Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update evm examples #1486

Merged
merged 4 commits into from
Jul 22, 2019
Merged

Update evm examples #1486

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
34f8fca
Update syntax for refactor
Tiecoon Jul 12, 2019
837c9d2
Update syntax for refactor
Tiecoon Jul 12, 2019
b0aa9b1
Update syntax for refactor
Tiecoon Jul 12, 2019
97253ac
Update syntax for refactor
Tiecoon Jul 12, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion examples/evm/complete.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@
)

print("[+] Resulting balances are:")
for state in m.running_states:
for state in m.all_states:
balance = state.platform.get_balance(int(user_account))
print(state.solve_one(balance))

Expand Down
2 changes: 1 addition & 1 deletion examples/evm/coverage.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
)

print(f"[+] There are {m.count_terminated_states()} reverted states now")
print(f"[+] There are {m.count_running_states()} alive states now")
print(f"[+] There are {m.count_busy_states()} alive states now")
# for state_id in m.running_state_ids:
# print(m.report(state_id))

Expand Down
51 changes: 28 additions & 23 deletions examples/evm/reentrancy_concrete.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,14 @@

contract Reentrance {
mapping (address => uint) userBalance;

function getBalance(address u) constant returns(uint){
return userBalance[u];
}

function addToBalance() payable{
userBalance[msg.sender] += msg.value;
}
}

function withdrawBalance(){
// send userBalance[msg.sender] ethers to msg.sender
Expand All @@ -26,9 +26,9 @@
revert();
}
userBalance[msg.sender] = 0;
}
}
}
//Function signatures:
//Function signatures:
//c0e317fb: addToBalance()
//f8b2cb4f: getBalance(address)
//5fd8c710: withdrawBalance()
Expand All @@ -38,7 +38,7 @@
pragma solidity ^0.4.15;

contract GenericReentranceExploit {
int reentry_reps=10;
int reentry_reps=10;
address vulnerable_contract;
address owner;
bytes reentry_attack_string;
Expand Down Expand Up @@ -87,7 +87,8 @@
contract_account = m.solidity_create_contract(
contract_source_code, owner=user_account
) # Not payable
m.world.set_balance(contract_account, 1000000000000000000) # give it some ether
for i in m.all_states:
i.platform.set_balance(contract_account, 1000000000000000000) # give it some ether

exploit_account = m.solidity_create_contract(exploit_source_code, owner=attacker_account)

Expand All @@ -101,16 +102,18 @@
exploit_account.set_reentry_attack_string(reentry_string)

print("[+] Initial world state")
print(
f" attacker_account {attacker_account.address:x} balance: {m.get_balance(attacker_account.address)}"
)
print(
f" exploit_account {exploit_account.address} balance: {m.get_balance(exploit_account.address)}"
)
print(f" user_account {user_account.address:x} balance: {m.get_balance(user_account.address)}")
print(
f" contract_account {contract_account.address:x} balance: {m.get_balance(contract_account.address)}"
)
for i in m.all_states:
i = i.platform
print(
f" attacker_account {attacker_account.address:x} balance: {i.get_balance(attacker_account.address)}"
)
print(
f" exploit_account {exploit_account.address} balance: {i.get_balance(exploit_account.address)}"
)
print(f" user_account {user_account.address:x} balance: {i.get_balance(user_account.address)}")
print(
f" contract_account {contract_account.address:x} balance: {i.get_balance(contract_account.address)}"
)


# User deposits all in contract
Expand All @@ -127,13 +130,15 @@
print("[+] Let attacker destroy the exploit contract and profit")
exploit_account.get_money()

print(
f" attacker_account {attacker_account.address:x} balance: {m.get_balance(attacker_account.address)}"
)
print(f" user_account {user_account.address:x} balance: {m.get_balance(user_account.address)}")
print(
f" contract_account {contract_account.address:x} balance: {m.get_balance(contract_account.address)}"
)
for i in m.all_states:
i = i.platform
print(
f" attacker_account {attacker_account.address:x} balance: {i.get_balance(attacker_account.address)}"
)
print(f" user_account {user_account.address:x} balance: {i.get_balance(user_account.address)}")
print(
f" contract_account {contract_account.address:x} balance: {i.get_balance(contract_account.address)}"
)

m.finalize()
print(f"[+] Look for results in {m.workspace}")
62 changes: 22 additions & 40 deletions examples/evm/use_def.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@
################ Script #######################

m = ManticoreEVM()
m.verbosity(0)
# And now make the contract account to analyze
# cat | solc --bin
source_code = """
Expand All @@ -18,80 +17,63 @@
c =0;
enabled = false;
i = false;

}
function f1() public {
c+=1;
}
function f2() public {
if(c>100)
enabled=true;

}
function f3() public{
if (!enabled)
if (!enabled)
return;
i = true;

}
}
"""
print(source_code)


class EVMUseDef(Plugin):
def _get_concrete_hex(self, state, array):
r = ""
for i in array:
l = state.solve_n(i, 2)
if len(l) == 1:
r += "%02x" % l[0]
if len(r) != 8:
return
return r

def did_evm_write_storage_callback(self, state, address, offset, value):
m = self.manticore
world = state.platform
tx = world.all_transactions[-1]
md = m.get_metadata(tx.address)

r = self._get_concrete_hex(state, tx.data[0:4])
if r is None:
return

offsets = state.solve_n(offset, 3000)
with self.locked_context("storage_writes", dict) as storage_writes:
contract_function = (md.name, md.get_func_name(r))
if contract_function not in storage_writes:
storage_writes[contract_function] = set()
for off in offsets:
storage_writes[contract_function].add(off)
if md:
offsets = state.solve_n(offset, 3000)
with self.locked_context("storage_writes", dict) as storage_writes:
contract_function = (md.name, md.get_func_name(state.solve_one(tx.data[0:4])))
if contract_function not in storage_writes:
storage_writes[contract_function] = set()
for off in offsets:
storage_writes[contract_function].add(off)

def did_evm_read_storage_callback(self, state, address, offset, value):
m = self.manticore
world = state.platform
tx = world.all_transactions[-1]
md = m.get_metadata(tx.address)
if md:
offsets = state.solve_n(offset, 3000)
with self.locked_context("storage_reads", dict) as storage_reads:
contract_function = (md.name, md.get_func_name(state.solve_one(tx.data[0:4])))
if contract_function not in storage_reads:
storage_reads[contract_function] = set()
for off in offsets:
storage_reads[contract_function].add(off)

r = self._get_concrete_hex(state, tx.data[0:4])
if r is None:
return

offsets = state.solve_n(offset, 3000)
with self.locked_context("storage_reads", dict) as storage_reads:
contract_function = (md.name, md.get_func_name(r))
if contract_function not in storage_reads:
storage_reads[contract_function] = set()
for off in offsets:
storage_reads[contract_function].add(off)

p = EVMUseDef()
m.register_plugin(p)

# Initialize accounts
user_account = m.create_account(balance=1000)
contract_account = m.solidity_create_contract(source_code, owner=user_account)
p = EVMUseDef()
m.register_plugin(p)

symbolic_data = m.make_symbolic_buffer(320)
symbolic_value = m.make_symbolic_value()
Expand Down