1import angr
2import claripy
3import archinfo
4
5# all the input values were generated via
6# [random.randrange(256) for _ in range(16)]
7# then set into the input registers via gdb
8# set $xmm0.v16_int8 = {...}
9# then read out as uint128s
10# p/x $xmm0.uint128
11# then single stepped and the result read out
12
13def test_irop_perm():
14    p = angr.load_shellcode('vpshufb xmm0,xmm1,xmm2', 'amd64')
15
16    # concrete test
17    s1 = p.factory.blank_state()
18    s1.regs.xmm1 = 0x3c899a56814ee9b84c7b5d8394c85881
19    s1.regs.xmm2 = 0xa55c66a2cdef1cbcd72b42078d1b7f8b
20    s2 = s1.step(num_inst=1).successors[0]
21    assert (s2.regs.xmm0 == 0x00567b00000056000081c84c00813c00).is_true()
22
23    # symbolic test
24    s3 = p.factory.blank_state()
25    s3.regs.xmm1 = claripy.BVS('xmm1', 128)
26    s3.regs.xmm2 = claripy.BVS('xmm2', 128)
27    s4 = s3.step(num_inst=1).successors[0]
28    s4.solver.add(s4.regs.xmm2 == 0xa55c66a2cdef1cbcd72b42078d1b7f8b)
29    s4.solver.add(s4.regs.xmm0 == 0x00567b00000056000081c84c00813c00)
30    assert s4.solver.solution(s4.regs.xmm1, 0x3c899a56814ee9b84c7b5d8394c85881)
31
32def test_irop_mulhi():
33    p = angr.load_shellcode('vpmulhw xmm0,xmm1,xmm2', 'amd64')
34
35    # concrete test
36    s1 = p.factory.blank_state()
37    s1.regs.xmm1 = 0x3aca92553c2526d4f20987aeab250255
38    s1.regs.xmm2 = 0x1aebcb281463274ec3ce6473619a8541
39    s2 = s1.step(num_inst=1).successors[0]
40    assert (s2.regs.xmm0 == 0x62e16a304ca05f60348d0c9dfa5fee1).is_true()
41
42def test_irop_catevenlanes():
43    p = angr.load_shellcode('pmulhrsw xmm0, xmm1', 'amd64')
44
45    # concrete test
46    s1 = p.factory.blank_state()
47    s1.regs.xmm0 = 0x4713e06bf3235e97ca8cfde0647d65fd
48    s1.regs.xmm1 = 0x31f1f86da1dce7de252adc78160e1016
49    s2 = s1.step(num_inst=1).successors[0]
50    assert (s2.regs.xmm0 == 0x1bbb01de0976ee2bf07b009711500cd1).is_true()
51
52
53if __name__ == '__main__':
54    test_irop_perm()
55    test_irop_mulhi()
56    test_irop_catevenlanes()
57