Hacking on Manticore

Adding a Syscall

as of c78ea5c9109191654d26c7bfd2bedd662dafcdc5

To implement a Linux syscall:

• open manticore/models/linux.py
• add a method to the SLinux (Symbolic Linux) class for your syscall. Conventionally, they are currently prefixed with sys_. The arguments to this method should be
  • 1: self (standard Python self variable)
  • 2: cpu (manticore.core.abstractcpu.Cpu object representing current cpu state)
  • 3+: arguments to the syscall
• implement the logic of the syscall in this method, using the Cpu APIs as needed
• the method should return the value returned by the syscall
• if this is a 64 bit syscall, edit the local dictionary in Linux.syscall, and add your method with the appropriate syscall number. if it's a 32 bit syscall, edit Linux.int80

Adding an Instruction

as of c78ea5c9109191654d26c7bfd2bedd662dafcdc5

To implement a cpu instruction:

• open the file according to the architecture for this instruction
  • x86 is in manticore/core/cpu/x86.py
  • armv7 is in manticore/core/cpu/arm.py
• Add a method to the specific Cpu class in either of those files that subclasses Cpu
  • decorate it with the @instruction decorator
  • the arguments to the method should be
    • 1: self
    • 2+ one argument for every operand in instruction.operands as decoded by Capstone. The types of these arguments are manticore.core.abstractcpu.Operand which is a light wrapper over a Capstone operand object (e.g. ArmOp)) and notably support convenience .read and .write methods.
• Implement the instruction's effects

Source Tree

manticore/
├── binary # code related to binary formats. ignore this
│   ├── grr
│   │   ├── __init__.py
│   │   └── snapshot.py
│   ├── __init__.py
│   └── pe
│       ├── __init__.py
│       └── minidump.py
├── core
│   ├── cpu # code implementing symbolic emulators
│   │   ├── abstractcpu.py
│   │   ├── arm.py
│   │   ├── bitwise.py
│   │   ├── cpufactory.py
│   │   ├── __init__.py
│   │   ├── register.py
│   │   └── x86.py
│   ├── executor.py # main symbolic execution file
│   ├── __init__.py
│   ├── mappings.py
│   ├── memory.py
│   ├── parser
│   │   ├── __init__.py
│   │   └── parser.py
│   ├── smtlib # code related to handling symbolic data
│   │   ├── constraints.py #
│   │   ├── expression.py # defines symbolic data types
│   │   ├── __init__.py
│   │   ├── operators.py # library of operators for transparently handling concrete or symbolic data
│   │   ├── solver.py # code for interacting with the SMT solver
│   │   └── visitors.py # code for transforming expression trees, including serializing to SMTLIB
│   └── state.py # defines type for program state
├── __init__.py
├── __main__.py
├── manticore.py # high level API object
├── models # operating system models implemented here
│   ├── cgcrandom.py
│   ├── decree.py
│   ├── __init__.py
│   ├── libc.py
│   ├── linux.py
│   ├── windows.py
│   └── windows_syscalls.py
└── utils
    ├── emulate.py # code integrating unicorn for emulation of unimplemented instructions
    ├── event.py
    ├── helpers.py
    ├── __init__.py
    ├── iterpickle.py
    └── nointerrupt.py