angr_platforms/bf/engine_bf.py
def process_successors(self, successors, **kwargs):
        """
        This function executes one "basic block" of BrainFuck.

        As input, we get the current state, which contains the value of the two registers (ip and ptr),
        and the program's code and data memory.
        We then perform a series of symbolic actions on this state, until the block ends, at which point we define
        its "successors" -- where execution can possibly go from here.
        The basic block ends when:
            1) A branch is reached.  The successors are the next instruction if the branch is taken,
            and the instruction if it is not.
            2) Input and Output.  We're modeling I/O as a system call, so this ends the block.
            3) ip points somewhere outside the program's memory.  In Brainfuck, this is the simple halting case.

        :param successors: The SimSuccessors for this block.  In other words, where the program can go from here, and
        under what circumstances
        :type successors: angr.SimSuccessors
        :param args:
        :param kwargs:
        :return:
        """
        state = self.state
        my_block = state.ip  # The start address of this basic block.  We'll need this later
        while True:
            # Run through instructions, until we hit a branch.
            # Step 0: Fetch the next instruction
            # Because memory can be symbolic, but code in BrainFuck can't,
            # we just ask for a concrete value, and we'll get one.
            try:
                inst = chr(state.mem_concrete(state.ip,1))
            except angr.SimValueError:
                # ...except if it IS symbolic.  That means we ran off the memory.
                # Drop the mic and go home.  We're done here.
                the_end = state.copy()
                successors.add_successor(the_end, state.ip, claripy.true, "Ijk_Exit", add_guard=False, exit_stmt_idx=-1,
                                         exit_ins_addr=state.ip, source=my_block)
                break
            # Step 1: Decode.  If it's a....
            if inst == '>':
                # Increment ptr
                state.regs.ptr = (state.regs.ptr + 1)
            elif inst == "<":
                state.regs.ptr = (state.regs.ptr - 1)
            elif inst == "-":
                # Decrement the byte at ptr in memory
                # NOTE: We're doing the "wrap-around" variation of BF
                oldval = state.memory.load(state.regs.ptr, 1)
                newval = (oldval - 1)
                state.memory.store(state.regs.ptr, newval, 1)
            elif inst == "+":
                # Increment the byte at ptr in memory
                oldval = state.memory.load(state.regs.ptr, 1)
                newval = (oldval + 1)
                state.memory.store(state.regs.ptr, newval, 1)
            elif inst == ".":
                # Syscall: write byte at mem to stdout
                newstate = state.copy()
                newstate.regs.inout = 1  # Set this to 0 to cause a write syscall
                newstate.ip = state.ip + 1
                successors.add_successor(newstate, newstate.ip, claripy.true, "Ijk_Syscall",
                                         add_guard=False, exit_stmt_idx=-1, exit_ins_addr=state.ip, source=my_block)
                # Syscalls, even fake ones like this, end a basic block.
                break
            elif inst == ',':
                # Syscall: read byte from stdin to cell at ptr
                new_state = state.copy()
                new_state.regs.inout = 0  # This must be 0 when we do a syscall to get a read!
                new_state.ip = state.ip + 1
                successors.add_successor(new_state, new_state.ip, claripy.true, "Ijk_Syscall",
                                         add_guard=False, exit_stmt_idx=-1, exit_ins_addr=state.ip, source=my_block)
                # Syscalls, even fake ones like this, end the basic block
                break
            elif inst == '[':
                # Jump to matching ] if value at ptr is 0
                val_at_ptr = state.memory.load(state.regs.ptr, 1)
                # find the ].  This returns None if we don't find it (ran off the end)
                jk = "Ijk_Boring"
                dest = self.resolve_jump(state, state.solver.eval(state.ip))
                taken_state = state.copy()
                taken_state.ip = dest
                not_taken_state = state.copy()
                not_taken_state.ip = state.ip + 1

                successors.add_successor(taken_state, taken_state.ip, val_at_ptr == 0, jk, add_guard=True,
                                         exit_stmt_idx=-1, exit_ins_addr=state.ip, source=my_block)
                successors.add_successor(not_taken_state, not_taken_state.ip, val_at_ptr != 0, "Ijk_Boring",
                                         add_guard=True, exit_stmt_idx=-1, exit_ins_addr=state.ip, source=my_block)
                # This is a conditional, so this basic block is done!
                break
            elif inst == ']':
                # Jump backward to matching [ if value at ptr is non-zero
                val_at_ptr = state.memory.load(state.regs.ptr, 1)
                # find the [, or the beginning.  If we go there, it's over.
                jk = "Ijk_Boring"
                taken_state = state.copy()
                dest = self.resolve_jump(state, state.solver.eval(state.ip))
                taken_state.ip = dest
                not_taken_state = state.copy()
                not_taken_state.ip = state.ip + 1
                successors.add_successor(taken_state, taken_state.ip, val_at_ptr != 0, jk, add_guard=True,
                                         exit_stmt_idx=-1, exit_ins_addr=state.ip, source=my_block)
                successors.add_successor(not_taken_state, not_taken_state.ip, val_at_ptr == 0, "Ijk_Boring",
                                         add_guard=True, exit_stmt_idx=-1, exit_ins_addr=state.ip, source=my_block)
                # This is a conditional, so this basic block is done!
                break
            # Step 3: Increment PC!
            state.ip += 1

        # Step 4: Set this flag to tell the rest of angr that you finished processing the block
        successors.processed = True

        # TODO: HACK: FIXME: this just has to be here. This should not have to be here.
        successors.artifacts['irsb_size'] = state.ip - my_block
        successors.artifacts['irsb'] = None
        successors.artifacts['irsb_direct_next'] = True

        This function executes one "basic block" of BrainFuck.

        As input, we get the current state, which contains the value of the two registers (ip and ptr),
        and the program's code and data memory.
        We then perform a series of symbolic actions on this state, until the block ends, at which point we define
        its "successors" -- where execution can possibly go from here.
        The basic block ends when:
            1) A branch is reached.  The successors are the next instruction if the branch is taken,
            and the instruction if it is not.
            2) Input and Output.  We're modeling I/O as a system call, so this ends the block.
            3) ip points somewhere outside the program's memory.  In Brainfuck, this is the simple halting case.

        :param successors: The SimSuccessors for this block.  In other words, where the program can go from here, and
        under what circumstances
        :type successors: angr.SimSuccessors
        :param args:
        :param kwargs:
        :return:
        
This function executes one "basic block" of BrainFuck.
As input, we get the current state, which contains the value of the two registers (ip and ptr),
and the program's code and data memory.
We then perform a series of symbolic actions on this state, until the block ends, at which point we define
its "successors" -- where execution can possibly go from here.
The basic block ends when:
1) A branch is reached.  The successors are the next instruction if the branch is taken,
and the instruction if it is not.
2) Input and Output.  We're modeling I/O as a system call, so this ends the block.
3) ip points somewhere outside the program's memory.  In Brainfuck, this is the simple halting case.
This function executes one " basic block " of BrainFuck . As input we get the current state which contains the value of the two registers ( ip and ptr ) and the program ' s code and data memory . We then perform a series of symbolic actions on this state until the block ends at which point we define its " successors " -- where execution can possibly go from here . The basic block ends when : 1 ) A branch is reached . The successors are the next instruction if the branch is taken and the instruction if it is not . 2 ) Input and Output . We ' re modeling I / O as a system call so this ends the block . 3 ) ip points somewhere outside the program ' s memory . In Brainfuck this is the simple halting case .
def process_successors(self, successors, **kwargs):
        state = self.state
        my_block = state.ip  
        while True:
            try:
                inst = chr(state.mem_concrete(state.ip,1))
            except angr.SimValueError:
                the_end = state.copy()
                successors.add_successor(the_end, state.ip, claripy.true, "Ijk_Exit", add_guard=False, exit_stmt_idx=-1,
                                         exit_ins_addr=state.ip, source=my_block)
                break
            if inst == '>':
                state.regs.ptr = (state.regs.ptr + 1)
            elif inst == "<":
                state.regs.ptr = (state.regs.ptr - 1)
            elif inst == "-":
                oldval = state.memory.load(state.regs.ptr, 1)
                newval = (oldval - 1)
                state.memory.store(state.regs.ptr, newval, 1)
            elif inst == "+":
                oldval = state.memory.load(state.regs.ptr, 1)
                newval = (oldval + 1)
                state.memory.store(state.regs.ptr, newval, 1)
            elif inst == ".":
                newstate = state.copy()
                newstate.regs.inout = 1  
                newstate.ip = state.ip + 1
                successors.add_successor(newstate, newstate.ip, claripy.true, "Ijk_Syscall",
                                         add_guard=False, exit_stmt_idx=-1, exit_ins_addr=state.ip, source=my_block)
                break
            elif inst == ',':
                new_state = state.copy()
                new_state.regs.inout = 0  
                new_state.ip = state.ip + 1
                successors.add_successor(new_state, new_state.ip, claripy.true, "Ijk_Syscall",
                                         add_guard=False, exit_stmt_idx=-1, exit_ins_addr=state.ip, source=my_block)
                break
            elif inst == '[':
                val_at_ptr = state.memory.load(state.regs.ptr, 1)
                jk = "Ijk_Boring"
                dest = self.resolve_jump(state, state.solver.eval(state.ip))
                taken_state = state.copy()
                taken_state.ip = dest
                not_taken_state = state.copy()
                not_taken_state.ip = state.ip + 1
                successors.add_successor(taken_state, taken_state.ip, val_at_ptr == 0, jk, add_guard=True,
                                         exit_stmt_idx=-1, exit_ins_addr=state.ip, source=my_block)
                successors.add_successor(not_taken_state, not_taken_state.ip, val_at_ptr != 0, "Ijk_Boring",
                                         add_guard=True, exit_stmt_idx=-1, exit_ins_addr=state.ip, source=my_block)
                break
            elif inst == ']':
                val_at_ptr = state.memory.load(state.regs.ptr, 1)
                jk = "Ijk_Boring"
                taken_state = state.copy()
                dest = self.resolve_jump(state, state.solver.eval(state.ip))
                taken_state.ip = dest
                not_taken_state = state.copy()
                not_taken_state.ip = state.ip + 1
                successors.add_successor(taken_state, taken_state.ip, val_at_ptr != 0, jk, add_guard=True,
                                         exit_stmt_idx=-1, exit_ins_addr=state.ip, source=my_block)
                successors.add_successor(not_taken_state, not_taken_state.ip, val_at_ptr == 0, "Ijk_Boring",
                                         add_guard=True, exit_stmt_idx=-1, exit_ins_addr=state.ip, source=my_block)
                break
            state.ip += 1
        successors.processed = True
        successors.artifacts['irsb_size'] = state.ip - my_block
        successors.artifacts['irsb'] = None
        successors.artifacts['irsb_direct_next'] = True
def process_successors ( self , successors , ** kwargs ) : state = self . state my_block = state . ip while True : try : inst = chr ( state . mem_concrete ( state . ip , 1 ) ) except angr . SimValueError : the_end = state . copy ( ) successors . add_successor ( the_end , state . ip , claripy . true , "Ijk_Exit" , add_guard = False , exit_stmt_idx = - 1 , exit_ins_addr = state . ip , source = my_block ) break if inst == '>' : state . regs . ptr = ( state . regs . ptr + 1 ) elif inst == "<" : state . regs . ptr = ( state . regs . ptr - 1 ) elif inst == "-" : oldval = state . memory . load ( state . regs . ptr , 1 ) newval = ( oldval - 1 ) state . memory . store ( state . regs . ptr , newval , 1 ) elif inst == "+" : oldval = state . memory . load ( state . regs . ptr , 1 ) newval = ( oldval + 1 ) state . memory . store ( state . regs . ptr , newval , 1 ) elif inst == "." : newstate = state . copy ( ) newstate . regs . inout = 1 newstate . ip = state . ip + 1 successors . add_successor ( newstate , newstate . ip , claripy . true , "Ijk_Syscall" , add_guard = False , exit_stmt_idx = - 1 , exit_ins_addr = state . ip , source = my_block ) break elif inst == ',' : new_state = state . copy ( ) new_state . regs . inout = 0 new_state . ip = state . ip + 1 successors . add_successor ( new_state , new_state . ip , claripy . true , "Ijk_Syscall" , add_guard = False , exit_stmt_idx = - 1 , exit_ins_addr = state . ip , source = my_block ) break elif inst == '[' : val_at_ptr = state . memory . load ( state . regs . ptr , 1 ) jk = "Ijk_Boring" dest = self . resolve_jump ( state , state . solver . eval ( state . ip ) ) taken_state = state . copy ( ) taken_state . ip = dest not_taken_state = state . copy ( ) not_taken_state . ip = state . ip + 1 successors . add_successor ( taken_state , taken_state . ip , val_at_ptr == 0 , jk , add_guard = True , exit_stmt_idx = - 1 , exit_ins_addr = state . ip , source = my_block ) successors . add_successor ( not_taken_state , not_taken_state . ip , val_at_ptr != 0 , "Ijk_Boring" , add_guard = True , exit_stmt_idx = - 1 , exit_ins_addr = state . ip , source = my_block ) break elif inst == ']' : val_at_ptr = state . memory . load ( state . regs . ptr , 1 ) jk = "Ijk_Boring" taken_state = state . copy ( ) dest = self . resolve_jump ( state , state . solver . eval ( state . ip ) ) taken_state . ip = dest not_taken_state = state . copy ( ) not_taken_state . ip = state . ip + 1 successors . add_successor ( taken_state , taken_state . ip , val_at_ptr != 0 , jk , add_guard = True , exit_stmt_idx = - 1 , exit_ins_addr = state . ip , source = my_block ) successors . add_successor ( not_taken_state , not_taken_state . ip , val_at_ptr == 0 , "Ijk_Boring" , add_guard = True , exit_stmt_idx = - 1 , exit_ins_addr = state . ip , source = my_block ) break state . ip += 1 successors . processed = True successors . artifacts [ 'irsb_size' ] = state . ip - my_block successors . artifacts [ 'irsb' ] = None successors . artifacts [ 'irsb_direct_next' ] = True
This function executes one "basic block" of BrainFuck.
This function executes one " basic block " of BrainFuck .
"""
        This function executes one "basic block" of BrainFuck.

        As input, we get the current state, which contains the value of the two registers (ip and ptr),
        and the program's code and data memory.
        We then perform a series of symbolic actions on this state, until the block ends, at which point we define
        its "successors" -- where execution can possibly go from here.
        The basic block ends when:
            1) A branch is reached.  The successors are the next instruction if the branch is taken,
            and the instruction if it is not.
            2) Input and Output.  We're modeling I/O as a system call, so this ends the block.
            3) ip points somewhere outside the program's memory.  In Brainfuck, this is the simple halting case.

        :param successors: The SimSuccessors for this block.  In other words, where the program can go from here, and
        under what circumstances
        :type successors: angr.SimSuccessors
        :param args:
        :param kwargs:
        :return:
        """ # The start address of this basic block.  We'll need this later # Run through instructions, until we hit a branch. # Step 0: Fetch the next instruction # Because memory can be symbolic, but code in BrainFuck can't, # we just ask for a concrete value, and we'll get one. # ...except if it IS symbolic.  That means we ran off the memory. # Drop the mic and go home.  We're done here. # Step 1: Decode.  If it's a.... # Increment ptr # Decrement the byte at ptr in memory # NOTE: We're doing the "wrap-around" variation of BF # Increment the byte at ptr in memory # Syscall: write byte at mem to stdout # Set this to 0 to cause a write syscall # Syscalls, even fake ones like this, end a basic block. # Syscall: read byte from stdin to cell at ptr # This must be 0 when we do a syscall to get a read! # Syscalls, even fake ones like this, end the basic block # Jump to matching ] if value at ptr is 0 # find the ].  This returns None if we don't find it (ran off the end) # This is a conditional, so this basic block is done! # Jump backward to matching [ if value at ptr is non-zero # find the [, or the beginning.  If we go there, it's over. # This is a conditional, so this basic block is done! # Step 3: Increment PC! # Step 4: Set this flag to tell the rest of angr that you finished processing the block # TODO: HACK: FIXME: this just has to be here. This should not have to be here.
None
self
successors
The SimSuccessors for this block.  In other words, where the program can go from here, and
under what circumstances
The SimSuccessors for this block . In other words where the program can go from here and under what circumstances
args
None
kwargs
None