Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

question about tritondse #33

Open
hroash opened this issue Jul 18, 2024 · 0 comments
Open

question about tritondse #33

hroash opened this issue Jul 18, 2024 · 0 comments

Comments

@hroash
Copy link

hroash commented Jul 18, 2024

using tritondse to solve the famous copy_it example failed: copy_it on usenix
AFL++ was able to find it in a few seconds, KLEE was able to solve it on ~ 1 hour.
when I tried to solve it with tritondse exploration:

I compiled copyit with clang -m32 copy_it.c -o copy_it.elf

from triton import Instruction
from tritondse import SymbolicExplorator, Config, Seed, Program, ProcessState, SeedFormat, CompositeData
from tritondse import Config
from tritondse import CoverageStrategy
from tritondse import Seed, CompositeData
import time


p = Program("./copy_it.elf")
config = Config(coverage_strategy=CoverageStrategy.PATH, pipe_stdout=True, seed_format=SeedFormat.COMPOSITE)
explorer = SymbolicExplorator(config, p)

composite_seed = Seed(CompositeData(argv=[b"./copy_it.elf", b"filename.txt"],files={"filename.txt": b"A"*51}))
explorer.add_input_seed(composite_seed)


file2=open("symbolicExploration_inputs.log","w")
def pre_exec_hook(se: SymbolicExplorator, state: ProcessState):
     file2.write(f"input: {se.seed.hash} {se.seed.content.argv} {se.seed.content.files} \n")
     file2.flush()

file=open("symbolicExploration_results.log","w")

def post_exec_hook(se: SymbolicExplorator, state: ProcessState):
    if se.exitcode!=0:
        file.write(f"crashed!!! with  [exitcode:{se.exitcode}] input: {se.seed.hash} {se.seed.content.argv} {se.seed.content.files}\n")
    else:
        file.write(f"input: {se.seed.hash} {se.seed.content.argv} {se.seed.content.files} \n")
    file.flush()
    time.sleep(2)

explorer.callback_manager.register_pre_execution_callback(pre_exec_hook)
explorer.callback_manager.register_post_execution_callback(post_exec_hook)

explorer.explore()

  1. if I do not add time.sleep(2) after ~ 10 minutes all my recourses are taken and I can't even use my mouse/key
  2. even if I add time.sleep(2) tritondse did not found the crashing input for copy_it program, while KLEE was able to find it in ~1 hour
  3. after ~1 day tritondse get segfault (I do not know what cause tritondse to crash):
    image

I wanted to ask:

  1. do you know why it's take tritondse to solve it more time?
  2. what causing the segfault?
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant