cozy.project

Module Contents

Classes

Project

Represents a project for a single executable

class cozy.project.Project(binary_path: str, fun_prototypes: dict[str | int, str] | None = None, load_debug_info: bool = False, **kwargs)

Represents a project for a single executable

Variables:
  • angr_proj (angr.Project) – The angr project created for this cozy project.

  • fun_prototypes (dict[str | int, str]) – Maps function names or function addresses to their type signatures.

Constructor for a project.

Parameters:
  • binary_path (str) – The path to the binary to analyze.

  • fun_prototypes (dict[str | int, str] | None) – Initial dictionary that maps function names or addresses to their type signatures. If None is passed, fun_prototypes is initialized to the empty dictionary.

  • kwargs – Extra arguments to pass to angr.Project

property cfg

Returns the control flow graph for this project. This property will cache the cfg in a pickle file to speed up future runs. This means if you change the underlying program you will need to delete the .cfg.pickle file located in the same directory as your executable.

property arch

Returns the underlying angr project architecture

object_ranges(obj_filter: collections.abc.Callable[[cle.Backend], bool] | None = None) list[range]

Returns the ranges of the objects stored in the executable (for example: ELF objects). If obj_filter is specified, only objects that pass the filter make it into the return list.

Parameters:

obj_filter (Callable[[Backend], bool] | None) – Used to filter certain objects from the output list.

Returns:

A list of memory ranges.

Return type:

list[range]

find_symbol_addr(sym_name: str) int

Finds the rebased addressed of a symbol. Functions are the most common symbol type.

Parameters:

sym_name (str) – The symbol to lookup.

Returns:

The rebased symbol address

Return type:

int

add_prototype(fun: str | int, fun_prototype: str) None

Adds a function prototype to this project.

Parameters:
  • fun (str | int) – The function’s name or address.

  • fun_prototype (str) – The function’s type signature.

Returns:

None

Return type:

None

session(start_fun: str | int | None = None) cozy.session.Session

Returns a new session derived from this project.

Parameters:

start_fun (str | int | None) – The name or address of the function which this session will start with. If None is specified, then the program will start at the entry point (main function).

Returns:

The fresh session.

Return type:

Session

hook_symbol(symbol_name: str, simproc_class: type[angr.SimProcedure], kwargs=None, replace: bool | None = None) int

Hooks a symbol in the angr project. If the symbol is one from libc, this method will also replace what is stored in angr.SIM_PROCEDURES["libc"][symbol_name].

Parameters:
  • symbol_name (str) – The name of the symbol to hook.

  • simproc_class (type[SimProcedure]) – The class to use to hook the symbol. Note that this is not an instance of SimProcedure, but is instead a reference to the class itself.

  • kwargs – These are the keyword arguments that will be passed to the procedure’s run method eventually.

  • replace (bool | None) – Control the behavior on finding that the address is already hooked. If true, silently replace the hook. If false, warn and do not replace the hook. If none (default), warn and replace the hook.

Return type:

int

Returns:

The address of the new symbol.

hook_syscall(syscall_name: str, simproc_class: type[angr.SimProcedure])

Hooks a syscall in the angr project.

Parameters:
  • syscall_name (str) – The name of the syscall to hook.

  • simproc_class (type[SimProcedure]) – The class to use to hook the symbol. Note that this is not an instance of SimProcedure, but is instead a reference to the class itself.