user25282992
user25282992

Reputation: 1

Can I directly perform symbolic execution on P-Code with angr?

I have successfully translate an ELF to P-Code with the following codes.

from pypcode import Context, PcodePrettyPrinter
ctx = Context("sparc:BE:64:default")
with open('example', 'rb') as f:
    bin_data = f.read()
tx = ctx.translate(bin_data)

Now, I want to perform symbolic execution on P-Code I got.

Unfortunately, I cannot find a way to load the P-Code and how to perform symbolic execution. Is there anyone know the solution?

I have tried the following codes:

sparc_lang = None
for arch in pypcode.Arch.enumerate():
    for lang in arch.languages:
        if lang.id == "sparc:BE:64:default":
            sparc_lang = lang
            break
    if sparc_lang is not None:
        break

pcode_arch = archinfo.ArchPcode(sparc_lang)

p = angr.Project(r"example", arch=pcode_arch, auto_load_libs=False)

state = p.factory.entry_state()
sm = p.factory.simgr(state)
sm.step()
sm.run(until=lambda sm_: len(sm_.active) > 1)

When I ran the sm.run(until=lambda sm_: len(sm_.active) > 1), I encountered an error AssertionError: FIXME: Test statement_offset behavior.

I want to build a pipeline from loading the P-Code file to performing the symbolic execution. And firstly, I need to load the P-Code to angr.

FYI, the example's source code is

#include <stdio.h>
#include <stdlib.h>
int main() {
    int num = 0;
    scanf("%d", &num);
    if (num > 50) {
        if (num <= 100) {
            printf("50 < num <= 100\n");
        } else {
            printf("100 < num\n");
            exit(1);
        }
    } else {
        printf("num <= 50\n");
    }
}

Upvotes: 0

Views: 47

Answers (0)

Related Questions