changed repo structure

training/h4tum/IntroAngr/templatecode/angr_concretization.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+
+import angr
+import claripy
+import os
+
+base_addr = 0x400000
+main_fun = base_addr + 0x0 #TODO
+
+binarypath = "" # TODO
+
+# Load the binary
+p = angr.Project(binarypath, auto_load_libs=False)
+
+# If you want debug output
+#import logging
+#logging.getLogger('angr').setLevel('DEBUG')
+
+
+
+class ConcretizationHandler(object):
+    def __init__(self, dbg_addr=0xDEADAFFE0000):
+        self.DEBUG_ADDR = dbg_addr
+
+    def before_address_concretization(self, state):
+        self.index_expr = state.inspect.address_concretization_expr
+        state.inspect.address_concretization_expr = self.DEBUG_ADDR
+
+    """
+    Angr API:
+
+
+    """
+    def after_address_concretization(self, state):
+        ## TODO
+        # Set self.DEBUG_ADDR to a value modeling the array access / mathematical operation that is actually performed
+        # memory can be set via state.mem[addr].uint8_t = ..., state.mem[addr].uint16_t = ..., etc.
+
+        # Do not add new path constraints
+        state.inspect.address_concretization_add_constraints = False
+        # Specify our DEBUG_ADDR as the target of the concretization
+        state.inspect.address_concretization_result = [self.DEBUG_ADDR]
+
+
+
+
+
+
+
+proto = "int main()" # Example for main
+
+## Initialize call state with useful options
+#   ZERO_FILL_UNCONSTRAINED_MEMORY: Memory that is used but not initialized is set to 0
+#   ZERO_FILL_UNCONSTRAINED_REGISTERS: Registers that are used but are not initialized are set to 0, this prevents warnings whencallee-saved registers are pushed onto the stack
+#   LAZY_SOLVES: This is somewhat of a magic "hack": Do not query the constrained solver unless really necessary. If you're trying to go through a specific code path, this can save tons of time! Experiment with and without it!
+state = p.factory.call_state(main_fun, prototype=proto,
+                             add_options=({angr.options.ZERO_FILL_UNCONSTRAINED_MEMORY,
+                                           angr.options.ZERO_FILL_UNCONSTRAINED_REGISTERS,
+                                           angr.options.LAZY_SOLVES}),
+                             )
+
+# Register concretization hooks
+conc_handler = ConcretizationHandler()
+state.inspect.b('address_concretization', when=angr.BP_BEFORE, action=conc_handler.before_address_concretization)
+state.inspect.b('address_concretization', when=angr.BP_AFTER, action=conc_handler.after_address_concretization)
+
+
+
+# Initialize a simulation manager with the state
+sm = p.factory.simulation_manager(state)
+
+
+# Perform explore
+print("Starting explore...")
+
+# Try to find a state that fulfills a certain condition via exploration
+# Useful: s.posix.dumps(1) to access stdout and s.posix.dumps(2) to access stderr
+# Note: find and avoid can also have single integers (addresses) or lists of integers
+sm.explore(find=lambda s: False, avoid=lambda s: False) # TODO
+
+# dump stdin and stdout of found states
+for s in sm.found:
+    print(s.posix.dumps(1))
+    print(s.posix.dumps(0).strip(b'\x00').decode())