crackers 0.9.0

A tool for synthesizing Code Reuse Attacks (ROP chains) using Ghidra's p-code and Z3
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117

use std::borrow::Borrow;
use std::sync::Arc;

use crate::error::CrackersError;
use crate::gadget::candidates::Candidates;
use crate::gadget::library::GadgetLibrary;
use crate::reference_program::ReferenceProgram;
use crate::synthesis::builder::{StateConstraintGenerator, TransitionConstraintGenerator};
use crate::synthesis::pcode_theory::PcodeTheory;
use crate::synthesis::pcode_theory::pcode_assignment::PcodeAssignment;
use crate::synthesis::slot_assignments::SlotAssignments;
use jingle::modeling::{ModeledBlock, ModeledInstruction};
use jingle::sleigh::SleighArchInfo;

#[derive(Clone)]
pub struct PcodeTheoryBuilder<'lib> {
    reference_program: ReferenceProgram,
    library: &'lib GadgetLibrary,
    candidates: Candidates,
    preconditions: Vec<Arc<StateConstraintGenerator>>,
    postconditions: Vec<Arc<StateConstraintGenerator>>,
    pointer_invariants: Vec<Arc<TransitionConstraintGenerator>>,
    candidates_per_slot: usize,
}

impl<'lib> PcodeTheoryBuilder<'lib> {
    // todo: this is gross
    pub fn new(candidates: Candidates, library: &'lib GadgetLibrary) -> PcodeTheoryBuilder<'lib> {
        Self {
            reference_program: Default::default(),
            library,
            candidates,
            preconditions: vec![],
            postconditions: vec![],
            pointer_invariants: vec![],
            candidates_per_slot: 200,
        }
    }
    pub fn build(self) -> Result<PcodeTheory<ModeledInstruction>, CrackersError> {
        let modeled_templates = self.model_instructions(self.library.arch_info())?;
        let gadget_candidates = self.candidates.model(self.library.arch_info())?;
        let t = PcodeTheory::new(
            self.library.arch_info(),
            modeled_templates,
            self.reference_program.initial_memory().clone(),
            gadget_candidates,
            self.preconditions,
            self.postconditions,
            self.pointer_invariants,
        )?;
        Ok(t)
    }

    pub fn build_assignment<T: Borrow<SleighArchInfo>>(
        &self,
        info: T,
        slot_assignments: SlotAssignments,
    ) -> Result<PcodeAssignment, CrackersError> {
        let info = info.borrow();
        let modeled_templates: Vec<ModeledInstruction> = self.model_instructions(info)?;
        let gadget_candidates: Vec<Vec<ModeledBlock>> = self.candidates.model(info)?;
        let selected_candidates: Vec<ModeledBlock> = slot_assignments
            .choices()
            .iter()
            .enumerate()
            .map(|(i, c)| gadget_candidates[i][*c].clone())
            .collect();
        Ok(PcodeAssignment::new(
            self.reference_program.initial_memory().clone(),
            modeled_templates,
            selected_candidates,
            self.preconditions.clone(),
            self.postconditions.clone(),
            self.pointer_invariants.clone(),
        ))
    }

    pub fn with_templates(mut self, templates: ReferenceProgram) -> Self {
        self.reference_program = templates;
        self
    }

    pub fn with_preconditions(mut self, preconditions: &[Arc<StateConstraintGenerator>]) -> Self {
        self.preconditions = preconditions.to_vec();
        self
    }

    pub fn with_postconditions(mut self, postconditions: &[Arc<StateConstraintGenerator>]) -> Self {
        self.postconditions = postconditions.to_vec();
        self
    }

    pub fn with_pointer_invariants(
        mut self,
        invariants: &[Arc<TransitionConstraintGenerator>],
    ) -> Self {
        self.pointer_invariants = invariants.to_vec();
        self
    }

    pub fn with_max_candidates(mut self, candidates: usize) -> Self {
        self.candidates_per_slot = candidates;
        self
    }

    fn model_instructions<T: Borrow<SleighArchInfo>>(
        &self,
        info: T,
    ) -> Result<Vec<ModeledInstruction>, CrackersError> {
        let info = info.borrow();
        let mut modeled_templates = vec![];
        for step in self.reference_program.steps() {
            modeled_templates.push(step.model(info)?);
        }
        Ok(modeled_templates)
    }
}