about summary refs log tree commit diff stats
path: root/arch/x86.py (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Refactor project structureTheofilos Augoustis2023-12-311-102/+0
| | | | | | | | Read concrete state on demand during concolic exec During concolic tracing, don't record full program snapshots at each basic block, but instead read concrete values directly from the concrete target when they are needed.
* Implement symbolic comparison and match traces via MiasmTheofilos Augoustis2023-12-141-3/+16
| | | | | Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
* Adapt symbolic compare to new transform interfaceTheofilos Augoustis2023-12-081-0/+1
| | | | | | | | | | | | Also implement a `MiasmSymbolicTransform.concat` function that concatenates two transformations. Some minor adaptions to the eval_expr code was necessary to remove some assumptions that don't work if the resolver state returns symbols instead of concrete values. Remove obsolete utilities that were used for angr. Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
* Record symbolic transform for single instructionsTheofilos Augoustis2023-11-281-3/+6
| | | | | | | | | Step manually through single instructions instead of full basic blocks. Record the transformation performed by each instruction as symbolic equations. Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
* Implement symbolic state comparison algorithmTheofilos Augoustis2023-11-271-0/+2
| | | | | | | | | This is the first draft of a `compare` algorithm that uses recorded symbolic transformations. Is currently based on angr, so it's probably going to be reworked to work with states generated by Miasm. Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
* Standardize X86 register namesTheofilos Augoustis2023-11-261-24/+74
| | | | | | | | | | | | | | | | | | | | | | | Add some infrastructure for flexible register name matching (i.e. using 'PC' to look up RIP): - `Arch.to_regname` tries to look up a register's standard name from an arbitrary string. - `ArchX86` overrides `to_regname` to resolve alias names for registers. Currently just 'PC' for 'RIP'. - `ProgramState.read` and `ProgramState.write` use `to_regname` to make register access more convenient. Add all flags with their standard abbreviations to `x86.regnames`. Implement a full RFLAGS decomposition into its individual flags in `x86`. Replace the hacks in `run.py` and `miasm_test.py` with this more complete solution. Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>
* Support for testing concrete and emulated execution with angrTheofilos Augoustis2023-10-211-1/+1
|
* Refactor file structureTheofilos Augoustis2023-10-111-0/+33
- main.py: focaccia user-interface - snapshot.py: state trace snapshots handling - compare.py: snapshot comparison algorithms - run.py: native execution tracer - arancini.py: Arancini log handling - arch/: per-architecture abstractions Co-authored-by: Theofilos Augoustis <theofilos.augoustis@gmail.com> Co-authored-by: Nicola Crivellin <nicola.crivellin98@gmail.com>