Closed JonathanSalwan closed 1 year ago
Still in progress but it smells good. We are now able to solve our first crackme using the ABV logic which is, I remind, a new memory model. The only difference between the old solve.py
and the new one is that we just enable the MEMORY_ARRAY
mode. I've also added other modes like CONSTANT_FOLDING
and AST_OPTIMIZATIONS
to stress the new memory model and everything looks ok.
--- src/examples/python/ctf-writeups/defcamp-2015-r100/solve.py 2022-09-27 19:04:26.043125028 +0200
+++ src/examples/python/ctf-writeups/defcamp-2015-r100/solve-with-abv-logic.py 2022-09-27 19:03:01.033130502 +0200
@@ -122,8 +88,11 @@
ctx = TritonContext(ARCH.X86_64)
# Define symbolic optimizations
- ctx.setMode(MODE.ALIGNED_MEMORY, True)
- ctx.setMode(MODE.ONLY_ON_SYMBOLIZED, True)
+ ctx.setMode(MODE.CONSTANT_FOLDING, True)
+ ctx.setMode(MODE.AST_OPTIMIZATIONS, True)
+ ctx.setMode(MODE.MEMORY_ARRAY, True)
+ ctx.setMode(MODE.SYMBOLIZE_LOAD, True)
+ ctx.setMode(MODE.SYMBOLIZE_STORE, True)
# Load the binary
loadBinary(os.path.join(os.path.dirname(__file__), 'r100.bin'))
Done, it works. We now we have to think about an optimization to deal with the memory state to avoid RAM consumption.
Last edit: Oct 05 2022.
Description
The choices are a matter of tradeoff and in order to scale the dynamic symbolic execution on million instructions we made the choice (7 years ago) to only rely on the
QF_BV
logic. Which means that our symbolic expressions only contain bitvector operators and no array. Thus, our constraints sent to the SMT solver are easier to solve. However, in some cases it could be great to reason on symbolic pointers. So here we are and this contribution provides 3 new modes:MEMORY_ARRAY
: Enables the symbolic pointers reasoning (QF_ABV
logic). When this mode is not enabled, which is the case by default, theQF_BV
memory model is applied. So, this contribution will not impact your analysis tools if you do not use this mode.SYMBOLIZE_LOAD
: Keeps symbolic expressions onload
indexes (concretize them otherwise).SYMBOLIZE_STORE
: Keeps symbolic expressions onstore
indexes (concretize them otherwise).Important note
This mode looks to work but still experimental. I can already tell you that it will complexify a lot constraints and increase the RAM consumption a lot. I'm still working on this mode and I will try to add optimizations so that we can free memory expressions and thus keep a descent RAM consumption. However, even with those cons, this mode has the merit of existing :slightly_smiling_face:
Short example
In this example we store the constant
0xdead
to a fixed memory address0x1032
. Then, we symbolize thersi
register which is used as an index by themov rcx, [rsi]
instruction after axor
computation. Then, we constraintrcx
to be equal to0xdead
.output