-
Notifications
You must be signed in to change notification settings - Fork 29
/
JumpConditions.py
54 lines (41 loc) · 1.66 KB
/
JumpConditions.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
"""
This file is part of SEA.
reserbot is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
reserbot is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with SEA. If not, see <http://www.gnu.org/licenses/>.
Copyright 2013 by neuromancer
"""
from Reil import parse_reil
from Common import getPathConditions
from Instruction import *
input_vars = ["stdin:", "arg[0]@0:", "arg[1]@0:", "arg[2]@0:"]
def getJumpConditions(trace, addr):
raw_ins = parse_reil(trace["code"][-1])
addr = int(addr, 16)
pos = trace["code"].last - 1
if (raw_ins.instruction == "jcc"):
ins = Instruction(raw_ins, None)
jmp_op = ins.operands[2]
if (jmp_op.isVar()):
#print addr
trace["final_conditions"] = dict([( jmp_op , Operand(str(addr), "DWORD"))])
sol = getPathConditions(trace)
if (sol <> None):
print "SAT conditions found!"
filename = raw_ins.instruction + "[" + str(pos) +"]"
dumped = sol.dump(filename,input_vars)
for filename in dumped:
print filename, "dumped!"
else:
print "Impossible to jump to", hex(addr), "from", raw_ins.instruction, "at", pos
else:
return None
else:
return None