diff options
Diffstat (limited to 'example/symbol_exec')
| -rw-r--r-- | example/symbol_exec/depgraph.py | 23 | ||||
| -rw-r--r-- | example/symbol_exec/dse_strategies.py | 2 | ||||
| -rw-r--r-- | example/symbol_exec/single_instr.py | 19 |
3 files changed, 22 insertions, 22 deletions
diff --git a/example/symbol_exec/depgraph.py b/example/symbol_exec/depgraph.py index b8d838ae..f306e6e3 100644 --- a/example/symbol_exec/depgraph.py +++ b/example/symbol_exec/depgraph.py @@ -47,7 +47,7 @@ for element in args.element: raise ValueError("Unknown element '%s'" % element) mdis = machine.dis_engine(cont.bin_stream, dont_dis_nulstart_bloc=True) -ir_arch = machine.ira(mdis.symbol_pool) +ir_arch = machine.ira(mdis.loc_db) # Common argument forms init_ctx = {} @@ -59,21 +59,22 @@ if args.rename_args: init_ctx[e_mem] = ExprId("arg%d" % i, 32) # Disassemble the targeted function -blocks = mdis.dis_multiblock(int(args.func_addr, 0)) +asmcfg = mdis.dis_multiblock(int(args.func_addr, 0)) # Generate IR -for block in blocks: - ir_arch.add_block(block) +ircfg = ir_arch.new_ircfg_from_asmcfg(asmcfg) # Get the instance -dg = DependencyGraph(ir_arch, implicit=args.implicit, - apply_simp=not args.do_not_simplify, - follow_mem=not args.unfollow_mem, - follow_call=not args.unfollow_call) +dg = DependencyGraph( + ircfg, implicit=args.implicit, + apply_simp=not args.do_not_simplify, + follow_mem=not args.unfollow_mem, + follow_call=not args.unfollow_call +) # Build information target_addr = int(args.target_addr, 0) -current_block = list(ir_arch.getby_offset(target_addr))[0] +current_block = list(ircfg.getby_offset(target_addr))[0] assignblk_index = 0 for assignblk_index, assignblk in enumerate(current_block): if assignblk.instr.offset == target_addr: @@ -81,12 +82,12 @@ for assignblk_index, assignblk in enumerate(current_block): # Enumerate solutions json_solutions = [] -for sol_nb, sol in enumerate(dg.get(current_block.label, elements, assignblk_index, set())): +for sol_nb, sol in enumerate(dg.get(current_block.loc_key, elements, assignblk_index, set())): fname = "sol_%d.dot" % sol_nb with open(fname, "w") as fdesc: fdesc.write(sol.graph.dot()) - results = sol.emul(ctx=init_ctx) + results = sol.emul(ir_arch, ctx=init_ctx) tokens = {str(k): str(v) for k, v in results.iteritems()} if not args.json: result = ", ".join("=".join(x) for x in tokens.iteritems()) diff --git a/example/symbol_exec/dse_strategies.py b/example/symbol_exec/dse_strategies.py index a981853a..5a4be321 100644 --- a/example/symbol_exec/dse_strategies.py +++ b/example/symbol_exec/dse_strategies.py @@ -67,7 +67,7 @@ jitter.init_run(run_addr) # Init a DSE instance with a given strategy dse = DSEPathConstraint(machine, produce_solution=strategy) dse.attach(jitter) -# Concretize everything exept the argument +# Concretize everything except the argument dse.update_state_from_concrete() regs = jitter.ir_arch.arch.regs arg = ExprId("ARG", 32) diff --git a/example/symbol_exec/single_instr.py b/example/symbol_exec/single_instr.py index 22a48fc6..c78f1f7f 100644 --- a/example/symbol_exec/single_instr.py +++ b/example/symbol_exec/single_instr.py @@ -2,35 +2,34 @@ from miasm2.core.bin_stream import bin_stream_str from miasm2.ir.symbexec import SymbolicExecutionEngine from miasm2.analysis.machine import Machine -from miasm2.core.asmblock import AsmSymbolPool +from miasm2.core.locationdb import LocationDB START_ADDR = 0 machine = Machine("x86_32") - -symbol_pool = AsmSymbolPool() - +loc_db = LocationDB() # Assemble and disassemble a MOV ## Ensure that attributes 'offset' and 'l' are set -line = machine.mn.fromstring("MOV EAX, EBX", symbol_pool, 32) +line = machine.mn.fromstring("MOV EAX, EBX", loc_db, 32) asm = machine.mn.asm(line)[0] # Get back block bin_stream = bin_stream_str(asm) -mdis = machine.dis_engine(bin_stream, symbol_pool=symbol_pool) +mdis = machine.dis_engine(bin_stream, loc_db=loc_db) mdis.lines_wd = 1 asm_block = mdis.dis_block(START_ADDR) # Translate ASM -> IR -ira = machine.ira(mdis.symbol_pool) -ira.add_block(asm_block) +ira = machine.ira(mdis.loc_db) +ircfg = ira.new_ircfg() +ira.add_asmblock_to_ircfg(asm_block, ircfg) # Instanciate a Symbolic Execution engine with default value for registers -symb = SymbolicExecutionEngine(ira, {}) +symb = SymbolicExecutionEngine(ira) # Emulate one IR basic block ## Emulation of several basic blocks can be done through .emul_ir_blocks -cur_addr = symb.run_at(START_ADDR) +cur_addr = symb.run_at(ircfg, START_ADDR) # Modified elements print 'Modified registers:' |