miasm.analysis.dse.DSEEngine Class Reference

Inheritance diagram for miasm.analysis.dse.DSEEngine:

Collaboration diagram for miasm.analysis.dse.DSEEngine:

Public Member Functions
def	__init__ (self, machine, loc_db)
def	prepare (self)
def	attach (self, emulator)
def	handle (self, cur_addr)
def	add_handler (self, addr, callback)
def	add_lib_handler (self, libimp, namespace)
def	add_instrumentation (self, addr, callback)
def	callback (self, _)
def	take_snapshot (self)
def	restore_snapshot (self, snapshot, memory=True)
def	update_state (self, assignblk)
def	update_state_from_concrete (self, cpu=True, mem=False)
def	eval_expr (self, expr)
def	symbolize_memory (self, memory_range)

Static Public Member Functions
def	memory_to_expr (addr)

Public Attributes
	machine
	loc_db
	handler
	instrumentation
	addr_to_cacheblocks
	ir_arch
	ircfg
	jitter
	symb
	Prepare symbexec engines. More...
	symb_concrete
	mdis

Static Public Attributes
	SYMB_ENGINE = ESETrackModif

Detailed Description

Dynamic Symbolic Execution Engine

This class aims to be overridden for each specific purpose

Constructor & Destructor Documentation

__init__()

def miasm.analysis.dse.DSEEngine.__init__	(		self,
			machine,
			loc_db
	)

Member Function Documentation

add_handler()

def miasm.analysis.dse.DSEEngine.add_handler	(		self,
			addr,
			callback
	)

Add a @callback for address @addr before any state update.
The state IS NOT updated after returning from the callback
@addr: int
@callback: func(dse instance)

Here is the caller graph for this function:

add_instrumentation()

def miasm.analysis.dse.DSEEngine.add_instrumentation	(		self,
			addr,
			callback
	)

Add a @callback for address @addr before any state update.
The state IS updated after returning from the callback
@addr: int
@callback: func(dse instance)

Here is the call graph for this function:

add_lib_handler()

def miasm.analysis.dse.DSEEngine.add_lib_handler	(		self,
			libimp,
			namespace
	)

Add search for handler based on a @libimp libimp instance

Known functions will be looked by {name}_symb or {name}_{ord}_symb in the @namespace

Here is the call graph for this function:

attach()

def miasm.analysis.dse.DSEEngine.attach	(		self,
			emulator
	)

Attach the DSE to @emulator
@emulator: jitload (or API equivalent) instance

To attach *DURING A BREAKPOINT*, one may consider using the following snippet:

def breakpoint(self, jitter):
    ...
    dse.attach(jitter)
    dse.update...
    ...
    # Additional call to the exec callback is necessary, as breakpoints are
    # honored AFTER exec callback
    jitter.exec_cb(jitter)

    return True

Without it, one may encounteer a DriftException error due to a
"desynchronization" between jitter and dse states. Indeed, on 'handle'
call, the jitter must be one instruction AFTER the dse.

Here is the call graph for this function:

callback()

def miasm.analysis.dse.DSEEngine.callback	(		self,
			_
	)

Called before each instruction

Here is the call graph for this function:

Here is the caller graph for this function:

eval_expr()

def miasm.analysis.dse.DSEEngine.eval_expr	(		self,
			expr
	)

Return the evaluation of @expr:
@expr: Expr instance

Here is the caller graph for this function:

handle()

def miasm.analysis.dse.DSEEngine.handle	(		self,
			cur_addr
	)

Handle destination
@cur_addr: Expr of the next address in concrete execution
/!\ cur_addr may be a loc_key

In this method, self.symb is in the "just before branching" state

Reimplemented in miasm.analysis.dse.DSEPathConstraint.

Here is the caller graph for this function:

memory_to_expr()

def miasm.analysis.dse.DSEEngine.memory_to_expr (   addr )

static

Translate an address to its corresponding symbolic ID (8bits)
@addr: int

Here is the caller graph for this function:

prepare()

def miasm.analysis.dse.DSEEngine.prepare

(

self

)

Prepare the environment for attachment with a jitter

Here is the call graph for this function:

Here is the caller graph for this function:

restore_snapshot()

def miasm.analysis.dse.DSEEngine.restore_snapshot	(		self,
			snapshot,
			memory = True
	)

Restore a @snapshot taken with .take_snapshot
@snapshot: .take_snapshot output
@memory: (optional) if set, also restore the memory

symbolize_memory()

def miasm.analysis.dse.DSEEngine.symbolize_memory	(		self,
			memory_range
	)

Register a range of memory addresses to symbolize
@memory_range: object with support of __in__ operation (intervals, list,
...)

Here is the call graph for this function:

take_snapshot()

def miasm.analysis.dse.DSEEngine.take_snapshot

(

self

)

Return a snapshot of the current state (including jitter state)

Here is the call graph for this function:

update_state()

def miasm.analysis.dse.DSEEngine.update_state	(		self,
			assignblk
	)

From this point, assume @assignblk in the symbolic execution
@assignblk: AssignBlock/{dst -> src}

update_state_from_concrete()

def miasm.analysis.dse.DSEEngine.update_state_from_concrete	(		self,
			cpu = True,
			mem = False
	)

Update the symbolic state with concrete values from the concrete
engine

@cpu: (optional) if set, update registers' value
@mem: (optional) if set, update memory value

/!\ all current states will be loss.
This function is usually called when states are no more synchronized
(at the beginning, returning from an unstubbed syscall, ...)

Here is the call graph for this function:

Member Data Documentation

addr_to_cacheblocks

miasm.analysis.dse.DSEEngine.addr_to_cacheblocks

handler

miasm.analysis.dse.DSEEngine.handler

instrumentation

miasm.analysis.dse.DSEEngine.instrumentation

ir_arch

miasm.analysis.dse.DSEEngine.ir_arch

ircfg

miasm.analysis.dse.DSEEngine.ircfg

jitter

miasm.analysis.dse.DSEEngine.jitter

loc_db

miasm.analysis.dse.DSEEngine.loc_db

machine

miasm.analysis.dse.DSEEngine.machine

mdis

miasm.analysis.dse.DSEEngine.mdis

symb

miasm.analysis.dse.DSEEngine.symb

Prepare symbexec engines.

symb_concrete

miasm.analysis.dse.DSEEngine.symb_concrete

SYMB_ENGINE

miasm.analysis.dse.DSEEngine.SYMB_ENGINE = ESETrackModif

static

---

The documentation for this class was generated from the following file:

• /home/serpilliere/projet/test_doc_miasm/miasm/miasm/analysis/dse.py