Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

symbolizeRegister result is different with setConcreteRegisterValue result ? #1304

Open
badguy123 opened this issue Feb 1, 2024 · 0 comments

Comments

@badguy123
Copy link

HI, i write some code and obfuscate it, when i use ctx.symbolizeRegister set register value, the result is right, but when i use ctx.setConcreteRegisterValue set register with a symbol, the ctx.liftToLLVM return error ir. is i missing something?

my source code:

int fun(int a, int b){
    
    if(a > 0){
        ++b;
    }
    else{
        --b;
    }
    
    return a + b;
}

my triton code:

int main(int argc, const char **argv) {
    //read file
    std::vector<uint8> buffer = read_file("/Users/c/Desktop/AOT/main_bcf");
    
    /* Init the triton context */
    triton::Context ctx;
    int base = 0;
    int begin = 0x3d1c;
    int end = 0x3f00;
    std::ostream& outs = std::cout;
    // llvm::LLVMContext  c;
    // ast::TritonToLLVM lifter(c);

    ctx.setArchitecture(ARCH_AARCH64);

    // ctx.setConcreteRegisterValue(ctx.registers.aarch64_w0, uint512(1));
    // ctx.setConcreteRegisterValue(ctx.registers.aarch64_w1, uint512(2));

    ctx.symbolizeRegister(ctx.registers.aarch64_w0, "a");
    ctx.symbolizeRegister(ctx.registers.aarch64_w1, "b");

    ctx.setConcreteMemoryAreaValue(base, buffer);

    uint512 pc = begin;
    do{
        auto insn = ctx.disassembly(uint64(pc), 1);
        outs << insn.back() << "\n";

        if(pc == end) break;

        ctx.processing(insn.back());
        pc = ctx.getConcreteRegisterValue(ctx.registers.aarch64_pc);

    }while(pc);

    
    auto x = ctx.getRegisterAst(ctx.registers.aarch64_w0);
    // outs << x->evaluate() << "\n";
    auto synt = ctx.synthesize(x);

    // reurn((_ extract 31 0) ((_ zero_extend 32) (bvadd (bvadd (bvadd a (_ bv0 32)) (bvadd b (_ bv4294967295 32))) (_ bv0 32))))
    // outs << synt.getOutput() << "\n"; 
    ctx.liftToLLVM(outs, synt.getOutput());
    return 0;
}

when set register value w0 = 1, w1 = 2, x->evaluate() return 4
when set register symbol, ctx.liftToLLVM return error IR:

; ModuleID = 'tritonModule'
source_filename = "tritonModule"

define i32 @__triton(i32 %SymVar_0, i32 %SymVar_1) {
entry:
  %0 = add i32 %SymVar_1, -1
  %1 = add i32 %SymVar_0, 0
  %2 = add i32 %1, %0
  %3 = add i32 %2, 0
  %4 = zext i32 %3 to i64
  %5 = trunc i64 %4 to i32
  ret i32 %5
}

this is macho arm64 file
main_bcf.zip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant