search

DonggeLiu / Legion

A coverage-based software testing tool
MIT License
29 stars 4 forks source link

Compare against ANGR's builtin exploration strategyies #7

Open DonggeLiu opened 5 years ago

DonggeLiu commented 5 years ago
  1. Need a docker that contains all dependencies, e.g. the same docker that runs Legion.
  2. When running directly, gives the following error:

Traceback (most recent call last): File "Baselines/DFS.py", line 168, in print(explore()) File "Baselines/DFS.py", line 43, in explore states = symex() File "Baselines/DFS.py", line 35, in symex simgr.explore() File "/home/donggel/Dependencies/angr/angr/sim_manager.py", line 238, in explore self.run(stash=stash, n=n, kwargs) File "/home/donggel/Dependencies/angr/angr/sim_manager.py", line 260, in run self.step(stash=stash, kwargs) File "/home/donggel/Dependencies/angr/angr/misc/hookset.py", line 75, in call result = current_hook(self.func.self, args, kwargs) File "/home/donggel/Dependencies/angr/angr/exploration_techniques/explorer.py", line 96, in step return simgr.step(stash=stash, extra_stop_points=base_extra_stop_points | self._extra_stop_points, kwargs) File "/home/donggel/Dependencies/angr/angr/misc/hookset.py", line 80, in call return self.func(args, kwargs) File "/home/donggel/Dependencies/angr/angr/sim_manager.py", line 344, in step successors = self.step_state(state, successor_func=successor_func, run_args) File "/home/donggel/Dependencies/angr/angr/sim_manager.py", line 382, in step_state successors = self.successors(state, successor_func=successor_func, run_args) File "/home/donggel/Dependencies/angr/angr/sim_manager.py", line 421, in successors return self._project.factory.successors(state, run_args) File "/home/donggel/Dependencies/angr/angr/factory.py", line 54, in successors return self.project.engines.successors(args, kwargs) File "/home/donggel/Dependencies/angr/angr/engines/hub.py", line 128, in successors r = engine.process(state, kwargs) File "/home/donggel/Dependencies/angr/angr/engines/vex/engine.py", line 148, in process opt_level=opt_level) File "/home/donggel/Dependencies/angr/angr/engines/engine.py", line 60, in process self._process(new_state, successors, args, kwargs) File "/home/donggel/Dependencies/angr/angr/engines/vex/engine.py", line 199, in _process self._handle_irsb(state, successors, irsb, skip_stmts, last_stmt, whitelist) File "/home/donggel/Dependencies/angr/angr/engines/vex/engine.py", line 278, in _handle_irsb cont = self._handle_statement(state, successors, stmt) File "/home/donggel/Dependencies/angr/angr/engines/vex/engine.py", line 393, in _handle_statement exit_data = stmt_handler(self, state, stmt) File "/home/donggel/Dependencies/angr/angr/engines/vex/statements/wrtmp.py", line 4, in SimIRStmt_WrTmp data = engine.handle_expression(state, stmt.data) File "/home/donggel/Dependencies/angr/angr/engines/vex/engine.py", line 454, in handle_expression result = handler(self, state, expr) File "/home/donggel/Dependencies/angr/angr/engines/vex/expressions/load.py", line 27, in SimIRExpr_Load result = state.memory.load(addr, size, endness=expr.endness) File "/home/donggel/Dependencies/angr/angr/storage/memory.py", line 789, in load events=not disable_actions, ret_on_segv=ret_on_segv) File "/home/donggel/Dependencies/angr/angr/state_plugins/symbolic_memory.py", line 570, in _load addrs = self.concretize_read_addr(dst) File "/home/donggel/Dependencies/angr/angr/state_plugins/symbolic_memory.py", line 427, in concretize_read_addr return self._apply_concretization_strategies(addr, strategies, 'load') File "/home/donggel/Dependencies/angr/angr/state_plugins/symbolic_memory.py", line 375, in _apply_concretization_strategies a = s.concretize(self, e) File "/home/donggel/Dependencies/angr/angr/concretization_strategies/init.py", line 57, in concretize return self._concretize(memory, addr) File "/home/donggel/Dependencies/angr/angr/concretization_strategies/range.py", line 13, in _concretize mn,mx = self._range(memory, addr) File "/home/donggel/Dependencies/angr/angr/concretization_strategies/init.py", line 49, in _range return (self._min(memory, addr, kwargs), self._max(memory, addr, kwargs)) File "/home/donggel/Dependencies/angr/angr/concretization_strategies/init.py", line 25, in _min return memory.state.solver.min(addr, exact=kwargs.pop('exact', self._exact), kwargs) File "/home/donggel/Dependencies/angr/angr/state_plugins/solver.py", line 144, in concrete_shortcut_scalar return f(self, *args, kwargs) File "/home/donggel/Dependencies/angr/angr/state_plugins/sim_action_object.py", line 57, in ast_stripper return f(*new_args, *new_kwargs) File "/home/donggel/Dependencies/angr/angr/state_plugins/solver.py", line 87, in wrapped_f return f(args, kwargs) File "/home/donggel/Dependencies/angr/angr/state_plugins/solver.py", line 550, in min return self._solver.min(e, extra_constraints=self._adjust_constraint_list(extra_constraints), exact=exact) File "/home/donggel/Dependencies/claripy/claripy/frontend_mixins/concrete_handler_mixin.py", line 41, in min return super(ConcreteHandlerMixin, self).min(e, kwargs) File "/home/donggel/Dependencies/claripy/claripy/frontend_mixins/constraint_filter_mixin.py", line 55, in min return super(ConstraintFilterMixin, self).min(e, extra_constraints=ec, kwargs) File "/home/donggel/Dependencies/claripy/claripy/frontend_mixins/sat_cache_mixin.py", line 101, in min extra_constraints=extra_constraints, *kwargs File "/home/donggel/Dependencies/claripy/claripy/frontend_mixins/simplify_helper_mixin.py", line 8, in min return super(SimplifyHelperMixin, self).min(args, **kwargs) File "/home/donggel/Dependencies/claripy/claripy/frontend_mixins/constraint_expansion_mixin.py", line 35, in min self.add([e >= m], invalidate_cache=False) TypeError: unorderable types: BV() >= tuple()