1import angr 2import claripy 3import archinfo 4 5# all the input values were generated via 6# [random.randrange(256) for _ in range(16)] 7# then set into the input registers via gdb 8# set $xmm0.v16_int8 = {...} 9# then read out as uint128s 10# p/x $xmm0.uint128 11# then single stepped and the result read out 12 13def test_irop_perm(): 14 p = angr.load_shellcode('vpshufb xmm0,xmm1,xmm2', 'amd64') 15 16 # concrete test 17 s1 = p.factory.blank_state() 18 s1.regs.xmm1 = 0x3c899a56814ee9b84c7b5d8394c85881 19 s1.regs.xmm2 = 0xa55c66a2cdef1cbcd72b42078d1b7f8b 20 s2 = s1.step(num_inst=1).successors[0] 21 assert (s2.regs.xmm0 == 0x00567b00000056000081c84c00813c00).is_true() 22 23 # symbolic test 24 s3 = p.factory.blank_state() 25 s3.regs.xmm1 = claripy.BVS('xmm1', 128) 26 s3.regs.xmm2 = claripy.BVS('xmm2', 128) 27 s4 = s3.step(num_inst=1).successors[0] 28 s4.solver.add(s4.regs.xmm2 == 0xa55c66a2cdef1cbcd72b42078d1b7f8b) 29 s4.solver.add(s4.regs.xmm0 == 0x00567b00000056000081c84c00813c00) 30 assert s4.solver.solution(s4.regs.xmm1, 0x3c899a56814ee9b84c7b5d8394c85881) 31 32def test_irop_mulhi(): 33 p = angr.load_shellcode('vpmulhw xmm0,xmm1,xmm2', 'amd64') 34 35 # concrete test 36 s1 = p.factory.blank_state() 37 s1.regs.xmm1 = 0x3aca92553c2526d4f20987aeab250255 38 s1.regs.xmm2 = 0x1aebcb281463274ec3ce6473619a8541 39 s2 = s1.step(num_inst=1).successors[0] 40 assert (s2.regs.xmm0 == 0x62e16a304ca05f60348d0c9dfa5fee1).is_true() 41 42def test_irop_catevenlanes(): 43 p = angr.load_shellcode('pmulhrsw xmm0, xmm1', 'amd64') 44 45 # concrete test 46 s1 = p.factory.blank_state() 47 s1.regs.xmm0 = 0x4713e06bf3235e97ca8cfde0647d65fd 48 s1.regs.xmm1 = 0x31f1f86da1dce7de252adc78160e1016 49 s2 = s1.step(num_inst=1).successors[0] 50 assert (s2.regs.xmm0 == 0x1bbb01de0976ee2bf07b009711500cd1).is_true() 51 52 53if __name__ == '__main__': 54 test_irop_perm() 55 test_irop_mulhi() 56 test_irop_catevenlanes() 57