cozy.underconstrained

Attributes

underconstrained_preset

Classes

SimConcretizationStrategyUnderconstrained

This class extends SimConcretizationStrategyNorepeatsRange, making it suitable for use with underconstrained

Box

DefaultMemoryUnderconstrained

The primary goal of this class is to provide a wrapper for memory use in underconstrained symbolic execution.

Module Contents

class cozy.underconstrained.SimConcretizationStrategyUnderconstrained(*args, **kwargs)

Bases: angr.concretization_strategies.SimConcretizationStrategyNorepeatsRange

This class extends SimConcretizationStrategyNorepeatsRange, making it suitable for use with underconstrained execution. The primary use case of this class is to provide concretization strategies for when memory contents are underconstrained/symbolic. The main problem occurs when reading/writing symbolic addresses, which means those addresses must be concretized. The strategy we employ is to allocate a fresh chunk of memory for fresh symbols, giving them sufficient scratch space to store their members.

Initializes the base SimConcretizationStrategy.

Parameters:
  • filter – A function, taking arguments of (SimMemory, claripy.AST) that determins if this strategy can handle resolving the provided AST.

  • exact – A flag (default: True) that determines if the convenience resolution functions provided by this class use exact or approximate resolution.

constrain_addr(memory, addr)
multi_concretize(memory, addr)
_concretize(memory, addr, **kwargs)

Should be implemented by child classes to handle concretization. :param **kwargs:

_any(*args, **kwargs)

Gets any solution of an address.

class cozy.underconstrained.Box(value)
class cozy.underconstrained.DefaultMemoryUnderconstrained(*args, **kwargs)

Bases: angr.storage.memory_mixins.DefaultMemory

The primary goal of this class is to provide a wrapper for memory use in underconstrained symbolic execution. Here we record all the fresh symbols that are created whenever underconstrained memory is read.

get_default_backer()
set_default_backer(backer: angr.storage.memory_mixins.DefaultMemory)
set_symbols(symbols: list[claripy.BVS])
get_symbols() list[claripy.BVS]
copy(*args, **kwargs)

Should return a copy of the plugin without any state attached. Should check the memo first, and add itself to memo if it ends up making a new copy.

In order to simplify using the memo, you should annotate implementations of this function with SimStatePlugin.memo

The base implementation of this function constructs a new instance of the plugin’s class without calling its initializer. If you super-call down to it, make sure you instanciate all the fields in your copy method!

Parameters:

memo – A dictionary mapping object identifiers (id(obj)) to their copied instance. Use this to avoid infinite recursion and diverged copies.

_default_value(addr, size, **kwargs)

Override this method to provide default values for a variety of edge cases and base cases.

Parameters:
  • addr – If this value is being filled to provide a default memory value, this will be its address. Otherwise, None.

  • size – The size in bytes of the value to return

  • name – A descriptive identifier for the value, for if a symbol is created.

The inspect, events, and key parameters are for state.solver.Unconstrained, if it is used.

cozy.underconstrained.underconstrained_preset