├── .build_number ├── .codecov.yml ├── .editorconfig ├── .github └── workflows │ ├── codecov.yml │ ├── docker.yml │ ├── linux.yml │ ├── osx.yml │ ├── python.yml │ └── vcpkg.yml ├── .gitignore ├── CMakeLists.txt ├── CMakeModules ├── FindBITWUZLA.cmake ├── FindCAPSTONE.cmake ├── FindZ3.cmake └── LibFindMacros.cmake ├── CMakePresets.json ├── Dockerfile ├── LICENSE.txt ├── README.md ├── doc ├── CMakeLists.txt ├── Doxyfile.in ├── DoxygenLayout.xml ├── autocomplete │ ├── .gitignore │ ├── example.py │ ├── function.py │ └── generate_autocomplete.py ├── customdoxygen.css ├── extract_doc.py ├── figures │ ├── figure.1.1.png │ ├── figure.1.10.png │ ├── figure.1.11.png │ ├── figure.1.19.png │ ├── figure.1.20.png │ ├── figure.1.4.png │ ├── figure.1.5.png │ ├── figure.1.6.png │ ├── figure.1.7.png │ ├── figure.1.8.png │ └── figure.1.9.png ├── footer.html └── header.html ├── publications ├── BAR2020-qsynth-robin-david.pdf ├── BHUSA2021-David-Greybox-Program-Synthesis.pdf ├── CESAR2021_robin-david-paper.pdf ├── CESAR2021_robin-david-slide.pdf ├── CSAW2016-SOS-Virtual-Machine-Deobfuscation-RThomas_JSalwan.pdf ├── DIMVA2018-deobfuscation-salwan-bardin-potet.pdf ├── DIMVA2018-slide-deobfuscation-salwan-bardin-potet.pdf ├── ISPOPEN2020-slide-sydr-vishnyakov.pdf ├── ISPOPEN2021-security-predicates-vishnyakov.pdf ├── ISPOPEN2021-slide-security-predicates-vishnyakov.pdf ├── ISPOPEN2022-slide-sydr-fuzz-vishnyakov.pdf ├── ISPOPEN2022-sydr-fuzz.pdf ├── ISPRAS2020-sydr.pdf ├── IVMEM2021-slide-symbolic-pointers-kuts.pdf ├── IVMEM2021-symbolic-pointers-kuts.pdf ├── IVMEM2022-slide-strong-optimistic-parygina.pdf ├── IVMEM2022-strong-optimistic-parygina.pdf ├── KLEE2022-robin-david.pdf ├── MISC-82_French_Paper_How_Triton_may_help_to_analyse_obfuscated_binaries_RThomas_JSalwan.pdf ├── SSTIC2015_English_slide_detailed_version_Triton_Concolic_Execution_FrameWork_FSaudel_JSalwan.pdf ├── SSTIC2015_French_Paper_Triton_Framework_dexecution_Concolique_FSaudel_JSalwan.pdf ├── SSTIC2015_French_slide_light_version_Triton_Concolic_Execution_FrameWork_FSaudel_JSalwan.pdf ├── SSTIC2017-French-Article-desobfuscation_binaire_reconstruction_de_fonctions_virtualisees-salwan_potet_bardin.pdf ├── SSTIC2017_Deobfuscation_of_VM_based_software_protection.pdf ├── SecurityDay2015_dynamic_symbolic_execution_Jonathan_Salwan.pdf ├── StHack2015_Dynamic_Behavior_Analysis_using_Binary_Instrumentation_Jonathan_Salwan.pdf └── StHack2016_Dynamic_Binary_Analysis_and_Obfuscated_Codes_RThomas_JSalwan.pdf ├── setup.py ├── src ├── CMakeLists.txt ├── examples │ ├── CMakeLists.txt │ ├── cmake │ │ ├── CMakeLists.txt │ │ └── myproject.cpp │ ├── cpp │ │ ├── CMakeLists.txt │ │ ├── block.cpp │ │ ├── constraint.cpp │ │ ├── ctest_api.cpp │ │ ├── info_reg.cpp │ │ ├── ir.cpp │ │ ├── simplification.cpp │ │ └── taint_reg.cpp │ └── python │ │ ├── backward_slicing.py │ │ ├── code_coverage_crackme_xor.py │ │ ├── constraints.py │ │ ├── ctf-writeups │ │ ├── NorthSec-2018-MarsAnalytica │ │ │ ├── 00400000-00e5e000.dump │ │ │ ├── MarsAnalytica │ │ │ ├── README.md │ │ │ ├── fulldump.dump │ │ │ ├── solve.py │ │ │ └── sub-trace-of-sym-instructions │ │ ├── Nuit_du_Hack_CTF_Quals_2016_Matriochka_Step_3 │ │ │ ├── solve.py │ │ │ └── stage3.bin │ │ ├── alexctf-2017-re2-cpp-is-awesome │ │ │ ├── re2 │ │ │ └── solve.py │ │ ├── alexctf-2017-re3-catalyst-system │ │ │ ├── catalyst │ │ │ ├── catalyst.patched_without_sleep │ │ │ └── solve.py │ │ ├── cm002 │ │ │ ├── cm002 │ │ │ └── solve.py │ │ ├── custom-crackmes │ │ │ ├── aarch64-hash │ │ │ │ ├── crackme_hash │ │ │ │ ├── crackme_hash.c │ │ │ │ ├── solve-with-abv-logic.py │ │ │ │ └── solve.py │ │ │ ├── arm32-hash │ │ │ │ ├── crackme_hash-arm │ │ │ │ ├── crackme_hash-thumb │ │ │ │ ├── crackme_hash.c │ │ │ │ ├── solve-arm.py │ │ │ │ ├── solve-thumb.py │ │ │ │ └── solve-with-abv-logic.py │ │ │ ├── riscv32-hash │ │ │ │ ├── crackme_hash │ │ │ │ ├── crackme_hash.c │ │ │ │ ├── solve-with-abv-logic.py │ │ │ │ └── solve.py │ │ │ └── riscv64-hash │ │ │ │ ├── crackme_hash │ │ │ │ ├── crackme_hash.c │ │ │ │ ├── solve-with-abv-logic.py │ │ │ │ └── solve.py │ │ ├── defcamp-2015-r100 │ │ │ ├── r100.bin │ │ │ ├── solve-with-abv-logic.py │ │ │ └── solve.py │ │ ├── defcon-2016-baby-re │ │ │ ├── baby-re │ │ │ ├── baby-re.dump │ │ │ ├── gdb-peda-fulldump.patch │ │ │ └── solve.py │ │ ├── ekopartyctf2016_rev250 │ │ │ ├── FUck_binary │ │ │ ├── libget_flag.so │ │ │ └── solve.py │ │ ├── google2016-unbreakable │ │ │ ├── solve.py │ │ │ └── unbreakable-enterprise-product-activation │ │ ├── hackcon-2016-angry-reverser │ │ │ ├── solve.py │ │ │ └── yolomolo │ │ ├── hacklu-2021-ollvm │ │ │ ├── ollvm │ │ │ └── solve.py │ │ ├── hackover-ctf-2015-r150 │ │ │ ├── rvs.bin │ │ │ └── solve.py │ │ ├── mma-2015-howtouse │ │ │ ├── howtouse.dll │ │ │ └── solve.py │ │ └── securityfest-2016-fairlight │ │ │ ├── fairlight │ │ │ └── solve.py │ │ ├── dead_store_elimination.py │ │ ├── disass.py │ │ ├── forward_tainting.py │ │ ├── hooking_libc.py │ │ ├── ir.py │ │ ├── lifting_dot_format.py │ │ ├── multi_threading.py │ │ ├── proving_equivalence.py │ │ ├── proving_opaque_predicates.py │ │ ├── samples │ │ ├── sample_1 │ │ ├── sample_1.c │ │ ├── sample_2 │ │ └── sample_2.c │ │ ├── simplification.py │ │ ├── small_x86-64_symbolic_emulator.py │ │ ├── symbolic_emulation_1.py │ │ ├── symbolic_emulation_2.py │ │ ├── symbolic_emulation_crackme_xor.py │ │ ├── symbolic_pointers_reasoning.py │ │ ├── synthesizing_obfuscated_code.py │ │ └── synthesizing_obfuscated_expressions.py ├── libtriton │ ├── CMakeLists.txt │ ├── Config.cmake.in │ ├── arch │ │ ├── architecture.cpp │ │ ├── arm │ │ │ ├── aarch64 │ │ │ │ ├── aarch64Cpu.cpp │ │ │ │ ├── aarch64Semantics.cpp │ │ │ │ └── aarch64Specifications.cpp │ │ │ ├── arm32 │ │ │ │ ├── arm32Cpu.cpp │ │ │ │ ├── arm32Semantics.cpp │ │ │ │ └── arm32Specifications.cpp │ │ │ └── armOperandProperties.cpp │ │ ├── basicBlock.cpp │ │ ├── bitsVector.cpp │ │ ├── immediate.cpp │ │ ├── instruction.cpp │ │ ├── irBuilder.cpp │ │ ├── memoryAccess.cpp │ │ ├── operandWrapper.cpp │ │ ├── register.cpp │ │ ├── riscv │ │ │ ├── riscv32Cpu.cpp │ │ │ ├── riscv64Cpu.cpp │ │ │ ├── riscvSemantics.cpp │ │ │ └── riscvSpecifications.cpp │ │ └── x86 │ │ │ ├── x8664Cpu.cpp │ │ │ ├── x86Cpu.cpp │ │ │ ├── x86Semantics.cpp │ │ │ └── x86Specifications.cpp │ ├── ast │ │ ├── ast.cpp │ │ ├── astContext.cpp │ │ ├── bitwuzla │ │ │ └── tritonToBitwuzla.cpp │ │ ├── llvm │ │ │ ├── llvmToTriton.cpp │ │ │ └── tritonToLLVM.cpp │ │ ├── representations │ │ │ ├── astPcodeRepresentation.cpp │ │ │ ├── astPythonRepresentation.cpp │ │ │ ├── astRepresentation.cpp │ │ │ └── astSmtRepresentation.cpp │ │ └── z3 │ │ │ ├── tritonToZ3.cpp │ │ │ └── z3ToTriton.cpp │ ├── bindings │ │ └── python │ │ │ ├── init.cpp │ │ │ ├── modules │ │ │ └── tritonCallbacks.cpp │ │ │ ├── namespaces │ │ │ ├── initArchNamespace.cpp │ │ │ ├── initAstNodeNamespace.cpp │ │ │ ├── initAstRepresentationNamespace.cpp │ │ │ ├── initCallbackNamespace.cpp │ │ │ ├── initConditionsNamespace.cpp │ │ │ ├── initCpuSizeNamespace.cpp │ │ │ ├── initExceptionNamespace.cpp │ │ │ ├── initExtendNamespace.cpp │ │ │ ├── initModeNamespace.cpp │ │ │ ├── initOpcodesNamespace.cpp │ │ │ ├── initOperandNamespace.cpp │ │ │ ├── initPrefixesNamespace.cpp │ │ │ ├── initRegNamespace.cpp │ │ │ ├── initShiftsNamespace.cpp │ │ │ ├── initSolverNamespace.cpp │ │ │ ├── initSolverStateNamespace.cpp │ │ │ ├── initStubsNamespace.cpp │ │ │ ├── initSymbolicNamespace.cpp │ │ │ ├── initVASNamespace.cpp │ │ │ └── initVersionNamespace.cpp │ │ │ ├── objects │ │ │ ├── pyAstContext.cpp │ │ │ ├── pyAstNode.cpp │ │ │ ├── pyBasicBlock.cpp │ │ │ ├── pyBitsVector.cpp │ │ │ ├── pyImmediate.cpp │ │ │ ├── pyInstruction.cpp │ │ │ ├── pyMemoryAccess.cpp │ │ │ ├── pyPathConstraint.cpp │ │ │ ├── pyRegister.cpp │ │ │ ├── pySolverModel.cpp │ │ │ ├── pySymbolicExpression.cpp │ │ │ ├── pySymbolicVariable.cpp │ │ │ └── pyTritonContext.cpp │ │ │ ├── pyXFunctions.cpp │ │ │ └── utils.cpp │ ├── callbacks │ │ └── callbacks.cpp │ ├── context │ │ └── context.cpp │ ├── engines │ │ ├── lifters │ │ │ ├── liftingToDot.cpp │ │ │ ├── liftingToLLVM.cpp │ │ │ ├── liftingToPython.cpp │ │ │ └── liftingToSMT.cpp │ │ ├── solver │ │ │ ├── bitwuzla │ │ │ │ └── bitwuzlaSolver.cpp │ │ │ ├── solverEngine.cpp │ │ │ ├── solverModel.cpp │ │ │ └── z3 │ │ │ │ └── z3Solver.cpp │ │ ├── symbolic │ │ │ ├── pathConstraint.cpp │ │ │ ├── pathManager.cpp │ │ │ ├── symbolicEngine.cpp │ │ │ ├── symbolicExpression.cpp │ │ │ ├── symbolicSimplification.cpp │ │ │ └── symbolicVariable.cpp │ │ ├── synthesis │ │ │ ├── oracleTable.cpp │ │ │ ├── synthesisResult.cpp │ │ │ └── synthesizer.cpp │ │ └── taint │ │ │ └── taintEngine.cpp │ ├── includes │ │ └── triton │ │ │ ├── aarch64.spec │ │ │ ├── aarch64Cpu.hpp │ │ │ ├── aarch64Semantics.hpp │ │ │ ├── aarch64Specifications.hpp │ │ │ ├── archEnums.hpp │ │ │ ├── architecture.hpp │ │ │ ├── arm32.spec │ │ │ ├── arm32Cpu.hpp │ │ │ ├── arm32Semantics.hpp │ │ │ ├── arm32Specifications.hpp │ │ │ ├── armOperandProperties.hpp │ │ │ ├── ast.hpp │ │ │ ├── astContext.hpp │ │ │ ├── astEnums.hpp │ │ │ ├── astPcodeRepresentation.hpp │ │ │ ├── astPythonRepresentation.hpp │ │ │ ├── astRepresentation.hpp │ │ │ ├── astRepresentationInterface.hpp │ │ │ ├── astSmtRepresentation.hpp │ │ │ ├── basicBlock.hpp │ │ │ ├── bitsVector.hpp │ │ │ ├── bitwuzlaSolver.hpp │ │ │ ├── callbacks.hpp │ │ │ ├── callbacksEnums.hpp │ │ │ ├── comparableFunctor.hpp │ │ │ ├── config.hpp.in │ │ │ ├── context.hpp │ │ │ ├── coreUtils.hpp │ │ │ ├── cpuInterface.hpp │ │ │ ├── cpuSize.hpp │ │ │ ├── dllexport.hpp │ │ │ ├── exceptions.hpp │ │ │ ├── externalLibs.hpp │ │ │ ├── immediate.hpp │ │ │ ├── instruction.hpp │ │ │ ├── irBuilder.hpp │ │ │ ├── liftingEngine.hpp │ │ │ ├── liftingToDot.hpp │ │ │ ├── liftingToLLVM.hpp │ │ │ ├── liftingToPython.hpp │ │ │ ├── liftingToSMT.hpp │ │ │ ├── llvmToTriton.hpp │ │ │ ├── memoryAccess.hpp │ │ │ ├── modes.hpp │ │ │ ├── modesEnums.hpp │ │ │ ├── operandWrapper.hpp │ │ │ ├── oracleEntry.hpp │ │ │ ├── pathConstraint.hpp │ │ │ ├── pathManager.hpp │ │ │ ├── py3c_compat.h │ │ │ ├── pythonBindings.hpp │ │ │ ├── pythonObjects.hpp │ │ │ ├── pythonUtils.hpp │ │ │ ├── pythonXFunctions.hpp │ │ │ ├── register.hpp │ │ │ ├── riscv32.spec │ │ │ ├── riscv32Cpu.hpp │ │ │ ├── riscv64.spec │ │ │ ├── riscv64Cpu.hpp │ │ │ ├── riscvSemantics.hpp │ │ │ ├── riscvSpecifications.hpp │ │ │ ├── semanticsInterface.hpp │ │ │ ├── shortcutRegister.hpp │ │ │ ├── softfloat.hpp │ │ │ ├── solverEngine.hpp │ │ │ ├── solverEnums.hpp │ │ │ ├── solverInterface.hpp │ │ │ ├── solverModel.hpp │ │ │ ├── stubs.hpp │ │ │ ├── symbolicEngine.hpp │ │ │ ├── symbolicEnums.hpp │ │ │ ├── symbolicExpression.hpp │ │ │ ├── symbolicSimplification.hpp │ │ │ ├── symbolicVariable.hpp │ │ │ ├── synthesisResult.hpp │ │ │ ├── synthesizer.hpp │ │ │ ├── taintEngine.hpp │ │ │ ├── tritonToBitwuzla.hpp │ │ │ ├── tritonToLLVM.hpp │ │ │ ├── tritonToZ3.hpp │ │ │ ├── tritonTypes.hpp │ │ │ ├── uintwide_t.h │ │ │ ├── version.hpp.in │ │ │ ├── x86.spec │ │ │ ├── x8664Cpu.hpp │ │ │ ├── x86Cpu.hpp │ │ │ ├── x86Semantics.hpp │ │ │ ├── x86Specifications.hpp │ │ │ ├── z3Solver.hpp │ │ │ └── z3ToTriton.hpp │ ├── modes │ │ └── modes.cpp │ ├── stubs │ │ ├── aarch64-libc.cpp │ │ ├── i386-systemv-libc.cpp │ │ ├── x8664-ms-libc.cpp │ │ └── x8664-systemv-libc.cpp │ └── utils │ │ ├── coreUtils.cpp │ │ └── softfloat.cpp ├── misc │ ├── aarch64 │ │ ├── crackme_hash │ │ ├── crackme_hash.c │ │ ├── crackme_xor │ │ └── crackme_xor.c │ ├── ir_test_suite │ │ ├── ir │ │ ├── ir.c │ │ └── qemu-test-x86_64 │ └── smt │ │ ├── af.smt2 │ │ ├── array.smt2 │ │ ├── cmp.smt2 │ │ ├── firstCharTest.smt2 │ │ ├── jbe.smt2 │ │ ├── jle.smt2 │ │ ├── jnbe.smt2 │ │ ├── jnle.smt2 │ │ ├── of.smt2 │ │ ├── pf.smt2 │ │ └── sf.smt2 ├── scripts │ ├── docker │ │ ├── Dockerfile │ │ ├── build-docker-image.sh │ │ └── build-wheel-linux.sh │ ├── gen_oracle_table.py │ └── macos │ │ └── delocate-wheel-custom.py ├── stubs │ ├── Makefile │ ├── gen_symbols_vector.py │ └── triton-stubs.c └── testers │ ├── CMakeLists.txt │ ├── aarch64 │ └── unicorn_test_aarch64.py │ ├── arm32 │ ├── crypto_test │ │ ├── bin │ │ │ ├── crypto_test-nothumb-O0.bin │ │ │ ├── crypto_test-nothumb-O1.bin │ │ │ ├── crypto_test-nothumb-O2.bin │ │ │ ├── crypto_test-nothumb-O3.bin │ │ │ ├── crypto_test-nothumb-Os.bin │ │ │ ├── crypto_test-nothumb-Oz.bin │ │ │ ├── crypto_test-thumb-O0.bin │ │ │ ├── crypto_test-thumb-O1.bin │ │ │ ├── crypto_test-thumb-O2.bin │ │ │ ├── crypto_test-thumb-O3.bin │ │ │ ├── crypto_test-thumb-Os.bin │ │ │ └── crypto_test-thumb-Oz.bin │ │ ├── crypto_test-nothumb-O0-run.py │ │ ├── crypto_test-nothumb-O1-run.py │ │ ├── crypto_test-nothumb-O2-run.py │ │ ├── crypto_test-nothumb-O3-run.py │ │ ├── crypto_test-nothumb-Os-run.py │ │ ├── crypto_test-nothumb-Oz-run.py │ │ ├── crypto_test-thumb-O0-run.py │ │ ├── crypto_test-thumb-O1-run.py │ │ ├── crypto_test-thumb-O2-run.py │ │ ├── crypto_test-thumb-O3-run.py │ │ ├── crypto_test-thumb-Os-run.py │ │ └── crypto_test-thumb-Oz-run.py │ ├── unicorn_test_arm32_branch_arm_1.py │ ├── unicorn_test_arm32_branch_arm_2.py │ ├── unicorn_test_arm32_branch_pc_arm_1.py │ ├── unicorn_test_arm32_branch_pc_arm_2.py │ ├── unicorn_test_arm32_branch_thumb_1.py │ ├── unicorn_test_arm32_branch_thumb_2.py │ ├── unicorn_test_arm32_branch_thumb_3.py │ ├── unicorn_test_arm32_branch_thumb_4.py │ ├── unicorn_test_arm32_data_arm.py │ ├── unicorn_test_arm32_data_thumb.py │ ├── unicorn_test_arm32_interworking_arm_1.py │ ├── unicorn_test_arm32_interworking_arm_2.py │ ├── unicorn_test_arm32_interworking_thumb.py │ ├── unicorn_test_arm32_it_thumb.py │ ├── unicorn_test_arm32_loadstore_arm_1.py │ ├── unicorn_test_arm32_loadstore_arm_2.py │ ├── unicorn_test_arm32_loadstore_arm_3.py │ ├── unicorn_test_arm32_loadstore_arm_4.py │ ├── unicorn_test_arm32_loadstore_arm_5.py │ ├── unicorn_test_arm32_loadstore_thumb_1.py │ ├── unicorn_test_arm32_loadstore_thumb_2.py │ ├── unicorn_test_arm32_loadstore_thumb_3.py │ └── unicorn_test_arm32_loadstore_thumb_5.py │ ├── riscv │ ├── unicorn_test_riscv32.py │ └── unicorn_test_riscv64.py │ ├── unittests │ ├── misc │ │ ├── defcamp-2015-r100.bin │ │ ├── emu_1.dump │ │ ├── ir-test-suite.bin │ │ ├── md5 │ │ │ ├── md5-aarch64 │ │ │ ├── md5-arm32 │ │ │ ├── md5-x64 │ │ │ ├── md5-x86 │ │ │ └── md5.c │ │ └── qemu │ │ │ ├── ir-test-suite-qemu-light.bin │ │ │ ├── ir-test-suite-qemu.bin │ │ │ ├── test-i386-muldiv.h │ │ │ ├── test-i386-shift.h │ │ │ ├── test-i386.c │ │ │ └── test-i386.h │ ├── test_arch.py │ ├── test_ast_conversion.py │ ├── test_ast_deep.py │ ├── test_ast_duplication.py │ ├── test_ast_eval.py │ ├── test_ast_reference.py │ ├── test_ast_representation.py │ ├── test_ast_simplification.py │ ├── test_ast_utils.py │ ├── test_bitvector.py │ ├── test_callback.py │ ├── test_concrete_value.py │ ├── test_dead_store_elimination.py │ ├── test_disass.py │ ├── test_doc.py │ ├── test_emulation.py │ ├── test_examples.py │ ├── test_exclusive_memory_access.py │ ├── test_execCallbacks.py │ ├── test_flags.py │ ├── test_github_issues.py │ ├── test_im_callback.py │ ├── test_immediate.py │ ├── test_immutable_registers.py │ ├── test_instruction.py │ ├── test_memory.py │ ├── test_only_symbolized_mode.py │ ├── test_only_tainted_mode.py │ ├── test_path_constraint.py │ ├── test_registers.py │ ├── test_semantics.py │ ├── test_simulation.py │ ├── test_smt_array.py │ ├── test_solver.py │ ├── test_stubs.py │ ├── test_symbolic.py │ ├── test_symbolic_array.py │ ├── test_symbolic_expression.py │ ├── test_symbolic_optimizations.py │ ├── test_symbolic_variable.py │ ├── test_synthesizer.py │ ├── test_taint.py │ ├── test_undefined_registers.py │ └── utils.py │ └── x86 │ └── unicorn_test_x86.py ├── vcpkg.json └── vcpkg └── triplets ├── x64-linux-release.cmake ├── x64-osx-release.cmake └── x64-windows-static-release-md.cmake /.build_number: -------------------------------------------------------------------------------- 1 | 1597 2 | -------------------------------------------------------------------------------- /.codecov.yml: -------------------------------------------------------------------------------- 1 | coverage: 2 | range: 70..90 3 | round: nearest 4 | precision: 2 5 | 6 | ignore: 7 | - "**/examples/cpp" # ignore folders and all its contents 8 | - "**/*.spec" # glob accepted 9 | 10 | comment: false 11 | -------------------------------------------------------------------------------- /.editorconfig: -------------------------------------------------------------------------------- 1 | root = true 2 | # C++ 3 | [*.{h,hpp,c,cpp}] 4 | indent_style = space 5 | indent_size = tab 6 | tab_width = 2 7 | -------------------------------------------------------------------------------- /.github/workflows/codecov.yml: -------------------------------------------------------------------------------- 1 | name: Test the code coverage 2 | 3 | on: [push, pull_request, workflow_dispatch] 4 | 5 | jobs: 6 | build: 7 | runs-on: ubuntu-latest 8 | strategy: 9 | matrix: 10 | python-version: [3.11] 11 | steps: 12 | - name: Checkout 13 | uses: actions/checkout@v4 14 | 15 | - name: Set up Python ${{ matrix.python-version }} 16 | uses: actions/setup-python@v5 17 | with: 18 | python-version: ${{ matrix.python-version }} 19 | 20 | - name: Upgrade pip version 21 | run: | 22 | python -m pip install -U pip 23 | 24 | - name: Install dependencies 25 | run: | 26 | sudo apt-get install python3-setuptools lcov libboost-dev libgmp-dev 27 | 28 | - name: Install LLVM and Clang 29 | uses: KyleMayes/install-llvm-action@v2 30 | with: 31 | version: "14.0" 32 | directory: ${{ runner.temp }}/llvm 33 | 34 | - name: Install Z3 35 | run: | 36 | sudo apt-get install libz3-dev 37 | python -m pip install z3-solver 38 | python -m pip install importlib-resources 39 | 40 | - name: Install Ninja 41 | run: | 42 | sudo apt-get install ninja-build 43 | 44 | - name: Install Meson 45 | run: | 46 | python -m pip install meson 47 | 48 | - name: Install Bitwuzla 49 | run: | 50 | git clone https://github.com/bitwuzla/bitwuzla.git 51 | cd bitwuzla 52 | git checkout -b 0.7.0 0.7.0 53 | python ./configure.py --shared 54 | cd build 55 | sudo ninja install 56 | sudo ldconfig 57 | cd .. 58 | 59 | - name: Install Capstone 60 | run: | 61 | wget https://github.com/aquynh/capstone/archive/5.0.3.tar.gz 62 | tar -xf ./5.0.3.tar.gz 63 | cd ./capstone-5.0.3 64 | bash ./make.sh 65 | sudo make install 66 | cd ../ 67 | 68 | - name: Install Unicorn 69 | run: | 70 | python -m pip install unicorn 71 | 72 | - name: Install LIEF 73 | run: | 74 | python -m pip install lief 75 | 76 | - name: Compile Triton 77 | run: | 78 | mkdir ./build 79 | cd ./build 80 | cmake -DGCOV=on -DZ3_INTERFACE=on -DBITWUZLA_INTERFACE=on -DBITWUZLA_INCLUDE_DIRS=/usr/local/include -DBITWUZLA_LIBRARIES=/usr/local/lib/x86_64-linux-gnu/libbitwuzla.so -DLLVM_INTERFACE=on -DCMAKE_PREFIX_PATH=${{env.LLVM_PATH}} .. 81 | sudo make -j3 install 82 | 83 | - name: Unittests 84 | run: | 85 | make -C build check 86 | bash <(curl -s https://codecov.io/bash) || echo "Codecov did not collect coverage reports" 87 | -------------------------------------------------------------------------------- /.github/workflows/docker.yml: -------------------------------------------------------------------------------- 1 | name: Docker Image CI 2 | 3 | on: [push, pull_request, workflow_dispatch] 4 | 5 | jobs: 6 | build: 7 | runs-on: ubuntu-latest 8 | steps: 9 | - uses: actions/checkout@v4 10 | - name: Set Timestamp Variable 11 | run: echo "TIMESTAMP=$(date +%s)" >> $GITHUB_ENV 12 | - name: Build the Docker image 13 | run: docker build . --file Dockerfile --tag triton-docker:$TIMESTAMP 14 | - name: Run test cases 15 | run: docker run --entrypoint /bin/bash --rm triton-docker:$TIMESTAMP -c 'ctest --test-dir /tmp/triton-build/ --output-on-failure' -------------------------------------------------------------------------------- /.github/workflows/linux.yml: -------------------------------------------------------------------------------- 1 | name: Tests on Linux 2 | 3 | on: [push, pull_request, workflow_dispatch] 4 | 5 | jobs: 6 | build: 7 | runs-on: ubuntu-latest 8 | strategy: 9 | matrix: 10 | python-version: ['3.9', '3.10', '3.11', '3.12', '3.13'] 11 | boost-interface: ['ON', 'OFF'] 12 | capstone-version: ['5.0.3'] 13 | steps: 14 | - name: Checkout 15 | uses: actions/checkout@v4 16 | 17 | - name: Set up Python ${{ matrix.python-version }} 18 | uses: actions/setup-python@v5 19 | with: 20 | python-version: ${{ matrix.python-version }} 21 | 22 | - name: Upgrade pip version 23 | run: | 24 | python -m pip install -U pip 25 | python -m pip install setuptools 26 | 27 | - name: Install dependencies 28 | run: | 29 | sudo apt-get install python3-setuptools libboost-dev libgmp-dev 30 | 31 | - name: Install LLVM and Clang 32 | uses: KyleMayes/install-llvm-action@v2 33 | with: 34 | version: "14.0" 35 | directory: ${{ runner.temp }}/llvm 36 | 37 | - name: Install Z3 38 | run: | 39 | sudo apt-get install libz3-dev 40 | python -m pip install z3-solver 41 | python -m pip install importlib-resources 42 | 43 | - name: Install Ninja 44 | run: | 45 | sudo apt-get install ninja-build 46 | 47 | - name: Install Meson 48 | run: | 49 | python -m pip install meson 50 | 51 | - name: Install Bitwuzla 52 | run: | 53 | git clone https://github.com/bitwuzla/bitwuzla.git 54 | cd bitwuzla 55 | git checkout -b 0.7.0 0.7.0 56 | python ./configure.py --shared 57 | cd build 58 | sudo ninja install 59 | sudo ldconfig 60 | cd .. 61 | 62 | - name: Install Capstone 63 | run: | 64 | wget https://github.com/aquynh/capstone/archive/${{ matrix.capstone-version }}.tar.gz 65 | tar -xf ./${{ matrix.capstone-version }}.tar.gz 66 | cd ./capstone-${{ matrix.capstone-version }} 67 | bash ./make.sh 68 | sudo make install 69 | cd ../ 70 | 71 | - name: Install Unicorn 72 | run: | 73 | python -m pip install unicorn 74 | 75 | - name: Install LIEF 76 | run: | 77 | python -m pip install lief 78 | 79 | - name: Compile Triton 80 | run: | 81 | mkdir ./build 82 | cd ./build 83 | cmake -DZ3_INTERFACE=ON -DBITWUZLA_INTERFACE=ON -DBITWUZLA_INCLUDE_DIRS=/usr/local/include -DBITWUZLA_LIBRARIES=/usr/local/lib/x86_64-linux-gnu/libbitwuzla.so -DLLVM_INTERFACE=ON -DCMAKE_PREFIX_PATH=${{env.LLVM_PATH}} -DBOOST_INTERFACE=${{ matrix.boost-interface }} .. 84 | sudo make -j3 install 85 | 86 | - name: Unittests 87 | run: | 88 | ctest --test-dir build --output-on-failure 89 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *.db 2 | *.i64 3 | *.id0 4 | *.id1 5 | *.id2 6 | *.nam 7 | *.o 8 | *.pyc 9 | *.swp 10 | *.til 11 | .DS_Store 12 | .gdb_history 13 | CMakeLists.txt.user 14 | CMakeUserPresets.json 15 | build*/* 16 | peda-session* 17 | pin.log 18 | pintool.log 19 | private/* 20 | *.so 21 | .cache 22 | .vscode 23 | .venv 24 | dist/ 25 | *.egg-info/ 26 | wheelhouse/ 27 | -------------------------------------------------------------------------------- /CMakeModules/FindBITWUZLA.cmake: -------------------------------------------------------------------------------- 1 | # - Try to find BITWUZLA 2 | # Once done, this will define 3 | # 4 | # BITWUZLA_FOUND - system has BITWUZLA 5 | # BITWUZLA_INCLUDE_DIRS - the BITWUZLA include directories 6 | # BITWUZLA_LIBRARIES - link these to use BITWUZLA 7 | 8 | include(LibFindMacros) 9 | 10 | # Dependencies 11 | # libfind_package(BITWUZLA bitwuzla) 12 | 13 | # Use pkg-config to get hints about paths 14 | # libfind_pkg_check_modules(BITWUZLA_PKGCONF bitwuzla) 15 | 16 | if(NOT BITWUZLA_INCLUDE_DIRS) 17 | set(BITWUZLA_INCLUDE_DIRS "$ENV{BITWUZLA_INCLUDE_DIRS}") 18 | endif() 19 | 20 | if(NOT BITWUZLA_LIBRARIES) 21 | set(BITWUZLA_LIBRARIES "$ENV{BITWUZLA_LIBRARIES}") 22 | endif() 23 | 24 | if(NOT BITWUZLA_INCLUDE_DIRS AND NOT BITWUZLA_LIBRARIES) 25 | find_path(BITWUZLA_INCLUDE_DIR 26 | NAMES bitwuzla/bitwuzla.h bitwuzla/cpp/bitwuzla.h 27 | PATHS ${BITWUZLA_PKGCONF_INCLUDE_DIRS} 28 | ) 29 | 30 | find_library(BITWUZLA_LIBRARY 31 | NAMES bitwuzla 32 | PATHS ${BITWUZLA_PKGCONF_LIBRARY_DIRS} 33 | ) 34 | 35 | # Set the include dir variables and the libraries and let libfind_process do the rest. 36 | # NOTE: Singular variables for this library, plural for libraries this this lib depends on. 37 | set(BITWUZLA_PROCESS_INCLUDES BITWUZLA_INCLUDE_DIR BITWUZLA_INCLUDE_DIRS) 38 | set(BITWUZLA_PROCESS_LIBS BITWUZLA_LIBRARY BITWUZLA_LIBRARIES) 39 | 40 | libfind_process(BITWUZLA) 41 | 42 | if(NOT BITWUZLA_FOUND) 43 | message(FATAL_ERROR "Bitwuzla not found") 44 | else() 45 | cmake_path(GET BITWUZLA_LIBRARY PARENT_PATH BITWUZLA_LIB_DIR) 46 | cmake_path(GET BITWUZLA_LIBRARY STEM LAST_ONLY BITWUZLA_LIB_NAME) 47 | string(REGEX REPLACE "^lib" "" BITWUZLA_LIB_NAME ${BITWUZLA_LIB_NAME}) 48 | endif() 49 | else() 50 | message(STATUS "Bitwuzla includes directory defined: ${BITWUZLA_INCLUDE_DIRS}") 51 | message(STATUS "Bitwuzla libraries defined: ${BITWUZLA_LIBRARIES}") 52 | endif() 53 | -------------------------------------------------------------------------------- /CMakeModules/FindCAPSTONE.cmake: -------------------------------------------------------------------------------- 1 | # - Try to find CAPSTONE 2 | # Once done, this will define 3 | # 4 | # CAPSTONE_FOUND - system has CAPSTONE 5 | # CAPSTONE_VERSION - the CAPSTONE version 6 | # CAPSTONE_INCLUDE_DIRS - the CAPSTONE include directories 7 | # CAPSTONE_LIBRARIES - link these to use CAPSTONE 8 | 9 | include(LibFindMacros) 10 | 11 | # Dependencies 12 | # libfind_package(CAPSTONE capstone) 13 | 14 | # Use pkg-config to get hints about paths 15 | # libfind_pkg_check_modules(CAPSTONE_PKGCONF capstone) 16 | 17 | if(NOT CAPSTONE_INCLUDE_DIRS) 18 | set(CAPSTONE_INCLUDE_DIRS "$ENV{CAPSTONE_INCLUDE_DIRS}") 19 | endif() 20 | 21 | if(NOT CAPSTONE_LIBRARIES) 22 | set(CAPSTONE_LIBRARIES "$ENV{CAPSTONE_LIBRARIES}") 23 | endif() 24 | 25 | if(NOT CAPSTONE_INCLUDE_DIRS AND NOT CAPSTONE_LIBRARIES) 26 | find_path(CAPSTONE_INCLUDE_DIR 27 | NAMES 28 | capstone.h 29 | capstone/capstone.h 30 | PATHS ${CAPSTONE_PKGCONF_INCLUDE_DIRS} 31 | ) 32 | 33 | find_library(CAPSTONE_LIBRARY 34 | NAMES capstone 35 | PATHS ${CAPSTONE_PKGCONF_LIBRARY_DIRS} 36 | ) 37 | 38 | # Set the include dir variables and the libraries and let libfind_process do the rest. 39 | # NOTE: Singular variables for this library, plural for libraries this this lib depends on. 40 | set(CAPSTONE_PROCESS_INCLUDES CAPSTONE_INCLUDE_DIR CAPSTONE_INCLUDE_DIRS) 41 | set(CAPSTONE_PROCESS_LIBS CAPSTONE_LIBRARY CAPSTONE_LIBRARIES) 42 | 43 | libfind_process(CAPSTONE) 44 | 45 | if(NOT CAPSTONE_FOUND) 46 | message(FATAL_ERROR "Capstone not found") 47 | else() 48 | cmake_path(GET CAPSTONE_LIBRARY PARENT_PATH CAPSTONE_LIB_DIR) 49 | cmake_path(GET CAPSTONE_LIBRARY STEM LAST_ONLY CAPSTONE_LIB_NAME) 50 | string(REGEX REPLACE "^lib" "" CAPSTONE_LIB_NAME ${CAPSTONE_LIB_NAME}) 51 | endif() 52 | else() 53 | message(STATUS "Capstone includes directory defined: ${CAPSTONE_INCLUDE_DIRS}") 54 | message(STATUS "Capstone libraries defined: ${CAPSTONE_LIBRARIES}") 55 | endif() 56 | 57 | find_file(CAPSTONE_VERSION_HEADER 58 | NAMES 59 | capstone.h 60 | capstone/capstone.h 61 | PATHS ${CAPSTONE_INCLUDE_DIRS} 62 | REQUIRED 63 | ) 64 | 65 | file(READ "${CAPSTONE_VERSION_HEADER}" CAPSTONE_VERSION_HEADER_CONTENT) 66 | string(REGEX MATCH "CS_API_MAJOR +([0-9]+)" _ ${CAPSTONE_VERSION_HEADER_CONTENT}) 67 | set(CS_VERSION_MAJOR ${CMAKE_MATCH_1}) 68 | string(REGEX MATCH "CS_API_MINOR +([0-9]+)" _ ${CAPSTONE_VERSION_HEADER_CONTENT}) 69 | set(CS_VERSION_MINOR ${CMAKE_MATCH_1}) 70 | string(REGEX MATCH "CS_VERSION_EXTRA +([0-9]+)" _ ${CAPSTONE_VERSION_HEADER_CONTENT}) 71 | set(CS_VERSION_EXTRA ${CMAKE_MATCH_1}) 72 | set(CAPSTONE_VERSION "${CS_VERSION_MAJOR}.${CS_VERSION_MINOR}.${CS_VERSION_EXTRA}") 73 | -------------------------------------------------------------------------------- /CMakeModules/FindZ3.cmake: -------------------------------------------------------------------------------- 1 | # - Try to find Z3 2 | # Once done, this will define 3 | # 4 | # Z3_FOUND - system has Z3 5 | # Z3_VERSION - the Z3 version 6 | # Z3_INCLUDE_DIRS - the Z3 include directories 7 | # Z3_LIBRARIES - link these to use Z3 8 | 9 | include(LibFindMacros) 10 | 11 | # Dependencies 12 | # libfind_package(Z3 z3) 13 | 14 | # Use pkg-config to get hints about paths 15 | # libfind_pkg_check_modules(Z3_PKGCONF z3) 16 | 17 | if(NOT Z3_INCLUDE_DIRS) 18 | set(Z3_INCLUDE_DIRS "$ENV{Z3_INCLUDE_DIRS}") 19 | endif() 20 | 21 | if(NOT Z3_LIBRARIES) 22 | set(Z3_LIBRARIES "$ENV{Z3_LIBRARIES}") 23 | endif() 24 | 25 | if(NOT Z3_INCLUDE_DIRS AND NOT Z3_LIBRARIES) 26 | find_path(Z3_INCLUDE_DIR 27 | NAMES z3.h 28 | PATHS ${Z3_PKGCONF_INCLUDE_DIRS} 29 | ) 30 | 31 | find_library(Z3_LIBRARY 32 | NAMES z3 libz3 33 | PATHS ${Z3_PKGCONF_LIBRARY_DIRS} 34 | ) 35 | 36 | # Set the include dir variables and the libraries and let libfind_process do the rest. 37 | # NOTE: Singular variables for this library, plural for libraries this this lib depends on. 38 | set(Z3_PROCESS_INCLUDES Z3_INCLUDE_DIR Z3_INCLUDE_DIRS) 39 | set(Z3_PROCESS_LIBS Z3_LIBRARY Z3_LIBRARIES) 40 | 41 | libfind_process(Z3) 42 | 43 | if(NOT Z3_FOUND) 44 | message(FATAL_ERROR "Z3 not found") 45 | else() 46 | cmake_path(GET Z3_LIBRARY PARENT_PATH Z3_LIB_DIR) 47 | cmake_path(GET Z3_LIBRARY STEM LAST_ONLY Z3_LIB_NAME) 48 | string(REGEX REPLACE "^lib" "" Z3_LIB_NAME ${Z3_LIB_NAME}) 49 | endif() 50 | else() 51 | message(STATUS "Z3 includes directory defined: ${Z3_INCLUDE_DIRS}") 52 | message(STATUS "Z3 libraries defined: ${Z3_LIBRARIES}") 53 | endif() 54 | 55 | find_file(Z3_VERSION_HEADER 56 | z3_version.h 57 | PATHS ${Z3_INCLUDE_DIRS} 58 | REQUIRED 59 | ) 60 | 61 | file(READ "${Z3_VERSION_HEADER}" Z3_VERSION_HEADER_CONTENT) 62 | string(REGEX MATCH "Z3_MAJOR_VERSION +([0-9]+)" _ ${Z3_VERSION_HEADER_CONTENT}) 63 | set(Z3_MAJOR_VERSION ${CMAKE_MATCH_1}) 64 | string(REGEX MATCH "Z3_MINOR_VERSION +([0-9]+)" _ ${Z3_VERSION_HEADER_CONTENT}) 65 | set(Z3_MINOR_VERSION ${CMAKE_MATCH_1}) 66 | string(REGEX MATCH "Z3_BUILD_NUMBER +([0-9]+)" _ ${Z3_VERSION_HEADER_CONTENT}) 67 | set(Z3_BUILD_NUMBER ${CMAKE_MATCH_1}) 68 | string(REGEX MATCH "Z3_REVISION_NUMBER +([0-9]+)" _ ${Z3_VERSION_HEADER_CONTENT}) 69 | set(Z3_REVISION_NUMBER ${CMAKE_MATCH_1}) 70 | set(Z3_VERSION "${Z3_MAJOR_VERSION}.${Z3_MINOR_VERSION}.${Z3_BUILD_NUMBER}.${Z3_REVISION_NUMBER}") 71 | -------------------------------------------------------------------------------- /doc/autocomplete/.gitignore: -------------------------------------------------------------------------------- 1 | triton_autocomplete 2 | .mypy_cache -------------------------------------------------------------------------------- /doc/autocomplete/example.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | # The triton_autocomplete module has been replaced with a .pyi stub file 3 | # which is automatically installed when using a precompiled Triton package 4 | # IDEs should detect it and provide autocomplete without any extra imports 5 | from triton import * 6 | 7 | 8 | ctx = TritonContext() 9 | # Set the arch 10 | ctx.setArchitecture(ARCH.X86) 11 | 12 | inst = Instruction() 13 | inst.setAddress(0x40000) 14 | inst.setOpcode(b"\x89\xd0") # mov eax, edx 15 | ctx.processing(inst) 16 | print(inst) 17 | -------------------------------------------------------------------------------- /doc/autocomplete/function.py: -------------------------------------------------------------------------------- 1 | try: 2 | from typing import Dict, List, Set 3 | except ImportError: 4 | pass 5 | 6 | template = ''' 7 | def {fname}({arg_names}): 8 | # type: ({arg_types}) -> {ret_type} 9 | """{doc_str}""" 10 | pass 11 | ''' 12 | 13 | class Function(): 14 | 15 | def __init__(self, name, args, ret_type, doc_str=''): 16 | # type: (str, Dict[str, str], str, str) -> None 17 | self.name = name 18 | self.arg_types = [{t} for t in args.values()] 19 | self.arg_names = [{n} for n in args.keys()] 20 | self.ret_type = ret_type 21 | self.doc_str = doc_str 22 | self.overloaded_args = [] 23 | 24 | def add_overload(self, other): 25 | assert(self.name == other.name) 26 | 27 | # we have fewer args than the other overload and need to expand them 28 | if len(self.arg_names) < len(other.arg_names): 29 | for i in range(len(self.arg_names), len(other.arg_names)): 30 | self.arg_names.append(set()) 31 | self.arg_types.append(set()) 32 | 33 | # create unions of the names and types 34 | for i in range(len(other.arg_names)): 35 | self.arg_names[i] |= other.arg_names[i] 36 | self.arg_types[i] |= other.arg_types[i] 37 | 38 | def __str__(self): 39 | # type: () -> str 40 | 41 | def handle_default_initializer(full_names): 42 | # type: (Set[str]) -> List[str] 43 | names = list(full_names) 44 | for i in range(len(names) - 1): 45 | # remove the default parameter for every arg except the last one 46 | if '=' in names[i]: 47 | names[i] = names[i][:names[i].find('=')] 48 | 49 | return names 50 | 51 | arg_names = ', '.join(['self'] + ['_'.join(handle_default_initializer(names)) for names in self.arg_names]) 52 | arg_types = 'Self' 53 | if len(self.arg_types) != 1 or len(self.arg_types[0]) > 1 or list(self.arg_types[0])[0] != 'None': 54 | arg_types = ', '.join(['Self'] + [' | '.join(types) for types in self.arg_types]) 55 | func_str = template.format( 56 | fname=self.name, 57 | ret_type=self.ret_type, 58 | arg_names=arg_names, 59 | arg_types=arg_types, 60 | doc_str=self.doc_str) 61 | return func_str 62 | -------------------------------------------------------------------------------- /doc/figures/figure.1.1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/doc/figures/figure.1.1.png -------------------------------------------------------------------------------- /doc/figures/figure.1.10.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/doc/figures/figure.1.10.png -------------------------------------------------------------------------------- /doc/figures/figure.1.11.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/doc/figures/figure.1.11.png -------------------------------------------------------------------------------- /doc/figures/figure.1.19.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/doc/figures/figure.1.19.png -------------------------------------------------------------------------------- /doc/figures/figure.1.20.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/doc/figures/figure.1.20.png -------------------------------------------------------------------------------- /doc/figures/figure.1.4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/doc/figures/figure.1.4.png -------------------------------------------------------------------------------- /doc/figures/figure.1.5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/doc/figures/figure.1.5.png -------------------------------------------------------------------------------- /doc/figures/figure.1.6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/doc/figures/figure.1.6.png -------------------------------------------------------------------------------- /doc/figures/figure.1.7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/doc/figures/figure.1.7.png -------------------------------------------------------------------------------- /doc/figures/figure.1.8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/doc/figures/figure.1.8.png -------------------------------------------------------------------------------- /doc/figures/figure.1.9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/doc/figures/figure.1.9.png -------------------------------------------------------------------------------- /doc/footer.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 12 | 13 | 14 |
15 | $generatedby   16 | doxygen 17 | $doxygenversion 18 |
19 | 20 | 21 | 22 | -------------------------------------------------------------------------------- /doc/header.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | $title 10 | $title 11 | 12 | 13 | 14 | $treeview 15 | $search 16 | $mathjax 17 | 18 | $extrastylesheet 19 | 20 | 21 |
22 | 23 | 24 |
25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 38 | 39 | 40 | 41 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 |
33 |
$projectname 34 |  $projectnumber 35 |
36 |
$projectbrief
37 | 		42 |
$projectbrief
43 | 		$searchbox
54 |
55 | 56 | 57 | -------------------------------------------------------------------------------- /publications/BAR2020-qsynth-robin-david.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/BAR2020-qsynth-robin-david.pdf -------------------------------------------------------------------------------- /publications/BHUSA2021-David-Greybox-Program-Synthesis.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/BHUSA2021-David-Greybox-Program-Synthesis.pdf -------------------------------------------------------------------------------- /publications/CESAR2021_robin-david-paper.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/CESAR2021_robin-david-paper.pdf -------------------------------------------------------------------------------- /publications/CESAR2021_robin-david-slide.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/CESAR2021_robin-david-slide.pdf -------------------------------------------------------------------------------- /publications/CSAW2016-SOS-Virtual-Machine-Deobfuscation-RThomas_JSalwan.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/CSAW2016-SOS-Virtual-Machine-Deobfuscation-RThomas_JSalwan.pdf -------------------------------------------------------------------------------- /publications/DIMVA2018-deobfuscation-salwan-bardin-potet.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/DIMVA2018-deobfuscation-salwan-bardin-potet.pdf -------------------------------------------------------------------------------- /publications/DIMVA2018-slide-deobfuscation-salwan-bardin-potet.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/DIMVA2018-slide-deobfuscation-salwan-bardin-potet.pdf -------------------------------------------------------------------------------- /publications/ISPOPEN2020-slide-sydr-vishnyakov.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/ISPOPEN2020-slide-sydr-vishnyakov.pdf -------------------------------------------------------------------------------- /publications/ISPOPEN2021-security-predicates-vishnyakov.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/ISPOPEN2021-security-predicates-vishnyakov.pdf -------------------------------------------------------------------------------- /publications/ISPOPEN2021-slide-security-predicates-vishnyakov.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/ISPOPEN2021-slide-security-predicates-vishnyakov.pdf -------------------------------------------------------------------------------- /publications/ISPOPEN2022-slide-sydr-fuzz-vishnyakov.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/ISPOPEN2022-slide-sydr-fuzz-vishnyakov.pdf -------------------------------------------------------------------------------- /publications/ISPOPEN2022-sydr-fuzz.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/ISPOPEN2022-sydr-fuzz.pdf -------------------------------------------------------------------------------- /publications/ISPRAS2020-sydr.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/ISPRAS2020-sydr.pdf -------------------------------------------------------------------------------- /publications/IVMEM2021-slide-symbolic-pointers-kuts.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/IVMEM2021-slide-symbolic-pointers-kuts.pdf -------------------------------------------------------------------------------- /publications/IVMEM2021-symbolic-pointers-kuts.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/IVMEM2021-symbolic-pointers-kuts.pdf -------------------------------------------------------------------------------- /publications/IVMEM2022-slide-strong-optimistic-parygina.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/IVMEM2022-slide-strong-optimistic-parygina.pdf -------------------------------------------------------------------------------- /publications/IVMEM2022-strong-optimistic-parygina.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/IVMEM2022-strong-optimistic-parygina.pdf -------------------------------------------------------------------------------- /publications/KLEE2022-robin-david.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/KLEE2022-robin-david.pdf -------------------------------------------------------------------------------- /publications/MISC-82_French_Paper_How_Triton_may_help_to_analyse_obfuscated_binaries_RThomas_JSalwan.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/MISC-82_French_Paper_How_Triton_may_help_to_analyse_obfuscated_binaries_RThomas_JSalwan.pdf -------------------------------------------------------------------------------- /publications/SSTIC2015_English_slide_detailed_version_Triton_Concolic_Execution_FrameWork_FSaudel_JSalwan.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/SSTIC2015_English_slide_detailed_version_Triton_Concolic_Execution_FrameWork_FSaudel_JSalwan.pdf -------------------------------------------------------------------------------- /publications/SSTIC2015_French_Paper_Triton_Framework_dexecution_Concolique_FSaudel_JSalwan.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/SSTIC2015_French_Paper_Triton_Framework_dexecution_Concolique_FSaudel_JSalwan.pdf -------------------------------------------------------------------------------- /publications/SSTIC2015_French_slide_light_version_Triton_Concolic_Execution_FrameWork_FSaudel_JSalwan.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/SSTIC2015_French_slide_light_version_Triton_Concolic_Execution_FrameWork_FSaudel_JSalwan.pdf -------------------------------------------------------------------------------- /publications/SSTIC2017-French-Article-desobfuscation_binaire_reconstruction_de_fonctions_virtualisees-salwan_potet_bardin.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/SSTIC2017-French-Article-desobfuscation_binaire_reconstruction_de_fonctions_virtualisees-salwan_potet_bardin.pdf -------------------------------------------------------------------------------- /publications/SSTIC2017_Deobfuscation_of_VM_based_software_protection.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/SSTIC2017_Deobfuscation_of_VM_based_software_protection.pdf -------------------------------------------------------------------------------- /publications/SecurityDay2015_dynamic_symbolic_execution_Jonathan_Salwan.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/SecurityDay2015_dynamic_symbolic_execution_Jonathan_Salwan.pdf -------------------------------------------------------------------------------- /publications/StHack2015_Dynamic_Behavior_Analysis_using_Binary_Instrumentation_Jonathan_Salwan.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/StHack2015_Dynamic_Behavior_Analysis_using_Binary_Instrumentation_Jonathan_Salwan.pdf -------------------------------------------------------------------------------- /publications/StHack2016_Dynamic_Binary_Analysis_and_Obfuscated_Codes_RThomas_JSalwan.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/publications/StHack2016_Dynamic_Binary_Analysis_and_Obfuscated_Codes_RThomas_JSalwan.pdf -------------------------------------------------------------------------------- /src/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | add_subdirectory(libtriton) 2 | 3 | if(BUILD_EXAMPLES) 4 | if(NOT ${CMAKE_SYSTEM_NAME} MATCHES "Windows") 5 | # Disable exemples for windows as linkage doesn't work. Exported function should 6 | # be marked as exported on windows. 7 | add_subdirectory(examples) 8 | else() 9 | enable_testing() 10 | add_test(DummyTest echo "Windows is awesome") 11 | endif() 12 | endif() 13 | 14 | if(ENABLE_TEST) 15 | add_subdirectory(testers) 16 | endif() 17 | -------------------------------------------------------------------------------- /src/examples/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | add_subdirectory(cpp) 2 | -------------------------------------------------------------------------------- /src/examples/cmake/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | # This is an example about how to compile Triton using its config file. 2 | cmake_minimum_required(VERSION 3.20) 3 | project(myproject) 4 | 5 | find_package(triton REQUIRED CONFIG) 6 | link_libraries(${TRITON_LIBRARIES}) 7 | 8 | add_executable(myproject 9 | myproject.cpp 10 | ) 11 | -------------------------------------------------------------------------------- /src/examples/cmake/myproject.cpp: -------------------------------------------------------------------------------- 1 | // This is an example about how to compile Triton using its config file. 2 | // See the CMakeLists.txt from this directory. 3 | 4 | #include 5 | #include 6 | 7 | int main(int ac, const char *av[]) { 8 | /* Triton's context */ 9 | triton::Context ctx = triton::Context(triton::arch::ARCH_X86_64); 10 | 11 | /* Symbolize rax */ 12 | ctx.symbolizeRegister(ctx.registers.x86_rax); 13 | 14 | /* Process an instruction (inc rax) */ 15 | triton::arch::Instruction inst = triton::arch::Instruction(0x40000, "\x48\xff\xc0", 3); 16 | ctx.processing(inst); 17 | 18 | /* Display instruction's expressions */ 19 | std::cout << inst << std::endl; 20 | for (const auto& se : inst.symbolicExpressions) { 21 | std::cout << " -> " << se << std::endl; 22 | } 23 | 24 | return 0; 25 | } 26 | -------------------------------------------------------------------------------- /src/examples/cpp/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | enable_testing() 2 | 3 | if(NOT BUILD_SHARED_LIBS) 4 | find_package(Threads REQUIRED) 5 | set(CMAKE_CXX_FLAGS -pthread) 6 | if (CMAKE_CXX_COMPILER_ID STREQUAL "GNU") 7 | set(CMAKE_EXE_LINKER_FLAGS "-static") 8 | endif() 9 | endif() 10 | 11 | add_executable(taint_reg taint_reg.cpp) 12 | set_property(TARGET taint_reg PROPERTY CXX_STANDARD 17) 13 | target_link_libraries(taint_reg triton) 14 | add_test(TaintRegister taint_reg) 15 | add_dependencies(check taint_reg) 16 | 17 | add_executable(info_reg info_reg.cpp) 18 | set_property(TARGET info_reg PROPERTY CXX_STANDARD 17) 19 | target_link_libraries(info_reg triton) 20 | add_test(InfoRegister info_reg) 21 | add_dependencies(check info_reg) 22 | 23 | add_executable(ir ir.cpp) 24 | set_property(TARGET ir PROPERTY CXX_STANDARD 17) 25 | target_link_libraries(ir triton) 26 | add_test(IR ir) 27 | add_dependencies(check ir) 28 | 29 | add_executable(simplification simplification.cpp) 30 | set_property(TARGET simplification PROPERTY CXX_STANDARD 17) 31 | target_link_libraries(simplification triton) 32 | add_test(Simplification simplification) 33 | add_dependencies(check simplification) 34 | 35 | add_executable(constraint constraint.cpp) 36 | set_property(TARGET constraint PROPERTY CXX_STANDARD 17) 37 | target_link_libraries(constraint triton) 38 | add_test(Constraint constraint) 39 | add_dependencies(check constraint) 40 | 41 | add_executable(ctest_api ctest_api.cpp) 42 | set_property(TARGET ctest_api PROPERTY CXX_STANDARD 17) 43 | target_link_libraries(ctest_api triton) 44 | add_test(TestAPI ctest_api) 45 | add_dependencies(check ctest_api) 46 | 47 | add_executable(block block.cpp) 48 | set_property(TARGET block PROPERTY CXX_STANDARD 17) 49 | target_link_libraries(block triton) 50 | add_test(TestBlock block) 51 | add_dependencies(check block) 52 | -------------------------------------------------------------------------------- /src/examples/cpp/block.cpp: -------------------------------------------------------------------------------- 1 | 2 | #include 3 | #include 4 | #include 5 | 6 | using namespace triton; 7 | using namespace triton::arch; 8 | 9 | 10 | int main(int ac, const char **av) { 11 | /* Init the triton context */ 12 | triton::Context ctx; 13 | 14 | /* Set the arch */ 15 | ctx.setArchitecture(ARCH_X86_64); 16 | 17 | BasicBlock block = BasicBlock({ 18 | Instruction("\x89\xd0", 2), /* mov eax, edx */ 19 | Instruction("\x80\xf4\x99", 3), /* xor ah, 0x99 */ 20 | Instruction("\x85\xc0", 2), /* test eax, eax */ 21 | Instruction("\x74\x08", 2), /* jz 10 */ 22 | }); 23 | 24 | ctx.disassembly(block); 25 | 26 | std::cout << block << std::endl; 27 | std::cout << "----------" << std::endl; 28 | 29 | auto i = Instruction("\x90", 1); /* nop */ 30 | ctx.disassembly(i); 31 | 32 | block.add(i); 33 | block.add(i); 34 | block.add(i); 35 | 36 | std::cout << block << std::endl; 37 | std::cout << "----------" << std::endl; 38 | 39 | block.remove(0); 40 | 41 | std::cout << block << std::endl; 42 | std::cout << "----------" << std::endl; 43 | 44 | ctx.disassembly(block, 0x1000); 45 | 46 | std::cout << block << std::endl; 47 | 48 | std::cout << "First addr: 0x" << std::hex << block.getFirstAddress() << std::endl; 49 | std::cout << "Last addr: " << std::hex << block.getLastAddress() << std::endl; 50 | std::cout << "Number of instructions: " << std::hex << block.getSize() << std::endl; 51 | 52 | std::cout << "----------" << std::endl; 53 | 54 | block.remove(2); /* remove the jz */ 55 | ctx.processing(block); 56 | 57 | std::cout << block << std::endl; 58 | 59 | return 0; 60 | } 61 | -------------------------------------------------------------------------------- /src/examples/cpp/constraint.cpp: -------------------------------------------------------------------------------- 1 | /* 2 | ** Output: 3 | ** 4 | ** RAX expr: (bvxor ((_ extract 63 0) SymVar_0) (_ bv287454020 64)) 5 | ** constraint: (= (bvxor ((_ extract 63 0) SymVar_0) (_ bv287454020 64)) (_ bv0 64)) 6 | ** Model: 7 | ** - Variable id : 0 8 | ** - Variable name: SymVar_0 9 | ** - Value : 11223344 10 | ** 11 | */ 12 | 13 | 14 | #include 15 | #include 16 | #include 17 | #include 18 | 19 | using namespace triton; 20 | using namespace triton::arch; 21 | 22 | 23 | struct op { 24 | unsigned int addr; 25 | const void* inst; 26 | unsigned int size; 27 | }; 28 | 29 | struct op trace[] = { 30 | {0x400017, "\x48\x35\x44\x33\x22\x11", 6}, /* xor rax, 0x11223344 */ 31 | {0x0, nullptr, 0} 32 | }; 33 | 34 | 35 | 36 | int main(int ac, const char **av) { 37 | triton::Context ctx; 38 | 39 | /* Set the arch */ 40 | ctx.setArchitecture(ARCH_X86_64); 41 | 42 | /* Build an instruction */ 43 | Instruction inst; 44 | 45 | /* Setup opcode */ 46 | inst.setOpcode(trace[0].inst, trace[0].size); 47 | 48 | /* Define RAX as symbolic variable */ 49 | ctx.symbolizeRegister(ctx.registers.x86_rax); 50 | 51 | /* Process everything */ 52 | ctx.processing(inst); 53 | 54 | /* Get the RAX symbolic ID */ 55 | auto raxSym = ctx.getSymbolicRegister(ctx.registers.x86_rax); 56 | 57 | /* Get the RAX full AST */ 58 | auto raxFullAst = triton::ast::unroll(raxSym->getAst()); 59 | 60 | /* Display RAX's AST*/ 61 | std::cout << "RAX expr: " << raxFullAst << std::endl; 62 | 63 | /* Get the context to create and ast constraint*/ 64 | auto ast = ctx.getAstContext(); 65 | 66 | /* Modify RAX's AST to build the constraint */ 67 | auto constraint = ast->equal(raxFullAst, ast->bv(0, raxFullAst->getBitvectorSize())); 68 | 69 | /* Display the AST */ 70 | std::cout << "constraint: " << constraint << std::endl; 71 | 72 | /* Ask a model */ 73 | auto model = ctx.getModel(constraint); 74 | 75 | /* Display all symbolic variable value contained in the model */ 76 | std::cout << "Model:" << std::endl; 77 | for (auto it = model.begin(); it != model.end(); it++) { 78 | std::cout << " - Variable id : " << it->first << std::endl; 79 | std::cout << " - Variable name: " << it->second.getVariable()->getName() << std::endl; 80 | std::cout << " - Value : " << std::hex << it->second.getValue() << std::endl; 81 | } 82 | 83 | return 0; 84 | } 85 | 86 | -------------------------------------------------------------------------------- /src/examples/cpp/info_reg.cpp: -------------------------------------------------------------------------------- 1 | /* 2 | ** Output: 3 | ** 4 | ** $ ./info_reg.bin 5 | ** Name : ah 6 | ** Size byte : 1 7 | ** Size bit : 8 8 | ** Highed bit : 15 9 | ** Lower bit : 8 10 | ** Parent : rax 11 | ** operator<< : ah:8 bitsvector[15..8] 12 | ** Object : ah:8 bitsvector[15..8] 13 | ** Object : ah:8 bitsvector[15..8] 14 | */ 15 | 16 | #include 17 | #include 18 | #include 19 | 20 | using namespace triton; 21 | using namespace triton::arch; 22 | using namespace triton::arch::x86; 23 | 24 | 25 | int main(int ac, const char **av) { 26 | triton::Context ctx; 27 | 28 | /* Set the arch */ 29 | ctx.setArchitecture(ARCH_X86_64); 30 | 31 | std::cout << "Name : " << ctx.registers.x86_ah.getName() << std::endl; 32 | std::cout << "Size byte : " << ctx.registers.x86_ah.getSize() << std::endl; 33 | std::cout << "Size bit : " << ctx.registers.x86_ah.getBitSize() << std::endl; 34 | std::cout << "Higher bit : " << ctx.registers.x86_ah.getHigh() << std::endl; 35 | std::cout << "Lower bit : " << ctx.registers.x86_ah.getLow() << std::endl; 36 | std::cout << "Parent : " << ctx.getParentRegister(ID_REG_X86_AH).getName() << std::endl; 37 | std::cout << "operator<< : " << ctx.getRegister(ID_REG_X86_AH) << std::endl; 38 | std::cout << "Object : " << ctx.getRegister("ah") << std::endl; 39 | std::cout << "Object : " << ctx.getRegister("AH") << std::endl; 40 | 41 | std::cout << "----------------------------" << std::endl; 42 | 43 | for(const auto& kv: ctx.getAllRegisters()) 44 | std::cout << kv.second << std::endl; 45 | 46 | return 0; 47 | } 48 | 49 | -------------------------------------------------------------------------------- /src/examples/cpp/simplification.cpp: -------------------------------------------------------------------------------- 1 | /* 2 | ** Output 3 | ** 4 | ** 400017: xor rax, rax 5 | ** SymExpr 0: ref!0 = (_ bv0 64) ; XOR operation 6 | */ 7 | 8 | 9 | #include 10 | #include 11 | #include 12 | 13 | using namespace triton; 14 | using namespace triton::arch; 15 | 16 | 17 | struct op { 18 | unsigned int addr; 19 | const void* inst; 20 | unsigned int size; 21 | }; 22 | 23 | struct op trace[] = { 24 | {0x400017, "\x48\x31\xc0", 3}, /* xor rax, rax */ 25 | {0x0, nullptr, 0} 26 | }; 27 | 28 | 29 | /* if (bvxor x x) -> (_ bv0 x_size) */ 30 | ast::SharedAbstractNode xor_simplification(Context& ctx, const ast::SharedAbstractNode& snode) { 31 | ast::AbstractNode* node = snode.get(); 32 | 33 | if (node->getType() == ast::ZX_NODE) { 34 | node = node->getChildren()[1].get(); 35 | } 36 | 37 | if (node->getType() == ast::BVXOR_NODE) { 38 | if (node->getChildren()[0]->equalTo(node->getChildren()[1])) 39 | return node->getContext()->bv(0, node->getBitvectorSize()); 40 | } 41 | 42 | return snode; 43 | } 44 | 45 | 46 | int main(int ac, const char **av) { 47 | triton::Context ctx; 48 | 49 | /* Set the arch */ 50 | ctx.setArchitecture(ARCH_X86_64); 51 | 52 | /* Record a simplification callback */ 53 | ctx.addCallback(callbacks::SYMBOLIC_SIMPLIFICATION, xor_simplification); 54 | 55 | /* optional - Update register state */ 56 | ctx.setConcreteRegisterValue(ctx.registers.x86_rax, 12345); 57 | 58 | for (unsigned int i = 0; trace[i].inst; i++) { 59 | /* Build an instruction */ 60 | Instruction inst; 61 | 62 | /* Setup opcode */ 63 | inst.setOpcode(trace[i].inst, trace[i].size); 64 | 65 | /* optional - Setup address */ 66 | inst.setAddress(trace[i].addr); 67 | 68 | /* Process everything */ 69 | ctx.processing(inst); 70 | 71 | /* Display all symbolic expression of the instruction */ 72 | std::cout << inst << std::endl; 73 | for (unsigned int exp_index = 0; exp_index != inst.symbolicExpressions.size(); exp_index++) { 74 | auto expr = inst.symbolicExpressions[exp_index]; 75 | std::cout << "\tSymExpr " << exp_index << ": " << expr << std::endl; 76 | } 77 | 78 | } 79 | 80 | return 0; 81 | } 82 | 83 | -------------------------------------------------------------------------------- /src/examples/cpp/taint_reg.cpp: -------------------------------------------------------------------------------- 1 | /* 2 | ** Output: 3 | ** 4 | ** $ ./taint_reg 5 | ** 0 6 | ** 1 7 | ** 0 8 | */ 9 | 10 | #include 11 | #include 12 | #include 13 | 14 | using namespace triton; 15 | using namespace triton::arch; 16 | using namespace triton::arch::x86; 17 | 18 | 19 | int main(int ac, const char **av) { 20 | triton::Context ctx; 21 | 22 | /* Set the arch */ 23 | ctx.setArchitecture(ARCH_X86_64); 24 | 25 | /* Taint the RAX */ 26 | ctx.taintRegister(ctx.registers.x86_ah); 27 | 28 | /* Is RDX tainted ? */ 29 | std::cout << ctx.isRegisterTainted(ctx.registers.x86_rdx) << std::endl; 30 | 31 | /* Spread RAX into RDX */ 32 | ctx.taintAssignment(ctx.registers.x86_rdx, ctx.registers.x86_rax); 33 | 34 | /* Is RDX tainted ? */ 35 | std::cout << ctx.isRegisterTainted(ctx.registers.x86_rdx) << std::endl; 36 | 37 | /* Untaint RDX */ 38 | ctx.untaintRegister(ctx.registers.x86_rdx); 39 | 40 | /* Is RDX tainted ? */ 41 | std::cout << ctx.isRegisterTainted(ctx.registers.x86_rdx) << std::endl; 42 | 43 | return 0; 44 | } 45 | 46 | -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/NorthSec-2018-MarsAnalytica/00400000-00e5e000.dump: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/NorthSec-2018-MarsAnalytica/00400000-00e5e000.dump -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/NorthSec-2018-MarsAnalytica/MarsAnalytica: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/NorthSec-2018-MarsAnalytica/MarsAnalytica -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/Nuit_du_Hack_CTF_Quals_2016_Matriochka_Step_3/stage3.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/Nuit_du_Hack_CTF_Quals_2016_Matriochka_Step_3/stage3.bin -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/alexctf-2017-re2-cpp-is-awesome/re2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/alexctf-2017-re2-cpp-is-awesome/re2 -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/alexctf-2017-re3-catalyst-system/catalyst: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/alexctf-2017-re3-catalyst-system/catalyst -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/alexctf-2017-re3-catalyst-system/catalyst.patched_without_sleep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/alexctf-2017-re3-catalyst-system/catalyst.patched_without_sleep -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/cm002/cm002: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/cm002/cm002 -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/custom-crackmes/aarch64-hash/crackme_hash: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/custom-crackmes/aarch64-hash/crackme_hash -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/custom-crackmes/aarch64-hash/crackme_hash.c: -------------------------------------------------------------------------------- 1 | 2 | #include 3 | #include 4 | 5 | char *serial = "\x31\x3e\x3d\x26\x31"; 6 | 7 | int check(char *ptr) 8 | { 9 | int i; 10 | int hash = 0xABCD; 11 | 12 | for (i = 0; ptr[i]; i++) 13 | hash += ptr[i] ^ serial[i % 5]; 14 | 15 | return hash; 16 | } 17 | 18 | int main(int ac, char **av) 19 | { 20 | int ret; 21 | 22 | if (ac != 2) 23 | return -1; 24 | 25 | ret = check(av[1]); 26 | if (ret == 0xad6d) 27 | printf("Win\n"); 28 | else 29 | printf("fail\n"); 30 | 31 | return 0; 32 | } 33 | 34 | -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/custom-crackmes/arm32-hash/crackme_hash-arm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/custom-crackmes/arm32-hash/crackme_hash-arm -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/custom-crackmes/arm32-hash/crackme_hash-thumb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/custom-crackmes/arm32-hash/crackme_hash-thumb -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/custom-crackmes/arm32-hash/crackme_hash.c: -------------------------------------------------------------------------------- 1 | /* Compile: 2 | * 1. ARM: arm-linux-gnueabi-gcc-7 -marm -o crackme_hash-arm crackme_hash.c 3 | * 2. Thumb: arm-linux-gnueabi-gcc-7 -mthumb -o crackme_hash-thumb crackme_hash.c 4 | */ 5 | 6 | #include 7 | #include 8 | 9 | char *serial = "\x31\x3e\x3d\x26\x31"; 10 | 11 | int check(char *ptr) 12 | { 13 | int i; 14 | int hash = 0xABCD; 15 | 16 | for (i = 0; ptr[i]; i++) 17 | hash += ptr[i] ^ serial[i % 5]; 18 | 19 | return hash; 20 | } 21 | 22 | int main(int ac, char **av) 23 | { 24 | int ret; 25 | 26 | if (ac != 2) 27 | return -1; 28 | 29 | ret = check(av[1]); 30 | if (ret == 0xad6d) 31 | printf("Win\n"); 32 | else 33 | printf("fail\n"); 34 | 35 | return 0; 36 | } 37 | -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/custom-crackmes/riscv32-hash/crackme_hash: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/custom-crackmes/riscv32-hash/crackme_hash -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/custom-crackmes/riscv32-hash/crackme_hash.c: -------------------------------------------------------------------------------- 1 | 2 | #include 3 | #include 4 | 5 | char *serial = "\x31\x3e\x3d\x26\x31"; 6 | 7 | int check(char *ptr) 8 | { 9 | int i; 10 | int hash = 0xABCD; 11 | 12 | for (i = 0; ptr[i]; i++) 13 | hash += ptr[i] ^ serial[i % 5]; 14 | 15 | return hash; 16 | } 17 | 18 | int main(int ac, char **av) 19 | { 20 | int ret; 21 | 22 | if (ac != 2) 23 | return -1; 24 | 25 | ret = check(av[1]); 26 | if (ret == 0xad6d) 27 | printf("Win\n"); 28 | else 29 | printf("fail\n"); 30 | 31 | return 0; 32 | } 33 | 34 | -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/custom-crackmes/riscv64-hash/crackme_hash: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/custom-crackmes/riscv64-hash/crackme_hash -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/custom-crackmes/riscv64-hash/crackme_hash.c: -------------------------------------------------------------------------------- 1 | 2 | #include 3 | #include 4 | 5 | char *serial = "\x31\x3e\x3d\x26\x31"; 6 | 7 | int check(char *ptr) 8 | { 9 | int i; 10 | int hash = 0xABCD; 11 | 12 | for (i = 0; ptr[i]; i++) 13 | hash += ptr[i] ^ serial[i % 5]; 14 | 15 | return hash; 16 | } 17 | 18 | int main(int ac, char **av) 19 | { 20 | int ret; 21 | 22 | if (ac != 2) 23 | return -1; 24 | 25 | ret = check(av[1]); 26 | if (ret == 0xad6d) 27 | printf("Win\n"); 28 | else 29 | printf("fail\n"); 30 | 31 | return 0; 32 | } 33 | 34 | -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/defcamp-2015-r100/r100.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/defcamp-2015-r100/r100.bin -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/defcon-2016-baby-re/baby-re: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/defcon-2016-baby-re/baby-re -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/defcon-2016-baby-re/gdb-peda-fulldump.patch: -------------------------------------------------------------------------------- 1 | diff --git a/peda.py b/peda.py 2 | index 31eae61..40b6f2c 100644 3 | --- a/peda.py 4 | +++ b/peda.py 5 | @@ -5999,6 +5999,52 @@ class PEDACmd(object): 6 | return 7 | utils.options = ["int2hexstr", "list2hexstr", "str2intlist"] 8 | 9 | + def fulldump(self, *arg): 10 | + """ 11 | + Generate a full dump of the current execution 12 | + Usage: 13 | + fulldump 14 | + """ 15 | + (filename,) = normalize_argv(arg, 1) 16 | + if not filename: 17 | + filename = "fulldump.dump" 18 | + 19 | + pid = peda.getpid() 20 | + if not pid: 21 | + return False 22 | + 23 | + maps = peda.get_vmmap() 24 | + if not maps: 25 | + return False 26 | + 27 | + memory = list() 28 | + for s, e, x, f in maps: 29 | + raw = peda.dumpmem(s, e) 30 | + memory.append({"start": s, "end": e, "memory": raw, "permissions": x, "name": f}) 31 | + 32 | + # GPR 33 | + regs = peda.getregs() 34 | + 35 | + # XMM 36 | + arch, bits = peda.getarch() 37 | + cnt = (8 if bits == 32 else 16) 38 | + for i in range(cnt): 39 | + xmm = peda.execute_redirect("info registers xmm%d" % (i)) 40 | + offset = xmm.find('uint128') 41 | + if offset > 0: 42 | + uint128 = xmm[offset:].replace('\n', '').replace('}', '').split('=')[1] 43 | + regs.update({"xmm%d" % (i): int(uint128, 16)}) 44 | + 45 | + dump = (regs, memory) 46 | + 47 | + fd = open(filename, "w") 48 | + fd.write(repr(dump)) 49 | + fd.close() 50 | + 51 | + msg("Full dump saved into %s" % (filename)) 52 | + 53 | + return True 54 | + 55 | + 56 | ########################################################################### 57 | class pedaGDBCommand(gdb.Command): 58 | """ 59 | -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/ekopartyctf2016_rev250/FUck_binary: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/ekopartyctf2016_rev250/FUck_binary -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/ekopartyctf2016_rev250/libget_flag.so: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/ekopartyctf2016_rev250/libget_flag.so -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/google2016-unbreakable/unbreakable-enterprise-product-activation: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/google2016-unbreakable/unbreakable-enterprise-product-activation -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/hackcon-2016-angry-reverser/yolomolo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/hackcon-2016-angry-reverser/yolomolo -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/hacklu-2021-ollvm/ollvm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/hacklu-2021-ollvm/ollvm -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/hackover-ctf-2015-r150/rvs.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/hackover-ctf-2015-r150/rvs.bin -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/mma-2015-howtouse/howtouse.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/mma-2015-howtouse/howtouse.dll -------------------------------------------------------------------------------- /src/examples/python/ctf-writeups/securityfest-2016-fairlight/fairlight: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/ctf-writeups/securityfest-2016-fairlight/fairlight -------------------------------------------------------------------------------- /src/examples/python/lifting_dot_format.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | ## -*- coding: utf-8 -*- 3 | ## 4 | ## $ python3 lifting_dot_format.py > out.dot ; dot -Tpng ./out.dot -o out.png ; eog out.png 5 | ## 6 | 7 | import sys 8 | from triton import * 9 | 10 | CODE = b"\x55\x48\x89\xE5\x89\x7D\xEC\x89\x75\xE8\x8B\x45\xE8\x23\x45\xEC" 11 | CODE += b"\x89\xC2\x8B\x45\xE8\x0B\x45\xEC\x89\xD1\x0F\xAF\xC8\x8B\x45\xEC" 12 | CODE += b"\xF7\xD0\x23\x45\xE8\x89\xC2\x8B\x45\xE8\xF7\xD0\x23\x45\xEC\x0F" 13 | CODE += b"\xAF\xC2\x01\xC8\x23\x45\xE8\x89\xC2\x8B\x45\xE8\x23\x45\xEC\x89" 14 | CODE += b"\xC1\x8B\x45\xE8\x0B\x45\xEC\x89\xCE\x0F\xAF\xF0\x8B\x45\xEC\xF7" 15 | CODE += b"\xD0\x23\x45\xE8\x89\xC1\x8B\x45\xE8\xF7\xD0\x23\x45\xEC\x0F\xAF" 16 | CODE += b"\xC1\x01\xF0\x0B\x45\xE8\x89\xD6\x0F\xAF\xF0\x8B\x45\xE8\x23\x45" 17 | CODE += b"\xEC\x89\xC2\x8B\x45\xE8\x0B\x45\xEC\x89\xD1\x0F\xAF\xC8\x8B\x45" 18 | CODE += b"\xEC\xF7\xD0\x23\x45\xE8\x89\xC2\x8B\x45\xE8\xF7\xD0\x23\x45\xEC" 19 | CODE += b"\x0F\xAF\xC2\x8D\x14\x01\x8B\x45\xE8\xF7\xD0\x89\xD1\x21\xC1\x8B" 20 | CODE += b"\x45\xE8\x23\x45\xEC\x89\xC2\x8B\x45\xE8\x0B\x45\xEC\x89\xD7\x0F" 21 | CODE += b"\xAF\xF8\x8B\x45\xEC\xF7\xD0\x23\x45\xE8\x89\xC2\x8B\x45\xE8\xF7" 22 | CODE += b"\xD0\x23\x45\xEC\x0F\xAF\xC2\x01\xF8\xF7\xD0\x23\x45\xE8\x0F\xAF" 23 | CODE += b"\xC1\x8D\x14\x06\x8B\x45\xEC\x01\xD0\x83\xC0\x01\x89\x45\xFC\x8B" 24 | CODE += b"\x45\xFC\x5D\xC3" 25 | 26 | def emulate(ctx, pc): 27 | while pc: 28 | opcode = ctx.getConcreteMemoryAreaValue(pc, 16) 29 | instruction = Instruction(pc, opcode) 30 | ctx.processing(instruction) 31 | pc = ctx.getConcreteRegisterValue(ctx.registers.rip) 32 | return 33 | 34 | def main(): 35 | ctx = TritonContext(ARCH.X86_64) 36 | ast = ctx.getAstContext() 37 | 38 | ctx.setMode(MODE.CONSTANT_FOLDING, True) 39 | ctx.setMode(MODE.ALIGNED_MEMORY, True) 40 | ctx.setMode(MODE.AST_OPTIMIZATIONS, True) 41 | 42 | a = ast.variable(ctx.symbolizeRegister(ctx.registers.edi, "a")) 43 | b = ast.variable(ctx.symbolizeRegister(ctx.registers.esi, "b")) 44 | 45 | ctx.setConcreteMemoryAreaValue(0x1000, CODE) 46 | emulate(ctx, 0x1000) 47 | 48 | rax = ctx.getSymbolicRegister(ctx.registers.rax) 49 | print(ctx.liftToDot(rax)) 50 | return 0 51 | 52 | if __name__ == '__main__': 53 | sys.exit(main()) 54 | -------------------------------------------------------------------------------- /src/examples/python/multi_threading.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | ## -*- coding: utf-8 -*- 3 | 4 | from triton import * 5 | 6 | 7 | class ThreadContext(object): 8 | def __init__(self, tid): 9 | self.cregs = dict() # context of concrete registers 10 | self.sregs = dict() # context of symbolic registers 11 | self.tid = tid # The thread id 12 | 13 | def save(self, ctx): 14 | # Save symbolic registers 15 | self.sregs = ctx.getSymbolicRegisters() 16 | # Save concrete registers 17 | for r in ctx.getParentRegisters(): 18 | self.cregs.update({r.getId(): ctx.getConcreteRegisterValue(r)}) 19 | 20 | 21 | def restore(self, ctx): 22 | # Restore concrete registers 23 | for rid, v in self.cregs.items(): 24 | ctx.setConcreteRegisterValue(ctx.getRegister(rid), v) 25 | # Restore symbolic registers 26 | for rid, e in self.sregs.items(): 27 | ctx.assignSymbolicExpressionToRegister(e, ctx.getRegister(rid)) 28 | 29 | 30 | if __name__ == "__main__": 31 | thread0 = [ 32 | b"\xb8\x03\x00\x00\x00", # mov eax, 3 33 | b"\x89\xc3", # mov ebx, eax 34 | ] 35 | thread1 = [ 36 | b"\xb8\x04\x00\x00\x00", # mov eax, 4 37 | ] 38 | 39 | # The Triton context 40 | ctx = TritonContext(ARCH.X86) 41 | th0 = ThreadContext(0) 42 | th1 = ThreadContext(1) 43 | 44 | th0.save(ctx) # save the initial state of the thread 0 45 | th1.save(ctx) # save the initial state of the thread 1 46 | 47 | # Execute instructions of the thread 0 48 | for inst in thread0: 49 | ctx.processing(Instruction(inst)) 50 | 51 | # Save the state of the thread 0 and restore the state of thread 1 52 | th0.save(ctx) 53 | th1.restore(ctx) 54 | 55 | # Execute instructions of the thread 1 56 | for inst in thread1: 57 | ctx.processing(Instruction(inst)) 58 | 59 | # Save the state of the thread 1 and restore the state of the thread 0 60 | th1.save(ctx) 61 | th0.restore(ctx) 62 | 63 | print(f"Thread {th0.tid}: eax = {th0.cregs[REG.X86.EAX]}") 64 | print(f"Thread {th0.tid}: ebx = {th0.cregs[REG.X86.EBX]}") 65 | print(f"Thread {th1.tid}: eax = {th1.cregs[REG.X86.EAX]}") 66 | print(f"Thread {th1.tid}: ebx = {th1.cregs[REG.X86.EBX]}") 67 | -------------------------------------------------------------------------------- /src/examples/python/proving_equivalence.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | ## -*- coding: utf-8 -*- 3 | ## 4 | ## $ python ./proving equivalence.py 5 | ## True 6 | ## True 7 | ## True 8 | ## True 9 | ## True 10 | ## True 11 | ## True 12 | ## True 13 | ## True 14 | ## True 15 | ## True 16 | ## True 17 | ## True 18 | ## True 19 | ## 20 | 21 | import sys 22 | from triton import * 23 | 24 | 25 | def prove(ctx, n): 26 | ast = ctx.getAstContext() 27 | if ctx.isSat(ast.lnot(n)) == True: 28 | return False 29 | return True 30 | 31 | if __name__ == '__main__': 32 | ctx = TritonContext(ARCH.X86_64) 33 | ast = ctx.getAstContext() 34 | 35 | ctx.setAstRepresentationMode(AST_REPRESENTATION.PYTHON) 36 | 37 | x = ast.variable(ctx.newSymbolicVariable(8, 'x')) 38 | y = ast.variable(ctx.newSymbolicVariable(8, 'y')) 39 | 40 | # MBA coming from VMProtect https://whereisr0da.github.io/blog/posts/2021-02-16-vmp-3/ 41 | # To detect their equivalence you can synthesize them (see synthesizing_obfuscated_expressions.py) 42 | # Then you can confirm the synthesized output with this example 43 | print(prove(ctx, x ^ y == (~(~(x) & ~(y)) & ~(~(~(x)) & ~(~(y)))))) 44 | print(prove(ctx, x + y == ((~(~(x)) & ~(~(y))) + (~(~(x)) | ~(~(y)))))) 45 | print(prove(ctx, x + y == ((~(~(y)) | ~(~(x))) + ~(~(x)) - (~(~(x)) & ~(~(~(y))))))) 46 | print(prove(ctx, x + y == ((~(~(x)) | ~(~(y))) + (~(~(~(x))) | ~(~(y))) - (~(~(~(x))))))) 47 | print(prove(ctx, x + y == ((~(~(x)) | ~(~(y))) + ~(~(y)) - (~(~(~(x))) & ~(~(y)))))) 48 | print(prove(ctx, x + y == (~(~(y)) + (~(~(x)) & ~(~(~(y)))) + (~(~(x)) & ~(~(y)))))) 49 | print(prove(ctx, x - y == (~(~(x) + y)))) 50 | print(prove(ctx, ~((x | y) - x) == (~(((~(~(x)) | y) - (~(~(x)))))))) 51 | print(prove(ctx, x - y == (~((~(x) & ~(x)) + y) & ~((~(x) & ~(x)) + y)))) 52 | print(prove(ctx, x & y == ((~(~(x)) | y) - (~(~(~(x))) & y) - (~(~(x)) & ~y)))) 53 | print(prove(ctx, x & y == ((~(~(~(x))) | y) - (~(~(~(x))))))) 54 | print(prove(ctx, x | y == ((~(~(x)) & ~(y)) + y))) 55 | print(prove(ctx, x | y == (((~(~(x)) & ~(y)) & y) + ((~(~(x)) & ~(y)) | y)))) 56 | print(prove(ctx, x + y == ((~(~(x)) & ~(~(y))) + (~(~(x)) | ~(~(y)))))) 57 | 58 | sys.exit(0) 59 | -------------------------------------------------------------------------------- /src/examples/python/samples/sample_1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/samples/sample_1 -------------------------------------------------------------------------------- /src/examples/python/samples/sample_1.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | int main(int ac, const char* av[]) { 5 | if (ac != 2) 6 | return -1; 7 | printf("Input size = %ld\n", strlen(av[1])); 8 | return 0; 9 | } 10 | 11 | -------------------------------------------------------------------------------- /src/examples/python/samples/sample_2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/examples/python/samples/sample_2 -------------------------------------------------------------------------------- /src/examples/python/samples/sample_2.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | int main (int argc, char *argv[]) { 6 | 7 | printf("Some numbers and %s (%d,%d,%d,%d,%d) (%c) (%s) (%d)\n", "some strings", 1,2,3,4,5,'c', "abcdefg", 323); 8 | 9 | return(0); 10 | } 11 | -------------------------------------------------------------------------------- /src/examples/python/symbolic_emulation_2.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | ## -*- coding: utf-8 -*- 3 | ## 4 | ## Output: 5 | ## 6 | ## $ ./src/examples/python/symbolic_emulation_2.py 7 | ## Curr ip: 40056d: push rbp 8 | ## Next ip: 0x40056eL 9 | ## 10 | ## Curr ip: 40056e: mov rax, 0x41424344 11 | ## Next ip: 0x400575L 12 | ## 13 | ## Curr ip: 400575: call rax 14 | ## Next ip: 0x41424344L 15 | ## 16 | ## Curr ip: 41424344: xor rbx, rbx 17 | ## Next ip: 0x41424347L 18 | ## 19 | ## Curr ip: 41424347: ret 20 | ## Next ip: 0x400577L 21 | ## 22 | ## Curr ip: 400577: ret 23 | ## Next ip: 0x99999999L 24 | ## 25 | 26 | from __future__ import print_function 27 | from triton import TritonContext, ARCH, Instruction, MODE 28 | 29 | import sys 30 | 31 | 32 | function = { 33 | 0x40056d: b"\x55", # push rbp 34 | 0x40056e: b"\x48\xC7\xC0\x44\x43\x42\x41", # mov rax, 0x41424344 35 | 0x400575: b"\xFF\xD0", # call rax 36 | 0x400577: b"\xc3", # ret 37 | 0x41424344: b"\x48\x31\xDB", # xor rbx, rbx 38 | 0x41424347: b"\xc3", # ret 39 | } 40 | 41 | Triton = TritonContext() 42 | 43 | 44 | # This function emulates the code. 45 | def run(ip): 46 | while ip in function: 47 | # Build an instruction 48 | inst = Instruction() 49 | 50 | # Setup opcode 51 | inst.setOpcode(function[ip]) 52 | 53 | # Setup Address 54 | inst.setAddress(ip) 55 | 56 | # Process everything 57 | Triton.processing(inst) 58 | 59 | # Display instruction 60 | print('Curr ip:', inst) 61 | 62 | # Next instruction 63 | ip = Triton.getRegisterAst(Triton.registers.rip).evaluate() 64 | print('Next ip:', hex(ip)) 65 | print() 66 | return 67 | 68 | 69 | 70 | # This function initializes the context memory. 71 | def initContext(): 72 | Triton.setConcreteRegisterValue(Triton.registers.rsp, 0x7fffffff) 73 | Triton.setConcreteRegisterValue(Triton.registers.rbp, 0x99999999) 74 | return 75 | 76 | 77 | 78 | if __name__ == '__main__': 79 | # Set the architecture 80 | Triton.setArchitecture(ARCH.X86_64) 81 | 82 | # Symbolic optimization 83 | Triton.setMode(MODE.ALIGNED_MEMORY, True) 84 | 85 | # Define entry point 86 | ENTRY = 0x40056d 87 | 88 | # Init context memory 89 | initContext() 90 | 91 | # Emulate 92 | run(ENTRY) 93 | 94 | sys.exit(0) 95 | -------------------------------------------------------------------------------- /src/libtriton/Config.cmake.in: -------------------------------------------------------------------------------- 1 | @PACKAGE_INIT@ 2 | 3 | include("${CMAKE_CURRENT_LIST_DIR}/tritonTargets.cmake") 4 | 5 | set(TRITON_ARCHIVE "@CMAKE_INSTALL_PREFIX@/lib/@CMAKE_STATIC_LIBRARY_PREFIX@triton@CMAKE_STATIC_LIBRARY_SUFFIX@") 6 | set(TRITON_BITWUZLA_INTERFACE @BITWUZLA_INTERFACE@) 7 | set(TRITON_BOOST_INTERFACE @TRITON_BOOST_INTERFACE@) 8 | set(TRITON_BUILD_SHARED_LIBS @BUILD_SHARED_LIBS@) 9 | set(TRITON_INCLUDE_DIRS "@CMAKE_INSTALL_PREFIX@/include") 10 | set(TRITON_INSTALL_PREFIX @CMAKE_INSTALL_PREFIX@) 11 | set(TRITON_LIBRARIES "triton;@PYTHON_LIB_NAME@;@Z3_LIB_NAME@;@LLVM_LIBRARIES@;@BITWUZLA_LIB_NAME@;@CAPSTONE_LIB_NAME@") 12 | set(TRITON_LIBRARY "@CMAKE_INSTALL_PREFIX@/lib/@CMAKE_SHARED_LIBRARY_PREFIX@triton@CMAKE_SHARED_LIBRARY_SUFFIX@") 13 | set(TRITON_LLVM_INTERFACE @LLVM_INTERFACE@) 14 | set(TRITON_MSVC_STATIC @MSVC_STATIC@) 15 | set(TRITON_PYTHON_BINDINGS @PYTHON_BINDINGS@) 16 | set(TRITON_VERSION @VERSION_MAJOR@.@VERSION_MINOR@) 17 | set(TRITON_Z3_INTERFACE @Z3_INTERFACE@) 18 | 19 | message(STATUS "Found Triton: ${CMAKE_CURRENT_LIST_DIR}/tritonConfig.cmake (found version ${TRITON_VERSION})") 20 | 21 | include(CMakeFindDependencyMacro) 22 | 23 | # Boost includes 24 | if (TRITON_BOOST_INTERFACE) 25 | find_dependency(Boost) 26 | endif() 27 | 28 | # Triton include 29 | include_directories("@CMAKE_INSTALL_PREFIX@/include") 30 | link_directories(BEFORE "@CMAKE_INSTALL_PREFIX@/lib") 31 | 32 | # Capstone include 33 | include_directories("@CAPSTONE_INCLUDE_DIRS@") 34 | link_directories(BEFORE "@CAPSTONE_LIB_DIR@") 35 | 36 | # Python include directories 37 | if (TRITON_PYTHON_BINDINGS) 38 | include_directories("@PYTHON_INCLUDE_DIRS@") 39 | link_directories(BEFORE "@PYTHON_LIB_DIR@") 40 | endif() 41 | 42 | # LLVM include and lib directories 43 | if (TRITON_LLVM_INTERFACE) 44 | include_directories("@LLVM_INCLUDE_DIRS@") 45 | link_directories(BEFORE "@LLVM_LIBRARY_DIRS@") 46 | endif() 47 | 48 | # Z3 include directories 49 | if (TRITON_Z3_INTERFACE) 50 | include_directories("@Z3_INCLUDE_DIRS@") 51 | link_directories(BEFORE "@Z3_LIB_DIR@") 52 | endif() 53 | 54 | # Bitwuzla include directories 55 | if (TRITON_BITWUZLA_INTERFACE) 56 | include_directories("@BITWUZLA_INCLUDE_DIRS@") 57 | link_directories(BEFORE "@BITWUZLA_LIB_DIR@") 58 | endif() 59 | -------------------------------------------------------------------------------- /src/libtriton/arch/basicBlock.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | 11 | 12 | 13 | namespace triton { 14 | namespace arch { 15 | 16 | BasicBlock::BasicBlock() { 17 | } 18 | 19 | 20 | BasicBlock::BasicBlock(const std::vector& instructions) { 21 | this->instructions = instructions; 22 | } 23 | 24 | 25 | BasicBlock::BasicBlock(const BasicBlock& other) { 26 | this->instructions = other.instructions; 27 | } 28 | 29 | 30 | BasicBlock& BasicBlock::operator=(const BasicBlock& other) { 31 | this->instructions = other.instructions; 32 | return *this; 33 | } 34 | 35 | 36 | BasicBlock::~BasicBlock() { 37 | this->instructions.clear(); 38 | } 39 | 40 | 41 | void BasicBlock::add(const Instruction& instruction) { 42 | Instruction copy = instruction; 43 | if (this->instructions.size()) { 44 | copy.setAddress(this->instructions.back().getNextAddress()); 45 | } 46 | this->instructions.push_back(copy); 47 | } 48 | 49 | 50 | bool BasicBlock::remove(triton::uint32 position) { 51 | if (this->instructions.size() <= position) 52 | return false; 53 | this->instructions.erase(this->instructions.begin() + position); 54 | return true; 55 | } 56 | 57 | 58 | std::vector& BasicBlock::getInstructions(void) { 59 | return this->instructions; 60 | } 61 | 62 | 63 | triton::usize BasicBlock::getSize(void) const { 64 | return this->instructions.size(); 65 | } 66 | 67 | 68 | triton::uint64 BasicBlock::getFirstAddress(void) const { 69 | if (this->instructions.size() == 0) 70 | throw triton::exceptions::BasicBlock("BasicBlock::getFirstAddress(): No instruction in the block."); 71 | return this->instructions.front().getAddress(); 72 | } 73 | 74 | 75 | triton::uint64 BasicBlock::getLastAddress(void) const { 76 | if (this->instructions.size() == 0) 77 | throw triton::exceptions::BasicBlock("BasicBlock::getLastAddress(): No instruction in the block."); 78 | return this->instructions.back().getAddress(); 79 | } 80 | 81 | 82 | std::ostream& operator<<(std::ostream& stream, BasicBlock& block) { 83 | triton::usize size = block.getSize(); 84 | for (const auto& inst : block.getInstructions()) { 85 | stream << inst; 86 | if (--size) { 87 | stream << std::endl; 88 | } 89 | } 90 | return stream; 91 | } 92 | 93 | 94 | std::ostream& operator<<(std::ostream& stream, BasicBlock* block) { 95 | stream << *block; 96 | return stream; 97 | } 98 | 99 | }; 100 | }; 101 | -------------------------------------------------------------------------------- /src/libtriton/ast/representations/astRepresentation.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | 17 | 18 | 19 | namespace triton { 20 | namespace ast { 21 | namespace representations { 22 | 23 | AstRepresentation::AstRepresentation() { 24 | /* Set the default representation */ 25 | this->mode = SMT_REPRESENTATION; 26 | 27 | /* Init representations interface */ 28 | this->representations[SMT_REPRESENTATION] = std::unique_ptr(new(std::nothrow) AstSmtRepresentation()); 29 | this->representations[PYTHON_REPRESENTATION] = std::unique_ptr(new(std::nothrow) AstPythonRepresentation()); 30 | this->representations[PCODE_REPRESENTATION] = std::unique_ptr(new(std::nothrow) AstPcodeRepresentation()); 31 | 32 | if (this->representations[SMT_REPRESENTATION] == nullptr) 33 | throw triton::exceptions::AstRepresentation("AstRepresentation::AstRepresentation(): Cannot allocate a new representation instance."); 34 | 35 | if (this->representations[PYTHON_REPRESENTATION] == nullptr) 36 | throw triton::exceptions::AstRepresentation("AstRepresentation::AstRepresentation(): Cannot allocate a new representation instance."); 37 | 38 | if (this->representations[PCODE_REPRESENTATION] == nullptr) 39 | throw triton::exceptions::AstRepresentation("AstRepresentation::AstRepresentation(): Cannot allocate a new representation instance."); 40 | } 41 | 42 | 43 | AstRepresentation::AstRepresentation(const AstRepresentation& other) 44 | : AstRepresentation() { 45 | this->mode = other.mode; 46 | } 47 | 48 | 49 | AstRepresentation& AstRepresentation::operator=(const AstRepresentation& other) { 50 | this->mode = other.mode; 51 | return *this; 52 | } 53 | 54 | 55 | triton::ast::representations::mode_e AstRepresentation::getMode(void) const { 56 | return this->mode; 57 | } 58 | 59 | 60 | void AstRepresentation::setMode(triton::ast::representations::mode_e mode) { 61 | if (mode >= triton::ast::representations::LAST_REPRESENTATION) 62 | throw triton::exceptions::AstRepresentation("AstRepresentation::setMode(): Invalid representation mode."); 63 | this->mode = mode; 64 | } 65 | 66 | 67 | std::ostream& AstRepresentation::print(std::ostream& stream, AbstractNode* node) { 68 | return this->representations[this->mode]->print(stream, node); 69 | } 70 | 71 | }; 72 | }; 73 | }; 74 | -------------------------------------------------------------------------------- /src/libtriton/bindings/python/namespaces/initArchNamespace.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | 14 | 15 | /*! \page py_ARCH_page ARCH 16 | \brief [**python api**] All information about the ARCH Python namespace. 17 | 18 | \tableofcontents 19 | 20 | \section ARCH_py_description Description 21 |
22 | 23 | The ARCH namespace contains all kinds of architecture supported by Triton. 24 | 25 | \section ARCH_py_api Python API - Items of the ARCH namespace 26 |
27 | 28 | - **ARCH.AARCH64** 29 | - **ARCH.ARM32** 30 | - **ARCH.RV32** 31 | - **ARCH.RV64** 32 | - **ARCH.X86** 33 | - **ARCH.X86_64** 34 | 35 | */ 36 | 37 | 38 | 39 | namespace triton { 40 | namespace bindings { 41 | namespace python { 42 | 43 | void initArchNamespace(PyObject* archDict) { 44 | xPyDict_SetItemString(archDict, "AARCH64", PyLong_FromUint32(triton::arch::ARCH_AARCH64)); 45 | xPyDict_SetItemString(archDict, "ARM32", PyLong_FromUint32(triton::arch::ARCH_ARM32)); 46 | xPyDict_SetItemString(archDict, "RV32", PyLong_FromUint32(triton::arch::ARCH_RV32)); 47 | xPyDict_SetItemString(archDict, "RV64", PyLong_FromUint32(triton::arch::ARCH_RV64)); 48 | xPyDict_SetItemString(archDict, "X86", PyLong_FromUint32(triton::arch::ARCH_X86)); 49 | xPyDict_SetItemString(archDict, "X86_64", PyLong_FromUint32(triton::arch::ARCH_X86_64)); 50 | } 51 | 52 | }; /* python namespace */ 53 | }; /* bindings namespace */ 54 | }; /* triton namespace */ 55 | -------------------------------------------------------------------------------- /src/libtriton/bindings/python/namespaces/initExceptionNamespace.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | 14 | 15 | /*! \page py_EXCEPTION_page EXCEPTION 16 | \brief [**python api**] All information about the EXCEPTION Python namespace. 17 | 18 | \tableofcontents 19 | 20 | \section EXCEPTION_py_description Description 21 |
22 | 23 | The EXCEPTION namespace contains all kinds of exceptions. 24 | 25 | \section EXCEPTION_py_api Python API - Items of the EXCEPTION namespace 26 |
27 | 28 | - **EXCEPTION.NO_FAULT**
29 | No fault, execution succeed. 30 | 31 | - **EXCEPTION.FAULT_DE**
32 | Fault raised: Divide-by-zero. 33 | 34 | - **EXCEPTION.FAULT_BP**
35 | Fault raised: Breakpoint. 36 | 37 | - **EXCEPTION.FAULT_UD**
38 | Fault raised: Instruction not supported. 39 | 40 | - **EXCEPTION.FAULT_GP**
41 | Fault raised: General Protection Fault. 42 | 43 | */ 44 | 45 | 46 | 47 | namespace triton { 48 | namespace bindings { 49 | namespace python { 50 | 51 | void initExceptionNamespace(PyObject* exceptionDict) { 52 | xPyDict_SetItemString(exceptionDict, "NO_FAULT", PyLong_FromUint32(triton::arch::NO_FAULT)); 53 | xPyDict_SetItemString(exceptionDict, "FAULT_DE", PyLong_FromUint32(triton::arch::FAULT_DE)); 54 | xPyDict_SetItemString(exceptionDict, "FAULT_BP", PyLong_FromUint32(triton::arch::FAULT_BP)); 55 | xPyDict_SetItemString(exceptionDict, "FAULT_UD", PyLong_FromUint32(triton::arch::FAULT_UD)); 56 | xPyDict_SetItemString(exceptionDict, "FAULT_GP", PyLong_FromUint32(triton::arch::FAULT_GP)); 57 | } 58 | 59 | }; /* python namespace */ 60 | }; /* bindings namespace */ 61 | }; /* triton namespace */ 62 | -------------------------------------------------------------------------------- /src/libtriton/bindings/python/namespaces/initOperandNamespace.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | 14 | 15 | /*! \page py_OPERAND_page OPERAND 16 | \brief [**python api**] All information about the OPERAND Python namespace. 17 | 18 | \tableofcontents 19 | 20 | \section OPERAND_py_description Description 21 |
22 | 23 | The OPERAND namespace contains all kinds of operands. 24 | 25 | \section OPERAND_py_api Python API - Items of the OPERAND namespace 26 |
27 | 28 | - **OPERAND.INVALID** 29 | - **OPERAND.IMM** 30 | - **OPERAND.MEM** 31 | - **OPERAND.REG** 32 | 33 | */ 34 | 35 | 36 | 37 | namespace triton { 38 | namespace bindings { 39 | namespace python { 40 | 41 | void initOperandNamespace(PyObject* operandDict) { 42 | xPyDict_SetItemString(operandDict, "INVALID", PyLong_FromUint32(triton::arch::OP_INVALID)); 43 | xPyDict_SetItemString(operandDict, "IMM", PyLong_FromUint32(triton::arch::OP_IMM)); 44 | xPyDict_SetItemString(operandDict, "MEM", PyLong_FromUint32(triton::arch::OP_MEM)); 45 | xPyDict_SetItemString(operandDict, "REG", PyLong_FromUint32(triton::arch::OP_REG)); 46 | } 47 | 48 | }; /* python namespace */ 49 | }; /* bindings namespace */ 50 | }; /* triton namespace */ 51 | -------------------------------------------------------------------------------- /src/libtriton/bindings/python/namespaces/initPrefixesNamespace.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | 14 | 15 | /*! \page py_PREFIX_page PREFIX 16 | \brief [**python api**] All information about the PREFIX Python namespace. 17 | 18 | \tableofcontents 19 | 20 | \section PREFIX_py_description Description 21 |
22 | 23 | According to the CPU architecture, the PREFIX namespace contains all kinds of instruction prefixes. 24 | 25 | \section PREFIX_py_api Python API - Items of the PREFIX namespace 26 |
27 | 28 | \subsection PREFIX_x86_py_api x86 and x86_64 29 | 30 | - **PREFIX.X86.INVALID**
31 | - **PREFIX.X86.LOCK**
32 | - **PREFIX.X86.REP**
33 | - **PREFIX.X86.REPE**
34 | - **PREFIX.X86.REPNE**
35 | 36 | */ 37 | 38 | 39 | namespace triton { 40 | namespace bindings { 41 | namespace python { 42 | 43 | void initPrefixesNamespace(PyObject* prefixesDict) { 44 | PyDict_Clear(prefixesDict); 45 | 46 | PyObject* x86PrefixesDict = xPyDict_New(); 47 | 48 | xPyDict_SetItemString(x86PrefixesDict, "INVALID", PyLong_FromUint32(triton::arch::x86::ID_PREFIX_INVALID)); 49 | xPyDict_SetItemString(x86PrefixesDict, "LOCK", PyLong_FromUint32(triton::arch::x86::ID_PREFIX_LOCK)); 50 | xPyDict_SetItemString(x86PrefixesDict, "REP", PyLong_FromUint32(triton::arch::x86::ID_PREFIX_REP)); 51 | xPyDict_SetItemString(x86PrefixesDict, "REPE", PyLong_FromUint32(triton::arch::x86::ID_PREFIX_REPE)); 52 | xPyDict_SetItemString(x86PrefixesDict, "REPNE", PyLong_FromUint32(triton::arch::x86::ID_PREFIX_REPNE)); 53 | 54 | PyObject* x86PrefixesDictClass = xPyClass_New(nullptr, x86PrefixesDict, xPyString_FromString("X86")); 55 | xPyDict_SetItemString(prefixesDict, "X86", x86PrefixesDictClass); 56 | } 57 | 58 | }; /* python namespace */ 59 | }; /* bindings namespace */ 60 | }; /* triton namespace */ 61 | -------------------------------------------------------------------------------- /src/libtriton/bindings/python/namespaces/initSolverNamespace.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | 14 | 15 | /*! \page py_SOLVER_page SOLVER 16 | \brief [**python api**] All information about the SOLVER Python namespace. 17 | 18 | \tableofcontents 19 | 20 | \section SOLVER_py_description Description 21 |
22 | 23 | The SOLVER namespace contains all kinds of solver status. 24 | 25 | \section SOLVER_py_api Python API - Items of the SOLVER namespace 26 |
27 | 28 | - **SOLVER.Z3** 29 | - **SOLVER.BITWUZLA** 30 | 31 | */ 32 | 33 | 34 | 35 | namespace triton { 36 | namespace bindings { 37 | namespace python { 38 | 39 | void initSolverNamespace(PyObject* solverDict) { 40 | PyDict_Clear(solverDict); 41 | 42 | #if defined(TRITON_Z3_INTERFACE) 43 | xPyDict_SetItemString(solverDict, "Z3", PyLong_FromUint32(triton::engines::solver::SOLVER_Z3)); 44 | #endif 45 | #if defined(TRITON_BITWUZLA_INTERFACE) 46 | xPyDict_SetItemString(solverDict, "BITWUZLA", PyLong_FromUint32(triton::engines::solver::SOLVER_BITWUZLA)); 47 | #endif 48 | } 49 | 50 | }; /* python namespace */ 51 | }; /* bindings namespace */ 52 | }; /* triton namespace */ 53 | -------------------------------------------------------------------------------- /src/libtriton/bindings/python/namespaces/initSolverStateNamespace.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | 14 | 15 | /*! \page py_SOLVER_STATE_page SOLVER_STATE 16 | \brief [**python api**] All information about the SOLVER_STATE Python namespace. 17 | 18 | \tableofcontents 19 | 20 | \section SOLVER_STATE_py_description Description 21 |
22 | 23 | The SOLVER_STATE namespace contains all kinds of solver status. 24 | 25 | \section SOLVER_STATE_py_api Python API - Items of the SOLVER_STATE namespace 26 |
27 | 28 | - **SOLVER_STATE.OUTOFMEM** 29 | - **SOLVER_STATE.SAT** 30 | - **SOLVER_STATE.TIMEOUT** 31 | - **SOLVER_STATE.UNKNOWN** 32 | - **SOLVER_STATE.UNSAT** 33 | 34 | */ 35 | 36 | 37 | 38 | namespace triton { 39 | namespace bindings { 40 | namespace python { 41 | 42 | void initSolverStateNamespace(PyObject* solverStateDict) { 43 | PyDict_Clear(solverStateDict); 44 | 45 | xPyDict_SetItemString(solverStateDict, "OUTOFMEM", PyLong_FromUint32(triton::engines::solver::OUTOFMEM)); 46 | xPyDict_SetItemString(solverStateDict, "SAT", PyLong_FromUint32(triton::engines::solver::SAT)); 47 | xPyDict_SetItemString(solverStateDict, "TIMEOUT", PyLong_FromUint32(triton::engines::solver::TIMEOUT)); 48 | xPyDict_SetItemString(solverStateDict, "UNKNOWN", PyLong_FromUint32(triton::engines::solver::UNKNOWN)); 49 | xPyDict_SetItemString(solverStateDict, "UNSAT", PyLong_FromUint32(triton::engines::solver::UNSAT)); 50 | } 51 | 52 | }; /* python namespace */ 53 | }; /* bindings namespace */ 54 | }; /* triton namespace */ 55 | -------------------------------------------------------------------------------- /src/libtriton/bindings/python/namespaces/initSymbolicNamespace.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | 14 | 15 | /*! \page py_SYMBOLIC_page SYMBOLIC 16 | \brief [**python api**] All information about the SYMBOLIC Python namespace. 17 | 18 | \tableofcontents 19 | 20 | \section SYMBOLIC_py_description Description 21 |
22 | 23 | The SYMBOLIC namespace contains all types of symbolic expressions and variables. 24 | 25 | \section SYMBOLIC_py_api Python API - Items of the SYMBOLIC namespace 26 |
27 | 28 | - **SYMBOLIC.MEMORY_EXPRESSION** 29 | - **SYMBOLIC.MEMORY_VARIABLE** 30 | - **SYMBOLIC.REGISTER_EXPRESSION** 31 | - **SYMBOLIC.REGISTER_VARIABLE** 32 | - **SYMBOLIC.UNDEFINED_VARIABLE** 33 | - **SYMBOLIC.VOLATILE_EXPRESSION** 34 | 35 | */ 36 | 37 | 38 | 39 | namespace triton { 40 | namespace bindings { 41 | namespace python { 42 | 43 | void initSymbolicNamespace(PyObject* symbolicDict) { 44 | xPyDict_SetItemString(symbolicDict, "MEMORY_EXPRESSION", PyLong_FromUint32(triton::engines::symbolic::MEMORY_EXPRESSION)); 45 | xPyDict_SetItemString(symbolicDict, "MEMORY_VARIABLE", PyLong_FromUint32(triton::engines::symbolic::MEMORY_VARIABLE)); 46 | xPyDict_SetItemString(symbolicDict, "REGISTER_EXPRESSION", PyLong_FromUint32(triton::engines::symbolic::REGISTER_EXPRESSION)); 47 | xPyDict_SetItemString(symbolicDict, "REGISTER_VARIABLE", PyLong_FromUint32(triton::engines::symbolic::REGISTER_VARIABLE)); 48 | xPyDict_SetItemString(symbolicDict, "UNDEFINED_VARIABLE", PyLong_FromUint32(triton::engines::symbolic::UNDEFINED_VARIABLE)); 49 | xPyDict_SetItemString(symbolicDict, "VOLATILE_EXPRESSION", PyLong_FromUint32(triton::engines::symbolic::VOLATILE_EXPRESSION)); 50 | } 51 | 52 | }; /* python namespace */ 53 | }; /* bindings namespace */ 54 | }; /* triton namespace */ 55 | -------------------------------------------------------------------------------- /src/libtriton/bindings/python/namespaces/initVASNamespace.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | 14 | 15 | /*! \page py_VAS_page VAS 16 | \brief [**python api**] All information about the VAS Python namespace. 17 | 18 | \tableofcontents 19 | 20 | \section VAS_py_description Description 21 |
22 | 23 | The VAS namespace contains all kinds of vector arrangement specifier. 24 | 25 | \section VAS_py_api Python API - Items of the VAS namespace 26 |
27 | 28 | - **VAS.ARM.INVALID**
29 | Invalid vector arrangement specifier. 30 | 31 | - **VAS.ARM.v16B**
32 | 16 lanes, each containing an 8-bit element. 33 | 34 | - **VAS.ARM.v8B**
35 | 8 lanes, each containing an 8-bit element. 36 | 37 | - **VAS.ARM.v8H**
38 | 8 lanes, each containing a 16-bit element. 39 | 40 | - **VAS.ARM.v4H**
41 | 4 lanes, each containing a 16-bit element. 42 | 43 | - **VAS.ARM.v4S**
44 | 4 lanes, each containing a 32-bit element. 45 | 46 | - **VAS.ARM.v2S**
47 | 2 lanes, each containing a 32-bit element. 48 | 49 | - **VAS.ARM.v2D**
50 | 2 lanes, each containing a 64-bit element. 51 | 52 | - **VAS.ARM.v1D**
53 | 1 lane containing a 64-bit element. 54 | 55 | */ 56 | 57 | 58 | 59 | namespace triton { 60 | namespace bindings { 61 | namespace python { 62 | 63 | void initVASNamespace(PyObject* vasDict) { 64 | PyDict_Clear(vasDict); 65 | 66 | PyObject* armVASDict = xPyDict_New(); 67 | 68 | xPyDict_SetItemString(armVASDict, "INVALID", PyLong_FromUint32(triton::arch::arm::ID_VAS_INVALID)); 69 | xPyDict_SetItemString(armVASDict, "v16B", PyLong_FromUint32(triton::arch::arm::ID_VAS_16B)); 70 | xPyDict_SetItemString(armVASDict, "v8B", PyLong_FromUint32(triton::arch::arm::ID_VAS_8B)); 71 | xPyDict_SetItemString(armVASDict, "v8H", PyLong_FromUint32(triton::arch::arm::ID_VAS_8H)); 72 | xPyDict_SetItemString(armVASDict, "v4H", PyLong_FromUint32(triton::arch::arm::ID_VAS_4H)); 73 | xPyDict_SetItemString(armVASDict, "v4S", PyLong_FromUint32(triton::arch::arm::ID_VAS_4S)); 74 | xPyDict_SetItemString(armVASDict, "v2S", PyLong_FromUint32(triton::arch::arm::ID_VAS_2S)); 75 | xPyDict_SetItemString(armVASDict, "v2D", PyLong_FromUint32(triton::arch::arm::ID_VAS_2D)); 76 | xPyDict_SetItemString(armVASDict, "v1D", PyLong_FromUint32(triton::arch::arm::ID_VAS_1D)); 77 | 78 | PyObject* armVASDictClass = xPyClass_New(nullptr, armVASDict, xPyString_FromString("ARM")); 79 | xPyDict_SetItemString(vasDict, "ARM", armVASDictClass); 80 | } 81 | 82 | }; /* python namespace */ 83 | }; /* bindings namespace */ 84 | }; /* triton namespace */ 85 | -------------------------------------------------------------------------------- /src/libtriton/bindings/python/namespaces/initVersionNamespace.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | 14 | 15 | 16 | /*! \page py_VERSION_page VERSION 17 | \brief [**python api**] All information about the VERSION Python namespace. 18 | 19 | \tableofcontents 20 | 21 | \section VERSION_py_description Description 22 |
23 | 24 | The VERSION namespace contains all version numbers. 25 | 26 | \section VERSION_py_api Python API - Items of the VERSION namespace 27 |
28 | 29 | - **VERSION.BUILD** 30 | - **VERSION.MAJOR** 31 | - **VERSION.MINOR** 32 | - **VERSION.BITWUZLA_INTERFACE** 33 | - **VERSION.LLVM_INTERFACE** 34 | - **VERSION.Z3_INTERFACE** 35 | 36 | */ 37 | 38 | 39 | 40 | namespace triton { 41 | namespace bindings { 42 | namespace python { 43 | 44 | void initVersionNamespace(PyObject* versionDict) { 45 | xPyDict_SetItemString(versionDict, "MAJOR", PyLong_FromUint32(triton::MAJOR)); 46 | xPyDict_SetItemString(versionDict, "MINOR", PyLong_FromUint32(triton::MINOR)); 47 | xPyDict_SetItemString(versionDict, "BUILD", PyLong_FromUint32(triton::BUILD)); 48 | 49 | #ifdef TRITON_Z3_INTERFACE 50 | Py_INCREF(Py_True); 51 | xPyDict_SetItemString(versionDict, "Z3_INTERFACE", Py_True); 52 | #else 53 | Py_INCREF(Py_False); 54 | xPyDict_SetItemString(versionDict, "Z3_INTERFACE", Py_False); 55 | #endif 56 | 57 | #ifdef TRITON_BITWUZLA_INTERFACE 58 | Py_INCREF(Py_True); 59 | xPyDict_SetItemString(versionDict, "BITWUZLA_INTERFACE", Py_True); 60 | #else 61 | Py_INCREF(Py_False); 62 | xPyDict_SetItemString(versionDict, "BITWUZLA_INTERFACE", Py_False); 63 | #endif 64 | 65 | #ifdef TRITON_LLVM_INTERFACE 66 | Py_INCREF(Py_True); 67 | xPyDict_SetItemString(versionDict, "LLVM_INTERFACE", Py_True); 68 | #else 69 | Py_INCREF(Py_False); 70 | xPyDict_SetItemString(versionDict, "LLVM_INTERFACE", Py_False); 71 | #endif 72 | } 73 | 74 | }; /* python namespace */ 75 | }; /* bindings namespace */ 76 | }; /* triton namespace */ 77 | -------------------------------------------------------------------------------- /src/libtriton/bindings/python/pyXFunctions.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | 11 | namespace triton { 12 | namespace bindings { 13 | namespace python { 14 | 15 | static inline void notEnoughMemory(void) { 16 | std::cerr << "[ERROR] Not enough memory for allocation" << std::endl; 17 | exit(-1); 18 | } 19 | 20 | 21 | PyObject* xPyDict_New(void) { 22 | PyObject* dict = PyDict_New(); 23 | if (!dict) 24 | notEnoughMemory(); 25 | return dict; 26 | } 27 | 28 | 29 | PyObject* xPyList_New(Py_ssize_t len) { 30 | PyObject* list = PyList_New(len); 31 | if (!list) 32 | notEnoughMemory(); 33 | return list; 34 | } 35 | 36 | 37 | PyObject* xPyTuple_New(Py_ssize_t len) { 38 | PyObject* tuple = PyTuple_New(len); 39 | if (!tuple) 40 | notEnoughMemory(); 41 | return tuple; 42 | } 43 | 44 | 45 | PyObject* xPyString_FromString(const char *v) { 46 | PyObject* s = PyStr_FromString(v); 47 | if (!s) 48 | notEnoughMemory(); 49 | return s; 50 | } 51 | 52 | 53 | PyObject* xPyClass_New(PyObject* b, PyObject* d, PyObject* n) { 54 | PyObject* c = nullptr; 55 | 56 | if (b == NULL) 57 | b = PyTuple_New(0); 58 | 59 | c = PyObject_CallFunctionObjArgs((PyObject*)&PyType_Type, n, b, d, NULL); 60 | if (!c) 61 | notEnoughMemory(); 62 | 63 | Py_CLEAR(b); 64 | Py_CLEAR(d); 65 | Py_CLEAR(n); 66 | 67 | return c; 68 | } 69 | 70 | 71 | 72 | int xPyDict_SetItemString(PyObject* p, const char* key, PyObject* val) { 73 | int r = PyDict_SetItemString(p, key, val); 74 | Py_DECREF(val); 75 | return r; 76 | } 77 | 78 | 79 | int xPyDict_SetItem(PyObject* p, PyObject* key, PyObject* val) { 80 | int r = PyDict_SetItem(p, key, val); 81 | Py_DECREF(val); 82 | Py_DECREF(key); 83 | return r; 84 | } 85 | 86 | }; /* python namespace */ 87 | }; /* bindings namespace */ 88 | }; /* triton namespace */ 89 | -------------------------------------------------------------------------------- /src/libtriton/engines/lifters/liftingToLLVM.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | #include 11 | 12 | #include 13 | #include 14 | #include 15 | #include 16 | 17 | #include 18 | #include 19 | 20 | 21 | 22 | namespace triton { 23 | namespace engines { 24 | namespace lifters { 25 | 26 | LiftingToLLVM::LiftingToLLVM() { 27 | } 28 | 29 | 30 | std::ostream& LiftingToLLVM::liftToLLVM(std::ostream& stream, const triton::engines::symbolic::SharedSymbolicExpression& expr, const char* fname, bool optimize) { 31 | this->liftToLLVM(stream, expr->getAst(), fname, optimize); 32 | return stream; 33 | } 34 | 35 | 36 | std::ostream& LiftingToLLVM::liftToLLVM(std::ostream& stream, const triton::ast::SharedAbstractNode& node, const char* fname, bool optimize) { 37 | /* The LLVM context */ 38 | llvm::LLVMContext context; 39 | 40 | /* The lifter Triton -> LLVM */ 41 | triton::ast::TritonToLLVM lifter(context); 42 | 43 | /* Lift AST to LLVM IR */ 44 | auto llvmModule = lifter.convert(node, fname, optimize); 45 | 46 | /* Print the LLVM module into the stream */ 47 | std::string dump; 48 | llvm::raw_string_ostream llvmStream(dump); 49 | llvmModule->print(llvmStream, nullptr); 50 | stream << dump; 51 | 52 | return stream; 53 | } 54 | 55 | 56 | triton::ast::SharedAbstractNode LiftingToLLVM::simplifyAstViaLLVM(const triton::ast::SharedAbstractNode& node) const { 57 | llvm::LLVMContext context; 58 | 59 | triton::ast::TritonToLLVM ttllvm(context); 60 | triton::ast::LLVMToTriton llvmtt(node->getContext()); 61 | 62 | auto llvmModule = ttllvm.convert(node, "__tmp", true); /* from triton to llvm */ 63 | return llvmtt.convert(llvmModule.get(), "__tmp"); /* from llvm to triton */ 64 | } 65 | 66 | }; /* lifters namespace */ 67 | }; /* engines namespace */ 68 | }; /* triton namespace */ 69 | -------------------------------------------------------------------------------- /src/libtriton/engines/solver/solverModel.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | 10 | #include 11 | #include 12 | 13 | 14 | 15 | namespace triton { 16 | namespace engines { 17 | namespace solver { 18 | 19 | SolverModel::SolverModel() { 20 | this->value = 0; 21 | } 22 | 23 | 24 | SolverModel::SolverModel(const triton::engines::symbolic::SharedSymbolicVariable& variable, triton::uint512 value) { 25 | this->value = value; 26 | this->variable = variable; 27 | } 28 | 29 | 30 | SolverModel::SolverModel(const SolverModel& other) { 31 | this->copy(other); 32 | } 33 | 34 | 35 | void SolverModel::copy(const SolverModel& other) { 36 | this->value = other.value; 37 | this->variable = other.variable; 38 | } 39 | 40 | 41 | triton::usize SolverModel::getId(void) const { 42 | return this->variable->getId(); 43 | } 44 | 45 | 46 | triton::uint512 SolverModel::getValue(void) const { 47 | return this->value; 48 | } 49 | 50 | 51 | triton::uint32 SolverModel::getSize(void) const { 52 | return this->variable->getSize(); 53 | } 54 | 55 | 56 | const triton::engines::symbolic::SharedSymbolicVariable& SolverModel::getVariable(void) const { 57 | return this->variable; 58 | } 59 | 60 | 61 | SolverModel& SolverModel::operator=(const SolverModel& other) { 62 | this->copy(other); 63 | return *this; 64 | } 65 | 66 | 67 | bool SolverModel::operator==(const SolverModel& other) const { 68 | return (this->value == other.value && this->variable->getId() == other.variable->getId()); 69 | } 70 | 71 | 72 | std::ostream& operator<<(std::ostream& stream, const SolverModel& model) { 73 | stream << model.getVariable() << " = 0x" << std::hex << model.getValue() << std::dec; 74 | return stream; 75 | } 76 | 77 | 78 | std::ostream& operator<<(std::ostream& stream, const SolverModel* model) { 79 | stream << *model; 80 | return stream; 81 | } 82 | 83 | }; 84 | }; 85 | }; 86 | -------------------------------------------------------------------------------- /src/libtriton/engines/synthesis/synthesisResult.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | 10 | 11 | 12 | namespace triton { 13 | namespace engines { 14 | namespace synthesis { 15 | 16 | SynthesisResult::SynthesisResult() { 17 | this->input = nullptr; 18 | this->output = nullptr; 19 | this->success = false; 20 | this->time = 0; 21 | } 22 | 23 | 24 | SynthesisResult::SynthesisResult(const SynthesisResult& other) { 25 | this->input = other.input; 26 | this->output = other.output; 27 | this->success = other.success; 28 | this->time = other.time; 29 | } 30 | 31 | 32 | SynthesisResult& SynthesisResult::operator=(const SynthesisResult& other) { 33 | this->input = other.input; 34 | this->output = other.output; 35 | this->success = other.success; 36 | this->time = other.time; 37 | 38 | return *this; 39 | } 40 | 41 | 42 | void SynthesisResult::setInput(const triton::ast::SharedAbstractNode& input) { 43 | this->input = input; 44 | } 45 | 46 | 47 | void SynthesisResult::setOutput(const triton::ast::SharedAbstractNode& output) { 48 | this->output = output; 49 | } 50 | 51 | 52 | void SynthesisResult::setTime(triton::usize ms) { 53 | this->time = ms; 54 | } 55 | 56 | 57 | const triton::ast::SharedAbstractNode SynthesisResult::getInput(void) { 58 | return this->input; 59 | } 60 | 61 | 62 | const triton::ast::SharedAbstractNode SynthesisResult::getOutput(void) { 63 | return this->output; 64 | } 65 | 66 | 67 | triton::usize SynthesisResult::getTime(void) { 68 | return this->time; 69 | } 70 | 71 | 72 | bool SynthesisResult::successful(void) { 73 | return this->success; 74 | } 75 | 76 | 77 | void SynthesisResult::setSuccess(bool flag) { 78 | this->success = flag; 79 | } 80 | 81 | }; /* synthesis namespace */ 82 | }; /* engines namespace */ 83 | }; /* triton namespace */ 84 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/arm32.spec: -------------------------------------------------------------------------------- 1 | #pragma warning(disable:4067) 2 | 3 | #if not (defined REG_SPEC || defined REG_SPEC_NO_CAPSTONE) 4 | #error REG_SPEC have to be specified before including specs 5 | #endif 6 | 7 | #define TT_MUTABLE_REG true 8 | #define TT_IMMUTABLE_REG false 9 | 10 | // REG_SPEC(UPPER_NAME, LOWER_NAME, ARM32_UPPER, ARM32_LOWER, ARM32_PARENT, MUTABLE) 11 | 12 | // Thirteen general-purpose 32-bit registers, R0 to R12 13 | REG_SPEC(R0, r0, triton::bitsize::dword-1, 0, R0, TT_MUTABLE_REG) // r0 14 | REG_SPEC(R1, r1, triton::bitsize::dword-1, 0, R1, TT_MUTABLE_REG) // r1 15 | REG_SPEC(R2, r2, triton::bitsize::dword-1, 0, R2, TT_MUTABLE_REG) // r2 16 | REG_SPEC(R3, r3, triton::bitsize::dword-1, 0, R3, TT_MUTABLE_REG) // r3 17 | REG_SPEC(R4, r4, triton::bitsize::dword-1, 0, R4, TT_MUTABLE_REG) // r4 18 | REG_SPEC(R5, r5, triton::bitsize::dword-1, 0, R5, TT_MUTABLE_REG) // r5 19 | REG_SPEC(R6, r6, triton::bitsize::dword-1, 0, R6, TT_MUTABLE_REG) // r6 20 | REG_SPEC(R7, r7, triton::bitsize::dword-1, 0, R7, TT_MUTABLE_REG) // r7 21 | REG_SPEC(R8, r8, triton::bitsize::dword-1, 0, R8, TT_MUTABLE_REG) // r8 22 | REG_SPEC(R9, r9, triton::bitsize::dword-1, 0, R9, TT_MUTABLE_REG) // r9 23 | REG_SPEC(R10, r10, triton::bitsize::dword-1, 0, R10, TT_MUTABLE_REG) // r10 24 | REG_SPEC(R11, r11, triton::bitsize::dword-1, 0, R11, TT_MUTABLE_REG) // r11 25 | REG_SPEC(R12, r12, triton::bitsize::dword-1, 0, R12, TT_MUTABLE_REG) // r12 26 | 27 | // Three 32-bit registers with special uses, SP, LR, and PC, that can be described as R13 to R15. 28 | REG_SPEC(SP, sp, triton::bitsize::dword-1, 0, SP, TT_MUTABLE_REG) // SP 29 | REG_SPEC(R14, r14, triton::bitsize::dword-1, 0, R14, TT_MUTABLE_REG) // LR (r14) 30 | REG_SPEC(PC, pc, triton::bitsize::dword-1, 0, PC, TT_MUTABLE_REG) // PC 31 | REG_SPEC(APSR, apsr, triton::bitsize::dword-1, 0, APSR, TT_MUTABLE_REG) // APSR 32 | 33 | // Unique flag registers 34 | REG_SPEC_NO_CAPSTONE(C, c, 0, 0, C, TT_MUTABLE_REG) // C (Carry) 35 | REG_SPEC_NO_CAPSTONE(N, n, 0, 0, N, TT_MUTABLE_REG) // N (Negative) 36 | REG_SPEC_NO_CAPSTONE(V, v, 0, 0, V, TT_MUTABLE_REG) // V (Overflow) 37 | REG_SPEC_NO_CAPSTONE(Z, z, 0, 0, Z, TT_MUTABLE_REG) // Z (Zero) 38 | 39 | #undef REG_SPEC 40 | #undef REG_SPEC_NO_CAPSTONE 41 | #undef TT_IMMUTABLE_REG 42 | #undef TT_MUTABLE_REG 43 | 44 | #pragma warning(default:4067) 45 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/astRepresentation.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_ASTREPRESENTATION_H 9 | #define TRITON_ASTREPRESENTATION_H 10 | 11 | #include 12 | #include 13 | 14 | #include 15 | #include 16 | #include 17 | #include 18 | 19 | 20 | 21 | //! The Triton namespace 22 | namespace triton { 23 | /*! 24 | * \addtogroup triton 25 | * @{ 26 | */ 27 | 28 | //! The AST namespace 29 | namespace ast { 30 | /*! 31 | * \ingroup triton 32 | * \addtogroup ast 33 | * @{ 34 | */ 35 | 36 | //! The Representations namespace 37 | namespace representations { 38 | /*! 39 | * \ingroup ast 40 | * \addtogroup representations 41 | * @{ 42 | */ 43 | 44 | //! Pseudo code of SMT AST. 45 | class AstRepresentation { 46 | protected: 47 | //! The representation mode. 48 | triton::ast::representations::mode_e mode; 49 | 50 | //! AstRepresentation interface. 51 | std::unique_ptr representations[triton::ast::representations::LAST_REPRESENTATION]; 52 | 53 | public: 54 | //! Constructor. 55 | TRITON_EXPORT AstRepresentation(); 56 | 57 | //! Constructor. 58 | TRITON_EXPORT AstRepresentation(const AstRepresentation& other); 59 | 60 | //! Operator. 61 | TRITON_EXPORT AstRepresentation& operator=(const AstRepresentation& other); 62 | 63 | //! Returns the representation mode. 64 | TRITON_EXPORT triton::ast::representations::mode_e getMode(void) const; 65 | 66 | //! Sets the representation mode. 67 | TRITON_EXPORT void setMode(triton::ast::representations::mode_e mode); 68 | 69 | //! Prints the node according to the current representation mode. 70 | TRITON_EXPORT std::ostream& print(std::ostream& stream, AbstractNode* node); 71 | }; 72 | 73 | /*! @} End of representations namespace */ 74 | }; 75 | /*! @} End of ast namespace */ 76 | }; 77 | /*! @} End of triton namespace */ 78 | }; 79 | 80 | #endif /* TRITON_ASTREPRESENTATION_H */ 81 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/astRepresentationInterface.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_ASTREPRESENTATIONINTERFACE_HPP 9 | #define TRITON_ASTREPRESENTATIONINTERFACE_HPP 10 | 11 | #include 12 | 13 | #include 14 | #include 15 | 16 | 17 | 18 | //! The Triton namespace 19 | namespace triton { 20 | /*! 21 | * \addtogroup triton 22 | * @{ 23 | */ 24 | 25 | //! The AST namespace 26 | namespace ast { 27 | /*! 28 | * \ingroup triton 29 | * \addtogroup ast 30 | * @{ 31 | */ 32 | 33 | //! The Representations namespace 34 | namespace representations { 35 | /*! 36 | * \ingroup ast 37 | * \addtogroup representations 38 | * @{ 39 | */ 40 | 41 | /*! 42 | * \interface AstRepresentationInterface 43 | * \brief The AST representation interface. 44 | */ 45 | class AstRepresentationInterface { 46 | public: 47 | //! Constructor. 48 | TRITON_EXPORT virtual ~AstRepresentationInterface(){}; 49 | //! Entry point of print. 50 | TRITON_EXPORT virtual std::ostream& print(std::ostream& stream, triton::ast::AbstractNode* node) = 0; 51 | }; 52 | 53 | /*! @} End of representations namespace */ 54 | }; 55 | /*! @} End of ast namespace */ 56 | }; 57 | /*! @} End of triton namespace */ 58 | }; 59 | 60 | #endif /* TRITON_ASTREPRESENTATIONINTERFACE_HPP */ 61 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/basicBlock.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_BASICBLOCK_HPP 9 | #define TRITON_BASICBLOCK_HPP 10 | 11 | #include 12 | #include 13 | 14 | #include 15 | #include 16 | #include 17 | 18 | 19 | 20 | //! The Triton namespace 21 | namespace triton { 22 | /*! 23 | * \addtogroup triton 24 | * @{ 25 | */ 26 | 27 | //! The Triton namespace 28 | namespace arch { 29 | /*! 30 | * \ingroup triton 31 | * \addtogroup arch 32 | * @{ 33 | */ 34 | 35 | /*! \class BasicBlock 36 | * \brief This class is used to represent a basic block 37 | */ 38 | class BasicBlock { 39 | private: 40 | std::vector instructions; 41 | 42 | public: 43 | //! Constructor. 44 | TRITON_EXPORT BasicBlock(); 45 | 46 | //! Constructor. 47 | TRITON_EXPORT BasicBlock(const std::vector& instructions); 48 | 49 | //! Constructor by copy. 50 | TRITON_EXPORT BasicBlock(const BasicBlock& other); 51 | 52 | //! Copies an BasicBlock. 53 | TRITON_EXPORT BasicBlock& operator=(const BasicBlock& other); 54 | 55 | //! Destructor. 56 | TRITON_EXPORT ~BasicBlock(); 57 | 58 | //! Add an instruction to the block 59 | TRITON_EXPORT void add(const Instruction& instruction); 60 | 61 | //! Remove an instruction from the block at the given position. Returns true if success. 62 | TRITON_EXPORT bool remove(triton::uint32 position); 63 | 64 | //! Gets all instructions of the block 65 | TRITON_EXPORT std::vector& getInstructions(void); 66 | 67 | //! Returns the number of instructions in the block 68 | TRITON_EXPORT triton::usize getSize(void) const; 69 | 70 | //! Returns the first instruction's address 71 | TRITON_EXPORT triton::uint64 getFirstAddress(void) const; 72 | 73 | //! Returns the last instruction's address 74 | TRITON_EXPORT triton::uint64 getLastAddress(void) const; 75 | }; 76 | 77 | //! Displays an BasicBlock. 78 | TRITON_EXPORT std::ostream& operator<<(std::ostream& stream, BasicBlock& block); 79 | 80 | //! Displays an BasicBlock. 81 | TRITON_EXPORT std::ostream& operator<<(std::ostream& stream, BasicBlock* block); 82 | 83 | /*! @} End of arch namespace */ 84 | }; 85 | /*! @} End of triton namespace */ 86 | }; 87 | 88 | #endif /* TRITON_BASICBLOCK_HPP */ 89 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/bitsVector.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_BITSVECTOR_H 9 | #define TRITON_BITSVECTOR_H 10 | 11 | #include 12 | 13 | #include 14 | #include 15 | 16 | 17 | 18 | //! The Triton namespace 19 | namespace triton { 20 | /*! 21 | * \addtogroup triton 22 | * @{ 23 | */ 24 | 25 | //! The Architecture namespace 26 | namespace arch { 27 | /*! 28 | * \ingroup triton 29 | * \addtogroup arch 30 | * @{ 31 | */ 32 | 33 | /*! \class BitsVector 34 | * \brief This class is used to deal with registers and memory as bits vector. 35 | */ 36 | class BitsVector { 37 | protected: 38 | //! The highest bit of the bitvector 39 | triton::uint32 high; 40 | 41 | //! The lower bit of the bitvector 42 | triton::uint32 low; 43 | 44 | public: 45 | //! Constructor. 46 | TRITON_EXPORT BitsVector(); 47 | 48 | //! Constructor. 49 | TRITON_EXPORT BitsVector(triton::uint32 high, triton::uint32 low); 50 | 51 | //! Constructor by copy. 52 | TRITON_EXPORT BitsVector(const triton::arch::BitsVector& other); 53 | 54 | //! Copy a BitsVector. 55 | TRITON_EXPORT BitsVector& operator=(const BitsVector& other); 56 | 57 | //! Returns the highest bit 58 | TRITON_EXPORT triton::uint32 getHigh(void) const; 59 | 60 | //! Returns the lower bit 61 | TRITON_EXPORT triton::uint32 getLow(void) const; 62 | 63 | //! Returns the size in bits of the vector 64 | TRITON_EXPORT triton::uint32 getVectorSize(void) const; 65 | 66 | //! Returns the max possible value of the bitvector. 67 | TRITON_EXPORT triton::uint512 getMaxValue(void) const; 68 | 69 | //! Sets the highest bit position 70 | TRITON_EXPORT void setHigh(triton::uint32 v); 71 | 72 | //! Sets the lower bit position 73 | TRITON_EXPORT void setLow(triton::uint32 v); 74 | 75 | //! Sets the bits (high, low) position 76 | TRITON_EXPORT void setBits(triton::uint32 high, triton::uint32 low); 77 | }; 78 | 79 | //! Displays a BitsVector. 80 | TRITON_EXPORT std::ostream& operator<<(std::ostream& stream, const BitsVector& bv); 81 | 82 | //! Displays a BitsVector. 83 | TRITON_EXPORT std::ostream& operator<<(std::ostream& stream, const BitsVector* bv); 84 | 85 | /*! @} End of arch namespace */ 86 | }; 87 | /*! @} End of triton namespace */ 88 | }; 89 | 90 | #endif /* TRITON_BITSVECTOR_H */ 91 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/callbacksEnums.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_CALLBACKSENUMS_HPP 9 | #define TRITON_CALLBACKSENUMS_HPP 10 | 11 | 12 | 13 | //! The Triton namespace 14 | namespace triton { 15 | /*! 16 | * \addtogroup triton 17 | * @{ 18 | */ 19 | 20 | //! The Callbacks namespace 21 | namespace callbacks { 22 | /*! 23 | * \ingroup triton 24 | * \addtogroup callbacks 25 | * @{ 26 | */ 27 | 28 | /*! Enumerates all kinds callbacks. */ 29 | enum callback_e { 30 | GET_CONCRETE_MEMORY_VALUE, /*!< LOAD concrete memory value callback */ 31 | GET_CONCRETE_REGISTER_VALUE, /*!< GET concrete register value callback */ 32 | SET_CONCRETE_MEMORY_VALUE, /*!< STORE concrete memory value callback */ 33 | SET_CONCRETE_REGISTER_VALUE, /*!< PUT concrete register value callback */ 34 | SYMBOLIC_SIMPLIFICATION, /*!< Symbolic simplification callback */ 35 | }; 36 | 37 | /*! @} End of callbacks namespace */ 38 | }; 39 | /*! @} End of triton namespace */ 40 | }; 41 | 42 | #endif /* TRITON_CALLBACKSENUMS_HPP */ 43 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/comparableFunctor.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_COMPARABLE_FUNCTOR_H 9 | #define TRITON_COMPARABLE_FUNCTOR_H 10 | 11 | #include 12 | #include 13 | 14 | 15 | 16 | //! The Triton namespace 17 | namespace triton { 18 | /*! 19 | * \addtogroup triton 20 | * @{ 21 | */ 22 | 23 | /*! 24 | * \class ComparableFunctor 25 | * \details This Helper class is a wrapper around a std::function adding a comparison operator 26 | * to make it searchable in a list even with lambda function. 27 | */ 28 | template 29 | struct ComparableFunctor { 30 | private: 31 | //! The functor use when called 32 | std::function F_; 33 | 34 | //! Id use for functor comparison 35 | void* ID_; 36 | 37 | public: 38 | //! Constructor 39 | ComparableFunctor(std::function F, void* ID) 40 | : F_(std::move(F)), ID_(ID) { 41 | } 42 | 43 | //! Constructor 44 | ComparableFunctor(Signature* F) 45 | : F_(F), ID_((void*)F) { 46 | } 47 | 48 | //! Forward call to real functor 49 | template 50 | auto operator()(apiType& api) const -> decltype(F_(api)) { 51 | return F_(api); 52 | } 53 | 54 | //! Forward call to real functor 55 | template 56 | auto operator()(apiType& api, paramType& param) const -> decltype(F_(api, param)) { 57 | return F_(api, param); 58 | } 59 | 60 | //! Forward call to real functor 61 | template 62 | auto operator()(apiType& api, paramType1& param1, paramType2& param2) const -> decltype(F_(api, param1, param2)) { 63 | /* We don't use C++ variadic templates to support VS2013... */ 64 | return F_(api, param1, param2); 65 | } 66 | 67 | //! Comparison of functor based on id 68 | template 69 | bool operator==(const ComparableFunctor& O) const { 70 | return this->ID_ == O.ID_; 71 | } 72 | 73 | //! Comparison of functor based on id 74 | template 75 | bool operator!=(const ComparableFunctor& O) const { 76 | return !(this->ID_ == O.ID_); 77 | } 78 | }; 79 | /*! @} End of triton namespace */ 80 | } 81 | 82 | #endif 83 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/config.hpp.in: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_CONFIG_HPP 9 | #define TRITON_CONFIG_HPP 10 | 11 | #cmakedefine TRITON_BITWUZLA_INTERFACE 12 | #cmakedefine TRITON_BOOST_INTERFACE 13 | #cmakedefine TRITON_LLVM_INTERFACE 14 | #cmakedefine TRITON_Z3_INTERFACE 15 | 16 | #endif // TRITON_CONFIG_HPP 17 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/cpuSize.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_CPUSIZE_H 9 | #define TRITON_CPUSIZE_H 10 | 11 | #include 12 | 13 | 14 | 15 | //! The Triton namespace 16 | namespace triton { 17 | /*! 18 | * \addtogroup triton 19 | * @{ 20 | */ 21 | 22 | //! The Size namespace 23 | namespace size { 24 | /*! 25 | * \ingroup triton 26 | * \addtogroup size 27 | * @{ 28 | */ 29 | //! byte size in byte 30 | constexpr triton::uint32 byte = 1; 31 | //! word size in byte 32 | constexpr triton::uint32 word = 2; 33 | //! dword size in byte 34 | constexpr triton::uint32 dword = 4; 35 | //! qword size in byte 36 | constexpr triton::uint32 qword = 8; 37 | //! fword size in byte 38 | constexpr triton::uint32 fword = 10; 39 | //! dqword size in byte 40 | constexpr triton::uint32 dqword = 16; 41 | //! qqword size in byte 42 | constexpr triton::uint32 qqword = 32; 43 | //! dqqword size in byte 44 | constexpr triton::uint32 dqqword = 64; 45 | //! max size supported in byte 46 | constexpr triton::uint32 max_supported = dqqword; 47 | /*! @} End of size namespace */ 48 | }; 49 | 50 | //! The BitSize namespace 51 | namespace bitsize { 52 | /*! 53 | * \ingroup triton 54 | * \addtogroup bitsize 55 | * @{ 56 | */ 57 | //! flag size in bit 58 | constexpr triton::uint32 flag = 1; 59 | //! byte size in bit 60 | constexpr triton::uint32 byte = 8; 61 | //! word size in bit 62 | constexpr triton::uint32 word = 16; 63 | //! dword size in bit 64 | constexpr triton::uint32 dword = 32; 65 | //! qword size in bit 66 | constexpr triton::uint32 qword = 64; 67 | //! fword size in bit 68 | constexpr triton::uint32 fword = 80; 69 | //! dqword size in bit 70 | constexpr triton::uint32 dqword = 128; 71 | //! qqword size in bit 72 | constexpr triton::uint32 qqword = 256; 73 | //! dqqword size in bit 74 | constexpr triton::uint32 dqqword = 512; 75 | //! max size supported in bit 76 | constexpr triton::uint32 max_supported = dqqword; 77 | /*! @} End of bitsize namespace */ 78 | }; 79 | 80 | /*! @} End of triton namespace */ 81 | }; 82 | 83 | #endif /* TRITON_CPUSIZE_H */ 84 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/dllexport.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_DLLEXPORT_H 9 | #define TRITON_DLLEXPORT_H 10 | 11 | #if defined _WIN32 || defined __CYGWIN__ 12 | #ifdef BUILDING_DLL 13 | #ifdef __GNUC__ 14 | #define TRITON_EXPORT __attribute__ ((dllexport)) 15 | #else 16 | #define TRITON_EXPORT __declspec(dllexport) // Note: actually gcc seems to also supports this syntax. 17 | #endif 18 | #else 19 | #ifdef __GNUC__ 20 | #define TRITON_EXPORT __attribute__ ((dllimport)) 21 | #else 22 | #define TRITON_EXPORT 23 | #endif 24 | #endif 25 | #else 26 | #if __GNUC__ >= 4 27 | #define TRITON_EXPORT __attribute__ ((visibility ("default"))) 28 | #else 29 | #define TRITON_EXPORT 30 | #endif 31 | #endif 32 | 33 | #endif /* TRITON_DLLEXPORT_H */ 34 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/externalLibs.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_EXTERNALLIBS_HPP 9 | #define TRITON_EXTERNALLIBS_HPP 10 | 11 | 12 | 13 | //! The Triton namespace 14 | namespace triton { 15 | /*! 16 | * \addtogroup triton 17 | * @{ 18 | */ 19 | //! The external libraries namespace 20 | namespace extlibs { 21 | /*! 22 | * \addtogroup triton 23 | * @{ 24 | */ 25 | 26 | //! The Capstone library namespace 27 | namespace capstone { 28 | /*! 29 | * \addtogroup extlibs 30 | * @{ 31 | */ 32 | #include 33 | #include 34 | #include 35 | #include 36 | #include 37 | /*! @} End of capstone namespace */ 38 | }; 39 | 40 | /*! @} End of extlibs namespace */ 41 | }; 42 | /*! @} End of triton namespace */ 43 | }; 44 | 45 | #endif /* TRITON_EXTERNALLIBS_HPP */ 46 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/liftingEngine.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_LIFTINGENGINE_HPP 9 | #define TRITON_LIFTINGENGINE_HPP 10 | 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | 20 | #ifdef TRITON_LLVM_INTERFACE 21 | #include 22 | #endif 23 | 24 | 25 | 26 | //! The Triton namespace 27 | namespace triton { 28 | /*! 29 | * \addtogroup triton 30 | * @{ 31 | */ 32 | 33 | //! The Engines namespace 34 | namespace engines { 35 | /*! 36 | * \ingroup triton 37 | * \addtogroup engines 38 | * @{ 39 | */ 40 | 41 | //! The Lifters namespace 42 | namespace lifters { 43 | /*! 44 | * \ingroup engines 45 | * \addtogroup lifters 46 | * @{ 47 | */ 48 | 49 | //! \class LiftingEngine 50 | /*! \brief The lifting engine class. */ 51 | class LiftingEngine 52 | : public LiftingToSMT, 53 | public LiftingToDot, 54 | #ifdef TRITON_LLVM_INTERFACE 55 | public LiftingToLLVM, 56 | #endif 57 | public LiftingToPython { 58 | 59 | public: 60 | //! Constructor. 61 | TRITON_EXPORT LiftingEngine(const triton::ast::SharedAstContext& astCtxt, triton::engines::symbolic::SymbolicEngine* symbolic) 62 | : LiftingToSMT(astCtxt, symbolic), 63 | LiftingToDot(astCtxt, symbolic), 64 | #ifdef TRITON_LLVM_INTERFACE 65 | LiftingToLLVM(), 66 | #endif 67 | LiftingToPython(astCtxt, symbolic) { 68 | }; 69 | }; 70 | 71 | /*! @} End of lifters namespace */ 72 | }; 73 | /*! @} End of engines namespace */ 74 | }; 75 | /*! @} End of triton namespace */ 76 | }; 77 | 78 | #endif /* TRITON_LIFTINGENGINE_HPP */ 79 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/liftingToLLVM.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_LIFTINGTOLLVM_HPP 9 | #define TRITON_LIFTINGTOLLVM_HPP 10 | 11 | #include 12 | #include 13 | #include 14 | 15 | #include 16 | #include 17 | #include 18 | 19 | 20 | 21 | //! The Triton namespace 22 | namespace triton { 23 | /*! 24 | * \addtogroup triton 25 | * @{ 26 | */ 27 | 28 | //! The Engines namespace 29 | namespace engines { 30 | /*! 31 | * \ingroup triton 32 | * \addtogroup engines 33 | * @{ 34 | */ 35 | 36 | //! The Lifters namespace 37 | namespace lifters { 38 | /*! 39 | * \ingroup engines 40 | * \addtogroup lifters 41 | * @{ 42 | */ 43 | 44 | //! \class LiftingToLLVM 45 | /*! \brief The lifting to LLVM class. */ 46 | class LiftingToLLVM { 47 | public: 48 | //! Constructor. 49 | TRITON_EXPORT LiftingToLLVM(); 50 | 51 | //! Lifts a symbolic expression and all its references to LLVM format. `fname` represents the name of the LLVM function. 52 | TRITON_EXPORT std::ostream& liftToLLVM(std::ostream& stream, const triton::engines::symbolic::SharedSymbolicExpression& expr, const char* fname="__triton", bool optimize=false); 53 | 54 | //! Lifts a abstract node and all its references to LLVM format. `fname` represents the name of the LLVM function. 55 | TRITON_EXPORT std::ostream& liftToLLVM(std::ostream& stream, const triton::ast::SharedAbstractNode& node, const char* fname="__triton", bool optimize=false); 56 | 57 | //! Lifts and simplify an AST using LLVM 58 | TRITON_EXPORT triton::ast::SharedAbstractNode simplifyAstViaLLVM(const triton::ast::SharedAbstractNode& node) const; 59 | }; 60 | 61 | /*! @} End of lifters namespace */ 62 | }; 63 | /*! @} End of engines namespace */ 64 | }; 65 | /*! @} End of triton namespace */ 66 | }; 67 | 68 | #endif /* TRITON_LIFTINGTOLLVM_HPP */ 69 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/liftingToPython.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_LIFTINGTOPYTHON_HPP 9 | #define TRITON_LIFTINGTOPYTHON_HPP 10 | 11 | #include 12 | 13 | #include 14 | #include 15 | #include 16 | #include 17 | 18 | 19 | 20 | //! The Triton namespace 21 | namespace triton { 22 | /*! 23 | * \addtogroup triton 24 | * @{ 25 | */ 26 | 27 | //! The Engines namespace 28 | namespace engines { 29 | /*! 30 | * \ingroup triton 31 | * \addtogroup engines 32 | * @{ 33 | */ 34 | 35 | //! The Lifters namespace 36 | namespace lifters { 37 | /*! 38 | * \ingroup engines 39 | * \addtogroup lifters 40 | * @{ 41 | */ 42 | 43 | //! \class LiftingToPython 44 | /*! \brief The lifting to Python class. */ 45 | class LiftingToPython { 46 | private: 47 | //! Reference to the context managing ast nodes. 48 | triton::ast::SharedAstContext astCtxt; 49 | 50 | //! Instance to the symbolic engine. 51 | triton::engines::symbolic::SymbolicEngine* symbolic; 52 | 53 | //! Define required functions like ror, rol, sx and forall 54 | void requiredFunctions(std::ostream& stream); 55 | 56 | public: 57 | //! Constructor. 58 | TRITON_EXPORT LiftingToPython(const triton::ast::SharedAstContext& astCtxt, triton::engines::symbolic::SymbolicEngine* symbolic); 59 | 60 | //! Lifts a symbolic expression and all its references to Python format. If `icomment` is true, then print instructions assembly in expression comments. 61 | TRITON_EXPORT std::ostream& liftToPython(std::ostream& stream, const triton::engines::symbolic::SharedSymbolicExpression& expr, bool icomment=false); 62 | }; 63 | 64 | /*! @} End of lifters namespace */ 65 | }; 66 | /*! @} End of engines namespace */ 67 | }; 68 | /*! @} End of triton namespace */ 69 | }; 70 | 71 | #endif /* TRITON_LIFTINGTOPYTHON_HPP */ 72 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/liftingToSMT.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_LIFTINGTOSMT_HPP 9 | #define TRITON_LIFTINGTOSMT_HPP 10 | 11 | #include 12 | 13 | #include 14 | #include 15 | #include 16 | #include 17 | 18 | 19 | 20 | //! The Triton namespace 21 | namespace triton { 22 | /*! 23 | * \addtogroup triton 24 | * @{ 25 | */ 26 | 27 | //! The Engines namespace 28 | namespace engines { 29 | /*! 30 | * \ingroup triton 31 | * \addtogroup engines 32 | * @{ 33 | */ 34 | 35 | //! The Lifters namespace 36 | namespace lifters { 37 | /*! 38 | * \ingroup engines 39 | * \addtogroup lifters 40 | * @{ 41 | */ 42 | 43 | //! \class LiftingToSMT 44 | /*! \brief The lifting to SMT class. */ 45 | class LiftingToSMT { 46 | private: 47 | //! Reference to the context managing ast nodes. 48 | triton::ast::SharedAstContext astCtxt; 49 | 50 | //! Instance to the symbolic engine. 51 | triton::engines::symbolic::SymbolicEngine* symbolic; 52 | 53 | //! Define required functions like bswap 54 | void requiredFunctions(std::ostream& stream); 55 | 56 | public: 57 | //! Constructor. 58 | TRITON_EXPORT LiftingToSMT(const triton::ast::SharedAstContext& astCtxt, triton::engines::symbolic::SymbolicEngine* symbolic); 59 | 60 | //! Lifts a symbolic expression and all its references to SMT format. If `assert_` is true, then (assert ). If `icomment` is true, then print instructions assembly in expression comments. 61 | TRITON_EXPORT std::ostream& liftToSMT(std::ostream& stream, const triton::engines::symbolic::SharedSymbolicExpression& expr, bool assert_=false, bool icomment=false); 62 | }; 63 | 64 | /*! @} End of lifters namespace */ 65 | }; 66 | /*! @} End of engines namespace */ 67 | }; 68 | /*! @} End of triton namespace */ 69 | }; 70 | 71 | #endif /* LIFTINGTOSMT_HPP */ 72 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/llvmToTriton.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | // 8 | 9 | #ifndef TRITON_LLVMTOTRITON_HPP 10 | #define TRITON_LLVMTOTRITON_HPP 11 | 12 | #include 13 | #include 14 | #include 15 | 16 | #include 17 | 18 | #include 19 | #include 20 | #include 21 | 22 | 23 | 24 | //! The Triton namespace 25 | namespace triton { 26 | /*! 27 | * \addtogroup triton 28 | * @{ 29 | */ 30 | 31 | //! The AST namespace 32 | namespace ast { 33 | /*! 34 | * \ingroup triton 35 | * \addtogroup ast 36 | * @{ 37 | */ 38 | 39 | //! \class LLVMToTriton 40 | /*! \brief Converts a LLVM IR to a Triton AST. */ 41 | class LLVMToTriton { 42 | private: 43 | //! The Triton AST context. 44 | triton::ast::SharedAstContext actx; 45 | 46 | //! The Triton Context. 47 | triton::Context* ctx; 48 | 49 | //! Map of triton symbolic variables. 50 | std::map symvars; 51 | 52 | //! Converts nodes. 53 | triton::ast::SharedAbstractNode do_convert(llvm::Value* llvmnode); 54 | 55 | //! Gets or creates new symbolic variable. 56 | triton::ast::SharedAbstractNode var(const std::string& name, triton::uint32 varSize); 57 | 58 | public: 59 | //! Constructor. 60 | TRITON_EXPORT LLVMToTriton(triton::Context& ctx); 61 | 62 | //! Constructor. 63 | TRITON_EXPORT LLVMToTriton(const triton::ast::SharedAstContext& actx); 64 | 65 | //! Converts a given function from an LLVM module to a Triton AST. 66 | TRITON_EXPORT triton::ast::SharedAbstractNode convert(llvm::Module* llvmModule, const char* fname="__triton"); 67 | 68 | //! Converts an LLVM instruction function to a Triton AST. 69 | TRITON_EXPORT triton::ast::SharedAbstractNode convert(llvm::Value* instruction); 70 | }; 71 | 72 | /*! @} End of ast namespace */ 73 | }; 74 | /*! @} End of triton namespace */ 75 | }; 76 | 77 | #endif /* TRITON_LLVMTOTRITON_HPP */ 78 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/modes.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_MODES_H 9 | #define TRITON_MODES_H 10 | 11 | #include 12 | #include 13 | 14 | #include 15 | #include 16 | 17 | 18 | 19 | //! The Triton namespace 20 | namespace triton { 21 | /*! 22 | * \addtogroup triton 23 | * @{ 24 | */ 25 | 26 | //! The Modes namespace 27 | namespace modes { 28 | /*! 29 | * \ingroup triton 30 | * \addtogroup modes 31 | * @{ 32 | */ 33 | 34 | //! \class Modes 35 | /*! \brief The modes class */ 36 | class Modes { 37 | private: 38 | //! Copies a Modes. 39 | void copy(const Modes& other); 40 | 41 | protected: 42 | //! The set of enabled modes 43 | std::unordered_set enabledModes; 44 | 45 | public: 46 | //! Constructor. 47 | TRITON_EXPORT Modes(); 48 | 49 | //! Constructor. 50 | TRITON_EXPORT Modes(const Modes& other); 51 | 52 | //! Copies a Modes. 53 | TRITON_EXPORT Modes& operator=(const Modes& other); 54 | 55 | //! Returns true if the mode is enabled. 56 | TRITON_EXPORT bool isModeEnabled(triton::modes::mode_e mode) const; 57 | 58 | //! Enables or disables a specific mode. 59 | TRITON_EXPORT void setMode(triton::modes::mode_e mode, bool flag); 60 | 61 | //! Clears recorded modes. 62 | TRITON_EXPORT void clearModes(void); 63 | }; 64 | 65 | //! Shared Modes. 66 | using SharedModes = std::shared_ptr; 67 | 68 | /*! @} End of modes namespace */ 69 | }; 70 | /*! @} End of triton namespace */ 71 | }; 72 | 73 | #endif /* TRITON_MODES_H */ 74 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/modesEnums.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_MODES_HPP 9 | #define TRITON_MODES_HPP 10 | 11 | 12 | 13 | //! The Triton namespace 14 | namespace triton { 15 | /*! 16 | * \addtogroup triton 17 | * @{ 18 | */ 19 | 20 | //! The Modes namespace 21 | namespace modes { 22 | /*! 23 | * \ingroup triton 24 | * \addtogroup modes 25 | * @{ 26 | */ 27 | 28 | //! Enumerates all kinds of mode. 29 | enum mode_e { 30 | ALIGNED_MEMORY, //!< [symbolic] Keep a map of aligned memory. 31 | AST_OPTIMIZATIONS, //!< [AST] Classical arithmetic optimisations to reduce the depth of the trees. 32 | CONCRETIZE_UNDEFINED_REGISTERS, //!< [symbolic] Concretize every registers tagged as undefined (see #750). 33 | CONSTANT_FOLDING, //!< [symbolic] Perform a constant folding optimization of sub ASTs which do not contain symbolic variables. 34 | MEMORY_ARRAY, //!< [symbolic] Enable memory symbolic array 35 | ONLY_ON_SYMBOLIZED, //!< [symbolic] Perform symbolic execution only on symbolized expressions. 36 | ONLY_ON_TAINTED, //!< [symbolic] Perform symbolic execution only on tainted instructions. 37 | PC_TRACKING_SYMBOLIC, //!< [symbolic] Track path constraints only if they are symbolized. 38 | SYMBOLIZE_INDEX_ROTATION, //!< [symbolic] Symbolize index rotation for bvrol and bvror (see #751). This mode increases the complexity of solving. 39 | SYMBOLIZE_LOAD, //!< [symbolic] Symbolize memory load if memory array is enabled 40 | SYMBOLIZE_STORE, //!< [symbolic] Symbolize memory store if memory array is enabled 41 | TAINT_THROUGH_POINTERS, //!< [taint] Spread the taint if an index pointer is already tainted (see #725). 42 | }; 43 | 44 | /*! @} End of modes namespace */ 45 | }; 46 | /*! @} End of triton namespace */ 47 | }; 48 | 49 | namespace std { 50 | //! Define the hash function for mode_e to be use in stl containers like unordered_set 51 | template <> struct hash : public hash { 52 | }; 53 | }; 54 | 55 | #endif /* TRITON_MODES_HPP */ 56 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/pythonUtils.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_PYTHONUTILS_H 9 | #define TRITON PYTHONUTILS_H 10 | 11 | #include 12 | #include 13 | 14 | 15 | 16 | //! The Triton namespace 17 | namespace triton { 18 | /*! 19 | * \addtogroup triton 20 | * @{ 21 | */ 22 | 23 | //! The Bindings namespace 24 | namespace bindings { 25 | /*! 26 | * \ingroup triton 27 | * \addtogroup bindings 28 | * @{ 29 | */ 30 | 31 | //! The Python namespace 32 | namespace python { 33 | /*! 34 | * \ingroup bindings 35 | * \addtogroup python 36 | * @{ 37 | */ 38 | 39 | //! Returns a bool from a pyObject. 40 | bool PyLong_AsBool(PyObject* obj); 41 | 42 | //! Returns a triton::__uint from a pyObject. 43 | triton::__uint PyLong_AsUint(PyObject* obj); 44 | 45 | //! Returns a triton::usize from a pyObject. 46 | triton::usize PyLong_AsUsize(PyObject* obj); 47 | 48 | //! Returns a triton::uint32 from a pyObject. 49 | triton::uint32 PyLong_AsUint32(PyObject* obj); 50 | 51 | //! Returns a triton::uint64 from a pyObject. 52 | triton::uint64 PyLong_AsUint64(PyObject* obj); 53 | 54 | //! Returns a triton::uint128 from a pyObject. 55 | triton::uint128 PyLong_AsUint128(PyObject* obj); 56 | 57 | //! Returns a triton::uint256 from a pyObject. 58 | triton::uint256 PyLong_AsUint256(PyObject* obj); 59 | 60 | //! Returns a triton::uint512 from a pyObject. 61 | triton::uint512 PyLong_AsUint512(PyObject* obj); 62 | 63 | //! Returns a pyObject from a triton::__uint. 64 | PyObject* PyLong_FromUint(triton::__uint value); 65 | 66 | //! Returns a pyObject from a triton::usize. 67 | PyObject* PyLong_FromUsize(triton::usize value); 68 | 69 | //! Returns a pyObject from a triton::uint32. 70 | PyObject* PyLong_FromUint32(triton::uint32 value); 71 | 72 | //! Returns a pyObject from a triton::uint64. 73 | PyObject* PyLong_FromUint64(triton::uint64 value); 74 | 75 | //! Returns a pyObject from a triton::uint128. 76 | PyObject* PyLong_FromUint128(triton::uint128 value); 77 | 78 | //! Returns a pyObject from a triton::uint256. 79 | PyObject* PyLong_FromUint256(triton::uint256 value); 80 | 81 | //! Returns a pyObject from a triton::uint512. 82 | PyObject* PyLong_FromUint512(triton::uint512 value); 83 | 84 | /*! @} End of python namespace */ 85 | }; 86 | /*! @} End of bindings namespace */ 87 | }; 88 | /*! @} End of triton namespace */ 89 | }; 90 | 91 | #endif /* TRITON_PYTHONUTILS_H */ 92 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/pythonXFunctions.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITONXPYFUNCTION_H 9 | #define TRITONXPYFUNCTION_H 10 | 11 | #include 12 | 13 | 14 | 15 | //! The Triton namespace 16 | namespace triton { 17 | /*! 18 | * \addtogroup triton 19 | * @{ 20 | */ 21 | 22 | //! The Bindings namespace 23 | namespace bindings { 24 | /*! 25 | * \ingroup triton 26 | * \addtogroup bindings 27 | * @{ 28 | */ 29 | 30 | //! The Python namespace 31 | namespace python { 32 | /*! 33 | * \ingroup bindings 34 | * \addtogroup python 35 | * @{ 36 | */ 37 | 38 | //! Creates a PyClass and raises an exception if it fails. __dict__ is copied in Py3 ! All references are decremented. 39 | PyObject* xPyClass_New(PyObject* b, PyObject* d, PyObject* n); 40 | 41 | //! Creates a PyDict and raises an exception if it fails. 42 | PyObject* xPyDict_New(void); 43 | 44 | //! Creates a PyList and raises an exception if it fails. 45 | PyObject* xPyList_New(Py_ssize_t len); 46 | 47 | //! Creates a PyString and raises an exception if it fails. 48 | PyObject* xPyString_FromString(const char *v); 49 | 50 | //! Creates a PyTuple and raises an exception if it fails. 51 | PyObject* xPyTuple_New(Py_ssize_t len); 52 | 53 | //! Same as PyDict_SetItemString but decrements reference on object 54 | int xPyDict_SetItemString(PyObject *p, const char *key, PyObject *val); 55 | 56 | //! Same as PyDict_SetItem but decrements reference on object and key 57 | int xPyDict_SetItem(PyObject *p, PyObject* key, PyObject *val); 58 | 59 | /*! @} End of python namespace */ 60 | }; 61 | /*! @} End of bindings namespace */ 62 | }; 63 | /*! @} End of triton namespace */ 64 | }; 65 | 66 | #endif /* TRITONXPYFUNCTION_H */ 67 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/semanticsInterface.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_SEMANTICSINTERFACE_HPP 9 | #define TRITON_SEMANTICSINTERFACE_HPP 10 | 11 | #include 12 | #include 13 | #include 14 | 15 | 16 | 17 | //! The Triton namespace 18 | namespace triton { 19 | /*! 20 | * \addtogroup triton 21 | * @{ 22 | */ 23 | 24 | //! The Architecture namespace 25 | namespace arch { 26 | /*! 27 | * \ingroup triton 28 | * \addtogroup arch 29 | * @{ 30 | */ 31 | 32 | /*! \interface SemanticsInterface 33 | \brief This interface is used as abstract semantics interface. All ISA semantics must use this interface. */ 34 | class SemanticsInterface { 35 | public: 36 | //! Destructor. 37 | TRITON_EXPORT virtual ~SemanticsInterface(){}; 38 | 39 | //! Builds the semantics of the instruction. Returns `triton::arch::NO_FAULT` if succeed. 40 | TRITON_EXPORT virtual triton::arch::exception_e buildSemantics(triton::arch::Instruction& inst) = 0; 41 | }; 42 | 43 | /*! @} End of arch namespace */ 44 | }; 45 | /*! @} End of triton namespace */ 46 | }; 47 | 48 | #endif /* TRITON_SEMANTICSINTERFACE_HPP */ 49 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/softfloat.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_SOFTFLOAT_HPP 9 | #define TRITON_SOFTFLOAT_HPP 10 | 11 | #include 12 | 13 | //! The Triton namespace 14 | namespace triton { 15 | /*! 16 | * \addtogroup triton 17 | * @{ 18 | */ 19 | //! The Softfloat namespace 20 | namespace sf { 21 | /*! 22 | * \ingroup triton 23 | * \addtogroup softfloat 24 | * @{ 25 | */ 26 | 27 | //! Cast 32-bit floating point value to 16-bit according to IEEE-754 28 | auto f32_to_f16(float value) -> uint16_t; 29 | 30 | /*! @} End of softfloat namespace */ 31 | }; 32 | /*! @} End of triton namespace */ 33 | }; 34 | 35 | #endif /* TRITON_SOFTFLOAT_HPP */ 36 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/solverEnums.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_SOLVERENUMS_HPP 9 | #define TRITON_SOLVERENUMS_HPP 10 | 11 | #include 12 | 13 | 14 | 15 | //! The Triton namespace 16 | namespace triton { 17 | /*! 18 | * \addtogroup triton 19 | * @{ 20 | */ 21 | 22 | //! The Engines namespace 23 | namespace engines { 24 | /*! 25 | * \ingroup triton 26 | * \addtogroup engines 27 | * @{ 28 | */ 29 | 30 | //! The Solver namespace 31 | namespace solver { 32 | /*! 33 | * \ingroup engines 34 | * \addtogroup solver 35 | * @{ 36 | */ 37 | 38 | /*! The different kind of solvers */ 39 | enum solver_e { 40 | SOLVER_INVALID = 0, /*!< invalid solver. */ 41 | SOLVER_CUSTOM, /*!< custom solver. */ 42 | #ifdef TRITON_Z3_INTERFACE 43 | SOLVER_Z3, /*!< z3 solver. */ 44 | #endif 45 | #ifdef TRITON_BITWUZLA_INTERFACE 46 | SOLVER_BITWUZLA, /*!< bitwuzla solver. */ 47 | #endif 48 | }; 49 | 50 | /*! The different kind of status */ 51 | enum status_e { 52 | UNSAT = 0, /*!< UNSAT */ 53 | SAT = 1, /*!< SAT */ 54 | TIMEOUT, /*!< TIMEOUT */ 55 | OUTOFMEM, /*!< MEMORY LIMIT REACHED */ 56 | UNKNOWN /*!< UNKNOWN */ 57 | }; 58 | 59 | /*! @} End of solver namespace */ 60 | }; 61 | /*! @} End of engines namespace */ 62 | }; 63 | /*! @} End of triton namespace */ 64 | }; 65 | 66 | #endif /* TRITON_SOLVERENUMS_HPP */ 67 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/solverModel.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_SOLVERMODEL_H 9 | #define TRITON_SOLVERMODEL_H 10 | 11 | #include 12 | 13 | #include 14 | #include 15 | #include 16 | 17 | 18 | 19 | //! The Triton namespace 20 | namespace triton { 21 | /*! 22 | * \addtogroup triton 23 | * @{ 24 | */ 25 | //! The Engines namespace 26 | namespace engines { 27 | /*! 28 | * \ingroup triton 29 | * \addtogroup engines 30 | * @{ 31 | */ 32 | //! The Solver namespace 33 | namespace solver { 34 | /*! 35 | * \ingroup engines 36 | * \addtogroup solver 37 | * @{ 38 | */ 39 | 40 | //! \class SolverModel 41 | /*! \brief This class is used to represent a constraint model solved. */ 42 | class SolverModel { 43 | protected: 44 | //! The symbolic variable. 45 | triton::engines::symbolic::SharedSymbolicVariable variable; 46 | 47 | //! The value of the model. 48 | triton::uint512 value; 49 | 50 | private: 51 | //! Copies a SolverModel 52 | void copy(const SolverModel& other); 53 | 54 | public: 55 | //! Constructor. 56 | TRITON_EXPORT SolverModel(); 57 | 58 | //! Constructor. 59 | TRITON_EXPORT SolverModel(const triton::engines::symbolic::SharedSymbolicVariable& variable, triton::uint512 value); 60 | 61 | //! Constructor by copy. 62 | TRITON_EXPORT SolverModel(const SolverModel& other); 63 | 64 | //! Copies a SolverModel 65 | TRITON_EXPORT SolverModel& operator=(const SolverModel& other); 66 | 67 | //! Operator == 68 | TRITON_EXPORT bool operator==(const SolverModel& other) const; 69 | 70 | //! Returns the id of the variable. 71 | TRITON_EXPORT triton::usize getId(void) const; 72 | 73 | //! Returns the value of the model. 74 | TRITON_EXPORT triton::uint512 getValue(void) const; 75 | 76 | //! Returns the size (in bits) of the symbolic variable. 77 | TRITON_EXPORT triton::uint32 getSize(void) const; 78 | 79 | //! Returns the symbolic variable. 80 | TRITON_EXPORT const triton::engines::symbolic::SharedSymbolicVariable& getVariable(void) const; 81 | }; 82 | 83 | //! Display a solver model. 84 | TRITON_EXPORT std::ostream& operator<<(std::ostream& stream, const SolverModel& model); 85 | 86 | //! Display a solver model. 87 | TRITON_EXPORT std::ostream& operator<<(std::ostream& stream, const SolverModel* model); 88 | 89 | /*! @} End of solver namespace */ 90 | }; 91 | /*! @} End of engines namespace */ 92 | }; 93 | /*! @} End of triton namespace */ 94 | }; 95 | 96 | #endif /* TRITON_SOLVERMODEL_H */ 97 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/stubs.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_STUBS_HPP 9 | #define TRITON_STUBS_HPP 10 | 11 | #include 12 | #include 13 | 14 | #include 15 | 16 | 17 | 18 | namespace triton { 19 | namespace stubs { 20 | namespace x8664 { 21 | namespace systemv { 22 | namespace libc { 23 | /*! Symbols mapping. Each entry points on its position in `systemv::libc::code`. */ 24 | extern std::map symbols; 25 | /*! Position independent code of some libc functions */ 26 | extern std::vector code; 27 | }; 28 | }; 29 | namespace ms { 30 | namespace libc { 31 | /*! Symbols mapping. Each entry points on its position in `ms::libc::code`. */ 32 | extern std::map symbols; 33 | /*! Position independent code of some libc functions */ 34 | extern std::vector code; 35 | }; 36 | }; 37 | }; 38 | namespace i386 { 39 | namespace systemv { 40 | namespace libc { 41 | /*! Symbols mapping. Each entry points on its position in `systemv::libc::code`. */ 42 | extern std::map symbols; 43 | /*! Position independent code of some libc functions */ 44 | extern std::vector code; 45 | }; 46 | }; 47 | }; 48 | namespace aarch64 { 49 | namespace libc { 50 | /*! Symbols mapping. Each entry points on its position in `systemv::libc::code`. */ 51 | extern std::map symbols; 52 | /*! Position independent code of some libc functions */ 53 | extern std::vector code; 54 | }; 55 | }; 56 | }; 57 | }; 58 | 59 | #endif /* TRITON_STUBS_HPP */ 60 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/symbolicEnums.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_SYMBOLICENUMS_HPP 9 | #define TRITON_SYMBOLICENUMS_HPP 10 | 11 | /*! Defines the default name of a symbolic variable. */ 12 | #define TRITON_SYMVAR_NAME "SymVar_" 13 | 14 | 15 | 16 | //! The Triton namespace 17 | namespace triton { 18 | /*! 19 | * \addtogroup triton 20 | * @{ 21 | */ 22 | 23 | //! The Engines namespace 24 | namespace engines { 25 | /*! 26 | * \ingroup triton 27 | * \addtogroup engines 28 | * @{ 29 | */ 30 | 31 | //! The Symbolic Execution namespace 32 | namespace symbolic { 33 | /*! 34 | * \ingroup engines 35 | * \addtogroup symbolic 36 | * @{ 37 | */ 38 | 39 | //! Type of symbolic expressions. 40 | enum expression_e { 41 | MEMORY_EXPRESSION, //!< Assigned to a memory expression. 42 | REGISTER_EXPRESSION, //!< Assigned to a register expression. 43 | VOLATILE_EXPRESSION, //!< Assigned to a volatile expression. 44 | }; 45 | 46 | //! Type of symbolic variable. 47 | enum variable_e { 48 | MEMORY_VARIABLE, //!< Variable assigned to a memory. 49 | REGISTER_VARIABLE, //!< Variable assigned to a register. 50 | UNDEFINED_VARIABLE, //!< Undefined assignment. 51 | }; 52 | 53 | /*! @} End of symbolic namespace */ 54 | }; 55 | /*! @} End of engines namespace */ 56 | }; 57 | /*! @} End of triton namespace */ 58 | }; 59 | 60 | #endif /* TRITON_SYMBOLICENUMS_HPP */ 61 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/symbolicSimplification.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_SYMBOLICSIMPLIFICATION_H 9 | #define TRITON_SYMBOLICSIMPLIFICATION_H 10 | 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | 17 | 18 | 19 | //! The Triton namespace 20 | namespace triton { 21 | /*! 22 | * \addtogroup triton 23 | * @{ 24 | */ 25 | 26 | //! The Engines namespace 27 | namespace engines { 28 | /*! 29 | * \ingroup triton 30 | * \addtogroup engines 31 | * @{ 32 | */ 33 | 34 | //! The Symbolic Execution namespace 35 | namespace symbolic { 36 | /*! 37 | * \ingroup engines 38 | * \addtogroup symbolic 39 | * @{ 40 | */ 41 | 42 | //! \class SymbolicSimplification 43 | /*! \brief The symbolic simplification class */ 44 | class SymbolicSimplification { 45 | private: 46 | //! Architecture context 47 | triton::arch::Architecture* architecture; 48 | 49 | //! Callbacks API 50 | triton::callbacks::Callbacks* callbacks; 51 | 52 | //! Copies a SymbolicSimplification. 53 | void copy(const SymbolicSimplification& other); 54 | 55 | //! Performs a dead store elimination analysis. 56 | triton::arch::BasicBlock deadStoreElimination(const triton::arch::BasicBlock& block, bool padding=false) const; 57 | 58 | public: 59 | //! Constructor. 60 | TRITON_EXPORT SymbolicSimplification(triton::arch::Architecture* architecture, triton::callbacks::Callbacks* callbacks=nullptr); 61 | 62 | //! Constructor. 63 | TRITON_EXPORT SymbolicSimplification(const SymbolicSimplification& other); 64 | 65 | //! Processes all recorded simplifications. Returns the simplified node. 66 | TRITON_EXPORT triton::ast::SharedAbstractNode simplify(const triton::ast::SharedAbstractNode& node) const; 67 | 68 | //! Performs a dead store elimination simplification. If `padding` is true, keep addresses aligned and padds with NOP instructions. 69 | TRITON_EXPORT triton::arch::BasicBlock simplify(const triton::arch::BasicBlock& block, bool padding=false) const; 70 | 71 | //! Copies a SymbolicSimplification. 72 | TRITON_EXPORT SymbolicSimplification& operator=(const SymbolicSimplification& other); 73 | }; 74 | 75 | /*! @} End of symbolic namespace */ 76 | }; 77 | /*! @} End of engines namespace */ 78 | }; 79 | /*! @} End of triton namespace */ 80 | }; 81 | 82 | #endif /* TRITON_SYMBOLICSIMPLIFICATION_H */ 83 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/tritonToBitwuzla.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_TRITONTOBITWUZLA_H 9 | #define TRITON_TRITONTOBITWUZLA_H 10 | 11 | #include 12 | #include 13 | 14 | extern "C" { 15 | #include 16 | } 17 | 18 | #include 19 | #include 20 | #include 21 | 22 | 23 | 24 | //! The Triton namespace 25 | namespace triton { 26 | /*! 27 | * \addtogroup triton 28 | * @{ 29 | */ 30 | 31 | //! The AST namespace 32 | namespace ast { 33 | /*! 34 | * \ingroup triton 35 | * \addtogroup ast 36 | * @{ 37 | */ 38 | 39 | //! \class TritonToBitwuzla 40 | /*! \brief Converts a Triton's AST to Bitwuzla's AST. */ 41 | class TritonToBitwuzla { 42 | public: 43 | //! Constructor. 44 | TRITON_EXPORT TritonToBitwuzla(bool eval=false); 45 | 46 | //! Destructor. 47 | TRITON_EXPORT ~TritonToBitwuzla(); 48 | 49 | //! Converts to Bitwuzla's AST 50 | TRITON_EXPORT BitwuzlaTerm convert(const SharedAbstractNode& node, Bitwuzla* bzla); 51 | 52 | //! Returns symbolic variables and its assosiated Bitwuzla terms to process the solver model. 53 | TRITON_EXPORT const std::unordered_map& getVariables(void) const; 54 | 55 | //! Returns bitvector sorts. 56 | TRITON_EXPORT const std::map& getBitvectorSorts(void) const; 57 | 58 | private: 59 | //! The map of Triton's AST nodes translated to the Bitwuzla terms. 60 | std::unordered_map translatedNodes; 61 | 62 | //! The set of symbolic variables contained in the expression. 63 | std::unordered_map variables; 64 | 65 | //! The map of symbols. E.g: (let (symbols expr1) expr2) 66 | std::unordered_map symbols; 67 | 68 | //! All bitvector sorts that used in the expression. 69 | std::map bvSorts; 70 | 71 | //! This flag define if the conversion is used to evaluated a node or not. 72 | bool isEval; 73 | 74 | //! The convert internal process. 75 | BitwuzlaTerm translate(const SharedAbstractNode& node, Bitwuzla* bzla); 76 | }; 77 | 78 | /*! @} End of ast namespace */ 79 | }; 80 | /*! @} End of triton namespace */ 81 | }; 82 | 83 | #endif /* TRITON_TRITONTOBITWUZLA_H */ 84 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/tritonToLLVM.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_TRITONTOLLVM_HPP 9 | #define TRITON_TRITONTOLLVM_HPP 10 | 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | 17 | #include 18 | #include 19 | 20 | #include 21 | #include 22 | #include 23 | #include 24 | #include 25 | 26 | 27 | 28 | //! The Triton namespace 29 | namespace triton { 30 | /*! 31 | * \addtogroup triton 32 | * @{ 33 | */ 34 | 35 | //! The AST namespace 36 | namespace ast { 37 | /*! 38 | * \ingroup triton 39 | * \addtogroup ast 40 | * @{ 41 | */ 42 | 43 | //! \class TritonToLLVM 44 | /*! \brief Converts a Triton's AST to LVM IR. */ 45 | class TritonToLLVM { 46 | private: 47 | //! The LLVM context. 48 | llvm::LLVMContext& llvmContext; 49 | 50 | //! The LLVM module. 51 | std::shared_ptr llvmModule; 52 | 53 | //! The LLVM IR builder. 54 | llvm::IRBuilder<> llvmIR; 55 | 56 | //! Map Triton variables to LLVM ones. 57 | std::map llvmVars; 58 | 59 | //! Create a LLVM function. `fname` represents the name of the LLVM function. 60 | void createFunction(const triton::ast::SharedAbstractNode& node, const char* fname); 61 | 62 | //! Converts Triton AST to LLVM IR. 63 | llvm::Value* do_convert(const triton::ast::SharedAbstractNode& node, std::unordered_map* results); 64 | 65 | public: 66 | //! Constructor. 67 | TRITON_EXPORT TritonToLLVM(llvm::LLVMContext& llvmContext); 68 | 69 | //! Lifts a symbolic expression and all its references to LLVM format. `fname` represents the name of the LLVM function. 70 | TRITON_EXPORT std::shared_ptr convert(const triton::ast::SharedAbstractNode& node, const char* fname="__triton", bool optimize=false); 71 | }; 72 | 73 | /*! @} End of ast namespace */ 74 | }; 75 | /*! @} End of triton namespace */ 76 | }; 77 | 78 | #endif /* TRITON_TRITONTOLLVM_HPP */ 79 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/tritonToZ3.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_TRITONTOZ3_H 9 | #define TRITON_TRITONTOZ3_H 10 | 11 | #include 12 | #include 13 | 14 | #include 15 | #include 16 | #include 17 | 18 | 19 | 20 | //! The Triton namespace 21 | namespace triton { 22 | /*! 23 | * \addtogroup triton 24 | * @{ 25 | */ 26 | 27 | //! The AST namespace 28 | namespace ast { 29 | /*! 30 | * \ingroup triton 31 | * \addtogroup ast 32 | * @{ 33 | */ 34 | 35 | //! \class TritonToZ3 36 | /*! \brief Converts a Triton's AST to Z3's AST. */ 37 | class TritonToZ3 { 38 | private: 39 | //! This flag define if the conversion is used to evaluated a node or not. 40 | bool isEval; 41 | 42 | //! Returns the integer of the z3 expression as a string. 43 | std::string getStringValue(const z3::expr& expr); 44 | 45 | //! The convert internal process 46 | z3::expr do_convert(const triton::ast::SharedAbstractNode& node, std::unordered_map* output); 47 | 48 | protected: 49 | //! The z3's context. 50 | z3::context context; 51 | 52 | public: 53 | //! The map of symbols. E.g: (let (symbols expr1) expr2) 54 | std::unordered_map symbols; 55 | 56 | //! The set of symbolic variables contained in the expression. 57 | std::unordered_map variables; 58 | 59 | //! Constructor. 60 | TRITON_EXPORT TritonToZ3(bool eval=true); 61 | 62 | //! Destructor. 63 | TRITON_EXPORT ~TritonToZ3(); 64 | 65 | //! Converts to Z3's AST 66 | TRITON_EXPORT z3::expr convert(const triton::ast::SharedAbstractNode& node); 67 | }; 68 | 69 | /*! @} End of ast namespace */ 70 | }; 71 | /*! @} End of triton namespace */ 72 | }; 73 | 74 | #endif /* TRITON_TRITONTOZ3_H */ 75 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/version.hpp.in: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_VERSION_H 9 | #define TRITON_VERSION_H 10 | 11 | 12 | 13 | //! The Triton namespace 14 | namespace triton { 15 | /*! 16 | * \addtogroup triton 17 | * @{ 18 | */ 19 | 20 | //! The libTriton's version. 21 | enum version_e { 22 | MAJOR = @VERSION_MAJOR@, 23 | MINOR = @VERSION_MINOR@, 24 | BUILD = @VERSION_BUILD@ 25 | }; 26 | 27 | /*! @} End of triton namespace */ 28 | }; 29 | 30 | #endif // TRITON_VERSION_H 31 | -------------------------------------------------------------------------------- /src/libtriton/includes/triton/z3ToTriton.hpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #ifndef TRITON_Z3TOTRITONAST_H 9 | #define TRITON_Z3TOTRITONAST_H 10 | 11 | #include 12 | 13 | #include 14 | #include 15 | #include 16 | 17 | 18 | 19 | //! The Triton namespace 20 | namespace triton { 21 | /*! 22 | * \addtogroup triton 23 | * @{ 24 | */ 25 | 26 | //! The AST namespace 27 | namespace ast { 28 | /*! 29 | * \ingroup triton 30 | * \addtogroup ast 31 | * @{ 32 | */ 33 | 34 | //! \class Z3ToTriton 35 | /*! \brief Converts a Z3's AST to a Triton's AST. */ 36 | class Z3ToTriton { 37 | private: 38 | //! The Triton's AST context 39 | triton::ast::SharedAstContext astCtxt; 40 | 41 | public: 42 | //! Constructor. 43 | TRITON_EXPORT Z3ToTriton(const triton::ast::SharedAstContext& ctxt); 44 | 45 | //! Converts to Triton's AST 46 | TRITON_EXPORT triton::ast::SharedAbstractNode convert(const z3::expr& expr); 47 | }; 48 | 49 | /*! @} End of ast namespace */ 50 | }; 51 | /*! @} End of triton namespace */ 52 | }; 53 | 54 | #endif /* TRITON_Z3TOTRITONAST_H */ 55 | -------------------------------------------------------------------------------- /src/libtriton/modes/modes.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | #include 10 | 11 | 12 | 13 | namespace triton { 14 | namespace modes { 15 | 16 | Modes::Modes() { 17 | this->setMode(triton::modes::PC_TRACKING_SYMBOLIC, true); /* This mode is enabled by default */ 18 | } 19 | 20 | 21 | Modes::Modes(const Modes& other) { 22 | this->copy(other); 23 | } 24 | 25 | 26 | Modes& Modes::operator=(const Modes& other) { 27 | this->copy(other); 28 | return *this; 29 | } 30 | 31 | 32 | void Modes::copy(const Modes& other) { 33 | this->enabledModes = other.enabledModes; 34 | } 35 | 36 | 37 | bool Modes::isModeEnabled(triton::modes::mode_e mode) const { 38 | if (this->enabledModes.find(mode) != this->enabledModes.end()) 39 | return true; 40 | return false; 41 | } 42 | 43 | 44 | void Modes::setMode(triton::modes::mode_e mode, bool flag) { 45 | if (flag == true) 46 | this->enabledModes.insert(mode); 47 | else 48 | this->enabledModes.erase(mode); 49 | } 50 | 51 | 52 | void Modes::clearModes(void) { 53 | this->enabledModes.clear(); 54 | } 55 | 56 | }; /* modes namespace */ 57 | }; /*triton namespace */ 58 | -------------------------------------------------------------------------------- /src/libtriton/utils/softfloat.cpp: -------------------------------------------------------------------------------- 1 | //! \file 2 | /* 3 | ** Copyright (C) - Triton 4 | ** 5 | ** This program is under the terms of the Apache License 2.0. 6 | */ 7 | 8 | #include 9 | 10 | #include 11 | 12 | namespace triton { 13 | namespace sf { 14 | 15 | uint16_t f32_to_f16(float value) { 16 | uint32_t f; 17 | 18 | static_assert(sizeof(float) == sizeof(uint32_t), "Unexpected float type size"); 19 | std::memcpy(&f, &value, sizeof(uint32_t)); 20 | 21 | uint16_t sign = ((f >> 16) & 0x8000); 22 | int16_t exponent = ((f >> 23) & 0xff) - 127 + 15; 23 | uint16_t mantissa = ((f >> 13) & 0x3ff); 24 | 25 | if (exponent <= 0) { 26 | if (exponent < -10) { 27 | return sign; 28 | } 29 | mantissa = (mantissa | 0x400) >> (1 - exponent); 30 | return sign | mantissa; 31 | } 32 | 33 | else if (exponent == 0xff - (127 - 15)) { 34 | if (mantissa) { 35 | return sign | 0x7fff; 36 | } else { 37 | return sign | 0x7c00; 38 | } 39 | } 40 | 41 | else if (exponent > 30) { 42 | return sign | 0x7c00; 43 | } 44 | 45 | return sign | (exponent << 10) | mantissa; 46 | } 47 | 48 | }; /* sf namespace */ 49 | }; /* triton namespace */ 50 | -------------------------------------------------------------------------------- /src/misc/aarch64/crackme_hash: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/misc/aarch64/crackme_hash -------------------------------------------------------------------------------- /src/misc/aarch64/crackme_hash.c: -------------------------------------------------------------------------------- 1 | 2 | #include 3 | #include 4 | 5 | char *serial = "\x31\x3e\x3d\x26\x31"; 6 | 7 | int check(char *ptr) 8 | { 9 | int i; 10 | int hash = 0xABCD; 11 | 12 | for (i = 0; ptr[i]; i++) 13 | hash += ptr[i] ^ serial[i % 5]; 14 | 15 | return hash; 16 | } 17 | 18 | int main(int ac, char **av) 19 | { 20 | int ret; 21 | 22 | if (ac != 2) 23 | return -1; 24 | 25 | ret = check(av[1]); 26 | if (ret == 0xad6d) 27 | printf("Win\n"); 28 | else 29 | printf("fail\n"); 30 | 31 | return 0; 32 | } 33 | 34 | -------------------------------------------------------------------------------- /src/misc/aarch64/crackme_xor: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/misc/aarch64/crackme_xor -------------------------------------------------------------------------------- /src/misc/aarch64/crackme_xor.c: -------------------------------------------------------------------------------- 1 | 2 | #include 3 | #include 4 | 5 | char *serial = "\x31\x3e\x3d\x26\x31"; 6 | 7 | int check(char *ptr) 8 | { 9 | int i = 0; 10 | 11 | while (i < 5){ 12 | if (((ptr[i] - 1) ^ 0x55) != serial[i]) 13 | return 1; 14 | i++; 15 | } 16 | return 0; 17 | } 18 | 19 | int main(int ac, char **av) 20 | { 21 | int ret; 22 | 23 | if (ac != 2) 24 | return -1; 25 | 26 | ret = check(av[1]); 27 | if (ret == 0) 28 | printf("Win\n"); 29 | else 30 | printf("fail\n"); 31 | 32 | return 0; 33 | } 34 | -------------------------------------------------------------------------------- /src/misc/ir_test_suite/ir: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/misc/ir_test_suite/ir -------------------------------------------------------------------------------- /src/misc/ir_test_suite/qemu-test-x86_64: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/misc/ir_test_suite/qemu-test-x86_64 -------------------------------------------------------------------------------- /src/misc/smt/af.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_AUFBV) 2 | 3 | (declare-fun SymVar_0 () (_ BitVec 64)) 4 | (declare-fun SymVar_1 () (_ BitVec 64)) 5 | (declare-fun SymVar_2 () (_ BitVec 64)) 6 | 7 | (assert (= (_ bv16 64) (bvand (_ bv16 64) (bvxor SymVar_0 (bvxor SymVar_1 SymVar_2))))) 8 | 9 | (check-sat) 10 | (get-model) 11 | -------------------------------------------------------------------------------- /src/misc/smt/array.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_ABV) 2 | 3 | (define-fun ref!1 () (_ BitVec 64) (_ bv4096 64)) ; MOV operation 4 | (define-fun ref!2 () (_ BitVec 64) (_ bv7 64)) ; Program Counter 5 | (define-fun ref!3 () (_ BitVec 64) (_ bv50 64)) ; MOV operation 6 | (define-fun ref!4 () (_ BitVec 64) (_ bv14 64)) ; Program Counter 7 | (declare-fun ref!5 () (Array (_ BitVec 64) (_ BitVec 8))) 8 | (define-fun ref!6 () (Array (_ BitVec 64) (_ BitVec 8)) (store ref!5 (bvadd (bvadd (bvadd ref!1 (bvmul ref!3 (_ bv1 64))) (_ bv0 64)) (_ bv3 64)) ((_ extract 31 24) (_ bv57005 32)))) ; Byte reference - MOV operation 9 | 10 | (check-sat) 11 | (get-model) 12 | -------------------------------------------------------------------------------- /src/misc/smt/cmp.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_AUFBV) 2 | 3 | (declare-fun SymVar_0 () (_ BitVec 32)) 4 | 5 | (assert (= (bvsub SymVar_0 ((_ sign_extend 0) (_ bv4 32))) (_ bv0 32))) 6 | 7 | (check-sat) 8 | (get-model) 9 | -------------------------------------------------------------------------------- /src/misc/smt/firstCharTest.smt2: -------------------------------------------------------------------------------- 1 | 2 | (set-logic QF_AUFBV) 3 | (declare-fun Sym1 () (_ BitVec 8)) 4 | 5 | (assert (= (bvsub ((_ extract 31 0) (bvxor (bvsub ((_ sign_extend 24) ((_ extract 7 0) ((_ zero_extend 24) Sym1))) (_ bv1 32)) (_ bv85 32))) ((_ extract 31 0) ((_ sign_extend 24) ((_ extract 7 0) ((_ zero_extend 24) (_ bv49 8)))))) (_ bv0 32))) 6 | 7 | (check-sat) 8 | (get-model) 9 | 10 | -------------------------------------------------------------------------------- /src/misc/smt/jbe.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_AUFBV) 2 | 3 | (declare-fun zf () (_ BitVec 1)) 4 | (declare-fun cf () (_ BitVec 1)) 5 | 6 | (assert (= (bvor zf cf) (_ bv1 1))) 7 | 8 | (check-sat) 9 | (get-model) 10 | -------------------------------------------------------------------------------- /src/misc/smt/jle.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_AUFBV) 2 | 3 | (define-fun TRUE () (_ BitVec 1) (_ bv1 1)) 4 | (define-fun FALSE () (_ BitVec 1) (_ bv0 1)) 5 | 6 | (declare-fun zf () (_ BitVec 1)) 7 | (declare-fun of () (_ BitVec 1)) 8 | (declare-fun sf () (_ BitVec 1)) 9 | 10 | (assert (= (bvor (bvxor sf of) zf) TRUE)) 11 | 12 | (check-sat) 13 | (get-model) 14 | -------------------------------------------------------------------------------- /src/misc/smt/jnbe.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_AUFBV) 2 | 3 | (declare-fun zf () (_ BitVec 1)) 4 | (declare-fun cf () (_ BitVec 1)) 5 | 6 | (assert (= (bvand (bvnot zf) (bvnot cf)) (_ bv1 1))) 7 | 8 | (check-sat) 9 | (get-model) 10 | -------------------------------------------------------------------------------- /src/misc/smt/jnle.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_AUFBV) 2 | 3 | (define-fun TRUE () (_ BitVec 1) (_ bv1 1)) 4 | (define-fun FALSE () (_ BitVec 1) (_ bv0 1)) 5 | 6 | (declare-fun zf () (_ BitVec 1)) 7 | (declare-fun of () (_ BitVec 1)) 8 | (declare-fun sf () (_ BitVec 1)) 9 | 10 | (assert (= (bvor (bvxor sf of) zf) FALSE)) 11 | 12 | (check-sat) 13 | (get-model) 14 | -------------------------------------------------------------------------------- /src/misc/smt/of.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_AUFBV) 2 | 3 | (declare-fun SymVar_0 () (_ BitVec 64)) 4 | (declare-fun SymVar_1 () (_ BitVec 64)) 5 | (declare-fun SymVar_2 () (_ BitVec 64)) 6 | 7 | (assert (= ((_ extract 63 63)(bvand (bvxor SymVar_0 (bvnot SymVar_1)) (bvxor SymVar_0 SymVar_2))) (_ bv1 1))) 8 | 9 | (check-sat) 10 | (get-model) 11 | -------------------------------------------------------------------------------- /src/misc/smt/pf.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_AUFBV) 2 | 3 | (declare-fun SymVar_0 () (_ BitVec 64)) 4 | (define-fun parity_flag ((x!1 (_ BitVec 8))) (_ BitVec 1) 5 | ; x ^= x >> 4; 6 | ; v &= 0xf; 7 | ; return (0x6996 >> v) & 1; 8 | ((_ extract 0 0) 9 | (bvlshr 10 | (_ bv27030 16) 11 | ((_ zero_extend 8) 12 | (bvand 13 | (bvxor 14 | x!1 15 | (bvlshr x!1 (_ bv4 8))) 16 | (_ bv15 8)))))) 17 | 18 | (assert (= (parity_flag ((_ extract 7 0) SymVar_0)) (_ bv0 1))) 19 | 20 | (check-sat) 21 | (get-model) 22 | 23 | -------------------------------------------------------------------------------- /src/misc/smt/sf.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_AUFBV) 2 | (declare-fun SymVar_0 () (_ BitVec 64)) 3 | 4 | (assert (= 5 | ((_ extract 63 63)SymVar_0) (_ bv1 1) 6 | ) 7 | ) 8 | 9 | (check-sat) 10 | (get-model) 11 | ;(get-value (SymVar_1)) 12 | 13 | -------------------------------------------------------------------------------- /src/scripts/docker/Dockerfile: -------------------------------------------------------------------------------- 1 | ARG BASE_IMG=quay.io/pypa/manylinux_2_34_x86_64 2 | 3 | FROM $BASE_IMG 4 | 5 | RUN yum install -y \ 6 | cmake \ 7 | clang \ 8 | git \ 9 | less \ 10 | ninja-build \ 11 | sudo \ 12 | wget 13 | 14 | # LLVM dependencies. 15 | RUN yum install -y \ 16 | libxml2-devel \ 17 | libzstd-devel \ 18 | ncurses-devel 19 | 20 | RUN python3.10 -m pip install meson 21 | 22 | ENV DEPENDENCIES_DIR=/tmp/triton-dependencies 23 | ENV SOURCE_DIR=/src 24 | 25 | # Create directory for dependencies. 26 | RUN mkdir -p $DEPENDENCIES_DIR 27 | 28 | # Download, build and install Bitwuzla. 29 | RUN echo "[+] Download, build and install Bitwuzla" && \ 30 | cd $DEPENDENCIES_DIR && \ 31 | git clone https://github.com/bitwuzla/bitwuzla.git && \ 32 | cd bitwuzla && \ 33 | git checkout -b 0.7.0 0.7.0 && \ 34 | export PY310_PATH=$(python3.10 -c 'import sys, os; print(os.path.dirname(sys.executable))') && \ 35 | CC=clang CXX=clang++ PATH=$PATH:$PY310_PATH python3.10 ./configure.py --shared --prefix $(pwd)/install && \ 36 | cd build && \ 37 | PATH=$PATH:$PY310_PATH ninja -j $(nproc) install 38 | 39 | # Download Z3. 40 | RUN echo "[+] Download Z3" && \ 41 | cd $DEPENDENCIES_DIR && \ 42 | wget -q https://github.com/Z3Prover/z3/releases/download/z3-4.12.2/z3-4.12.2-x64-glibc-2.31.zip && \ 43 | unzip -q z3-4.12.2-x64-glibc-2.31.zip 44 | 45 | # Download, build and install Capstone. 46 | RUN echo "[+] Download, build and install Capstone" && \ 47 | cd $DEPENDENCIES_DIR && \ 48 | wget -q https://github.com/capstone-engine/capstone/archive/refs/tags/5.0.3.tar.gz -O capstone-5.0.3.tar.gz && \ 49 | tar xf capstone-5.0.3.tar.gz && \ 50 | cd ./capstone-5.0.3 && \ 51 | CAPSTONE_ARCHS="arm aarch64 riscv x86" ./make.sh && \ 52 | sudo make install 53 | -------------------------------------------------------------------------------- /src/scripts/docker/build-docker-image.sh: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env bash 2 | 3 | # This file is used for building the docker image necessary to build 4 | # triton-library with the manylinux tag. It is used by the Build Python 5 | # Package Github workflow but can also be used locally. 6 | 7 | set -ex 8 | 9 | SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) 10 | 11 | docker build \ 12 | --build-arg BASE_IMG=quay.io/pypa/manylinux_2_34_x86_64 \ 13 | --tag build-triton-linux-x86_64 \ 14 | $SCRIPT_DIR 15 | -------------------------------------------------------------------------------- /src/scripts/macos/delocate-wheel-custom.py: -------------------------------------------------------------------------------- 1 | import sys 2 | 3 | from delocate.cmd.delocate_wheel import main 4 | import delocate.delocating 5 | 6 | 7 | def filter_system_libs(libname): 8 | copy_lib = not (libname.startswith('/usr/lib') or 9 | libname.startswith('/System') or 10 | libname.find('libpython') >= 0) 11 | 12 | print(f'[filter_system_libs] libname: {libname}, copy_lib: {copy_lib}') 13 | 14 | return copy_lib 15 | 16 | 17 | def delocate_wheel(in_wheel, 18 | out_wheel=None, 19 | lib_sdir='.dylibs', 20 | lib_filt_func=None, 21 | copy_filt_func=filter_system_libs, 22 | require_archs=None, 23 | check_verbose=None, 24 | executable_path=None, 25 | ignore_missing=False): 26 | return delocate.delocating.delocate_wheel(in_wheel, 27 | out_wheel, 28 | lib_sdir, 29 | lib_filt_func, 30 | copy_filt_func, 31 | require_archs, 32 | check_verbose, 33 | executable_path, 34 | ignore_missing) 35 | 36 | delocate.cmd.delocate_wheel.delocate_wheel = delocate_wheel 37 | 38 | 39 | if __name__ == '__main__': 40 | sys.exit(main()) 41 | -------------------------------------------------------------------------------- /src/stubs/Makefile: -------------------------------------------------------------------------------- 1 | SRC = triton-stubs.c 2 | CFLAGS = -c -fno-stack-protector -fno-builtin -fPIC -fno-asynchronous-unwind-tables 3 | CC = gcc 4 | 5 | all: 64b 32b 6 | 7 | 64b: 8 | $(CC) $(SRC) $(CFLAGS) -o triton-x8664-systemv-stubs.o -D STUB_ABI=sysv_abi 9 | $(CC) $(SRC) $(CFLAGS) -o triton-x8664-ms-stubs.o -D STUB_ABI=ms_abi 10 | 11 | 32b: 12 | $(CC) $(SRC) $(CFLAGS) -m32 -o triton-i386-systemv-stubs.o -D STUB_ABI=sysv_abi 13 | $(CC) $(SRC) $(CFLAGS) -m32 -o triton-i386-cdecl-stubs.o -D STUB_ABI=cdecl 14 | $(CC) $(SRC) $(CFLAGS) -m32 -o triton-i386-stdcall-stubs.o -D STUB_ABI=stdcall 15 | $(CC) $(SRC) $(CFLAGS) -m32 -o triton-i386-fastcall-stubs.o -D STUB_ABI=fastcall 16 | 17 | clean: 18 | rm triton-x8664-systemv-stubs.o 19 | rm triton-x8664-ms-stubs.o 20 | rm triton-i386-systemv-stubs.o 21 | rm triton-i386-cdecl-stubs.o 22 | rm triton-i386-stdcall-stubs.o 23 | rm triton-i386-fastcall-stubs.o 24 | 25 | .PHONY: clean install all 26 | -------------------------------------------------------------------------------- /src/stubs/gen_symbols_vector.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | ## -*- coding: utf-8 -*- 3 | 4 | import lief 5 | import sys 6 | 7 | binary = lief.parse(sys.argv[1]) 8 | 9 | print('std::map symbols = {') 10 | for f in binary.exported_functions: 11 | print(' {"%s", 0x%x},' %(f.name, f.address)) 12 | print('};') 13 | -------------------------------------------------------------------------------- /src/testers/arm32/crypto_test/bin/crypto_test-nothumb-O0.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/arm32/crypto_test/bin/crypto_test-nothumb-O0.bin -------------------------------------------------------------------------------- /src/testers/arm32/crypto_test/bin/crypto_test-nothumb-O1.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/arm32/crypto_test/bin/crypto_test-nothumb-O1.bin -------------------------------------------------------------------------------- /src/testers/arm32/crypto_test/bin/crypto_test-nothumb-O2.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/arm32/crypto_test/bin/crypto_test-nothumb-O2.bin -------------------------------------------------------------------------------- /src/testers/arm32/crypto_test/bin/crypto_test-nothumb-O3.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/arm32/crypto_test/bin/crypto_test-nothumb-O3.bin -------------------------------------------------------------------------------- /src/testers/arm32/crypto_test/bin/crypto_test-nothumb-Os.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/arm32/crypto_test/bin/crypto_test-nothumb-Os.bin -------------------------------------------------------------------------------- /src/testers/arm32/crypto_test/bin/crypto_test-nothumb-Oz.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/arm32/crypto_test/bin/crypto_test-nothumb-Oz.bin -------------------------------------------------------------------------------- /src/testers/arm32/crypto_test/bin/crypto_test-thumb-O0.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/arm32/crypto_test/bin/crypto_test-thumb-O0.bin -------------------------------------------------------------------------------- /src/testers/arm32/crypto_test/bin/crypto_test-thumb-O1.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/arm32/crypto_test/bin/crypto_test-thumb-O1.bin -------------------------------------------------------------------------------- /src/testers/arm32/crypto_test/bin/crypto_test-thumb-O2.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/arm32/crypto_test/bin/crypto_test-thumb-O2.bin -------------------------------------------------------------------------------- /src/testers/arm32/crypto_test/bin/crypto_test-thumb-O3.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/arm32/crypto_test/bin/crypto_test-thumb-O3.bin -------------------------------------------------------------------------------- /src/testers/arm32/crypto_test/bin/crypto_test-thumb-Os.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/arm32/crypto_test/bin/crypto_test-thumb-Os.bin -------------------------------------------------------------------------------- /src/testers/arm32/crypto_test/bin/crypto_test-thumb-Oz.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/arm32/crypto_test/bin/crypto_test-thumb-Oz.bin -------------------------------------------------------------------------------- /src/testers/unittests/misc/defcamp-2015-r100.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/unittests/misc/defcamp-2015-r100.bin -------------------------------------------------------------------------------- /src/testers/unittests/misc/ir-test-suite.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/unittests/misc/ir-test-suite.bin -------------------------------------------------------------------------------- /src/testers/unittests/misc/md5/md5-aarch64: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/unittests/misc/md5/md5-aarch64 -------------------------------------------------------------------------------- /src/testers/unittests/misc/md5/md5-arm32: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/unittests/misc/md5/md5-arm32 -------------------------------------------------------------------------------- /src/testers/unittests/misc/md5/md5-x64: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/unittests/misc/md5/md5-x64 -------------------------------------------------------------------------------- /src/testers/unittests/misc/md5/md5-x86: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/unittests/misc/md5/md5-x86 -------------------------------------------------------------------------------- /src/testers/unittests/misc/qemu/ir-test-suite-qemu-light.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/unittests/misc/qemu/ir-test-suite-qemu-light.bin -------------------------------------------------------------------------------- /src/testers/unittests/misc/qemu/ir-test-suite-qemu.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/JonathanSalwan/Triton/e312eafcdf507d9aebd0f8a7daf2eb4c28a19d30/src/testers/unittests/misc/qemu/ir-test-suite-qemu.bin -------------------------------------------------------------------------------- /src/testers/unittests/misc/qemu/test-i386-muldiv.h: -------------------------------------------------------------------------------- 1 | 2 | void glue(glue(test_, OP), b)(long op0, long op1) 3 | { 4 | long res, s1, s0, flags; 5 | s0 = op0; 6 | s1 = op1; 7 | res = s0; 8 | flags = 0; 9 | asm ("push %4\n\t" 10 | "popf\n\t" 11 | stringify(OP)"b %b2\n\t" 12 | "pushf\n\t" 13 | "pop %1\n\t" 14 | : "=a" (res), "=g" (flags) 15 | : "q" (s1), "0" (res), "1" (flags)); 16 | printf("%-10s A=" FMTLX " B=" FMTLX " R=" FMTLX " CC=%04lx\n", 17 | stringify(OP) "b", s0, s1, res, flags & CC_MASK); 18 | } 19 | 20 | void glue(glue(test_, OP), w)(long op0h, long op0, long op1) 21 | { 22 | long res, s1, flags, resh; 23 | s1 = op1; 24 | resh = op0h; 25 | res = op0; 26 | flags = 0; 27 | asm ("push %5\n\t" 28 | "popf\n\t" 29 | stringify(OP) "w %w3\n\t" 30 | "pushf\n\t" 31 | "pop %1\n\t" 32 | : "=a" (res), "=g" (flags), "=d" (resh) 33 | : "q" (s1), "0" (res), "1" (flags), "2" (resh)); 34 | printf("%-10s AH=" FMTLX " AL=" FMTLX " B=" FMTLX " RH=" FMTLX " RL=" FMTLX " CC=%04lx\n", 35 | stringify(OP) "w", op0h, op0, s1, resh, res, flags & CC_MASK); 36 | } 37 | 38 | void glue(glue(test_, OP), l)(long op0h, long op0, long op1) 39 | { 40 | long res, s1, flags, resh; 41 | s1 = op1; 42 | resh = op0h; 43 | res = op0; 44 | flags = 0; 45 | asm ("push %5\n\t" 46 | "popf\n\t" 47 | stringify(OP) "l %k3\n\t" 48 | "pushf\n\t" 49 | "pop %1\n\t" 50 | : "=a" (res), "=g" (flags), "=d" (resh) 51 | : "q" (s1), "0" (res), "1" (flags), "2" (resh)); 52 | printf("%-10s AH=" FMTLX " AL=" FMTLX " B=" FMTLX " RH=" FMTLX " RL=" FMTLX " CC=%04lx\n", 53 | stringify(OP) "l", op0h, op0, s1, resh, res, flags & CC_MASK); 54 | } 55 | 56 | #if defined(__x86_64__) 57 | void glue(glue(test_, OP), q)(long op0h, long op0, long op1) 58 | { 59 | long res, s1, flags, resh; 60 | s1 = op1; 61 | resh = op0h; 62 | res = op0; 63 | flags = 0; 64 | asm ("push %5\n\t" 65 | "popf\n\t" 66 | stringify(OP) "q %3\n\t" 67 | "pushf\n\t" 68 | "pop %1\n\t" 69 | : "=a" (res), "=g" (flags), "=d" (resh) 70 | : "q" (s1), "0" (res), "1" (flags), "2" (resh)); 71 | printf("%-10s AH=" FMTLX " AL=" FMTLX " B=" FMTLX " RH=" FMTLX " RL=" FMTLX " CC=%04lx\n", 72 | stringify(OP) "q", op0h, op0, s1, resh, res, flags & CC_MASK); 73 | } 74 | #endif 75 | 76 | #undef OP 77 | -------------------------------------------------------------------------------- /src/testers/unittests/test_ast_deep.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # coding: utf-8 3 | """Test deep AST.""" 4 | 5 | import unittest 6 | from triton import * 7 | 8 | DEPTH = 1000 9 | 10 | 11 | 12 | class TestDeep(unittest.TestCase): 13 | 14 | """Test deep AST.""" 15 | 16 | def setUp(self): 17 | """Define the arch.""" 18 | self.triton = TritonContext() 19 | self.triton.setArchitecture(ARCH.X86_64) 20 | self.ctx = self.triton.getAstContext() 21 | 22 | self.sym_var = self.ctx.variable(self.triton.symbolizeRegister(self.triton.registers.rax)) 23 | self.triton.setConcreteRegisterValue(self.triton.registers.rbx, 0) 24 | 25 | add_inst = Instruction() 26 | add_inst.setAddress(0x100) 27 | add_inst.setOpcode(b"\x48\x01\xC3") # add rbx, rax 28 | 29 | sub_inst = Instruction() 30 | sub_inst.setOpcode(b"\x48\x29\xC3") # sub rbx, rax 31 | 32 | # We subtract and add the same symbolic value from rbx N times 33 | for _ in range(DEPTH): 34 | self.triton.processing(add_inst) 35 | sub_inst.setAddress(add_inst.getAddress() + add_inst.getSize()) 36 | self.triton.processing(sub_inst) 37 | add_inst.setAddress(sub_inst.getAddress() + sub_inst.getSize()) 38 | 39 | # And finally add symbolic variable ones 40 | add_inst.setAddress(add_inst.getAddress() + add_inst.getSize()) 41 | self.triton.processing(add_inst) 42 | 43 | # Now rbx has `SymVar_0` value 44 | self.complex_ast_tree = self.triton.getSymbolicRegister(self.triton.registers.rbx).getAst() 45 | 46 | def test_z3_conversion(self): 47 | result = self.triton.simplify(self.complex_ast_tree, True) 48 | self.assertEqual(str(result), str(self.sym_var)) 49 | 50 | def test_duplication(self): 51 | s = self.ctx.duplicate(self.complex_ast_tree) 52 | 53 | def test_symbolic_variable_update(self): 54 | self.triton.setConcreteVariableValue(self.sym_var.getSymbolicVariable(), 0xdeadbeaf) 55 | self.assertEqual(self.complex_ast_tree.evaluate(), 0xdeadbeaf) 56 | -------------------------------------------------------------------------------- /src/testers/unittests/test_ast_utils.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | ## -*- coding: utf-8 -*- 3 | """Test AST utils.""" 4 | 5 | import unittest 6 | from triton import * 7 | 8 | 9 | 10 | class TestAstUtils(unittest.TestCase): 11 | 12 | """Testing the AST utilities.""" 13 | 14 | def setUp(self): 15 | self.ctx = TritonContext() 16 | self.ctx.setArchitecture(ARCH.X86_64) 17 | 18 | self.astCtxt = self.ctx.getAstContext() 19 | 20 | self.sv1 = self.ctx.newSymbolicVariable(8) 21 | self.sv2 = self.ctx.newSymbolicVariable(8) 22 | 23 | self.v1 = self.astCtxt.variable(self.sv1) 24 | self.v2 = self.astCtxt.variable(self.sv2) 25 | 26 | def test_search(self): 27 | n = (((self.v1 + self.v2 * 3) + self.v2) - 1) 28 | 29 | # Looking for variables 30 | l = self.astCtxt.search(n, AST_NODE.VARIABLE) 31 | self.assertEqual(len(l), 2) 32 | self.assertEqual(l[0], self.v1) 33 | self.assertEqual(l[1], self.v2) 34 | self.assertEqual(l[0].getSymbolicVariable().getName(), self.sv1.getName()) 35 | self.assertEqual(l[1].getSymbolicVariable().getName(), self.sv2.getName()) 36 | 37 | l = self.astCtxt.search(n, AST_NODE.ANY) 38 | self.assertEqual(len(l), 12) 39 | 40 | l = self.astCtxt.search(n, AST_NODE.BVADD) 41 | self.assertEqual(len(l), 2) 42 | 43 | l = self.astCtxt.search(n, AST_NODE.BVSUB) 44 | self.assertEqual(len(l), 1) 45 | 46 | l = self.astCtxt.search(n, AST_NODE.BVMUL) 47 | self.assertEqual(len(l), 1) 48 | 49 | l = self.astCtxt.search(n, AST_NODE.BV) 50 | self.assertEqual(len(l), 2) 51 | 52 | def test_dereference(self): 53 | r1 = self.astCtxt.reference(self.ctx.newSymbolicExpression(self.v1, "r1")) 54 | r2 = self.astCtxt.reference(self.ctx.newSymbolicExpression(r1, "r2")) 55 | self.assertEqual(str(self.astCtxt.dereference(r2)), "SymVar_0") 56 | self.assertEqual(str(self.astCtxt.dereference(r1)), "SymVar_0") 57 | self.assertEqual(str(self.astCtxt.dereference(self.v1)), "SymVar_0") 58 | -------------------------------------------------------------------------------- /src/testers/unittests/test_bitvector.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # coding: utf-8 3 | """Test architectures.""" 4 | 5 | import unittest 6 | 7 | from triton import TritonContext, ARCH 8 | 9 | 10 | class TestRAXBitvector(unittest.TestCase): 11 | 12 | """Testing the Bitvector class.""" 13 | 14 | def setUp(self): 15 | """Define the arch.""" 16 | self.Triton = TritonContext() 17 | self.Triton.setArchitecture(ARCH.X86_64) 18 | self.bv = self.Triton.registers.rax.getBitvector() 19 | 20 | def test_high(self): 21 | """Check the highest bit.""" 22 | self.assertEqual(self.bv.getHigh(), 63) 23 | 24 | def test_low(self): 25 | """Check the lower bit.""" 26 | self.assertEqual(self.bv.getLow(), 0) 27 | 28 | def test_size(self): 29 | """Check the vector size.""" 30 | self.assertEqual(self.bv.getVectorSize(), 64) 31 | 32 | def test_maxValue(self): 33 | """Check the max value of the vector.""" 34 | self.assertEqual(self.bv.getMaxValue(), 0xffffffffffffffff) 35 | 36 | 37 | class TestCHBitvector(unittest.TestCase): 38 | 39 | """Testing the Bitvector class.""" 40 | 41 | def setUp(self): 42 | """Define the arch.""" 43 | self.Triton = TritonContext() 44 | self.Triton.setArchitecture(ARCH.X86_64) 45 | self.bv = self.Triton.registers.ch.getBitvector() 46 | 47 | def test_high(self): 48 | """Check the highest bit.""" 49 | self.assertEqual(self.bv.getHigh(), 15) 50 | 51 | def test_low(self): 52 | """Check the lower bit.""" 53 | self.assertEqual(self.bv.getLow(), 8) 54 | 55 | def test_size(self): 56 | """Check the vector size.""" 57 | self.assertEqual(self.bv.getVectorSize(), 8) 58 | 59 | def test_maxValue(self): 60 | """Check the max value of the vector.""" 61 | self.assertEqual(self.bv.getMaxValue(), 0xff) 62 | 63 | 64 | class TestDLBitvector(unittest.TestCase): 65 | 66 | """Testing the Bitvector class.""" 67 | 68 | def setUp(self): 69 | """Define the arch.""" 70 | self.Triton = TritonContext() 71 | self.Triton.setArchitecture(ARCH.X86_64) 72 | self.bv = self.Triton.registers.dl.getBitvector() 73 | 74 | def test_high(self): 75 | """Check the highest bit.""" 76 | self.assertEqual(self.bv.getHigh(), 7) 77 | 78 | def test_low(self): 79 | """Check the lower bit.""" 80 | self.assertEqual(self.bv.getLow(), 0) 81 | 82 | def test_size(self): 83 | """Check the vector size.""" 84 | self.assertEqual(self.bv.getVectorSize(), 8) 85 | 86 | def test_maxValue(self): 87 | """Check the max value of the vector.""" 88 | self.assertEqual(self.bv.getMaxValue(), 0xff) 89 | 90 | -------------------------------------------------------------------------------- /src/testers/unittests/test_doc.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # coding: utf-8 3 | """Tester for documentation.""" 4 | import unittest 5 | import doctest 6 | import os 7 | import glob 8 | 9 | SNIPPET_DIR = os.path.join(os.path.dirname(__file__), "..", "..", "libtriton", "bindings", "python", "objects") 10 | 11 | class TestDoc(unittest.TestCase): 12 | 13 | """Holder to run examples as tests.""" 14 | 15 | 16 | for i, example in enumerate(glob.iglob(os.path.join(SNIPPET_DIR, "*.cpp"))): 17 | 18 | # FIXME: Waiting for libboost1.71-all-dev in the Travis apt-package-safelist. 19 | if "pyAstContext.cpp" in example: 20 | continue 21 | 22 | def _test_snippet(self, example_name=example): 23 | """Run example and show stdout in case of fail.""" 24 | res = doctest.testfile(example_name, module_relative=False) 25 | self.assertEqual(res.failed, 0) 26 | 27 | # Define an arguments with a default value as default value is capture at 28 | # lambda creation so that example_name is not in the closure of the lambda 29 | # function. 30 | setattr(TestDoc, "test_" + str(i) + "_" + os.path.basename(example), _test_snippet) 31 | -------------------------------------------------------------------------------- /src/testers/unittests/test_examples.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # coding: utf-8 3 | """Tester for examples.""" 4 | import glob 5 | import itertools 6 | import os 7 | import platform 8 | import subprocess 9 | import sys 10 | import unittest 11 | 12 | EXAMPLE_DIR = os.path.join(os.path.dirname(__file__), "..", "..", "examples", "python") 13 | 14 | ARGS = { 15 | "small_x86-64_symbolic_emulator.py": [os.path.join(EXAMPLE_DIR, "samples", "sample_1"), "hello"], 16 | } 17 | 18 | 19 | class TestExample(unittest.TestCase): 20 | """Holder to run examples as tests.""" 21 | 22 | for i, example in enumerate(itertools.chain(glob.iglob(os.path.join(EXAMPLE_DIR, "*.py")), 23 | glob.iglob(os.path.join(EXAMPLE_DIR, "*", "*.py")), 24 | glob.iglob(os.path.join(EXAMPLE_DIR, "*", "*", "*.py")), 25 | glob.iglob(os.path.join(EXAMPLE_DIR, "*", "*", "*", "*.py")))): 26 | 27 | def _test_example(self, example_name=example): 28 | """Run example and show stdout in case of fail.""" 29 | args = [v for k, v in list(ARGS.items()) if k in example_name] 30 | assert len(args) <= 1 31 | if len(args) == 1: 32 | args = args[0] 33 | 34 | if ('TRAVIS' in os.environ or 'APPVEYOR' in os.environ) and example_name.find('hackcon-2016-angry-reverser') >= 0: 35 | # FIXME: Doesn't work on Travis and Appveyor... 36 | return 37 | 38 | p = subprocess.Popen([sys.executable, example_name] + args, stdout=subprocess.PIPE, stderr=subprocess.PIPE) 39 | out, err = p.communicate() 40 | self.assertEqual(p.returncode, 0, "\n".join((str(out), str(err), str(p.returncode)))) 41 | 42 | # Define an arguments with a default value as default value is capture at 43 | # lambda creation so that example_name is not in the closure of the lambda 44 | # function. 45 | setattr(TestExample, "test_" + str(i) + "_" + os.path.basename(example), _test_example) 46 | -------------------------------------------------------------------------------- /src/testers/unittests/test_exclusive_memory_access.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # coding: utf-8 3 | 4 | import unittest 5 | 6 | from triton import * 7 | 8 | 9 | class TestExclusiveMemoryAccess(unittest.TestCase): 10 | 11 | """Testing exclusive memory access on AArch64.""" 12 | 13 | def setUp(self): 14 | """Define the arch.""" 15 | self.ctx = TritonContext(ARCH.AARCH64) 16 | self.data = b"\x11\x22\x33\x44\x55\x66\x77\x88\x99\xaa\xbb\xcc\xdd\xee\xff" 17 | 18 | self.ctx.setConcreteMemoryAreaValue(0x2000, self.data) 19 | self.ctx.setConcreteRegisterValue(self.ctx.registers.x0, 0x1234567890abcdef) 20 | self.ctx.setConcreteRegisterValue(self.ctx.registers.x9, 0xcccccccccccccccc) 21 | self.ctx.setConcreteRegisterValue(self.ctx.registers.x1, 0x2000) 22 | 23 | def test_exclusive_memory_access1(self): 24 | self.ctx.processing(Instruction(b"\x20\x7c\x02\xc8")) # stxr w2, x0, [x1] 25 | 26 | # we can not do the store, status must be equal to 1 27 | w2 = self.ctx.getConcreteRegisterValue(self.ctx.registers.w2) 28 | data = self.ctx.getConcreteMemoryAreaValue(0x2000, 15) 29 | self.assertEqual(w2, 1) 30 | self.assertEqual(data, self.data) 31 | 32 | def test_exclusive_memory_access2(self): 33 | self.ctx.processing(Instruction(b"\x23\x7c\x5f\xc8")) # ldxr x3, [x1] ; set x1 as exclusive address 34 | self.ctx.processing(Instruction(b"\x20\x7c\x02\xc8")) # stxr w2, x0, [x1] ; store has the exclusive access 35 | 36 | # we can do the store, status must be equal to 0 37 | w2 = self.ctx.getConcreteRegisterValue(self.ctx.registers.w2) 38 | data = self.ctx.getConcreteMemoryAreaValue(0x2000, 15) 39 | self.assertEqual(w2, 0) 40 | self.assertEqual(data, b"\xef\xcd\xab\x90\x78\x56\x34\x12\x99\xaa\xbb\xcc\xdd\xee\xff") 41 | 42 | self.ctx.processing(Instruction(b"\x29\x7c\x02\xc8")) # stxr w2, x9, [x1] ; store has no more the exclusive access 43 | 44 | # we can not do the store anymore, status must be equal to 1 45 | w2 = self.ctx.getConcreteRegisterValue(self.ctx.registers.w2) 46 | data = self.ctx.getConcreteMemoryAreaValue(0x2000, 15) 47 | self.assertEqual(w2, 1) 48 | self.assertEqual(data, b"\xef\xcd\xab\x90\x78\x56\x34\x12\x99\xaa\xbb\xcc\xdd\xee\xff") 49 | -------------------------------------------------------------------------------- /src/testers/unittests/test_flags.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # coding: utf-8 3 | """Test flags.""" 4 | 5 | import unittest 6 | import random 7 | 8 | from triton import ARCH, REG, TritonContext 9 | 10 | 11 | class TestFlags(unittest.TestCase): 12 | 13 | """Testing the concrete flag values.""" 14 | 15 | def setUp(self): 16 | """Define the arch.""" 17 | self.Triton = TritonContext() 18 | self.Triton.setArchitecture(ARCH.X86_64) 19 | 20 | def test_set_flags(self): 21 | """Check flags can be set in any order with a correct output result.""" 22 | registers = [REG.X86_64.ZF, REG.X86_64.AF, REG.X86_64.IF, REG.X86_64.CF, 23 | REG.X86_64.DF, REG.X86_64.PF, REG.X86_64.SF, REG.X86_64.OF, 24 | REG.X86_64.TF] 25 | values = [0] * len(registers) 26 | 27 | rand_registers = list(registers) 28 | random.shuffle(rand_registers) 29 | 30 | # Randomnly set flags registers and check result is the one expected 31 | for reg in rand_registers: 32 | self.Triton.setConcreteRegisterValue(self.Triton.getRegister(reg), 1) 33 | values[registers.index(reg)] = 1 34 | self.assertListEqual([self.Triton.getConcreteRegisterValue(self.Triton.getRegister(r)) for r in registers], values) 35 | 36 | def test_unset_flags(self): 37 | """Check flags can be unset in any order with a correct result.""" 38 | registers = [REG.X86_64.ZF, REG.X86_64.AF, REG.X86_64.IF, REG.X86_64.CF, 39 | REG.X86_64.DF, REG.X86_64.PF, REG.X86_64.SF, REG.X86_64.OF, 40 | REG.X86_64.TF] 41 | values = [1] * len(registers) 42 | for reg in registers: 43 | self.Triton.setConcreteRegisterValue(self.Triton.getRegister(reg), 1) 44 | 45 | rand_registers = list(registers) 46 | random.shuffle(rand_registers) 47 | 48 | # Randomnly unset flags registers and check result is the one expected 49 | for reg in rand_registers: 50 | self.Triton.setConcreteRegisterValue(self.Triton.getRegister(reg), 0) 51 | values[registers.index(reg)] = 0 52 | self.assertListEqual([self.Triton.getConcreteRegisterValue(self.Triton.getRegister(r)) for r in registers], values) 53 | -------------------------------------------------------------------------------- /src/testers/unittests/test_im_callback.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # coding: utf-8 3 | 4 | import unittest 5 | 6 | from triton import * 7 | 8 | 9 | class TestInstanceMethodCallback(unittest.TestCase): 10 | 11 | """Testing instance method callbacks.""" 12 | 13 | def test_get_concrete_memory_value(self): 14 | self.Triton = TritonContext() 15 | self.Triton.setArchitecture(ARCH.X86_64) 16 | 17 | self.flag = False 18 | self.Triton.addCallback(CALLBACK.GET_CONCRETE_MEMORY_VALUE, self.cb_flag) 19 | self.Triton.processing(Instruction(b"\x48\xa1\x00\x10\x00\x00\x00\x00\x00\x00")) # movabs rax, qword ptr [0x1000] 20 | self.assertTrue(self.flag) 21 | 22 | self.flag = False 23 | self.Triton.removeCallback(CALLBACK.GET_CONCRETE_MEMORY_VALUE, self.cb_flag) 24 | self.Triton.processing(Instruction(b"\x48\xa1\x00\x10\x00\x00\x00\x00\x00\x00")) # movabs rax, qword ptr [0x1000] 25 | self.assertFalse(self.flag) 26 | 27 | def test_get_concrete_register_value(self): 28 | self.Triton = TritonContext() 29 | self.Triton.setArchitecture(ARCH.X86_64) 30 | 31 | self.flag = False 32 | self.Triton.addCallback(CALLBACK.GET_CONCRETE_REGISTER_VALUE, self.cb_flag) 33 | self.Triton.processing(Instruction(b"\x48\x89\xd8")) # mov rax, rbx 34 | self.assertTrue(self.flag) 35 | 36 | self.flag = False 37 | self.Triton.removeCallback(CALLBACK.GET_CONCRETE_REGISTER_VALUE, self.cb_flag) 38 | self.Triton.processing(Instruction(b"\x48\x89\xd8")) # mov rax, rbx 39 | self.assertFalse(self.flag) 40 | 41 | def cb_flag(self, ctx, x): 42 | self.flag = True 43 | 44 | -------------------------------------------------------------------------------- /src/testers/unittests/test_immutable_registers.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # coding: utf-8 3 | """Test immutable registers.""" 4 | 5 | import unittest 6 | import random 7 | 8 | from triton import * 9 | 10 | 11 | class TestImmutableAArch64Registers(unittest.TestCase): 12 | 13 | def setUp(self): 14 | """Define the arch.""" 15 | self.ctx = TritonContext() 16 | self.ctx.setArchitecture(ARCH.AARCH64) 17 | 18 | def test_immutable(self): 19 | x1 = self.ctx.registers.x1 20 | x2 = self.ctx.registers.x2 21 | xzr = self.ctx.registers.xzr 22 | wzr = self.ctx.registers.wzr 23 | 24 | self.assertEqual(self.ctx.getConcreteRegisterValue(xzr), 0) 25 | self.assertEqual(self.ctx.getConcreteRegisterValue(wzr), 0) 26 | 27 | # Set concrete values 28 | self.ctx.setConcreteRegisterValue(xzr, 1234) 29 | self.ctx.setConcreteRegisterValue(x1, 10) 30 | self.ctx.setConcreteRegisterValue(x2, 20) 31 | 32 | self.assertEqual(self.ctx.getConcreteRegisterValue(xzr), 0) 33 | self.assertEqual(self.ctx.getConcreteRegisterValue(wzr), 0) 34 | self.assertEqual(self.ctx.getConcreteRegisterValue(x1), 10) 35 | self.assertEqual(self.ctx.getConcreteRegisterValue(x2), 20) 36 | 37 | inst = Instruction(b"\x3f\x00\x02\x8b") # add xzr, x1, x2 38 | self.ctx.processing(inst) 39 | 40 | # Concrete 41 | self.assertEqual(self.ctx.getConcreteRegisterValue(xzr), 0) 42 | self.assertEqual(self.ctx.getConcreteRegisterValue(wzr), 0) 43 | 44 | # Symbolic 45 | self.assertEqual(self.ctx.getSymbolicRegisterValue(xzr), 0) 46 | self.assertEqual(self.ctx.getSymbolicRegisterValue(wzr), 0) 47 | 48 | # Assignment 49 | self.assertEqual(REG.AARCH64.XZR in self.ctx.getSymbolicRegisters(), False) 50 | self.assertEqual(REG.AARCH64.WZR in self.ctx.getSymbolicRegisters(), False) 51 | self.assertEqual(REG.AARCH64.PC in self.ctx.getSymbolicRegisters(), True) 52 | -------------------------------------------------------------------------------- /src/testers/unittests/test_solver.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # coding: utf-8 3 | """Test Solvers.""" 4 | 5 | import unittest 6 | 7 | from triton import * 8 | 9 | 10 | class TestSolvers(unittest.TestCase): 11 | 12 | """Testing the solver engines.""" 13 | 14 | def setUp(self): 15 | """Define the arch.""" 16 | self.ctx = TritonContext(ARCH.X86_64) 17 | self.ast = self.ctx.getAstContext() 18 | 19 | def solve_a_query(self, solver): 20 | self.ctx.reset() 21 | self.ctx.setSolver(solver) 22 | self.ctx.symbolizeRegister(self.ctx.registers.rax, 'my_rax') 23 | self.ctx.processing(Instruction(b"\x48\x35\x34\x12\x00\x00")) # xor rax, 0x1234 24 | self.ctx.processing(Instruction(b"\x48\x89\xc1")) # xor rcx, rax 25 | rcx_expr = self.ctx.getSymbolicRegister(self.ctx.registers.rcx) 26 | constraint = rcx_expr.getAst() == 0xdead 27 | 28 | # Testing isSat() 29 | self.assertEqual(self.ctx.isSat(constraint), True) 30 | 31 | # Testing getModels() with status and timeout 32 | models, status, time = self.ctx.getModels(constraint, 10, status=True, timeout=5000) 33 | self.assertEqual(status, SOLVER_STATE.SAT) # must be SAT 34 | self.assertEqual(len(models), 1) # Only one possible model 35 | self.assertEqual(models[0][0].getValue(), 0xcc99) # The correct model 36 | 37 | # Testing getModel() with status and timeout 38 | models, status, time = self.ctx.getModel(constraint, status=True, timeout=5000) 39 | self.assertEqual(status, SOLVER_STATE.SAT) # must be SAT 40 | self.assertEqual(models[0].getValue(), 0xcc99) # The correct model 41 | return 42 | 43 | def solve_bswap(self, solver): 44 | self.ctx = TritonContext(ARCH.X86_64) 45 | self.ast = self.ctx.getAstContext() 46 | self.ctx.setSolver(solver) 47 | var = self.ast.variable(self.ctx.newSymbolicVariable(32, "x")) 48 | node = self.ast.bswap(var) 49 | model = self.ctx.getModel(node == 0x44332211) 50 | self.assertEqual(model[0].getValue(), 0x11223344) 51 | return 52 | 53 | def test_solvers(self): 54 | # Test if Z3 has been enabled 55 | if 'Z3' in dir(SOLVER): 56 | self.solve_a_query(SOLVER.Z3) 57 | self.solve_bswap(SOLVER.Z3) 58 | 59 | # Test if BITWUZLA has been enabled 60 | if 'BITWUZLA' in dir(SOLVER): 61 | self.solve_a_query(SOLVER.BITWUZLA) 62 | self.solve_bswap(SOLVER.BITWUZLA) 63 | -------------------------------------------------------------------------------- /src/testers/unittests/test_symbolic_optimizations.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # coding: utf-8 3 | """Test Symbolic Optimizations.""" 4 | 5 | import unittest 6 | from triton import * 7 | 8 | 9 | class TestSymbolicOptimizations(unittest.TestCase): 10 | 11 | """Testing ALIGNED_MEMORY.""" 12 | 13 | def setUp(self): 14 | self.ctx = TritonContext(ARCH.X86_64) 15 | 16 | 17 | def test_without_optim(self): 18 | self.ctx.setMode(MODE.ALIGNED_MEMORY, False) 19 | 20 | self.ctx.processing(Instruction(b"\x48\xc7\xc0\x01\x00\x00\x00")) # mov rax, 1 21 | self.ctx.processing(Instruction(b"\x48\x89\x03")) # mov [rbx], rax 22 | self.ctx.processing(Instruction(b"\x48\x8b\x0b")) # mov rcx, [rbx] 23 | 24 | rcx = self.ctx.getMemoryAst(MemoryAccess(0, CPUSIZE.QWORD)) 25 | self.assertEqual(rcx.getType(), AST_NODE.CONCAT) 26 | self.assertEqual(rcx.evaluate(), 1) 27 | return 28 | 29 | 30 | def test_with_optim(self): 31 | self.ctx.setMode(MODE.ALIGNED_MEMORY, True) 32 | 33 | self.ctx.processing(Instruction(b"\x48\xc7\xc0\x01\x00\x00\x00")) # mov rax, 1 34 | self.ctx.processing(Instruction(b"\x48\x89\x03")) # mov [rbx], rax 35 | self.ctx.processing(Instruction(b"\x48\x8b\x0b")) # mov rcx, [rbx] 36 | 37 | rcx = self.ctx.getMemoryAst(MemoryAccess(0, CPUSIZE.QWORD)) 38 | self.assertEqual(rcx.getType(), AST_NODE.REFERENCE) 39 | self.assertEqual(rcx.evaluate(), 1) 40 | return 41 | -------------------------------------------------------------------------------- /src/testers/unittests/test_undefined_registers.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # coding: utf-8 3 | """Test the undefined register behavior.""" 4 | 5 | import unittest 6 | from triton import * 7 | 8 | 9 | class TestUndefinedRegisters(unittest.TestCase): 10 | 11 | """Testing the undefined register behavior.""" 12 | 13 | def setUp(self): 14 | """Define the arch.""" 15 | self.ctx = TritonContext() 16 | self.ctx.setArchitecture(ARCH.X86_64) 17 | 18 | 19 | def test_undefined_on(self): 20 | self.ctx.setMode(MODE.CONCRETIZE_UNDEFINED_REGISTERS, True) 21 | 22 | trace = [ 23 | b"\x48\xc7\xc0\x10\x00\x00\x00", # mov rax, 0x10 24 | b"\x48\xc7\xc3\x20\x00\x00\x00", # mov rbx, 0x20 25 | b"\x48\xff\xc0", # inc rax 26 | b"\x48\x31\xd8", # xor rax, rbx 27 | b"\x48\xf7\xe3", # mul rbx 28 | ] 29 | 30 | for op in trace: 31 | inst = Instruction(op) 32 | self.ctx.processing(inst) 33 | if inst.getType() == OPCODE.X86.XOR: 34 | self.assertEqual(len(inst.getUndefinedRegisters()), 1) 35 | if inst.getType() == OPCODE.X86.MUL: 36 | self.assertEqual(len(inst.getUndefinedRegisters()), 4) 37 | 38 | self.assertEqual(REG.X86_64.SF in self.ctx.getSymbolicRegisters(), False) 39 | self.assertEqual(REG.X86_64.ZF in self.ctx.getSymbolicRegisters(), False) 40 | self.assertEqual(REG.X86_64.AF in self.ctx.getSymbolicRegisters(), False) 41 | self.assertEqual(REG.X86_64.PF in self.ctx.getSymbolicRegisters(), False) 42 | 43 | 44 | def test_undefined_off(self): 45 | self.ctx.setMode(MODE.CONCRETIZE_UNDEFINED_REGISTERS, False) 46 | 47 | trace = [ 48 | b"\x48\xc7\xc0\x10\x00\x00\x00", # mov rax, 0x10 49 | b"\x48\xc7\xc3\x20\x00\x00\x00", # mov rbx, 0x20 50 | b"\x48\xff\xc0", # inc rax 51 | b"\x48\x31\xd8", # xor rax, rbx 52 | b"\x48\xf7\xe3", # mul rbx 53 | ] 54 | 55 | for op in trace: 56 | inst = Instruction(op) 57 | self.ctx.processing(inst) 58 | if inst.getType() == OPCODE.X86.XOR: 59 | self.assertEqual(len(inst.getUndefinedRegisters()), 1) 60 | if inst.getType() == OPCODE.X86.MUL: 61 | self.assertEqual(len(inst.getUndefinedRegisters()), 4) 62 | 63 | self.assertEqual(REG.X86_64.SF in self.ctx.getSymbolicRegisters(), True) 64 | self.assertEqual(REG.X86_64.ZF in self.ctx.getSymbolicRegisters(), True) 65 | self.assertEqual(REG.X86_64.AF in self.ctx.getSymbolicRegisters(), True) 66 | self.assertEqual(REG.X86_64.PF in self.ctx.getSymbolicRegisters(), True) 67 | -------------------------------------------------------------------------------- /src/testers/unittests/utils.py: -------------------------------------------------------------------------------- 1 | """Helper module for testing functions.""" 2 | 3 | 4 | def xfail(f): 5 | """Decorator to mark expected failing tests.""" 6 | def wrapper(self, *args, **kwargs): 7 | """Expected fail function raise an exception.""" 8 | with self.assertRaises(Exception): 9 | f(self, *args, **kwargs) 10 | return wrapper 11 | -------------------------------------------------------------------------------- /vcpkg.json: -------------------------------------------------------------------------------- 1 | { 2 | "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg/master/scripts/vcpkg.schema.json", 3 | "name": "triton", 4 | "version": "1.0", 5 | "description": "Triton is a dynamic binary analysis library. It provides internal components like a dynamic symbolic execution engine, a dynamic taint analysis engine, AST representation of the x86, x86-64, ARM32 and AArch64 ISA semantic, an expressions synthesis engine, some SMT simplification passes, SMT solver interface to Z3 and Bitwuzla and, the last but not least, Python bindings. Based on these components, you are able to build your program analysis tools, automate reverse engineering, perform software verification or just emulate code.", 6 | "homepage": "https://github.com/JonathanSalwan/Triton", 7 | "license": "Apache-2.0", 8 | "supports": "!arm", 9 | "builtin-baseline": "e809a42f87565e803b2178a0c11263f462d1800a", 10 | "dependencies": [ 11 | "boost-math", 12 | "boost-multiprecision", 13 | "boost-numeric-conversion", 14 | { "name": "capstone", "default-features": false, "features": ["arm", "arm64", "riscv", "x86"] }, 15 | "z3" 16 | ], 17 | "overrides": [ 18 | { "name":"capstone", "version-semver":"5.0.1", "port-version": 1 } 19 | ] 20 | } 21 | -------------------------------------------------------------------------------- /vcpkg/triplets/x64-linux-release.cmake: -------------------------------------------------------------------------------- 1 | set(VCPKG_TARGET_ARCHITECTURE x64) 2 | set(VCPKG_CRT_LINKAGE dynamic) 3 | set(VCPKG_LIBRARY_LINKAGE static) 4 | set(VCPKG_BUILD_TYPE release) 5 | set(VCPKG_CMAKE_SYSTEM_NAME Linux) 6 | -------------------------------------------------------------------------------- /vcpkg/triplets/x64-osx-release.cmake: -------------------------------------------------------------------------------- 1 | set(VCPKG_TARGET_ARCHITECTURE arm64) 2 | set(VCPKG_CRT_LINKAGE dynamic) 3 | set(VCPKG_LIBRARY_LINKAGE static) 4 | set(VCPKG_BUILD_TYPE release) 5 | set(VCPKG_CMAKE_SYSTEM_NAME Darwin) 6 | set(VCPKG_OSX_ARCHITECTURES arm64) 7 | -------------------------------------------------------------------------------- /vcpkg/triplets/x64-windows-static-release-md.cmake: -------------------------------------------------------------------------------- 1 | set(VCPKG_TARGET_ARCHITECTURE x64) 2 | set(VCPKG_CRT_LINKAGE dynamic) 3 | set(VCPKG_LIBRARY_LINKAGE static) 4 | set(VCPKG_BUILD_TYPE release) 5 | --------------------------------------------------------------------------------