Git Product home page Git Product logo

Comments (2)

JonathanSalwan avatar JonathanSalwan commented on June 12, 2024 1

It appears that the MemoryAccess information stored in instruction might only contain concrete access information,

Have you tried to use MemoryAccess::getLeaAst()? That should return the symbolic memory access.

from triton.

GreenieQwQ avatar GreenieQwQ commented on June 12, 2024

It appears that the MemoryAccess information stored in instruction might only contain concrete access information,

Have you tried to use MemoryAccess::getLeaAst()? That should return the symbolic memory access.

Much appreciated! By digging out MemoryAccess::getLeaAst() and its related documentation, I've learned a lot from Triton's memory modeling procedure.

However, I'm still confused about how to symbolize memory before their initial access. I attempted a simple test case as shown below, yet I realized that I may not be able to retrieve the very memory access until having processed the instruction (e.g., I've tried using disassembly before processing the instruction, but the memory access information in getOperands is incomplete until having the instruction processed).

def test(self):
        self.ctx = TritonContext(ARCH.X86_64)
        self.ctx.setMode(MODE.MEMORY_ARRAY, True)
        self.ctx.setMode(MODE.SYMBOLIZE_LOAD, True)
        self.ctx.setMode(MODE.SYMBOLIZE_STORE, True)
        code = [
            (1, b"\x8b\x0c\x18"), # mov ecx, dword ptr [rax + rbx]
            (2, b"\x48\x81\xf9\xad\xde\x00\x00"), # cmp rcx, 0xdead
        ]

        self.ctx.symbolizeRegister(self.ctx.registers.rax, 's_rax')
        self.ctx.symbolizeRegister(self.ctx.registers.rbx, 's_rbx')
        self.ctx.symbolizeRegister(self.ctx.registers.rcx, 's_rcx')
        count = 0 # counter for symbolized memory
        for i, op in code:
            i= Instruction(op)
            self.ctx.processing(i)
            if i.isMemoryRead():
                a = i.getLoadAccess()
                readMemory = a[0][0]
                if not self.ctx.isMemorySymbolized(readMemory):
                    memAlias = f'mem_{count}'
                    self.ctx.symbolizeMemory(readMemory, memAlias)
                    print(f"symbolize memory {readMemory} with {memAlias}")
                    count += 1
            if i.isMemoryWrite():
                # similar to memory read
        zf = self.ctx.getRegisterAst(self.ctx.registers.zf)
        m = self.ctx.getModel(zf == 1)
        print(m)

Ideally, a model where [rax+rbx] is set to 0xdead will be printed. However, since the memory is symbolized after its initial access, m is empty in actual.

from triton.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.