Reputation: 1
I have successfully translate an ELF to P-Code with the following codes.
from pypcode import Context, PcodePrettyPrinter
ctx = Context("sparc:BE:64:default")
with open('example', 'rb') as f:
bin_data = f.read()
tx = ctx.translate(bin_data)
Now, I want to perform symbolic execution on P-Code I got.
Unfortunately, I cannot find a way to load the P-Code and how to perform symbolic execution. Is there anyone know the solution?
I have tried the following codes:
sparc_lang = None
for arch in pypcode.Arch.enumerate():
for lang in arch.languages:
if lang.id == "sparc:BE:64:default":
sparc_lang = lang
break
if sparc_lang is not None:
break
pcode_arch = archinfo.ArchPcode(sparc_lang)
p = angr.Project(r"example", arch=pcode_arch, auto_load_libs=False)
state = p.factory.entry_state()
sm = p.factory.simgr(state)
sm.step()
sm.run(until=lambda sm_: len(sm_.active) > 1)
When I ran the sm.run(until=lambda sm_: len(sm_.active) > 1)
, I encountered an error AssertionError: FIXME: Test statement_offset behavior
.
I want to build a pipeline from loading the P-Code file to performing the symbolic execution. And firstly, I need to load the P-Code to angr.
FYI, the example
's source code is
#include <stdio.h>
#include <stdlib.h>
int main() {
int num = 0;
scanf("%d", &num);
if (num > 50) {
if (num <= 100) {
printf("50 < num <= 100\n");
} else {
printf("100 < num\n");
exit(1);
}
} else {
printf("num <= 50\n");
}
}
Upvotes: 0
Views: 47