illera88 / Ponce

IDA 2016 plugin contest winner! Symbolic Execution just one-click away!
https://docs.idaponce.com
Other
1.48k stars 72 forks source link

Implement solve a condition #19

Closed 0ca closed 8 years ago

0ca commented 8 years ago

We need to implement the button solve a condition.

The idea is first to show the solution in the IDa output.

We could do more things:

0ca commented 8 years ago

To implement this we need to keep in memory all the conditional jumps executed. We can keep the TritonInstruction, or only the information we need like the RIP symbolic expression ID and address when the jump is taken/not taken.

For now I keeping all the TritonInstructions in a map:

std::map<triton::__uint, std::list<triton::arch::Instruction *>> instructions_executed_map;

I think keeping all the instructions is not very memory consuming compare to keep all the symbolic expressions. And having all the instructions could be useful for other functionalities like the slicing #23, or if the user wants to know the symbolic expressions for a given address.

Other important thing is that a condition could be executed more than one time. So we need to have a list per every address.

Then we should show besides the "Negate condition" menu a submenu with all the times the condition was executed, so the user could negate a condition at a given point.

For example, if we have a loop and we want the loop to be executed 10 times, we only want to negate the 10th condition.

0ca commented 8 years ago

Implemented solve formula. image

We still need to deal with a same address executed multiple times.

0ca commented 8 years ago

When we are solving we should differenciate between solving online or offline.

Offline is when the user has execute all the program and after that is trying to invert a condition. But this condition could has been executed multiple times so we need to offer him which one he wants to negate.

Online is when the user is debugging an app and he wants to invert a condition. In that case we don't need to ask him for the condition, he want to invert the current condition at the last execution point.

0ca commented 8 years ago

@illera88 done right? Or there is some pending thing to do here? Maybe change the name of the negate runtime. Right now it is:

Negate condition
Negate Inject Restore

Maybe we could use:

Negate & Inject
Negate, Inject & Restore snapshot

Is it ok?

illera88 commented 8 years ago

yes! I like the second one.

Change the name and close

0ca commented 8 years ago

This is still not working when the condition is in a loop.