crackers 0.9.0

A tool for synthesizing Code Reuse Attacks (ROP chains) using Ghidra's p-code and Z3
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

use std::{collections::HashMap, ops::Range};

use jingle::{modeling::State, sleigh::VarNode};
use z3::ast::Bool;

use crate::error::CrackersError;

#[derive(Debug, Clone, Default)]
pub struct MemoryValuation(pub(super) HashMap<VarNode, Vec<u8>>);

impl MemoryValuation {
    pub fn to_constraint(&self) -> impl Fn(&State) -> Result<Bool, CrackersError> {
        let map = self.0.clone();
        move |state| {
            let mut v = vec![];
            for (vn, value) in &map {
                let mut temp_vn: VarNode = VarNode {
                    space_index: vn.space_index,
                    size: 1,
                    offset: vn.offset,
                };
                let r: Range<u64> = vn.into();
                for (index, offset) in r.enumerate() {
                    temp_vn.offset = offset;
                    v.push(state.read_varnode(&temp_vn)?.eq(value[index]))
                }
            }
            Ok(Bool::and(&v))
        }
    }
}