search

angr / angr-targets

This repository contains the currently implemented angr concrete targets.
32 stars 9 forks source link

Add panda target and test #29

Closed AndrewFasano closed 1 year ago

AndrewFasano commented 1 year ago

PANDA is a qemu fork designed for for dynamic analysis with a nice python interface for guest control and analysis. Avatar supports PANDA as an emulation backend, but this PR adds PANDA as a dedicated target.

The model here is a bit different than other concrete targets. Instead of passing a binary to angr and configuring it to use panda as a concrete execution engine, users explicitly drive a PANDA-emulated guest OS and use PANDA callbacks to suspend emulation at an event of interest. Then, when the concrete guest is suspended, a user can use this interface to synchronize the concrete state from PANDA to angr and run a symbolic execution. Information learned from the symbolic execution can then be used to alter concrete state in the PANDA guest.

I'm very open for suggestions on how to improve this PR, just let me know.

AndrewFasano commented 1 year ago

Happy to try fixing the few linter issues, but I'm not sure how to best fix the failing panda import. Unfortunately PANDA's not easily installed via pip (there is a package, but it's very outdated). I could modify a dockerfile to install PANDA from source if you'd like, but I'm not sure where the dockerfile for the test container is and if that would be appropriate.

twizmwazin commented 1 year ago

Lacking proper packaging and a strong motive I'm not sure if we want to add panda to CI. In the test file, the test can be written as a unittest.TestCase subclass, and then @skipUnless(pandare, "pandare is required for this test") could be used so that CI doesn't try to run it.

twizmwazin commented 1 year ago

Well, it looks like they do have a pip package: https://github.com/panda-re/panda/#quickstart-python-pip

We could add this as an optional dependency and install it in the venv, and install the needed binaries at build time in the container. If this interests you, check out the angr/ci-settings repository, which is where the CI container is built.

AndrewFasano commented 1 year ago

Thanks for the suggestions! I think skipping the CI for it would be best, the panda pip package is a few years outdated (and to make it even worse, that's my fault). I'll update this with the @skipUnless and fix up the linter errors too.

AndrewFasano commented 1 year ago

Turns out I already had the skipUnless set up, there was just an unnecessary panda import in another file. Updated the code to (hopefully) address the various linter warnings and errors.

AndrewFasano commented 1 year ago

Thanks for the review. Fixed those 3 things and hopefully fixed the linter complaints from the last CI run.