cozy.project
¶
Module Contents¶
Classes¶
Represents a project for a single executable |
- class cozy.project.Project(binary_path: str, fun_prototypes: dict[str | int, str] | None = None, load_debug_info: bool = False, **kwargs)¶
Represents a project for a single executable
- Variables:
angr_proj (angr.Project) – The angr project created for this cozy project.
fun_prototypes (dict[str | int, str]) – Maps function names or function addresses to their type signatures.
Constructor for a project.
- Parameters:
binary_path (str) – The path to the binary to analyze.
fun_prototypes (dict[str | int, str] | None) – Initial dictionary that maps function names or addresses to their type signatures. If None is passed, fun_prototypes is initialized to the empty dictionary.
kwargs – Extra arguments to pass to angr.Project
- property cfg¶
Returns the control flow graph for this project. This property will cache the cfg in a pickle file to speed up future runs. This means if you change the underlying program you will need to delete the .cfg.pickle file located in the same directory as your executable.
- property arch¶
Returns the underlying angr project architecture
- object_ranges(obj_filter: collections.abc.Callable[[cle.Backend], bool] | None = None) list[range] ¶
Returns the ranges of the objects stored in the executable (for example: ELF objects). If obj_filter is specified, only objects that pass the filter make it into the return list.
- Parameters:
obj_filter (Callable[[Backend], bool] | None) – Used to filter certain objects from the output list.
- Returns:
A list of memory ranges.
- Return type:
list[range]
- find_symbol_addr(sym_name: str) int ¶
Finds the rebased addressed of a symbol. Functions are the most common symbol type.
- Parameters:
sym_name (str) – The symbol to lookup.
- Returns:
The rebased symbol address
- Return type:
int
- add_prototype(fun: str | int, fun_prototype: str) None ¶
Adds a function prototype to this project.
- Parameters:
fun (str | int) – The function’s name or address.
fun_prototype (str) – The function’s type signature.
- Returns:
None
- Return type:
None
- session(start_fun: str | int | None = None) cozy.session.Session ¶
Returns a new session derived from this project.
- Parameters:
start_fun (str | int | None) – The name or address of the function which this session will start with. If None is specified, then the program will start at the entry point (main function).
- Returns:
The fresh session.
- Return type:
- hook_symbol(symbol_name: str, simproc_class: type[angr.SimProcedure], kwargs=None, replace: bool | None = None) int ¶
Hooks a symbol in the angr project. If the symbol is one from libc, this method will also replace what is stored in
angr.SIM_PROCEDURES["libc"][symbol_name]
.- Parameters:
symbol_name (str) – The name of the symbol to hook.
simproc_class (type[SimProcedure]) – The class to use to hook the symbol. Note that this is not an instance of SimProcedure, but is instead a reference to the class itself.
kwargs – These are the keyword arguments that will be passed to the procedure’s run method eventually.
replace (bool | None) – Control the behavior on finding that the address is already hooked. If true, silently replace the hook. If false, warn and do not replace the hook. If none (default), warn and replace the hook.
- Return type:
int
- Returns:
The address of the new symbol.
- hook_syscall(syscall_name: str, simproc_class: type[angr.SimProcedure])¶
Hooks a syscall in the angr project.
- Parameters:
syscall_name (str) – The name of the syscall to hook.
simproc_class (type[SimProcedure]) – The class to use to hook the symbol. Note that this is not an instance of SimProcedure, but is instead a reference to the class itself.