cozy.project¶
Classes¶
Represents a project for a single executable |
Module Contents¶
- class cozy.project.Project(binary_path: str, fun_prototypes: dict[str | int, str] | None = None, load_debug_info: bool = False, **kwargs)¶
Represents a project for a single executable
- Variables:
angr_proj (angr.Project) – The angr project created for this cozy project.
fun_prototypes (dict[str | int, str]) – Maps function names or function addresses to their type signatures.
Constructor for a project.
- Parameters:
binary_path (str) – The path to the binary to analyze.
fun_prototypes (dict[str | int, str] | None) – Initial dictionary that maps function names or addresses to their type signatures. If None is passed, fun_prototypes is initialized to the empty dictionary.
kwargs – Extra arguments to pass to angr.Project
- object_ranges(obj_filter: collections.abc.Callable[[cle.Backend], bool] | None = None) list[range] ¶
Returns the ranges of the objects stored in the executable (for example: ELF objects). If obj_filter is specified, only objects that pass the filter make it into the return list.
- Parameters:
obj_filter (Callable[[Backend], bool] | None) – Used to filter certain objects from the output list.
- Returns:
A list of memory ranges.
- Return type:
list[range]
- try_find_symbol_addr(sym_name: str) int | None ¶
- find_symbol_addr(sym_name: str) int ¶
Finds the rebased addressed of a symbol. Functions are the most common symbol type.
- Parameters:
sym_name (str) – The symbol to lookup.
- Returns:
The rebased symbol address
- Return type:
int
- add_prototype(fun: str | int, fun_prototype: str) None ¶
Adds a function prototype to this project.
- Parameters:
fun (str | int) – The function’s name or address.
fun_prototype (str) – The function’s type signature.
- Returns:
None
- Return type:
None
- session(start_fun: str | int | None = None, underconstrained_execution: bool = False, underconstrained_initial_state: cozy.session.UnderconstrainedMachineState | None = None) cozy.session.Session ¶
Returns a new session derived from this project.
- Parameters:
start_fun (str | int | None) – The name or address of the function which this session will start with. If None is specified, then the program will start at the entry point (main function).
underconstrained_execution (bool) – Set to True to enable underconstrained symbolic execution. With this option, all initial registers will be initialized with unconstrained fresh symbolic variables, and memory contents that are not initialized will likewise return fresh unconstrained symbolic variables.
underconstrained_initial_state (UnderconstrainedMachineState) – If this value is not None, then the inferred memory layout from a previous unconstrained symbolic execution should be used. You can retrieve this value from a previous
RunResult
via thecozy.session.RunResult.underconstrained_machine_state
field.
- Returns:
The fresh session.
- Return type:
- property cfg¶
- Returns the control flow graph for this project. This property will cache the cfg in a pickle file
- to speed up future runs. This means if you change the underlying program you will need to delete the
- .cfg.pickle file located in the same directory as your executable.
- property arch¶
- Returns the underlying angr project architecture
- hook_symbol(symbol_name: str, simproc_class: type[angr.SimProcedure], kwargs=None, replace: bool | None = None) int ¶
Hooks a symbol in the angr project. If the symbol is one from libc, this method will also replace what is stored in
angr.SIM_PROCEDURES["libc"][symbol_name]
.- Parameters:
symbol_name (str) – The name of the symbol to hook.
simproc_class (type[SimProcedure]) – The class to use to hook the symbol. Note that this is not an instance of SimProcedure, but is instead a reference to the class itself.
kwargs – These are the keyword arguments that will be passed to the procedure’s run method eventually.
replace (bool | None) – Control the behavior on finding that the address is already hooked. If true, silently replace the hook. If false, warn and do not replace the hook. If none (default), warn and replace the hook.
- Return type:
int
- Returns:
The address of the new symbol.
- hook_syscall(syscall_name: str, simproc_class: type[angr.SimProcedure])¶
Hooks a syscall in the angr project.
- Parameters:
syscall_name (str) – The name of the syscall to hook.
simproc_class (type[SimProcedure]) – The class to use to hook the symbol. Note that this is not an instance of SimProcedure, but is instead a reference to the class itself.