about summary refs log tree commit diff stats
Commit message (Collapse)AuthorAgeFilesLines
...
| * Verify QEMU by converting logs to internal data formatTheofilos Augoustis2023-12-264-1/+274
| | | | | | | | | | Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
| * Extend error reporting systemTheofilos Augoustis2023-12-274-92/+169
| | | | | | | | | | Add error severities and the ability to filter for them. Include more information in comparison error messages.
| * Refactor parser.py (for gdb integration)Theofilos Augoustis2023-12-261-25/+56
| | | | | | | | | | Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
| * Improve SparseMemory.write_memory performanceTheofilos Augoustis2023-12-262-8/+13
| | | | | | | | Reduce overhead of handling sparse memory
| * Implement symbolic comparison and match traces via MiasmTheofilos Augoustis2023-12-1410-293/+511
| | | | | | | | | | Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
| * Adapt symbolic compare to new transform interfaceTheofilos Augoustis2023-12-0818-614/+278
| | | | | | | | | | | | | | | | | | | | | | | | Also implement a `MiasmSymbolicTransform.concat` function that concatenates two transformations. Some minor adaptions to the eval_expr code was necessary to remove some assumptions that don't work if the resolver state returns symbols instead of concrete values. Remove obsolete utilities that were used for angr. Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
| * Replace symbolic execution tools with MiasmTheofilos Augoustis2023-12-074-400/+317
| | | | | | | | | | | | | | | | | | Refactor SymbolicTransform interface a bit to include transformations of memory content. Implement it for Miasm as a backend. Move all symbolic execution things out of the test script (`miasm_test.py`) and move them to `symbolic.py` to replace the angr-based algorithms.
| * Record symbolic transform for single instructionsTheofilos Augoustis2023-11-284-78/+178
| | | | | | | | | | | | | | | | | | Step manually through single instructions instead of full basic blocks. Record the transformation performed by each instruction as symbolic equations. Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
| * Add memory storage capabilities to `ProgramState`Theofilos Augoustis2023-11-274-156/+229
| | | | | | | | | | | | | | | | | | | | The `SparseMemory` class represents a program's memory. While the user can read from and write to arbitrary memory addresses, it manages its memory in pages/chunks internally. This is a tradeoff between space consumption (this solution might have a memory overhead) and lookup speed of individual memory addresses. Add two small unit tests for `SparseMemory`.
| * Implement symbolic state comparison algorithmTheofilos Augoustis2023-11-278-191/+210
| | | | | | | | | | | | | | | | | | This is the first draft of a `compare` algorithm that uses recorded symbolic transformations. Is currently based on angr, so it's probably going to be reworked to work with states generated by Miasm. Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
| * Standardize X86 register namesTheofilos Augoustis2023-11-266-122/+142
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add some infrastructure for flexible register name matching (i.e. using 'PC' to look up RIP): - `Arch.to_regname` tries to look up a register's standard name from an arbitrary string. - `ArchX86` overrides `to_regname` to resolve alias names for registers. Currently just 'PC' for 'RIP'. - `ProgramState.read` and `ProgramState.write` use `to_regname` to make register access more convenient. Add all flags with their standard abbreviations to `x86.regnames`. Implement a full RFLAGS decomposition into its individual flags in `x86`. Replace the hacks in `run.py` and `miasm_test.py` with this more complete solution. Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
| * Migrate to Miasm for concolic execution from AngrTheofilos Augoustis2023-11-253-0/+363
| | | | | | | | | | Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
| * Implement interpreter for symbolic expressionsTheofilos Augoustis2023-11-106-71/+427
| |
| * Implement symbolic tracing in trace_symbols.py using AngrTheofilos Augoustis2023-11-073-180/+158
| |
| * Support for testing concrete and emulated execution with angrTheofilos Augoustis2023-10-219-92/+421
| |
| * Implement simple comparison algorithmTheofilos Augoustis2023-10-152-3/+119
| | | | | | | | | | Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
| * Refactor file structureTheofilos Augoustis2023-10-119-306/+326
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - main.py: focaccia user-interface - snapshot.py: state trace snapshots handling - compare.py: snapshot comparison algorithms - run.py: native execution tracer - arancini.py: Arancini log handling - arch/: per-architecture abstractions Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
| * Simplify log file parsingTheofilos Augoustis2023-10-091-92/+94
| | | | | | | | | | | | | | Employ some refactorings to make the parsing code simpler and faster. Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
| * Print statistics for unmatched reference basic blocksTheofilos Augoustis2025-02-251-0/+17
| |
* | Print statistics for unmatched reference basic blocksTheofilos Augoustis2023-08-241-0/+17
|/
* Improve progressive comparisonTheofilos Augoustis2023-08-241-4/+29
|
* Add progressive search over basic blocksTheofilos Augoustis2023-08-241-16/+71
|
* Add initial support for diffs between snapshotsTheofilos Augoustis2023-08-201-6/+29
|
* Add READMETheofilos Augoustis2023-07-121-0/+5
|
* Add development scripts for comparing Arancini dumpsTheofilos Augoustis2023-07-123-0/+466
|
* Add initial gitignoreTheofilos Augoustis2023-07-121-0/+11