<s> import logging <EOL> import string <EOL> import math <EOL> import re <EOL> import os <EOL> import pickle <EOL> from datetime import datetime <EOL> from collections import defaultdict <EOL> import networkx <EOL> import progressbar <EOL> import simuvex <EOL> import cle <EOL> import pyvex <EOL> from . . errors import AngrError <EOL> from . . analysis import Analysis , register_analysis <EOL> from . . surveyors import Explorer , Slicecutor <EOL> from . . annocfg import AnnotatedCFG <EOL> l = logging . getLogger ( "<STR_LIT>" ) <EOL> class GirlScout ( Analysis ) : <EOL> """<STR_LIT>""" <EOL> def __init__ ( self , binary = None , start = None , end = None , pickle_intermediate_results = False , perform_full_code_scan = False ) : <EOL> self . _binary = binary if binary is not None else self . project . loader . main_bin <EOL> self . _start = start if start is not None else ( self . _binary . rebase_addr + self . _binary . get_min_addr ( ) ) <EOL> self . _end = end if end is not None else ( self . _binary . rebase_addr + self . _binary . get_max_addr ( ) ) <EOL> self . _pickle_intermediate_results = pickle_intermediate_results <EOL> self . _perform_full_code_scan = perform_full_code_scan <EOL> l . debug ( "<STR_LIT>" , self . _start , self . _end ) <EOL> self . _valid_memory_regions = sorted ( <EOL> [ ( self . _binary . rebase_addr + start , self . _binary . rebase_addr + start + len ( cbacker ) ) <EOL> for start , cbacker in self . project . loader . memory . cbackers ] , <EOL> key = lambda x : x [ <NUM_LIT:0> ] <EOL> ) <EOL> self . _valid_memory_region_size = sum ( [ ( end - start ) for start , end in self . _valid_memory_regions ] ) <EOL> self . _block_size = { } <EOL> self . _next_addr = self . _start - <NUM_LIT:1> <EOL> self . functions = None <EOL> self . call_map = networkx . DiGraph ( ) <EOL> self . cfg = networkx . DiGraph ( ) <EOL> self . _seg_list = SegmentList ( ) <EOL> self . _read_addr_to_run = defaultdict ( list ) <EOL> self . _write_addr_to_run = defaultdict ( list ) <EOL> self . _indirect_jumps = set ( ) <EOL> self . _unassured_functions = set ( ) <EOL> self . base_address = None <EOL> self . _reconnoiter ( ) <EOL> @ property <EOL> def call_map ( self ) : <EOL> return self . call_map <EOL> def _get_next_addr_to_search ( self , alignment = None ) : <EOL> curr_addr = self . _next_addr <EOL> if self . _seg_list . has_blocks : <EOL> curr_addr = self . _seg_list . next_free_pos ( curr_addr ) <EOL> if alignment is not None : <EOL> if curr_addr % alignment > <NUM_LIT:0> : <EOL> curr_addr = curr_addr - curr_addr % alignment + alignment <EOL> accepted = False <EOL> for start , end in self . _valid_memory_regions : <EOL> if curr_addr >= start and curr_addr < end : <EOL> accepted = True <EOL> break <EOL> if curr_addr < start : <EOL> accepted = True <EOL> curr_addr = start <EOL> if not accepted : <EOL> return None <EOL> self . _next_addr = curr_addr <EOL> if self . _end is None or curr_addr < self . _end : <EOL> l . debug ( "<STR_LIT>" , curr_addr ) <EOL> return curr_addr <EOL> else : <EOL> l . debug ( "<STR_LIT>" , curr_addr ) <EOL> return None <EOL> def _get_next_code_addr ( self , initial_state ) : <EOL> """<STR_LIT>""" <EOL> next_addr = self . _get_next_addr_to_search ( ) <EOL> if next_addr is None : <EOL> return None <EOL> start_addr = next_addr <EOL> sz = "<STR_LIT>" <EOL> is_sz = True <EOL> while is_sz : <EOL> while next_addr in initial_state . memory : <EOL> try : <EOL> l . debug ( "<STR_LIT>" , next_addr ) <EOL> val = initial_state . mem_concrete ( next_addr , <NUM_LIT:1> ) <EOL> if val == <NUM_LIT:0> : <EOL> if len ( sz ) < <NUM_LIT:4> : <EOL> is_sz = False <EOL> else : <EOL> reach_end = True <EOL> break <EOL> if chr ( val ) not in string . printable : <EOL> is_sz = False <EOL> break <EOL> sz += chr ( val ) <EOL> next_addr += <NUM_LIT:1> <EOL> except simuvex . SimValueError : <EOL> l . debug ( "<STR_LIT>" , next_addr ) <EOL> break <EOL> if len ( sz ) > <NUM_LIT:0> and is_sz : <EOL> l . debug ( "<STR_LIT>" , len ( sz ) , sz ) <EOL> self . _seg_list . occupy ( start_addr , len ( sz ) + <NUM_LIT:1> ) <EOL> sz = "<STR_LIT>" <EOL> next_addr = self . _get_next_addr_to_search ( ) <EOL> if next_addr is None : <EOL> return None <EOL> start_addr = next_addr <EOL> if is_sz : <EOL> next_addr += <NUM_LIT:1> <EOL> instr_alignment = initial_state . arch . instruction_alignment <EOL> if start_addr % instr_alignment > <NUM_LIT:0> : <EOL> start_addr = start_addr - start_addr % instr_alignment + instr_alignment <EOL> l . debug ( '<STR_LIT>' , start_addr ) <EOL> return start_addr <EOL> def _symbolic_reconnoiter ( self , addr , target_addr , max_depth = <NUM_LIT:10> ) : <EOL> """<STR_LIT>""" <EOL> state = self . project . factory . blank_state ( addr = addr , <EOL> mode = "<STR_LIT>" , <EOL> add_options = { simuvex . o . CALLLESS } <EOL> ) <EOL> initial_exit = self . project . factory . path ( state ) <EOL> explorer = Explorer ( self . project , <EOL> start = initial_exit , <EOL> max_depth = max_depth , <EOL> find = ( target_addr ) , num_find = <NUM_LIT:1> ) . run ( ) <EOL> if len ( explorer . found ) > <NUM_LIT:0> : <EOL> path = explorer . found [ <NUM_LIT:0> ] <EOL> last_run = path . last_run <EOL> return last_run . flat_exits ( ) <EOL> else : <EOL> return [ ] <EOL> def _static_memory_slice ( self , run ) : <EOL> if isinstance ( run , simuvex . SimIRSB ) : <EOL> for stmt in run . statements : <EOL> refs = stmt . actions <EOL> if len ( refs ) > <NUM_LIT:0> : <EOL> real_ref = refs [ - <NUM_LIT:1> ] <EOL> if type ( real_ref ) == simuvex . SimActionData : <EOL> if real_ref . action == '<STR_LIT>' : <EOL> addr = real_ref . addr <EOL> if not run . initial_state . se . symbolic ( addr ) : <EOL> concrete_addr = run . initial_state . se . any_int ( addr ) <EOL> self . _write_addr_to_run [ addr ] . append ( run . addr ) <EOL> elif real_ref . action == '<STR_LIT>' : <EOL> addr = real_ref . addr <EOL> if not run . initial_state . se . symbolic ( addr ) : <EOL> concrete_addr = run . initial_state . se . any_int ( addr ) <EOL> self . _read_addr_to_run [ addr ] . append ( run . addr ) <EOL> def _scan_code ( self , traced_addresses , function_exits , initial_state , starting_address ) : <EOL> remaining_exits = set ( ) <EOL> next_addr = starting_address <EOL> remaining_exits . add ( ( next_addr , <EOL> next_addr , <EOL> next_addr , <EOL> initial_state . copy ( ) ) ) <EOL> while len ( remaining_exits ) : <EOL> current_function_addr , previous_addr , parent_addr , state = remaining_exits . pop ( ) <EOL> if previous_addr in traced_addresses : <EOL> continue <EOL> self . cfg . add_node ( previous_addr ) <EOL> if current_function_addr != - <NUM_LIT:1> : <EOL> l . debug ( "<STR_LIT>" , <EOL> previous_addr , current_function_addr ) <EOL> else : <EOL> l . debug ( "<STR_LIT>" , previous_addr ) <EOL> traced_addresses . add ( previous_addr ) <EOL> self . _scan_block ( previous_addr , state , current_function_addr , function_exits , remaining_exits , traced_addresses ) <EOL> def _scan_block ( self , addr , state , current_function_addr , function_exits , remaining_exits , traced_addresses ) : <EOL> try : <EOL> irsb = self . project . factory . block ( addr ) . vex <EOL> self . _block_size [ addr ] = irsb . size <EOL> self . _seg_list . occupy ( addr , irsb . size ) <EOL> except ( AngrTranslationError , AngrMemoryError ) : <EOL> return <EOL> next , jumpkind = irsb . next , irsb . jumpkind <EOL> successors = [ ( i . dst , i . jumpkind ) for i in irsb . statements if type ( i ) is pyvex . IRStmt . Exit ] <EOL> successors . append ( ( next , jumpkind ) ) <EOL> for suc in successors : <EOL> target , jumpkind = suc <EOL> if type ( target ) is pyvex . IRExpr . Const : <EOL> next_addr = target . con . value <EOL> else : <EOL> next_addr = None <EOL> if jumpkind == '<STR_LIT>' and next_addr is not None : <EOL> remaining_exits . add ( ( current_function_addr , next_addr , <EOL> addr , None ) ) <EOL> elif jumpkind == '<STR_LIT>' and next_addr is not None : <EOL> if jumpkind == "<STR_LIT>" : <EOL> if current_function_addr != - <NUM_LIT:1> : <EOL> self . functions . add ( current_function_addr ) <EOL> self . functions . add ( next_addr ) <EOL> self . call_map . add_edge ( current_function_addr , next_addr ) <EOL> else : <EOL> self . functions . add ( next_addr ) <EOL> self . call_map . add_node ( next_addr ) <EOL> elif jumpkind == "<STR_LIT>" or jumpkind == "<STR_LIT>" : <EOL> if current_function_addr != - <NUM_LIT:1> : <EOL> function_exits [ current_function_addr ] . add ( next_addr ) <EOL> if next_addr in traced_addresses : <EOL> return <EOL> remaining_exits . add ( ( next_addr , next_addr , addr , None ) ) <EOL> l . debug ( "<STR_LIT>" , len ( self . call_map . nodes ( ) ) ) <EOL> def _scan_block_ ( self , addr , state , current_function_addr , function_exits , remaining_exits , traced_addresses ) : <EOL> state . ip = addr <EOL> s_path = self . project . factory . path ( state ) <EOL> try : <EOL> s_run = s_path . next_run <EOL> except simuvex . SimIRSBError , ex : <EOL> l . debug ( ex ) <EOL> return <EOL> except AngrError , ex : <EOL> l . debug ( ex ) <EOL> return <EOL> except ( simuvex . SimValueError , simuvex . SimSolverModeError ) , ex : <EOL> l . debug ( ex ) <EOL> return <EOL> except simuvex . SimError as ex : <EOL> l . debug ( ex ) <EOL> return <EOL> if type ( s_run ) is simuvex . SimIRSB : <EOL> bytes = s_run . irsb . _state [ <NUM_LIT:1> ] [ '<STR_LIT>' ] <EOL> size = s_run . irsb . size <EOL> ent = self . _calc_entropy ( bytes , size = size ) <EOL> if ent < <NUM_LIT:1.0> and size > <NUM_LIT> : <EOL> return <EOL> if isinstance ( s_run , simuvex . SimIRSB ) : <EOL> self . _seg_list . occupy ( addr , s_run . irsb . size ) <EOL> successors = s_run . flat_successors + s_run . unsat_successors <EOL> has_call_exit = False <EOL> tmp_exit_set = set ( ) <EOL> for suc in successors : <EOL> if suc . scratch . jumpkind == "<STR_LIT>" : <EOL> has_call_exit = True <EOL> for suc in successors : <EOL> jumpkind = suc . scratch . jumpkind <EOL> if has_call_exit and jumpkind == "<STR_LIT>" : <EOL> jumpkind = "<STR_LIT>" <EOL> if jumpkind == "<STR_LIT>" : <EOL> continue <EOL> try : <EOL> next_addr = suc . se . exactly_n_int ( suc . ip , <NUM_LIT:1> ) [ <NUM_LIT:0> ] <EOL> except ( simuvex . SimValueError , simuvex . SimSolverModeError ) as ex : <EOL> self . _indirect_jumps . add ( ( suc . scratch . jumpkind , addr ) ) <EOL> l . info ( "<STR_LIT>" , addr , suc . scratch . jumpkind ) <EOL> continue <EOL> self . cfg . add_edge ( addr , next_addr , jumpkind = jumpkind ) <EOL> if jumpkind == "<STR_LIT>" : <EOL> if current_function_addr != - <NUM_LIT:1> : <EOL> self . call_map . add_edge ( current_function_addr , next_addr ) <EOL> else : <EOL> self . call_map . add_node ( next_addr ) <EOL> elif jumpkind == "<STR_LIT>" or jumpkind == "<STR_LIT>" : <EOL> if current_function_addr != - <NUM_LIT:1> : <EOL> function_exits [ current_function_addr ] . add ( next_addr ) <EOL> if next_addr in traced_addresses : <EOL> continue <EOL> if next_addr in tmp_exit_set : <EOL> continue <EOL> tmp_exit_set . add ( next_addr ) <EOL> if jumpkind == "<STR_LIT>" : <EOL> new_state = suc . copy ( ) <EOL> remaining_exits . add ( ( next_addr , next_addr , addr , new_state ) ) <EOL> l . debug ( "<STR_LIT>" , len ( self . call_map . nodes ( ) ) ) <EOL> elif jumpkind == "<STR_LIT>" or jumpkind == "<STR_LIT>" or jumpkind == "<STR_LIT>" : <EOL> new_state = suc . copy ( ) <EOL> l . debug ( "<STR_LIT>" , jumpkind ) <EOL> remaining_exits . add ( ( current_function_addr , next_addr , <EOL> addr , new_state ) ) <EOL> elif jumpkind == "<STR_LIT>" : <EOL> pass <EOL> elif jumpkind . startswith ( "<STR_LIT>" ) : <EOL> pass <EOL> elif jumpkind == "<STR_LIT>" : <EOL> pass <EOL> elif jumpkind == '<STR_LIT>' : <EOL> pass <EOL> elif jumpkind == '<STR_LIT>' : <EOL> pass <EOL> elif jumpkind == '<STR_LIT>' : <EOL> pass <EOL> elif jumpkind == '<STR_LIT>' : <EOL> pass <EOL> else : <EOL> raise Exception ( "<STR_LIT>" ) <EOL> def _scan_function_prologues ( self , traced_address , function_exits , initial_state ) : <EOL> """<STR_LIT>""" <EOL> regexes = set ( ) <EOL> for ins_regex in self . project . arch . function_prologs : <EOL> r = re . compile ( ins_regex ) <EOL> regexes . add ( r ) <EOL> strides = self . project . loader . main_bin . memory . stride_repr <EOL> for start_ , end_ , bytes in strides : <EOL> for regex in regexes : <EOL> for mo in regex . finditer ( bytes ) : <EOL> position = mo . start ( ) + start_ <EOL> if position % self . project . arch . instruction_alignment == <NUM_LIT:0> : <EOL> if position not in traced_address : <EOL> percentage = self . _seg_list . occupied_size * <NUM_LIT> / ( self . _valid_memory_region_size ) <EOL> l . info ( "<STR_LIT>" , position , percentage ) <EOL> self . _unassured_functions . add ( position ) <EOL> self . _scan_code ( traced_address , function_exits , initial_state , position ) <EOL> else : <EOL> l . info ( "<STR_LIT>" , position ) <EOL> def _process_indirect_jumps ( self ) : <EOL> """<STR_LIT>""" <EOL> function_starts = set ( ) <EOL> print "<STR_LIT>" % len ( self . _indirect_jumps ) <EOL> for jumpkind , irsb_addr in self . _indirect_jumps : <EOL> if len ( function_starts ) > <NUM_LIT:20> : <EOL> break <EOL> if jumpkind == "<STR_LIT>" : <EOL> state = self . project . factory . blank_state ( addr = irsb_addr , mode = "<STR_LIT>" , <EOL> add_options = { simuvex . o . SYMBOLIC_INITIAL_VALUES } <EOL> ) <EOL> path = self . project . factory . path ( state ) <EOL> print hex ( irsb_addr ) <EOL> try : <EOL> r = ( path . next_run . successors + path . next_run . unsat_successors ) [ <NUM_LIT:0> ] <EOL> ip = r . se . exactly_n_int ( r . ip , <NUM_LIT:1> ) [ <NUM_LIT:0> ] <EOL> function_starts . add ( ip ) <EOL> continue <EOL> except simuvex . SimSolverModeError as ex : <EOL> pass <EOL> irsb = self . project . factory . block ( irsb_addr ) . vex <EOL> stmts = irsb . statements <EOL> b = Blade ( self . cfg , irsb . addr , - <NUM_LIT:1> , project = self . project ) <EOL> for addr , stmt_idx in sorted ( list ( b . slice . nodes ( ) ) ) : <EOL> irsb = self . project . factory . block ( addr ) . vex <EOL> stmts = irsb . statements <EOL> print "<STR_LIT>" % ( addr , stmt_idx ) , <EOL> print "<STR_LIT:%s>" % stmts [ stmt_idx ] , <EOL> print "<STR_LIT>" % b . slice . in_degree ( ( addr , stmt_idx ) ) <EOL> print "<STR_LIT>" <EOL> sources = [ n for n in b . slice . nodes ( ) if b . slice . in_degree ( n ) == <NUM_LIT:0> ] <EOL> annotatedcfg = AnnotatedCFG ( self . project , None , target_irsb_addr = irsb_addr , detect_loops = False ) <EOL> annotatedcfg . from_digraph ( b . slice ) <EOL> for src_irsb , src_stmt_idx in sources : <EOL> start_state = self . project . factory . blank_state ( addr = src_irsb , <EOL> add_options = <EOL> { simuvex . o . DO_RET_EMULATION , <EOL> simuvex . o . TRUE_RET_EMULATION_GUARD } <EOL> ) <EOL> start_path = self . project . factory . path ( start_state ) <EOL> slicecutor = Slicecutor ( self . project , annotatedcfg , start = start_path , targets = ( irsb_addr , ) ) <EOL> try : <EOL> slicecutor . run ( ) <EOL> except KeyError as ex : <EOL> l . debug ( "<STR_LIT>" , exc_info = ex ) <EOL> continue <EOL> for r in slicecutor . reached_targets : <EOL> if r . next_run . successors : <EOL> target_ip = r . next_run . successors [ <NUM_LIT:0> ] . ip <EOL> se = r . next_run . successors [ <NUM_LIT:0> ] . se <EOL> if not se . symbolic ( target_ip ) : <EOL> concrete_ip = se . exactly_n_int ( target_ip , <NUM_LIT:1> ) [ <NUM_LIT:0> ] <EOL> function_starts . add ( concrete_ip ) <EOL> l . info ( "<STR_LIT>" , concrete_ip ) <EOL> return function_starts <EOL> def _solve_forbase_address ( self , function_starts , functions ) : <EOL> """<STR_LIT>""" <EOL> pseudo_base_addr = self . project . loader . main_bin . get_min_addr ( ) <EOL> base_addr_ctr = { } <EOL> for s in function_starts : <EOL> for f in functions : <EOL> base_addr = s - f + pseudo_base_addr <EOL> ctr = <NUM_LIT:1> <EOL> for k in function_starts : <EOL> if k - base_addr + pseudo_base_addr in functions : <EOL> ctr += <NUM_LIT:1> <EOL> if ctr > <NUM_LIT:5> : <EOL> base_addr_ctr [ base_addr ] = ctr <EOL> if len ( base_addr_ctr ) : <EOL> base_addr , hits = sorted ( [ ( k , v ) for k , v in base_addr_ctr . iteritems ( ) ] , key = lambda x : x [ <NUM_LIT:1> ] , reverse = True ) [ <NUM_LIT:0> ] <EOL> return base_addr <EOL> else : <EOL> return None <EOL> def _reconnoiter ( self ) : <EOL> if type ( self . _binary ) is cle . blob . Blob : <EOL> self . _determinebase_address ( ) <EOL> if self . _perform_full_code_scan : <EOL> self . _full_code_scan ( ) <EOL> def _determinebase_address ( self ) : <EOL> """<STR_LIT>""" <EOL> traced_address = set ( ) <EOL> self . functions = set ( ) <EOL> self . call_map = networkx . DiGraph ( ) <EOL> self . cfg = networkx . DiGraph ( ) <EOL> initial_state = self . project . factory . blank_state ( mode = "<STR_LIT>" ) <EOL> initial_options = initial_state . options - { simuvex . o . TRACK_CONSTRAINTS } - simuvex . o . refs <EOL> initial_options |= { simuvex . o . SUPER_FASTPATH } <EOL> initial_state . options = initial_options <EOL> function_exits = defaultdict ( set ) <EOL> dump_file_prefix = self . project . filename <EOL> if self . _pickle_intermediate_results and os . path . exists ( dump_file_prefix + "<STR_LIT>" ) : <EOL> l . debug ( "<STR_LIT>" ) <EOL> self . _indirect_jumps = pickle . load ( open ( dump_file_prefix + "<STR_LIT>" , "<STR_LIT:rb>" ) ) <EOL> self . cfg = pickle . load ( open ( dump_file_prefix + "<STR_LIT>" , "<STR_LIT:rb>" ) ) <EOL> self . _unassured_functions = pickle . load ( open ( dump_file_prefix + "<STR_LIT>" , "<STR_LIT:rb>" ) ) <EOL> else : <EOL> self . _scan_function_prologues ( traced_address , function_exits , initial_state ) <EOL> if self . _pickle_intermediate_results : <EOL> l . debug ( "<STR_LIT>" ) <EOL> pickle . dump ( self . _indirect_jumps , open ( dump_file_prefix + "<STR_LIT>" , "<STR_LIT:wb>" ) ) <EOL> pickle . dump ( self . cfg , open ( dump_file_prefix + "<STR_LIT>" , "<STR_LIT:wb>" ) ) <EOL> pickle . dump ( self . _unassured_functions , open ( dump_file_prefix + "<STR_LIT>" , "<STR_LIT:wb>" ) ) <EOL> if len ( self . _indirect_jumps ) : <EOL> function_starts = self . _process_indirect_jumps ( ) <EOL> self . base_address = self . _solve_forbase_address ( function_starts , self . _unassured_functions ) <EOL> l . info ( "<STR_LIT>" , self . base_address ) <EOL> else : <EOL> l . debug ( "<STR_LIT>" ) <EOL> while True : <EOL> next_addr = self . _get_next_code_addr ( initial_state ) <EOL> percentage = self . _seg_list . occupied_size * <NUM_LIT> / ( self . _valid_memory_region_size ) <EOL> l . info ( "<STR_LIT>" , next_addr , percentage ) <EOL> if next_addr is None : <EOL> break <EOL> self . call_map . add_node ( next_addr ) <EOL> self . _scan_code ( traced_address , function_exits , initial_state , next_addr ) <EOL> for src , s in function_exits . items ( ) : <EOL> if src in self . call_map : <EOL> for target in s : <EOL> if target in self . call_map : <EOL> self . call_map . add_edge ( src , target ) <EOL> nodes = sorted ( self . call_map . nodes ( ) ) <EOL> for i in range ( len ( nodes ) - <NUM_LIT:1> ) : <EOL> if nodes [ i ] >= nodes [ i + <NUM_LIT:1> ] - <NUM_LIT:4> : <EOL> for dst in self . call_map . successors ( nodes [ i + <NUM_LIT:1> ] ) : <EOL> self . call_map . add_edge ( nodes [ i ] , dst ) <EOL> for src in self . call_map . predecessors ( nodes [ i + <NUM_LIT:1> ] ) : <EOL> self . call_map . add_edge ( src , nodes [ i ] ) <EOL> self . call_map . remove_node ( nodes [ i + <NUM_LIT:1> ] ) <EOL> l . debug ( "<STR_LIT>" ) <EOL> def _full_code_scan ( self ) : <EOL> """<STR_LIT>""" <EOL> start_time = datetime . now ( ) <EOL> traced_address = set ( ) <EOL> self . functions = set ( ) <EOL> self . call_map = networkx . DiGraph ( ) <EOL> self . cfg = networkx . DiGraph ( ) <EOL> initial_state = self . project . factory . blank_state ( mode = "<STR_LIT>" ) <EOL> initial_options = initial_state . options - { simuvex . o . TRACK_CONSTRAINTS } - simuvex . o . refs <EOL> initial_options |= { simuvex . o . SUPER_FASTPATH } <EOL> initial_state . options = initial_options <EOL> function_exits = defaultdict ( set ) <EOL> widgets = [ progressbar . Percentage ( ) , <EOL> '<STR_LIT:U+0020>' , <EOL> progressbar . Bar ( marker = progressbar . RotatingMarker ( ) ) , <EOL> '<STR_LIT:U+0020>' , <EOL> progressbar . Timer ( ) , <EOL> '<STR_LIT:U+0020>' , <EOL> progressbar . ETA ( ) <EOL> ] <EOL> pb = progressbar . ProgressBar ( widgets = widgets , maxval = <NUM_LIT> * <NUM_LIT:100> ) . start ( ) <EOL> while True : <EOL> next_addr = self . _get_next_code_addr ( initial_state ) <EOL> percentage = self . _seg_list . occupied_size * <NUM_LIT> / ( self . _valid_memory_region_size ) <EOL> if percentage > <NUM_LIT> : percentage = <NUM_LIT> <EOL> pb . update ( percentage * <NUM_LIT> ) <EOL> if next_addr is not None : <EOL> l . info ( "<STR_LIT>" , next_addr , percentage ) <EOL> else : <EOL> l . info ( '<STR_LIT>' , percentage ) <EOL> break <EOL> self . call_map . add_node ( next_addr ) <EOL> self . _scan_code ( traced_address , function_exits , initial_state , next_addr ) <EOL> pb . finish ( ) <EOL> end_time = datetime . now ( ) <EOL> l . info ( "<STR_LIT>" , ( end_time - start_time ) . seconds ) <EOL> def _calc_entropy ( self , data , size = None ) : <EOL> if not data : <EOL> return <NUM_LIT:0> <EOL> entropy = <NUM_LIT:0> <EOL> if size is None : size = len ( data ) <EOL> data = str ( pyvex . ffi . buffer ( data , size ) ) <EOL> for x in xrange ( <NUM_LIT:0> , <NUM_LIT> ) : <EOL> p_x = float ( data . count ( chr ( x ) ) ) / size <EOL> if p_x > <NUM_LIT:0> : <EOL> entropy += - p_x * math . log ( p_x , <NUM_LIT:2> ) <EOL> return entropy <EOL> def _dbg_output ( self ) : <EOL> ret = "<STR_LIT>" <EOL> ret += "<STR_LIT>" <EOL> function_list = list ( self . functions ) <EOL> function_list = sorted ( function_list ) <EOL> for f in function_list : <EOL> ret += "<STR_LIT>" % f <EOL> return ret <EOL> def genenare_callmap_sif ( self , filepath ) : <EOL> """<STR_LIT>""" <EOL> graph = self . call_map <EOL> if graph is None : <EOL> raise AngrGirlScoutError ( '<STR_LIT>' ) <EOL> f = open ( filepath , "<STR_LIT:wb>" ) <EOL> for src , dst in graph . edges ( ) : <EOL> f . write ( "<STR_LIT>" % ( src , dst ) ) <EOL> f . close ( ) <EOL> def generate_code_cover ( self ) : <EOL> """<STR_LIT>""" <EOL> lst = [ ] <EOL> for irsb_addr in self . cfg . nodes ( ) : <EOL> if irsb_addr not in self . _block_size : <EOL> continue <EOL> irsb_size = self . _block_size [ irsb_addr ] <EOL> lst . append ( ( irsb_addr , irsb_size ) ) <EOL> lst = sorted ( lst , key = lambda x : x [ <NUM_LIT:0> ] ) <EOL> return lst <EOL> register_analysis ( GirlScout , '<STR_LIT>' ) <EOL> from . . blade import Blade <EOL> from . . errors import AngrGirlScoutError , AngrTranslationError , AngrMemoryError </s>
