From 13a00a41ea1abb4826b32b130c42c174f953c270 Mon Sep 17 00:00:00 2001 From: cnheitman Date: Wed, 12 Jun 2024 13:45:20 +0000 Subject: [PATCH] =?UTF-8?q?Deploying=20to=20gh-pages=20from=20=20@=20d9ed6?= =?UTF-8?q?62957bf0005ef22e8917226e028cee1e249=20=F0=9F=9A=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- tutos/hooks.html | 114 ++++++++++++++++++------------------- tutos/loaders.html | 98 ++++++++++++++++---------------- tutos/sanitizers.html | 72 ++++++++++++------------ tutos/seeds.html | 50 ++++++++--------- tutos/starting.html | 128 +++++++++++++++++++++--------------------- 5 files changed, 231 insertions(+), 231 deletions(-) diff --git a/tutos/hooks.html b/tutos/hooks.html index 3320c5e..b94fb78 100644 --- a/tutos/hooks.html +++ b/tutos/hooks.html @@ -134,15 +134,15 @@

Playing with Hooks
[41]:
-
from triton import Instruction
-from tritondse import SymbolicExecutor, Config, Seed, Program, ProcessState, SeedFormat, CompositeData
+
from triton import Instruction
+from tritondse import SymbolicExecutor, Config, Seed, Program, ProcessState, SeedFormat, CompositeData
 
-p = Program("crackme_xor")
-config = Config(pipe_stdout=False, seed_format=SeedFormat.COMPOSITE)
-seed = Seed(CompositeData(argv=[b"./crackme_xor", b"AAAAAAAAAAAA"]))
+p = Program("crackme_xor")
+config = Config(pipe_stdout=False, seed_format=SeedFormat.COMPOSITE)
+seed = Seed(CompositeData(argv=[b"./crackme_xor", b"AAAAAAAAAAAA"]))
 
-executor = SymbolicExecutor(config, seed)
-executor.load(p)
+executor = SymbolicExecutor(config, seed)
+executor.load(p)
@@ -166,10 +166,10 @@

I. Instruction hooking
[42]:

-
def trace_inst(se: SymbolicExecutor, pstate: ProcessState, inst: Instruction):
-    print(f"[tid:{inst.getThreadId()}] 0x{inst.getAddress():x}: {inst.getDisassembly()}")
+
def trace_inst(se: SymbolicExecutor, pstate: ProcessState, inst: Instruction):
+    print(f"[tid:{inst.getThreadId()}] 0x{inst.getAddress():x}: {inst.getDisassembly()}")
 
-executor.callback_manager.register_post_instruction_callback(trace_inst)
+executor.callback_manager.register_post_instruction_callback(trace_inst)
@@ -177,7 +177,7 @@

I. Instruction hooking
[43]:

-
executor.run()
+
executor.run()
@@ -266,14 +266,14 @@

II. Address/Function hooking
[44]:

-
def hook_cmp(se: SymbolicExecutor, pstate: ProcessState, addr: int):
-    print(f"{pstate.cpu.al} - {pstate.cpu.cl}")
-    pstate.cpu.zf = 1
-    #exec.abort()
+
def hook_cmp(se: SymbolicExecutor, pstate: ProcessState, addr: int):
+    print(f"{pstate.cpu.al} - {pstate.cpu.cl}")
+    pstate.cpu.zf = 1
+    #exec.abort()
 
-def hook_puts(se: SymbolicExecutor, pstate: ProcessState, routine: str, addr: int):
-    s = pstate.memory.read_string(pstate.get_argument_value(0))
-    print(f"puts: {s}")
+def hook_puts(se: SymbolicExecutor, pstate: ProcessState, routine: str, addr: int):
+    s = pstate.memory.read_string(pstate.get_argument_value(0))
+    print(f"puts: {s}")
@@ -281,13 +281,13 @@

II. Address/Function hooking
[45]:

-
executor = SymbolicExecutor(config, seed)
-executor.load(p)
+
executor = SymbolicExecutor(config, seed)
+executor.load(p)
 
-# Remove trace printing callback
-executor.callback_manager.reset()
-executor.callback_manager.register_post_addr_callback(0x0400597, hook_cmp)
-executor.callback_manager.register_post_imported_routine_callback("puts", hook_puts)
+# Remove trace printing callback
+executor.callback_manager.reset()
+executor.callback_manager.register_post_addr_callback(0x0400597, hook_cmp)
+executor.callback_manager.register_post_imported_routine_callback("puts", hook_puts)
@@ -303,7 +303,7 @@

II. Address/Function hooking
[46]:

-
executor.run()
+
executor.run()
@@ -329,28 +329,28 @@

III. Solving queries
[47]:

-
from tritondse.types import SolverStatus
+
from tritondse.types import SolverStatus
 
-def hook_cmp2(se: SymbolicExecutor, pstate: ProcessState, addr: int):
-    # CL contains the input of the user (hashed)
+def hook_cmp2(se: SymbolicExecutor, pstate: ProcessState, addr: int):
+    # CL contains the input of the user (hashed)
 
-    # retrieve the symbolic value of both characters
-    sym_al = pstate.read_symbolic_register(pstate.registers.al)
-    sym_cl = pstate.read_symbolic_register(pstate.registers.cl)
+    # retrieve the symbolic value of both characters
+    sym_al = pstate.read_symbolic_register(pstate.registers.al)
+    sym_cl = pstate.read_symbolic_register(pstate.registers.cl)
 
-    # Solve the constraint such that one match the other
-    status, model = pstate.solve(sym_al.getAst() == sym_cl.getAst())
+    # Solve the constraint such that one match the other
+    status, model = pstate.solve(sym_al.getAst() == sym_cl.getAst())
 
-    # If formula is SAT retrieve input values
-    if status == SolverStatus.SAT:
-        # Retrieve value of the input variable involved in the cl value here (shall be only one here)
-        var_values = pstate.get_expression_variable_values_model(sym_cl, model)
-        for var, value in var_values.items():
-            print(f"{var}: {chr(value)}")
-    else:
-        print(status.name)
+    # If formula is SAT retrieve input values
+    if status == SolverStatus.SAT:
+        # Retrieve value of the input variable involved in the cl value here (shall be only one here)
+        var_values = pstate.get_expression_variable_values_model(sym_cl, model)
+        for var, value in var_values.items():
+            print(f"{var}: {chr(value)}")
+    else:
+        print(status.name)
 
-    pstate.cpu.zf = 1
+    pstate.cpu.zf = 1
@@ -358,11 +358,11 @@

III. Solving queries
[48]:

-
executor = SymbolicExecutor(config, seed)
-executor.load(p)
+
executor = SymbolicExecutor(config, seed)
+executor.load(p)
 
-executor.callback_manager.reset()
-executor.callback_manager.register_post_addr_callback(0x0400597, hook_cmp2)
+executor.callback_manager.reset()
+executor.callback_manager.register_post_addr_callback(0x0400597, hook_cmp2)
@@ -378,7 +378,7 @@

III. Solving queries
[49]:

-
executor.run()
+
executor.run()
@@ -402,21 +402,21 @@

IV. Hooking exploration events
[53]:

-
from tritondse import SymbolicExplorator, Config, Seed, Program, ProcessState, SeedFormat, CompositeData
+
from tritondse import SymbolicExplorator, Config, Seed, Program, ProcessState, SeedFormat, CompositeData
 
-def pre_exec_hook(se: SymbolicExecutor, state: ProcessState):
-    print(f"input: {se.seed.hash} {se.seed.content.argv} ", end="")
+def pre_exec_hook(se: SymbolicExecutor, state: ProcessState):
+    print(f"input: {se.seed.hash} {se.seed.content.argv} ", end="")
 
-def post_exec_hook(se: SymbolicExecutor, state: ProcessState):
-    print(f"status:{se.seed.status.name}   [exitcode:{se.exitcode}]")
+def post_exec_hook(se: SymbolicExecutor, state: ProcessState):
+    print(f"status:{se.seed.status.name}   [exitcode:{se.exitcode}]")
 
-dse = SymbolicExplorator(Config(seed_format=SeedFormat.COMPOSITE), p)
-dse.add_input_seed(Seed(CompositeData(argv=[b"./crackme_xor", b"AAAAAAAAAAAA"])))
+dse = SymbolicExplorator(Config(seed_format=SeedFormat.COMPOSITE), p)
+dse.add_input_seed(Seed(CompositeData(argv=[b"./crackme_xor", b"AAAAAAAAAAAA"])))
 
-dse.callback_manager.register_pre_execution_callback(pre_exec_hook)
-dse.callback_manager.register_post_execution_callback(post_exec_hook)
+dse.callback_manager.register_pre_execution_callback(pre_exec_hook)
+dse.callback_manager.register_post_execution_callback(post_exec_hook)
 
-dse.explore()
+dse.explore()
diff --git a/tutos/loaders.html b/tutos/loaders.html index 3687cbb..b64bb49 100644 --- a/tutos/loaders.html +++ b/tutos/loaders.html @@ -124,13 +124,13 @@

Linux ELF loader
[4]:

-
from tritondse import ProcessState, Program
+
from tritondse import ProcessState, Program
 
-p = Program("crackme_xor")
+p = Program("crackme_xor")
 
-ps = ProcessState.from_loader(p)
+ps = ProcessState.from_loader(p)
 
-list(ps.memory.get_maps())
+list(ps.memory.get_maps())
@@ -155,13 +155,13 @@

CLE Loader
[5]:

-
from tritondse import ProcessState, CleLoader
+
from tritondse import ProcessState, CleLoader
 
-p = CleLoader("crackme_xor")
+p = CleLoader("crackme_xor")
 
-ps = ProcessState.from_loader(p)
+ps = ProcessState.from_loader(p)
 
-list(ps.memory.get_maps())
+list(ps.memory.get_maps())
@@ -205,21 +205,21 @@

Firmware Loading
[ ]:

-
from tritondse import Architecture, RawBinaryLoader, LoadableSegment
+
from tritondse import Architecture, RawBinaryLoader, LoadableSegment
 
-BASE_ADDRESS= 0x8000000
-ENTRY_POINT = 0x81dc46e
-STACK_ADDR  = 0x1000000
-STACK_SIZE  = 1024*6
+BASE_ADDRESS= 0x8000000
+ENTRY_POINT = 0x81dc46e
+STACK_ADDR  = 0x1000000
+STACK_SIZE  = 1024*6
 
-raw_f = Path("./bugged_json_parser.bin").read_bytes()
+raw_f = Path("./bugged_json_parser.bin").read_bytes()
 
-ldr = RawBinaryLoader(Architecture.ARM32,
-                       cpustate = {"pc": ENTRY_POINT,
-                                   "sp": STACK_ADDR+STACK_SIZE},
-                       set_thumb=True,
-                       maps = [LoadableSegment(BASE_ADDRESS, len(raw_f), Perm.R|Perm.X, raw_f, name="bugged_json_parser"),
-                               LoadableSegment(STACK_ADDR, STACK_SIZE, Perm.R|Perm.W, name="[stack]")])
+ldr = RawBinaryLoader(Architecture.ARM32,
+                       cpustate = {"pc": ENTRY_POINT,
+                                   "sp": STACK_ADDR+STACK_SIZE},
+                       set_thumb=True,
+                       maps = [LoadableSegment(BASE_ADDRESS, len(raw_f), Perm.R|Perm.X, raw_f, name="bugged_json_parser"),
+                               LoadableSegment(STACK_ADDR, STACK_SIZE, Perm.R|Perm.W, name="[stack]")])
@@ -232,46 +232,46 @@

Writing a Loader
[ ]:

-
class Loader(object):
-    def __init__(self, path: str):
-        self.bin_path = Path(path)
+
class Loader(object):
+    def __init__(self, path: str):
+        self.bin_path = Path(path)
 
-    @property
-    def name(self) -> str:
-        raise NotImplementedError()
+    @property
+    def name(self) -> str:
+        raise NotImplementedError()
 
-    @property
-    def entry_point(self) -> Addr:
-        raise NotImplementedError()
+    @property
+    def entry_point(self) -> Addr:
+        raise NotImplementedError()
 
-    @property
-    def architecture(self) -> Architecture:
-        raise NotImplementedError()
+    @property
+    def architecture(self) -> Architecture:
+        raise NotImplementedError()
 
-    @property
-    def arch_mode(self) -> Optional[ArchMode]:
-        return None
+    @property
+    def arch_mode(self) -> Optional[ArchMode]:
+        return None
 
-    @property
-    def platform(self) -> Optional[Platform]:
-        return None
+    @property
+    def platform(self) -> Optional[Platform]:
+        return None
 
-    def memory_segments(self) -> Generator[LoadableSegment, None, None]:
-        raise NotImplementedError()
+    def memory_segments(self) -> Generator[LoadableSegment, None, None]:
+        raise NotImplementedError()
 
-    @property
-    def cpustate(self) -> Dict[str, int]:
-        return {}
+    @property
+    def cpustate(self) -> Dict[str, int]:
+        return {}
 
 
-    def imported_functions_relocations(self) -> Generator[Tuple[str, Addr], None, None]:
-        yield from ()
+    def imported_functions_relocations(self) -> Generator[Tuple[str, Addr], None, None]:
+        yield from ()
 
-    def imported_variable_symbols_relocations(self) -> Generator[Tuple[str, Addr], None, None]:
-        yield from ()
+    def imported_variable_symbols_relocations(self) -> Generator[Tuple[str, Addr], None, None]:
+        yield from ()
 
-    def find_function_addr(self, name: str) -> Optional[Addr]:
-        return None
+    def find_function_addr(self, name: str) -> Optional[Addr]:
+        return None
diff --git a/tutos/sanitizers.html b/tutos/sanitizers.html index 0745e0f..f363ca3 100644 --- a/tutos/sanitizers.html +++ b/tutos/sanitizers.html @@ -148,12 +148,12 @@

Using built-in sanitizers
[2]:

-
from tritondse import SymbolicExecutor, Config, Seed, Program, ProcessState, SymbolicExplorator, CoverageStrategy
-from tritondse.sanitizers import NullDerefSanitizer
+
from tritondse import SymbolicExecutor, Config, Seed, Program, ProcessState, SymbolicExplorator, CoverageStrategy
+from tritondse.sanitizers import NullDerefSanitizer
 
-dse = SymbolicExplorator(Config(), Program("crackme_xor"))
+dse = SymbolicExplorator(Config(), Program("crackme_xor"))
 
-dse.callback_manager.register_probe(NullDerefSanitizer())
+dse.callback_manager.register_probe(NullDerefSanitizer())
@@ -166,40 +166,40 @@

Writing a sanitizer
[3]:

-
from tritondse import ProbeInterface, SymbolicExecutor, ProcessState, CbType, SeedStatus
-from tritondse.types import Addr, SolverStatus
+
from tritondse import ProbeInterface, SymbolicExecutor, ProcessState, CbType, SeedStatus
+from tritondse.types import Addr, SolverStatus
 
-class OpenSanitizer(ProbeInterface):
+class OpenSanitizer(ProbeInterface):
 
-    PASSWD_FILE = "/etc/passwd"
+    PASSWD_FILE = "/etc/passwd"
 
-    def __init__(self):
-        super(OpenSanitizer, self).__init__()
-        self._add_callback(CbType.PRE_RTN, self.fopen_check, 'fopen')
-        self._add_callback(CbType.PRE_RTN, self.fopen_check, 'freopen')
-
-    def fopen_check(self, se: SymbolicExecutor, pstate: ProcessState, rtn_name: str, addr: Addr):
-        # the filepath is located in arg0 (ptr to a string)
-        string_ptr = se.pstate.get_argument_value(0)
-
-        symbolic = True
-        cur_ptr = string_ptr
-        while pstate.read_memory_int(cur_ptr, 1):        # while different from 0
-            if not se.pstate.is_memory_symbolic(cur_ptr, 1): # check that the byte is symbolic
-                symbolic = False
-            cur_ptr += 1
-
-        # if all memory bytes are symbolic and we have enough place to fit our string
-        if symbolic and (cur_ptr - string_ptr) > len(self.PASSWD_FILE):
-
-            # Try to solve by SMT that the filepath string is /etc/passwd
-            constraints = [pstate.read_symbolic_memory_byte(string_ptr+i).getAst() == ord(pwd_byte) for i, pwd_byte in enumerate(self.PASSWD_FILE)]
-            st, model = pstate.solve(constraints)
-
-            if st == SolverStatus.SAT:                          # if formula satisfiable
-                new_seed = se.mk_new_seed_from_model(model)  # create a new input from the model
-                new_seed.status = SeedStatus.CRASH           # mark it as crash
-                se.enqueue_seed(new_seed)                    # enqueue it *(so that it will put in the workspace..)*
+    def __init__(self):
+        super(OpenSanitizer, self).__init__()
+        self._add_callback(CbType.PRE_RTN, self.fopen_check, 'fopen')
+        self._add_callback(CbType.PRE_RTN, self.fopen_check, 'freopen')
+
+    def fopen_check(self, se: SymbolicExecutor, pstate: ProcessState, rtn_name: str, addr: Addr):
+        # the filepath is located in arg0 (ptr to a string)
+        string_ptr = se.pstate.get_argument_value(0)
+
+        symbolic = True
+        cur_ptr = string_ptr
+        while pstate.read_memory_int(cur_ptr, 1):        # while different from 0
+            if not se.pstate.is_memory_symbolic(cur_ptr, 1): # check that the byte is symbolic
+                symbolic = False
+            cur_ptr += 1
+
+        # if all memory bytes are symbolic and we have enough place to fit our string
+        if symbolic and (cur_ptr - string_ptr) > len(self.PASSWD_FILE):
+
+            # Try to solve by SMT that the filepath string is /etc/passwd
+            constraints = [pstate.read_symbolic_memory_byte(string_ptr+i).getAst() == ord(pwd_byte) for i, pwd_byte in enumerate(self.PASSWD_FILE)]
+            st, model = pstate.solve(constraints)
+
+            if st == SolverStatus.SAT:                          # if formula satisfiable
+                new_seed = se.mk_new_seed_from_model(model)  # create a new input from the model
+                new_seed.status = SeedStatus.CRASH           # mark it as crash
+                se.enqueue_seed(new_seed)                    # enqueue it *(so that it will put in the workspace..)*
@@ -208,7 +208,7 @@

Writing a sanitizer
[4]:

-
dse.callback_manager.register_probe(OpenSanitizer())
+
dse.callback_manager.register_probe(OpenSanitizer())
diff --git a/tutos/seeds.html b/tutos/seeds.html index 5c3bcf0..c3fc6c6 100644 --- a/tutos/seeds.html +++ b/tutos/seeds.html @@ -121,20 +121,20 @@

Managing Seeds
[80]:

-
from tritondse import SymbolicExecutor, Config, Seed, Program, ProcessState, SymbolicExplorator, CoverageStrategy, SeedFormat, CompositeData
+
from tritondse import SymbolicExecutor, Config, Seed, Program, ProcessState, SymbolicExplorator, CoverageStrategy, SeedFormat, CompositeData
 
-config = Config(pipe_stdout=False, coverage_strategy=CoverageStrategy.PATH, seed_format=SeedFormat.COMPOSITE)
+config = Config(pipe_stdout=False, coverage_strategy=CoverageStrategy.PATH, seed_format=SeedFormat.COMPOSITE)
 
-def post_exec_hook(se: SymbolicExecutor, state: ProcessState):
-    print(f"seed:{se.seed.hash} ({repr(se.seed.content.argv)})   [exitcode:{se.exitcode}]")
+def post_exec_hook(se: SymbolicExecutor, state: ProcessState):
+    print(f"seed:{se.seed.hash} ({repr(se.seed.content.argv)})   [exitcode:{se.exitcode}]")
 
-dse = SymbolicExplorator(config, Program("crackme_xor"))
+dse = SymbolicExplorator(config, Program("crackme_xor"))
 
-dse.add_input_seed(Seed(CompositeData(argv=[b"./crackme", b"AAAAAAAAAAAAAAA"])))
+dse.add_input_seed(Seed(CompositeData(argv=[b"./crackme", b"AAAAAAAAAAAAAAA"])))
 
-dse.callback_manager.register_post_execution_callback(post_exec_hook)
+dse.callback_manager.register_post_execution_callback(post_exec_hook)
 
-dse.explore()
+dse.explore()
@@ -185,16 +185,16 @@

Managing generated corpus
[81]:

-
def hook_cmp(se: SymbolicExecutor, pstate: ProcessState, addr: int):
-    zf = pstate.cpu.zf  # concrete value
-    sym_zf = pstate.read_symbolic_register(pstate.registers.zf)
+
def hook_cmp(se: SymbolicExecutor, pstate: ProcessState, addr: int):
+    zf = pstate.cpu.zf  # concrete value
+    sym_zf = pstate.read_symbolic_register(pstate.registers.zf)
 
-    # Revert the current value of zf to "negate" condition
-    status, model = pstate.solve(sym_zf.getAst() != zf)
+    # Revert the current value of zf to "negate" condition
+    status, model = pstate.solve(sym_zf.getAst() != zf)
 
-    if status == SolverStatus.SAT:
-        new_seed = se.mk_new_seed_from_model(model)
-        se.enqueue_seed(new_seed)
+    if status == SolverStatus.SAT:
+        new_seed = se.mk_new_seed_from_model(model)
+        se.enqueue_seed(new_seed)
@@ -204,11 +204,11 @@

Managing generated corpus
[82]:

-
print("seed to process:", len(list(dse.workspace.iter_worklist())))
+
print("seed to process:", len(list(dse.workspace.iter_worklist())))
 
-print("\nCorpus:")
-for seed in dse.workspace.iter_corpus():
-      print(seed.filename)
+print("\nCorpus:")
+for seed in dse.workspace.iter_corpus():
+      print(seed.filename)
@@ -265,8 +265,8 @@

Setting seed status
[83]:

-
composite_seed_1 = Seed(CompositeData(argv=[b"this", b"will", b"injected", b"into", b"argv"]))
-composite_seed_2 = Seed(CompositeData(files={"stdin": b"This will be injected when the program reads from stdin"}))
+
composite_seed_1 = Seed(CompositeData(argv=[b"this", b"will", b"injected", b"into", b"argv"]))
+composite_seed_2 = Seed(CompositeData(files={"stdin": b"This will be injected when the program reads from stdin"}))
@@ -275,9 +275,9 @@

Setting seed status
[84]:

-
from tritondse import SymbolicExplorator, Config, SeedFormat, Program
-dse_using_raw_seeds = SymbolicExplorator(Config(), Program("crackme_xor"))
-dse_using_composite_seeds = SymbolicExplorator(Config(seed_format=SeedFormat.COMPOSITE), Program("crackme_xor"))
+
from tritondse import SymbolicExplorator, Config, SeedFormat, Program
+dse_using_raw_seeds = SymbolicExplorator(Config(), Program("crackme_xor"))
+dse_using_composite_seeds = SymbolicExplorator(Config(seed_format=SeedFormat.COMPOSITE), Program("crackme_xor"))
diff --git a/tutos/starting.html b/tutos/starting.html index 58a3708..14feeef 100644 --- a/tutos/starting.html +++ b/tutos/starting.html @@ -143,12 +143,12 @@

I. Program
[119]:

-
from tritondse import Program
+
from tritondse import Program
 
-p = Program("crackme_xor")
+p = Program("crackme_xor")
 
-print(p.architecture, p.endianness)
-print(hex(p.entry_point))
+print(p.architecture, p.endianness)
+print(hex(p.entry_point))
@@ -169,7 +169,7 @@

I. Program
[120]:

-
p.find_function_addr("main")
+
p.find_function_addr("main")
@@ -186,8 +186,8 @@

I. Program
[121]:

-
for seg in p.memory_segments():
-    print(f"0x{seg.address:x} size:{len(seg.content)}")
+
for seg in p.memory_segments():
+    print(f"0x{seg.address:x} size:{len(seg.content)}")
@@ -209,13 +209,13 @@

II. Single Execution
[123]:

-
from tritondse import SymbolicExecutor, Config, Seed, CompositeData
+
from tritondse import SymbolicExecutor, Config, Seed, CompositeData
 
-config = Config()
-seed = Seed(CompositeData(argv=[b"Hello", b"world"]))
+config = Config()
+seed = Seed(CompositeData(argv=[b"Hello", b"world"]))
 
-executor = SymbolicExecutor(config, seed)
-executor.load(p)
+executor = SymbolicExecutor(config, seed)
+executor.load(p)
@@ -233,7 +233,7 @@

II. Single Execution
[124]:

-
executor.run()
+
executor.run()
@@ -243,7 +243,7 @@

II. Single Execution
[ ]:

-
pstate = executor.pstate  # ProcessState object
+
pstate = executor.pstate  # ProcessState object
@@ -252,7 +252,7 @@

II. Single Execution
[125]:

-
executor.coverage.total_instruction_executed
+
executor.coverage.total_instruction_executed
@@ -269,7 +269,7 @@

II. Single Execution
[126]:

-
executor.exitcode
+
executor.exitcode
@@ -290,7 +290,7 @@

III. Concrete State Manipulation
[127]:

-
from tritondse.types import Architecture
+
from tritondse.types import Architecture
@@ -298,8 +298,8 @@

III. Concrete State Manipulation
[128]:

-
pstate = executor.pstate
-print(f"arch: {pstate.architecture.name}  ptrsize:{pstate.ptr_bit_size}")
+
pstate = executor.pstate
+print(f"arch: {pstate.architecture.name}  ptrsize:{pstate.ptr_bit_size}")
@@ -318,7 +318,7 @@

a. Reading, writing registers (function API)
[129]:

-
pstate.registers.rax
+
pstate.registers.rax
@@ -336,10 +336,10 @@

a. Reading, writing registers (function API)
[130]:

-
pstate.program_counter_register, \
-pstate.base_pointer_register, \
-pstate.stack_pointer_register, \
-pstate.return_register
+
pstate.program_counter_register, \
+pstate.base_pointer_register, \
+pstate.stack_pointer_register, \
+pstate.return_register
@@ -357,9 +357,9 @@

a. Reading, writing registers (function API)
[131]:

-
pstate.write_register(pstate.registers.rax, 0xdeadbeef)
+
pstate.write_register(pstate.registers.rax, 0xdeadbeef)
 
-hex(pstate.read_register(pstate.registers.rax))
+hex(pstate.read_register(pstate.registers.rax))
@@ -380,7 +380,7 @@

b. Reading, writing registers (Pythonic API)
[132]:

-
pstate.cpu.rax
+
pstate.cpu.rax
@@ -397,9 +397,9 @@

b. Reading, writing registers (Pythonic API)
[133]:

-
pstate.cpu.rax += 4
+
pstate.cpu.rax += 4
 
-pstate.cpu.rax
+pstate.cpu.rax
@@ -416,7 +416,7 @@

b. Reading, writing registers (Pythonic API)
[134]:

-
print(f"RIP: 0x{pstate.cpu.program_counter:x}")
+
print(f"RIP: 0x{pstate.cpu.program_counter:x}")
@@ -436,15 +436,15 @@

c. Reading, writing memory
[135]:

-
print(pstate.memory.read(p.entry_point, 10))  # Reads 10 bytes
-print(hex(pstate.memory.read_ptr(p.entry_point)))  # Reads a pointer size
-print(pstate.memory.read_int(p.entry_point))  # Reads a 4 bytes signed int
-print(pstate.memory.read_uint(p.entry_point))  # Reads a 4 bytes unsigned int
-print(pstate.memory.read_char(p.entry_point))  # Reads a 1 bytes signed char
-print(pstate.memory.read_uchar(p.entry_point))  # Reads a 1 bytes unsigned char
-print(pstate.memory.read_word(p.entry_point))  # Reads a 2 bytes unsigned integer
-print(pstate.memory.read_dword(p.entry_point))  # Reads a 4 bytes unsigned integer
-print(pstate.memory.read_qword(p.entry_point))  # Reads a 8 bytes unsigned integer
+
print(pstate.memory.read(p.entry_point, 10))  # Reads 10 bytes
+print(hex(pstate.memory.read_ptr(p.entry_point)))  # Reads a pointer size
+print(pstate.memory.read_int(p.entry_point))  # Reads a 4 bytes signed int
+print(pstate.memory.read_uint(p.entry_point))  # Reads a 4 bytes unsigned int
+print(pstate.memory.read_char(p.entry_point))  # Reads a 1 bytes signed char
+print(pstate.memory.read_uchar(p.entry_point))  # Reads a 1 bytes unsigned char
+print(pstate.memory.read_word(p.entry_point))  # Reads a 2 bytes unsigned integer
+print(pstate.memory.read_dword(p.entry_point))  # Reads a 4 bytes unsigned integer
+print(pstate.memory.read_qword(p.entry_point))  # Reads a 8 bytes unsigned integer
@@ -470,7 +470,7 @@

c. Reading, writing memory
[ ]:

-
data = pstate.memory[p.entry_point:10]   # Read 10 bytes in memory
+
data = pstate.memory[p.entry_point:10]   # Read 10 bytes in memory
@@ -479,7 +479,7 @@

c. Reading, writing memory
[136]:

-
pstate.memory.is_mapped(p.entry_point), pstate.memory.is_mapped(0)
+
pstate.memory.is_mapped(p.entry_point), pstate.memory.is_mapped(0)
@@ -503,11 +503,11 @@

IV. Manipulating symbolic state
[137]:

-
new_sym = pstate.actx.bv(32, 64)  # new symbolic expression representing a constant
+
new_sym = pstate.actx.bv(32, 64)  # new symbolic expression representing a constant
 
-pstate.write_symbolic_register(pstate.registers.rax, new_sym)  # the expression can either be a AstNode or SymbolicExpression triton object
+pstate.write_symbolic_register(pstate.registers.rax, new_sym)  # the expression can either be a AstNode or SymbolicExpression triton object
 
-pstate.read_symbolic_register(pstate.registers.rax)
+pstate.read_symbolic_register(pstate.registers.rax)
@@ -528,12 +528,12 @@

IV. Manipulating symbolic state
[139]:

-
sym_rax = pstate.read_symbolic_register(pstate.registers.rax)
+
sym_rax = pstate.read_symbolic_register(pstate.registers.rax)
 
-constraint = sym_rax.getAst() == 4
-print(constraint)
+constraint = sym_rax.getAst() == 4
+print(constraint)
 
-pstate.push_constraint(constraint)
+pstate.push_constraint(constraint)
@@ -570,9 +570,9 @@

V. Configuration
[140]:

-
from tritondse import SeedFormat
-c = Config()
-c.seed_format=SeedFormat.COMPOSITE
+
from tritondse import SeedFormat
+c = Config()
+c.seed_format=SeedFormat.COMPOSITE
@@ -584,23 +584,23 @@

VI. Exploration
[141]:

-
from tritondse import SymbolicExplorator, SymbolicExecutor, ProcessState, Seed, Config, CoverageStrategy, Program, SeedFormat, CompositeData
-import tritondse.logging
+
from tritondse import SymbolicExplorator, SymbolicExecutor, ProcessState, Seed, Config, CoverageStrategy, Program, SeedFormat, CompositeData
+import tritondse.logging
 
-import logging
-logging.basicConfig(level=logging.DEBUG)
-tritondse.logging.enable() # enable tritondse to print log info
+import logging
+logging.basicConfig(level=logging.DEBUG)
+tritondse.logging.enable() # enable tritondse to print log info
 
-# Load the program
-p = Program("crackme_xor")
+# Load the program
+p = Program("crackme_xor")
 
-dse = SymbolicExplorator(Config(pipe_stdout=True, seed_format=SeedFormat.COMPOSITE), p)
+dse = SymbolicExplorator(Config(pipe_stdout=True, seed_format=SeedFormat.COMPOSITE), p)
 
-# create a dummy seed representing argv and add it to inputs
-seed = Seed(CompositeData(argv=[b"./crackme", b"AAAAAAAAAAAAAAA"]))
-dse.add_input_seed(seed)
+# create a dummy seed representing argv and add it to inputs
+seed = Seed(CompositeData(argv=[b"./crackme", b"AAAAAAAAAAAAAAA"]))
+dse.add_input_seed(seed)
 
-dse.explore()
+dse.explore()
@@ -634,7 +634,7 @@

VI. Exploration
[142]:

-
dse.execution_count
+
dse.execution_count