dwarfcore.detectors.common module

class dwarfcore.detectors.common.CallStackFrame(func_name: str, leave_va: dwarfcore.dwarfcore.ManticoreAddress, return_va: dwarfcore.dwarfcore.ManticoreAddress, register_state: manticore.native.cpu.abstractcpu.RegisterFile, inscope_variables: List[mate.build.tob_chess_utils.dwarf.MantiDwarfTypeInfo], other_data: Dict[str, Any] = <factory>)

Bases: object

Call Stack Frame information to look at info.

Return type


func_name: str

Address we left at

inscope_variables: List[mate.build.tob_chess_utils.dwarf.MantiDwarfTypeInfo]

Additional data for other plugins

leave_va: dwarfcore.dwarfcore.ManticoreAddress

Address to return to

other_data: Dict[str, Any]
register_state: manticore.native.cpu.abstractcpu.RegisterFile

DWARF-derived in-scope variables

return_va: dwarfcore.dwarfcore.ManticoreAddress

Register state we left at

class dwarfcore.detectors.common.FoundVarInfo(found_var: dwarfcore.detectors.common.VariableAtMemoryInfo, var_write_info: Dict[str, bool], call_frame: Optional[dwarfcore.detectors.common.CallStackFrame])

Bases: object

Simple data structure for holding more info about a variable found at a memory location and how it relates to the call stack.

Return type


call_frame: Optional[dwarfcore.detectors.common.CallStackFrame]
found_var: dwarfcore.detectors.common.VariableAtMemoryInfo
var_write_info: Dict[str, bool]
class dwarfcore.detectors.common.VariableAtMemoryInfo(name, min_mem, max_mem, var, parent_min_mem, parent_max_mem, padding)

Bases: tuple

max_mem: dwarfcore.dwarfcore.ManticoreAddress

Alias for field number 2

min_mem: dwarfcore.dwarfcore.ManticoreAddress

Alias for field number 1

name: str

Alias for field number 0

padding: bool

Alias for field number 6

parent_max_mem: dwarfcore.dwarfcore.ManticoreAddress

Alias for field number 5

parent_min_mem: dwarfcore.dwarfcore.ManticoreAddress

Alias for field number 4

var: mate.build.tob_chess_utils.dwarf.MantiDwarfTypeInfo

Alias for field number 3

dwarfcore.detectors.common.record_concretize_state_vars(state: manticore.native.state.State, orig_id: int) List[mate_common.models.integration.ReachingInput]

Concretize and constrain all symbolic variables and return their values.

This should be called with a temporary state if you wish to continue execution after this point.

  • state – State to look for variables. Will constrain variables to values

  • orig_id – Original state ID

  • state (manticore.native.state.State) –

  • orig_id (int) –


Information about user inputs that reach this point in execution

Return type


dwarfcore.detectors.common.stack_mem_access(state: manticore.native.state.State, where: int) bool

Check if a memory access is located at a valid position in the current stack.

We use the stack register to determine the upper (low value for x86) bound and Manticore’s load information for the bottom of the stack.

  • state – Manticore State to use as context for program values

  • where – The memory access to check

  • state (manticore.native.state.State) –

  • where (int) –


True if located in the stack; False otherwise

Return type


dwarfcore.detectors.common.variable_at_memory(mem_addr: dwarfcore.dwarfcore.ManticoreAddress, state: manticore.native.state.State, possible_vars: List[mate.build.tob_chess_utils.dwarf.MantiDwarfTypeInfo], regfile: Optional[manticore.native.cpu.abstractcpu.RegisterFile] = None) Optional[dwarfcore.detectors.common.VariableAtMemoryInfo]

Given a memory address and Manticore state, try to determine possible variables that occupy that space. Optionally, give a list of variables and their information to limit the search, otherwise search all known variables.

  • mem_addr – Manticore memory address

  • state – State to use for memory lookups

  • possible_vars – DWARF variable information to look at for matching mem_addr

  • regfile – Registers to use for looking up values at program state, if not specified use passed state

  • mem_addr (dwarfcore.dwarfcore.ManticoreAddress) –

  • state (manticore.native.state.State) –

  • possible_vars (List[mate.build.tob_chess_utils.dwarf.MantiDwarfTypeInfo]) –

  • regfile (Optional[manticore.native.cpu.abstractcpu.RegisterFile]) –


List of all variable information at the memory address or None

Return type