ChrisTheCoolHut / Firmware_Slap

Discovering vulnerabilities in firmware through concolic analysis and function clustering.
GNU General Public License v3.0
468 stars 79 forks source link

Undefined names and use == to compare str, bytes, and int literals #18

Closed cclauss closed 5 years ago

cclauss commented 5 years ago

flake8 testing of https://github.com/ChrisTheCoolHut/Firmware_Slap on Python 3.7.1

$ flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics

./firmware_slap/es_helper.py:31:25: F821 undefined name 'indeX_name'
        import_item(es, indeX_name, node)
                        ^
./firmware_slap/function_analyzer.py:69:39: F632 use ==/!= to compare str, bytes, and int literals
            if result is not None and type(
                                      ^
./firmware_slap/function_analyzer.py:70:46: F632 use ==/!= to compare str, bytes, and int literals
                    result) is not "str" and result is not "timeout":
                                             ^
./firmware_slap/function_analyzer.py:116:19: F632 use ==/!= to compare str, bytes, and int literals
            while string_val[-1] is not 0 and curr_len < max_str_len:
                  ^
./firmware_slap/function_analyzer.py:137:23: F632 use ==/!= to compare str, bytes, and int literals
                while end_val_solved[-1] is not 0 and curr_len < max_byte_len:
                      ^
./firmware_slap/ghidra_scripts/DumpFunctions.py:35:16: F821 undefined name 'java'
        except java.lang.UnsupportedOperationException as e:
               ^
./firmware_slap/ghidra_scripts/DumpFunctions.py:120:15: F821 undefined name 'ghidra'
    flatapi = ghidra.program.flatapi.FlatProgramAPI(getCurrentProgram(), getMonitor())
              ^
./firmware_slap/ghidra_scripts/DumpFunctions.py:120:53: F821 undefined name 'getCurrentProgram'
    flatapi = ghidra.program.flatapi.FlatProgramAPI(getCurrentProgram(), getMonitor())
                                                    ^
./firmware_slap/ghidra_scripts/DumpFunctions.py:120:74: F821 undefined name 'getMonitor'
    flatapi = ghidra.program.flatapi.FlatProgramAPI(getCurrentProgram(), getMonitor())
                                                                         ^
./firmware_slap/ghidra_scripts/DumpFunctions.py:121:14: F821 undefined name 'ghidra'
    decapi = ghidra.app.decompiler.flatapi.FlatDecompilerAPI(flatapi)
             ^
./firmware_slap/ghidra_scripts/DumpFunctions.py:126:16: F821 undefined name 'getFirstFunction'
    function = getFirstFunction()
               ^
./firmware_slap/ghidra_scripts/DumpFunctions.py:130:28: F821 undefined name 'getFunctionAfter'
                function = getFunctionAfter(function)
                           ^
./firmware_slap/ghidra_scripts/DumpFunctions.py:135:28: F821 undefined name 'getFunctionAfter'
                function = getFunctionAfter(function)
                           ^
./firmware_slap/ghidra_scripts/DumpFunctions.py:146:70: F821 undefined name 'getMonitor'
        func_dict['CallingFunctions'] = function.getCallingFunctions(getMonitor())
                                                                     ^
./firmware_slap/ghidra_scripts/DumpFunctions.py:150:58: F821 undefined name 'getMonitor'
        DecRes = decInt.decompileFunction(function, 120, getMonitor())
                                                         ^
./firmware_slap/ghidra_scripts/DumpFunctions.py:181:20: F821 undefined name 'getFunctionAfter'
        function = getFunctionAfter(function)
                   ^
./firmware_slap/ghidra_scripts/SetDecompilerOptions.py:2:1: F821 undefined name 'setAnalysisOption'
setAnalysisOption(currentProgram, "Decompiler Parameter ID", "true")
^
./firmware_slap/ghidra_scripts/SetDecompilerOptions.py:2:19: F821 undefined name 'currentProgram'
setAnalysisOption(currentProgram, "Decompiler Parameter ID", "true")
                  ^
./bin/Vuln_And_Cluster.py:54:8: F632 use ==/!= to compare str, bytes, and int literals
    if args.Vuln_Pickle is "":
       ^
./bin/Vuln_And_Cluster.py:147:39: F632 use ==/!= to compare str, bytes, and int literals
            if result is not None and type(
                                      ^
./bin/Vuln_And_Cluster.py:148:46: F632 use ==/!= to compare str, bytes, and int literals
                    result) is not "str" and result is not "timeout":
                                             ^
./bin/Sample_Vuln_Discover.py:82:39: F632 use ==/!= to compare str, bytes, and int literals
            if result is not None and type(
                                      ^
./bin/Sample_Vuln_Discover.py:83:46: F632 use ==/!= to compare str, bytes, and int literals
                    result) is not "str" and result is not "timeout":
                                             ^
9     F632 use ==/!= to compare str, bytes, and int literals
14    F821 undefined name 'indeX_name'
23

On the flake8 test selection, this PR does not focus on "style violations" (the majority of flake8 error codes that psf/black can autocorrect). Instead these tests are focused on runtime safety and correctness:

ChrisTheCoolHut commented 5 years ago

Thanks for the issue.

I addressed the fixes in 973136c

The issues outlined in the DumpFunctions Ghidra script aren't issues since it looks like Flake doesn't understand the Ghidra context.