Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement solve a condition #19

Closed
0ca opened this issue Sep 1, 2016 · 6 comments
Closed

Implement solve a condition #19

0ca opened this issue Sep 1, 2016 · 6 comments
Assignees
Milestone

Comments

@0ca
Copy link
Collaborator

0ca commented Sep 1, 2016

We need to implement the button solve a condition.

The idea is first to show the solution in the IDa output.

We could do more things:

  • Inject the solution? If it is memory bytes it makes sense, but if they are registers we should have the eip in the same instruction where they were symbolized.
  • Paint the solved/unsolved conditions with different color?
  • Use another windows to show big or complex solutions?
@0ca
Copy link
Collaborator Author

0ca commented Sep 6, 2016

To implement this we need to keep in memory all the conditional jumps executed. We can keep the TritonInstruction, or only the information we need like the RIP symbolic expression ID and address when the jump is taken/not taken.

For now I keeping all the TritonInstructions in a map:

std::map<triton::__uint, std::list<triton::arch::Instruction *>> instructions_executed_map;

I think keeping all the instructions is not very memory consuming compare to keep all the symbolic expressions. And having all the instructions could be useful for other functionalities like the slicing #23, or if the user wants to know the symbolic expressions for a given address.

Other important thing is that a condition could be executed more than one time. So we need to have a list per every address.

Then we should show besides the "Negate condition" menu a submenu with all the times the condition was executed, so the user could negate a condition at a given point.

For example, if we have a loop and we want the loop to be executed 10 times, we only want to negate the 10th condition.

@0ca
Copy link
Collaborator Author

0ca commented Sep 7, 2016

Implemented solve formula.
image

We still need to deal with a same address executed multiple times.

@0ca
Copy link
Collaborator Author

0ca commented Sep 7, 2016

When we are solving we should differenciate between solving online or offline.

Offline is when the user has execute all the program and after that is trying to invert a condition. But this condition could has been executed multiple times so we need to offer him which one he wants to negate.

Online is when the user is debugging an app and he wants to invert a condition. In that case we don't need to ask him for the condition, he want to invert the current condition at the last execution point.

@0ca 0ca self-assigned this Sep 7, 2016
@illera88 illera88 added this to the v0.1 milestone Sep 8, 2016
@0ca
Copy link
Collaborator Author

0ca commented Sep 10, 2016

@illera88 done right? Or there is some pending thing to do here? Maybe change the name of the negate runtime. Right now it is:

Negate condition
Negate Inject Restore

Maybe we could use:

Negate & Inject
Negate, Inject & Restore snapshot

Is it ok?

@illera88
Copy link
Owner

yes! I like the second one.

Change the name and close

@0ca 0ca closed this as completed in 5d3c93d Sep 10, 2016
@0ca
Copy link
Collaborator Author

0ca commented Sep 11, 2016

This is still not working when the condition is in a loop.

@0ca 0ca reopened this Sep 11, 2016
0ca pushed a commit that referenced this issue Sep 11, 2016
@0ca 0ca closed this as completed Sep 12, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants