Skip to content

Commit fcb2ec9

Browse files
SanWiebSanWieb
committed
[asmprinter] Make assembly output more clear
1 parent 8f97a1d commit fcb2ec9

File tree

128 files changed

+601
-483
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

128 files changed

+601
-483
lines changed

‎analyzer/asmprinter/asmprinter.py‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,11 +38,11 @@ def get_load_comments(expr: claripy.BV, secret_load_pc):
3838
if load_anno.address == secret_load_pc:
3939
# We load the secret value
4040
annotations[load_anno.address] = str(set(replace_secret_annotations_with_name(get_annotations(load_anno.read_address_ast), "Attacker")))
41-
annotations[load_anno.address] += " > " + str(set(replace_secret_annotations_with_name(get_annotations(v), "Secret")))
41+
annotations[load_anno.address] += " -> " + str(set(replace_secret_annotations_with_name(get_annotations(v), "Secret")))
4242
else:
4343
# We load an attacker indirect value
4444
annotations[load_anno.address] = str(set(replace_secret_annotations_with_name(get_annotations(load_anno.read_address_ast), "Attacker")))
45-
annotations[load_anno.address] += " > " + str(set(replace_secret_annotations_with_name(get_annotations(v), "Attacker")))
45+
annotations[load_anno.address] += " -> " + str(set(replace_secret_annotations_with_name(get_annotations(v), "Attacker")))
4646

4747
annotations.update(get_load_comments(load_anno.read_address_ast, secret_load_pc))
4848

@@ -62,14 +62,14 @@ def print_annotated_assembly(proj, bbls, branches, expr, pc, secret_load_pc, is_
6262
# Transmission
6363
if is_tfp:
6464
proj.kb.comments[pc] = str(set(replace_secret_annotations_with_name(get_annotations(expr), "Attacker")))
65-
proj.kb.comments[pc] += " > " + "TAINTED FUNCTION POINTER"
65+
proj.kb.comments[pc] += " -> " + "TAINTED FUNCTION POINTER"
6666
else:
6767
all_annotations = set(get_annotations(expr))
6868
secret_annotations = {a for a in all_annotations if isinstance(a, LoadAnnotation) and a.address == secret_load_pc}
6969
annotations = replace_secret_annotations_with_name(secret_annotations, "Secret")
7070
annotations += replace_secret_annotations_with_name(all_annotations - secret_annotations, "Attacker")
7171
proj.kb.comments[pc] = str(set(annotations))
72-
proj.kb.comments[pc] += " > " + "TRANSMISSION"
72+
proj.kb.comments[pc] += " -> " + "TRANSMISSION"
7373

7474

7575
output = ""
@@ -89,6 +89,7 @@ def output_gadget_to_file(t : Transmission, proj, path):
8989
o.write(f"""
9090
{'-'*48}
9191
uuid: {t.uuid}
92+
transmitter: {t.transmitter}
9293
9394
Secret Address:
9495
- Expr: {t.secret_address.expr}

tests/test-cases/alias_overlap/ref-asm/gadget_alias_overlap_0x4000009_294556ac-d9af-427e-9c8d-9b9a53c5b17e.asm renamed to tests/test-cases/alias_overlap/ref-asm/gadget_alias_overlap_0x4000009_0fa0b458-9aaa-48d4-bf82-9e49f83833df.asm

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
----------------- TRANSMISSION -----------------
22
alias_type_2:
33
4000000 movzx r8d, word ptr [rdx+0x28]
4-
4000005 mov rax, qword ptr [rdx+0x20] ; {Attacker@rdx} > {Secret@0x4000005}
5-
4000009 mov rcx, qword ptr [rax] ; {Secret@0x4000005} > TRANSMISSION
4+
4000005 mov rax, qword ptr [rdx+0x20] ; {Attacker@rdx} -> {Secret@0x4000005}
5+
4000009 mov rcx, qword ptr [rax] ; {Secret@0x4000005} -> TRANSMISSION
66
400000c mov r11, qword ptr [rcx+r8]
77
4000010 movzx r9d, word ptr [rdx+0x24]
88
4000015 mov rbx, qword ptr [rdx+0x20]
@@ -11,7 +11,8 @@
1111
4000020 jmp 0x400dead
1212

1313
------------------------------------------------
14-
uuid: 294556ac-d9af-427e-9c8d-9b9a53c5b17e
14+
uuid: 0fa0b458-9aaa-48d4-bf82-9e49f83833df
15+
transmitter: TransmitterType.LOAD
1516

1617
Secret Address:
1718
- Expr: <BV64 rdx + 0x20>

tests/test-cases/alias_overlap/ref-asm/gadget_alias_overlap_0x400000c_87ea610c-4081-430a-a302-6eb3fa2404e2.asm renamed to tests/test-cases/alias_overlap/ref-asm/gadget_alias_overlap_0x400000c_5006c4a9-08b7-41bd-8e71-beaaa6176c21.asm

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,18 @@
11
----------------- TRANSMISSION -----------------
22
alias_type_2:
3-
4000000 movzx r8d, word ptr [rdx+0x28] ; {Attacker@rdx} > {Attacker@0x4000000}
4-
4000005 mov rax, qword ptr [rdx+0x20] ; {Attacker@rdx} > {Attacker@0x4000005}
5-
4000009 mov rcx, qword ptr [rax] ; {Attacker@0x4000005} > {Secret@0x4000009}
6-
400000c mov r11, qword ptr [rcx+r8] ; {Secret@0x4000009, Attacker@0x4000000} > TRANSMISSION
3+
4000000 movzx r8d, word ptr [rdx+0x28] ; {Attacker@rdx} -> {Attacker@0x4000000}
4+
4000005 mov rax, qword ptr [rdx+0x20] ; {Attacker@rdx} -> {Attacker@0x4000005}
5+
4000009 mov rcx, qword ptr [rax] ; {Attacker@0x4000005} -> {Secret@0x4000009}
6+
400000c mov r11, qword ptr [rcx+r8] ; {Attacker@0x4000000, Secret@0x4000009} -> TRANSMISSION
77
4000010 movzx r9d, word ptr [rdx+0x24]
88
4000015 mov rbx, qword ptr [rdx+0x20]
99
4000019 mov rsi, qword ptr [rbx]
1010
400001c mov r12, qword ptr [rsi+r9]
1111
4000020 jmp 0x400dead
1212

1313
------------------------------------------------
14-
uuid: 87ea610c-4081-430a-a302-6eb3fa2404e2
14+
uuid: 5006c4a9-08b7-41bd-8e71-beaaa6176c21
15+
transmitter: TransmitterType.LOAD
1516

1617
Secret Address:
1718
- Expr: <BV64 LOAD_64[<BV64 rdx + 0x20>]_21>

tests/test-cases/alias_overlap/ref-asm/gadget_alias_overlap_0x400000c_1b43d77c-074b-44c0-9ac8-e426cc29d7a8.asm renamed to tests/test-cases/alias_overlap/ref-asm/gadget_alias_overlap_0x400000c_e47ff901-45f5-497c-91f0-2d50c1ca047b.asm

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,18 @@
11
----------------- TRANSMISSION -----------------
22
alias_type_2:
3-
4000000 movzx r8d, word ptr [rdx+0x28] ; {Attacker@rdx} > {Secret@0x4000000}
4-
4000005 mov rax, qword ptr [rdx+0x20] ; {Attacker@rdx} > {Attacker@0x4000005}
5-
4000009 mov rcx, qword ptr [rax] ; {Attacker@0x4000005} > {Attacker@0x4000009}
6-
400000c mov r11, qword ptr [rcx+r8] ; {Attacker@0x4000009, Secret@0x4000000} > TRANSMISSION
3+
4000000 movzx r8d, word ptr [rdx+0x28] ; {Attacker@rdx} -> {Secret@0x4000000}
4+
4000005 mov rax, qword ptr [rdx+0x20] ; {Attacker@rdx} -> {Attacker@0x4000005}
5+
4000009 mov rcx, qword ptr [rax] ; {Attacker@0x4000005} -> {Attacker@0x4000009}
6+
400000c mov r11, qword ptr [rcx+r8] ; {Attacker@0x4000009, Secret@0x4000000} -> TRANSMISSION
77
4000010 movzx r9d, word ptr [rdx+0x24]
88
4000015 mov rbx, qword ptr [rdx+0x20]
99
4000019 mov rsi, qword ptr [rbx]
1010
400001c mov r12, qword ptr [rsi+r9]
1111
4000020 jmp 0x400dead
1212

1313
------------------------------------------------
14-
uuid: 1b43d77c-074b-44c0-9ac8-e426cc29d7a8
14+
uuid: e47ff901-45f5-497c-91f0-2d50c1ca047b
15+
transmitter: TransmitterType.LOAD
1516

1617
Secret Address:
1718
- Expr: <BV64 rdx + 0x28>

tests/test-cases/alias_overlap/ref-asm/gadget_alias_overlap_0x4000019_314077e5-dbe3-4c45-bb40-c12bc8199b97.asm renamed to tests/test-cases/alias_overlap/ref-asm/gadget_alias_overlap_0x4000019_7bdb60d0-f3cd-4679-9ce6-7a410ccf8802.asm

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,14 @@
55
4000009 mov rcx, qword ptr [rax]
66
400000c mov r11, qword ptr [rcx+r8]
77
4000010 movzx r9d, word ptr [rdx+0x24]
8-
4000015 mov rbx, qword ptr [rdx+0x20] ; {Attacker@rdx} > {Secret@0x4000015}
9-
4000019 mov rsi, qword ptr [rbx] ; {Secret@0x4000015} > TRANSMISSION
8+
4000015 mov rbx, qword ptr [rdx+0x20] ; {Attacker@rdx} -> {Secret@0x4000015}
9+
4000019 mov rsi, qword ptr [rbx] ; {Secret@0x4000015} -> TRANSMISSION
1010
400001c mov r12, qword ptr [rsi+r9]
1111
4000020 jmp 0x400dead
1212

1313
------------------------------------------------
14-
uuid: 314077e5-dbe3-4c45-bb40-c12bc8199b97
14+
uuid: 7bdb60d0-f3cd-4679-9ce6-7a410ccf8802
15+
transmitter: TransmitterType.LOAD
1516

1617
Secret Address:
1718
- Expr: <BV64 rdx + 0x20>

tests/test-cases/alias_overlap/ref-asm/gadget_alias_overlap_0x400001c_f0885b62-2203-430a-a2c8-0ea1d7198799.asm renamed to tests/test-cases/alias_overlap/ref-asm/gadget_alias_overlap_0x400001c_61e8290a-aa5a-4dcd-a3a3-71c23eafcd37.asm

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,15 @@
44
4000005 mov rax, qword ptr [rdx+0x20]
55
4000009 mov rcx, qword ptr [rax]
66
400000c mov r11, qword ptr [rcx+r8]
7-
4000010 movzx r9d, word ptr [rdx+0x24] ; {Attacker@rdx} > {Attacker@0x4000010}
8-
4000015 mov rbx, qword ptr [rdx+0x20] ; {Attacker@rdx} > {Attacker@0x4000015}
9-
4000019 mov rsi, qword ptr [rbx] ; {Attacker@0x4000015} > {Secret@0x4000019}
10-
400001c mov r12, qword ptr [rsi+r9] ; {Secret@0x4000019, Attacker@0x4000010} > TRANSMISSION
7+
4000010 movzx r9d, word ptr [rdx+0x24] ; {Attacker@rdx} -> {Attacker@0x4000010}
8+
4000015 mov rbx, qword ptr [rdx+0x20] ; {Attacker@rdx} -> {Attacker@0x4000015}
9+
4000019 mov rsi, qword ptr [rbx] ; {Attacker@0x4000015} -> {Secret@0x4000019}
10+
400001c mov r12, qword ptr [rsi+r9] ; {Attacker@0x4000010, Secret@0x4000019} -> TRANSMISSION
1111
4000020 jmp 0x400dead
1212

1313
------------------------------------------------
14-
uuid: f0885b62-2203-430a-a2c8-0ea1d7198799
14+
uuid: 61e8290a-aa5a-4dcd-a3a3-71c23eafcd37
15+
transmitter: TransmitterType.LOAD
1516

1617
Secret Address:
1718
- Expr: <BV64 LOAD_64[<BV64 rdx + 0x20>]_25>

tests/test-cases/alias_overlap/ref-asm/gadget_alias_overlap_0x400001c_df0fa1e2-1091-4573-bb8d-98eee32c0328.asm renamed to tests/test-cases/alias_overlap/ref-asm/gadget_alias_overlap_0x400001c_e7b7c1a8-980f-4cc8-9b5d-1242d4a5d780.asm

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,15 @@
44
4000005 mov rax, qword ptr [rdx+0x20]
55
4000009 mov rcx, qword ptr [rax]
66
400000c mov r11, qword ptr [rcx+r8]
7-
4000010 movzx r9d, word ptr [rdx+0x24] ; {Attacker@rdx} > {Secret@0x4000010}
8-
4000015 mov rbx, qword ptr [rdx+0x20] ; {Attacker@rdx} > {Attacker@0x4000015}
9-
4000019 mov rsi, qword ptr [rbx] ; {Attacker@0x4000015} > {Attacker@0x4000019}
10-
400001c mov r12, qword ptr [rsi+r9] ; {Secret@0x4000010, Attacker@0x4000019} > TRANSMISSION
7+
4000010 movzx r9d, word ptr [rdx+0x24] ; {Attacker@rdx} -> {Secret@0x4000010}
8+
4000015 mov rbx, qword ptr [rdx+0x20] ; {Attacker@rdx} -> {Attacker@0x4000015}
9+
4000019 mov rsi, qword ptr [rbx] ; {Attacker@0x4000015} -> {Attacker@0x4000019}
10+
400001c mov r12, qword ptr [rsi+r9] ; {Secret@0x4000010, Attacker@0x4000019} -> TRANSMISSION
1111
4000020 jmp 0x400dead
1212

1313
------------------------------------------------
14-
uuid: df0fa1e2-1091-4573-bb8d-98eee32c0328
14+
uuid: e7b7c1a8-980f-4cc8-9b5d-1242d4a5d780
15+
transmitter: TransmitterType.LOAD
1516

1617
Secret Address:
1718
- Expr: <BV64 rdx + 0x24>

tests/test-cases/alias_partially_independent/ref-asm/gadget_alias_partially_independent_0x400000a_8552ad76-c42a-4c8e-8f65-3da3f0594310.asm renamed to tests/test-cases/alias_partially_independent/ref-asm/gadget_alias_partially_independent_0x400000a_95c145bd-0719-4194-af16-028a8b2ed308.asm

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
alias_partially_independent:
33
4000000 mov esi, edi
44
4000002 add rsi, r12
5-
4000005 mov rax, qword ptr [r12+0x28] ; {Attacker@r12} > {Secret@0x4000005}
6-
400000a mov r9, qword ptr [rsi+rax] ; {Secret@0x4000005, Attacker@rdi, Attacker@r12} > TRANSMISSION
5+
4000005 mov rax, qword ptr [r12+0x28] ; {Attacker@r12} -> {Secret@0x4000005}
6+
400000a mov r9, qword ptr [rsi+rax] ; {Secret@0x4000005, Attacker@rdi, Attacker@r12} -> TRANSMISSION
77
400000e mov esi, edi
88
4000010 add rsi, r12
99
4000013 mov eax, dword ptr [r12+0x28]
@@ -15,7 +15,8 @@
1515
400002c jmp 0x400dead
1616

1717
------------------------------------------------
18-
uuid: 8552ad76-c42a-4c8e-8f65-3da3f0594310
18+
uuid: 95c145bd-0719-4194-af16-028a8b2ed308
19+
transmitter: TransmitterType.LOAD
1920

2021
Secret Address:
2122
- Expr: <BV64 r12 + 0x28>
@@ -34,7 +35,7 @@ Transmission:
3435
- Expr: <BV64 (0#32 .. rdi[31:0]) + r12 + LOAD_64[<BV64 r12 + 0x28>]_20>
3536
- Range: (0x0,0xffffffffffffffff, 0x1) Exact: True
3637

37-
Register Requirements: {<BV64 r12>, <BV64 rdi>}
38+
Register Requirements: {<BV64 rdi>, <BV64 r12>}
3839
Constraints: []
3940
Branches: []
4041
------------------------------------------------

tests/test-cases/alias_partially_independent/ref-asm/gadget_alias_partially_independent_0x4000018_ce32cbcf-13cc-4849-a9f8-535854b27aa3.asm renamed to tests/test-cases/alias_partially_independent/ref-asm/gadget_alias_partially_independent_0x4000018_1ee1a0fa-31ef-4c40-989a-b105bb36f84e.asm

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,17 @@
66
400000a mov r9, qword ptr [rsi+rax]
77
400000e mov esi, edi
88
4000010 add rsi, r12
9-
4000013 mov eax, dword ptr [r12+0x28] ; {Attacker@r12} > {Secret@0x4000013}
10-
4000018 mov r10, qword ptr [rsi+rax] ; {Secret@0x4000013, Attacker@rdi, Attacker@r12} > TRANSMISSION
9+
4000013 mov eax, dword ptr [r12+0x28] ; {Attacker@r12} -> {Secret@0x4000013}
10+
4000018 mov r10, qword ptr [rsi+rax] ; {Secret@0x4000013, Attacker@rdi, Attacker@r12} -> TRANSMISSION
1111
400001c mov esi, edi
1212
400001e add rsi, qword ptr [r12+0x20]
1313
4000023 mov rax, qword ptr [r12+0x28]
1414
4000028 mov r11, qword ptr [rsi+rax]
1515
400002c jmp 0x400dead
1616

1717
------------------------------------------------
18-
uuid: ce32cbcf-13cc-4849-a9f8-535854b27aa3
18+
uuid: 1ee1a0fa-31ef-4c40-989a-b105bb36f84e
19+
transmitter: TransmitterType.LOAD
1920

2021
Secret Address:
2122
- Expr: <BV64 r12 + 0x28>
@@ -34,7 +35,7 @@ Transmission:
3435
- Expr: <BV64 (0#32 .. rdi[31:0]) + r12 + (0#32 .. LOAD_32[<BV64 r12 + 0x28>]_22)>
3536
- Range: (0x0,0xffffffffffffffff, 0x1) Exact: True
3637

37-
Register Requirements: {<BV64 r12>, <BV64 rdi>}
38+
Register Requirements: {<BV64 rdi>, <BV64 r12>}
3839
Constraints: []
3940
Branches: []
4041
------------------------------------------------

tests/test-cases/alias_partially_independent/ref-asm/gadget_alias_partially_independent_0x4000028_89aceeab-5c21-40a5-9b60-518403997e92.asm renamed to tests/test-cases/alias_partially_independent/ref-asm/gadget_alias_partially_independent_0x4000028_68bf3d4f-18cc-41ff-951e-0f7d73089faa.asm

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,14 @@
99
4000013 mov eax, dword ptr [r12+0x28]
1010
4000018 mov r10, qword ptr [rsi+rax]
1111
400001c mov esi, edi
12-
400001e add rsi, qword ptr [r12+0x20] ; {Attacker@r12} > {Secret@0x400001e}
13-
4000023 mov rax, qword ptr [r12+0x28] ; {Attacker@r12} > {Attacker@0x4000023}
14-
4000028 mov r11, qword ptr [rsi+rax] ; {Attacker@0x4000023, Secret@0x400001e, Attacker@rdi} > TRANSMISSION
12+
400001e add rsi, qword ptr [r12+0x20] ; {Attacker@r12} -> {Secret@0x400001e}
13+
4000023 mov rax, qword ptr [r12+0x28] ; {Attacker@r12} -> {Attacker@0x4000023}
14+
4000028 mov r11, qword ptr [rsi+rax] ; {Secret@0x400001e, Attacker@rdi, Attacker@0x4000023} -> TRANSMISSION
1515
400002c jmp 0x400dead
1616

1717
------------------------------------------------
18-
uuid: 89aceeab-5c21-40a5-9b60-518403997e92
18+
uuid: 68bf3d4f-18cc-41ff-951e-0f7d73089faa
19+
transmitter: TransmitterType.LOAD
1920

2021
Secret Address:
2122
- Expr: <BV64 r12 + 0x20>
@@ -34,7 +35,7 @@ Transmission:
3435
- Expr: <BV64 (0#32 .. rdi[31:0]) + LOAD_64[<BV64 r12 + 0x20>]_24 + LOAD_64[<BV64 r12 + 0x28>]_25>
3536
- Range: (0x0,0xffffffffffffffff, 0x1) Exact: True
3637

37-
Register Requirements: {<BV64 r12>, <BV64 rdi>}
38+
Register Requirements: {<BV64 rdi>, <BV64 r12>}
3839
Constraints: []
3940
Branches: []
4041
------------------------------------------------

0 commit comments

Comments
 (0)