mirror of
https://github.com/trailofbits/manticore.git
synced 2026-10-12 02:23:44 +00:00
Eric Hennenfent
451965f03a
* Add black to CI tests I'd rather have blackening be an optional check, but this will work for now * Yep, messed up Travis Again, sorry about the commit spam * Bump accepted line length to 120 Going to auto-format at 100 but will allow 20% overruns * Blacken * Cap line length at 100 rip my undisciplined coding habits * update black on the fly if necessary * Ignore CC errors * Only check modified files * Only python files * Re-blacken post merge * Re-Blacken * Fix deleted files * Explicitly invoke python The +x must not have gotten commited * Forgot to blacken again Hoisted on my own petard * Re-blacken
41 lines
1.1 KiB
Python
Executable File
41 lines
1.1 KiB
Python
Executable File
#!/usr/bin/env python
|
|
|
|
import sys
|
|
from manticore.native import Manticore
|
|
|
|
"""
|
|
Demonstrates the ability to guide Manticore's state exploration. In this case,
|
|
abandoning a state we're no longer interested in.
|
|
|
|
Usage:
|
|
|
|
$ gcc -static -g src/state_explore.c -o state_explore # -static is optional
|
|
$ ADDRESS=0x$(objdump -S state_explore | grep -A 1 'value == 0x41' | tail -n 1 | sed 's|^\s*||g' | cut -f1 -d:)
|
|
$ python ./state_control.py state_explore $ADDRESS
|
|
|
|
"""
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) < 3:
|
|
sys.stderr.write(f"Usage: {sys.argv[0]} [binary] [address]\n")
|
|
sys.exit(2)
|
|
|
|
m = Manticore(sys.argv[1])
|
|
|
|
# Uncomment to see debug output
|
|
# m.verbosity = 2
|
|
|
|
# Set to the address of the conditional at state_explore.c:38, which will be
|
|
# abandoned. If line 36 of this script is commented out, Manticore will
|
|
# explore all reachable states.
|
|
to_abandon = int(sys.argv[2], 0)
|
|
|
|
@m.hook(to_abandon)
|
|
def explore(state):
|
|
print(f"Abandoning state at PC: {state.cpu.PC:x}")
|
|
state.abandon()
|
|
|
|
print(f"Adding hook to: {to_abandon:x}")
|
|
|
|
m.run()
|