Skip to content

Instantly share code, notes, and snippets.

🎯
working on BAP 2.0

Ivan Gotovchits ivg

View GitHub Profile
@ivg
ivg / peval.ml
Created Oct 19, 2018
running Primus interpreter in a custom mode
View peval.ml
(*
Computes an expression using Primus. Showcases how to bootstrap the whole Primus machinery and how
to store and extract results of computations from the project data structure.
To compile, put this file in an empty folder and run the following commands:
$ bapbuild -pkg bap-primus peval.plugin
$ bapbundle instll peval.plugin
@ivg
ivg / primus_bil.ml
Created Jun 27, 2018
Standalone Primus BIL evaluator
View primus_bil.ml
open Core_kernel
open Bap.Std
open Bap_primus.Std
open Bap_plugins.Std
open Monads.Std
open Format
let empty_project arch =
let nil = Memmap.empty in
Project.Input.create arch "/bin/true" ~code:nil ~data:nil |>
@ivg
ivg / turing.v
Created Jun 21, 2018 — forked from casperbp/turing.v
Coq implementation of a Turing Machine
View turing.v
(*** Turing Machines in Coq *)
(** Some preliminary types we'll use *)
CoInductive CoList (A: Type) := CONS (a:A) (t:CoList A) | NIL.
Arguments CONS [A] _ _.
Arguments NIL [A].
CoInductive Delay A := HERE (a:A) | LATER (_:Delay A).
@ivg
ivg / ddtbd-debug.recipe
Last active Mar 16, 2019
Double Dereferences under Tainted Branch Detector
View ddtbd-debug.recipe
(extend ddtbd)
;; debugging stuff
(option primus-propagate-taint-to-attributes)
(option print-bir-attr tainted-reg)
(option print-bir-attr tainted-ptr)
(option print-bir-attr tainted-regs)
(option print-bir-attr tainted-ptrs)
(option dump bir:out.bir)
(option primus-print-obs enter-term read)
View path_tainter.ml
open Core_kernel
open Bap.Std
open Bap_primus.Std
open Bap_taint.Std
open Format
include Self()
type state = {
path_taints : Taint.Object.Set.t
}
@ivg
ivg / path_check.ml
Created Sep 27, 2017
Verifies a safety condition on all paths
View path_check.ml
open Core_kernel.Std
open Bap.Std
open Graphlib.Std
open Format
include Self()
module CG = Graphs.Callgraph
module CFG = Graphs.Tid
module DAG = Graphlib.Make(Tid)(Unit)
@ivg
ivg / cyclomatic.ml
Created Sep 27, 2017
Computes cyclomatic complexity of all functions in a binary Raw
View cyclomatic.ml
open Core_kernel.Std
open Bap.Std
open Graphlib.Std
module G = Graphs.Cfg
let complexity graph =
let edges = Seq.length (G.edges graph) in
let nodes = Seq.length (G.nodes graph) in
let parts = Graphlib.strong_components (module G) graph |>
@ivg
ivg / cyclomatic.py
Created Sep 27, 2017
Computes cyclomatic complexity of all functions in a binary
View cyclomatic.py
import bap
import networkx as nx
def build_cfg(sub):
G = nx.DiGraph()
entry = sub.blks[0].id.number
G.add_node(entry)
for blk in sub.blks:
for jmp in blk.jmps:
if jmp.constr == 'Goto' and jmp.target.constr == 'Direct':
@ivg
ivg / Vagrant
Created Sep 26, 2017
BAP Vagrant file with the emacs development environment
View Vagrant
Vagrant.configure(2) do |config|
config.vm.box = "ubuntu/trusty64"
config.vm.provider "virtualbox" do |vb|
vb.memory = "4096"
end
config.vm.provision "shell", privileged: false, inline: <<-SHELL
sudo add-apt-repository --yes ppa:avsm/ppa
sudo apt-get update
sudo apt-get --yes install opam
opam init --auto-setup --comp=4.02.3 --yes
@ivg
ivg / mips.ml
Created Mar 9, 2017
Minimal MIPS lifter for BAP
View mips.ml
open Core_kernel.Std
open Bap.Std
open Or_error.Monad_infix
module Insn = Disasm_expert.Basic.Insn
module Mips = struct
(** Defines the register map *)
module CPU = struct
let mem = Var.create "mem" @@ mem32_t `r8
You can’t perform that action at this time.