cozy.hooks.strtok_r
¶
Module Contents¶
Classes¶
A SimProcedure is a wonderful object which describes a procedure to run on a state. |
Attributes¶
- cozy.hooks.strtok_r.l¶
- class cozy.hooks.strtok_r.strtok_r(project=None, cc=None, prototype=None, symbolic_return=None, returns=None, is_syscall=False, is_stub=False, num_args=None, display_name=None, library_name=None, is_function=None, **kwargs)¶
Bases:
angr.SimProcedure
A SimProcedure is a wonderful object which describes a procedure to run on a state.
You may subclass SimProcedure and override
run()
, replacing it with mutatingself.state
however you like, and then either returning a value or jumping away somehow.A detailed discussion of programming SimProcedures may be found at https://docs.angr.io/extending-angr/simprocedures
- Parameters:
arch – The architecture to use for this procedure
The following parameters are optional:
- Parameters:
symbolic_return – Whether the procedure’s return value should be stubbed into a single symbolic variable constratined to the real return value
returns – Whether the procedure should return to its caller afterwards
is_syscall – Whether this procedure is a syscall
num_args – The number of arguments this procedure should extract
display_name – The name to use when displaying this procedure
library_name – The name of the library from which the function we’re emulating comes
cc – The SimCC to use for this procedure
sim_kwargs – Additional keyword arguments to be passed to run()
is_function – Whether this procedure emulates a function
The following class variables should be set if necessary when implementing a new SimProcedure:
- Variables:
NO_RET – Set this to true if control flow will never return from this function
DYNAMIC_RET – Set this to true if whether the control flow returns from this function or not depends on the context (e.g., libc’s error() call). Must implement dynamic_returns() method.
ADDS_EXITS – Set this to true if you do any control flow other than returning
IS_FUNCTION – Does this procedure simulate a function? True by default
ARGS_MISMATCH – Does this procedure have a different list of arguments than what is provided in the function specification? This may happen when we manually extract arguments in the run() method of a SimProcedure. False by default.
local_vars – If you use
self.call()
, set this to a list of all the local variable names in your class. They will be restored on return.
The following instance variables are available when working with simprocedures from the inside or the outside:
- Variables:
project – The associated angr project
arch – The associated architecture
addr – The linear address at which the procedure is executing
cc – The calling convention in use for engaging with the ABI
canonical – The canonical version of this SimProcedure. Procedures are deepcopied for many reasons, including to be able to store state related to a specific run and to be able to hook continuations.
kwargs – Any extra keyword arguments used to construct the procedure; will be passed to
run
display_name – See the eponymous parameter
library_name – See the eponymous parameter
abi – If this is a syscall simprocedure, which ABI are we using to map the syscall numbers?
symbolic_return – See the eponymous parameter
syscall_number – If this procedure is a syscall, the number will be populated here.
returns – See eponymous parameter and NO_RET cvar
is_syscall – See eponymous parameter
is_function – See eponymous parameter and cvar
is_stub – See eponymous parameter
is_continuation – Whether this procedure is the original or a continuation resulting from
self.call()
continuations – A mapping from name to each known continuation
run_func – The name of the function implementing the procedure. “run” by default, but different in continuations.
num_args – The number of arguments to the procedure. If not provided in the parameter, extracted from the definition of
self.run
The following instance variables are only used in a copy of the procedure that is actually executing on a state:
- Variables:
state – The SimState we should be mutating to perform the procedure
successors – The SimSuccessors associated with the current step
arguments – The function arguments, deserialized from the state
arg_session – The ArgSession that was used to parse arguments out of the state, in case you need it for varargs
use_state_arguments – Whether we’re using arguments extracted from the state or manually provided
ret_to – The current return address
ret_expr – The computed return value
call_ret_expr – The return value from having used
self.call()
inhibit_autoret – Whether we should avoid automatically adding an exit for returning once the run function ends
arg_session – The ArgSession object that was used to extract the runtime argument values. Useful for if you want to extract variadic args.
- run(str_ptr, delim_ptr, save_ptr, str_strlen=None, delim_strlen=None)¶
Implement the actual procedure here!