angr.state_plugins.trace_additions¶

This file contains objects to track additional information during a trace or modify symbolic variables during a trace.

The ChallRespInfo plugin tracks variables in stdin and stdout to enable handling of challenge response It handles atoi/int2str in a special manner since path constraints will usually prevent their values from being modified

The Zen plugin simplifies expressions created from variables in the flag page (losing some accuracy) to avoid situations where they become to complex for z3, but the actual equation doesn’t matter much. This can happen in challenge response if all of the values in the flag page are multiplied together before being printed.

class angr.state_plugins.trace_additions.FormatInfo¶

Bases: object

copy()¶

compute(state)¶

get_type()¶

class angr.state_plugins.trace_additions.FormatInfoStrToInt¶

Bases: FormatInfo

__init__(addr, func_name, str_arg_num, base, base_arg, allows_negative)¶

copy()¶

compute(state)¶

get_type()¶

class angr.state_plugins.trace_additions.FormatInfoIntToStr¶

Bases: FormatInfo

__init__(addr, func_name, int_arg_num, str_dst_num, base, base_arg)¶

copy()¶

compute(state)¶

get_type()¶

class angr.state_plugins.trace_additions.FormatInfoDontConstrain¶

Bases: FormatInfo

__init__(addr, func_name, check_symbolic_arg)¶

copy()¶

compute(state)¶

get_type()¶

angr.state_plugins.trace_additions.int2base(x, base)¶

angr.state_plugins.trace_additions.generic_info_hook(state)¶

angr.state_plugins.trace_additions.end_info_hook(state)¶

angr.state_plugins.trace_additions.exit_hook(state)¶

angr.state_plugins.trace_additions.syscall_hook(state)¶

angr.state_plugins.trace_additions.constraint_hook(state)¶

class angr.state_plugins.trace_additions.ChallRespInfo¶

Bases: SimStatePlugin

This state plugin keeps track of the reads and writes to symbolic addresses

__init__()¶

static get_byte(var_name)¶

lookup_original(replacement)¶

pop_from_backup()¶

get_stdin_indices(variable)¶

get_stdout_indices(variable)¶

get_real_len(input_val, base, result_bv, allows_negative)¶

get_possible_len(input_val, base, allows_negative)¶

get_same_length_constraints()¶

static atoi_dumps(state, require_same_length=True)¶

static prep_tracer(state, format_infos=None)¶

angr.state_plugins.trace_additions.zen_hook(state, expr)¶

angr.state_plugins.trace_additions.zen_memory_write(state)¶

angr.state_plugins.trace_additions.zen_register_write(state)¶

class angr.state_plugins.trace_additions.ZenPlugin¶

Bases: SimStatePlugin

__init__(max_depth=13)¶

static get_flag_rand_args(expr)¶

get_expr_depth(expr)¶

get_flag_bytes(ast)¶

filter_constraints(constraints)¶

analyze_transmit(state, buf)¶

static prep_tracer(state)¶