO: The debugger callback is currently specific to a single architecture. -# We should make it generic. -from arch import Arch, x86 -from snapshot import ProgramState - -class SnapshotBuilder: - """At every breakpoint, writes register contents to a stream. - - Generated snapshots are stored in and can be read from `self.states`. - """ - def __init__(self, arch: Arch): - self.arch = arch - self.states = [] - self.regnames = set(arch.regnames) - - def create_snapshot(self, frame: lldb.SBFrame): - state = ProgramState(self.arch) - state.set('PC', frame.GetPC()) - for regname in self.arch.regnames: - reg = frame.FindRegister(regname) - regval = int(reg.GetValue(), base=16) - state.set(regname, regval) - if regname == 'RFLAGS': - flags = x86.decompose_rflags(regval) - for flag_name, val in flags.items(): - state.set(flag_name, val) - return state - - def __call__(self, frame): - snapshot = self.create_snapshot(frame) - self.states.append(snapshot) - -class Debugger: - def __init__(self, program): - self.debugger = lldb.SBDebugger.Create() - self.debugger.SetAsync(False) - self.target = self.debugger.CreateTargetWithFileAndArch(program, - lldb.LLDB_ARCH_DEFAULT) - self.module = self.target.FindModule(self.target.GetExecutable()) - self.interpreter = self.debugger.GetCommandInterpreter() - - def set_breakpoint_by_addr(self, address: int): - command = f"b -a {address} -s {self.module.GetFileSpec().GetFilename()}" - result = lldb.SBCommandReturnObject() - self.interpreter.HandleCommand(command, result) - - def get_breakpoints_count(self): - return self.target.GetNumBreakpoints() - - def execute(self, callback: Callable): - error = lldb.SBError() - listener = self.debugger.GetListener() - process = self.target.Launch(listener, None, None, None, None, None, None, 0, - True, error) - - # Check if the process has launched successfully - if process.IsValid(): - print(f'Launched process: {process}') - else: - print('Failed to launch process', file=sys.stderr) - - while True: - state = process.GetState() - if state == lldb.eStateStopped: - for thread in process: - callback(thread.GetFrameAtIndex(0)) - process.Continue() - if state == lldb.eStateExited: - break - - print(f'Process state: {process.GetState()}') - print('Program output:') - print(process.GetSTDOUT(1024)) - print(process.GetSTDERR(1024)) - -def run_native_execution(oracle_program: str, breakpoints: set[int]): - """Gather snapshots from a native execution via an external debugger. - - :param oracle_program: Program to execute. - :param breakpoints: List of addresses at which to break and record the - program's state. - - :return: A list of snapshots gathered from the execution. - """ - assert(platform.machine() == "x86_64") - - debugger = Debugger(oracle_program) - - # Set breakpoints - for address in breakpoints: - debugger.set_breakpoint_by_addr(address) - assert(debugger.get_breakpoints_count() == len(breakpoints)) - - # Execute the native program - builder = SnapshotBuilder(x86.ArchX86()) - debugger.execute(builder) - - return builder.states |