Skip to content

Instantly share code, notes, and snippets.

View ivg's full-sized avatar

Ivan Gotovchits ivg

View GitHub Profile
@ivg
ivg / peval.ml
Created October 19, 2018 13:48
running Primus interpreter in a custom mode
(*
Computes an expression using Primus. Showcases how to bootstrap the whole Primus machinery and how
to store and extract results of computations from the project data structure.
To compile, put this file in an empty folder and run the following commands:
$ bapbuild -pkg bap-primus peval.plugin
$ bapbundle instll peval.plugin
@ivg
ivg / primus_bil.ml
Created June 27, 2018 16:25
Standalone Primus BIL evaluator
open Core_kernel
open Bap.Std
open Bap_primus.Std
open Bap_plugins.Std
open Monads.Std
open Format
let empty_project arch =
let nil = Memmap.empty in
Project.Input.create arch "/bin/true" ~code:nil ~data:nil |>
@ivg
ivg / turing.v
Created June 21, 2018 13:19 — forked from casperbp/turing.v
Coq implementation of a Turing Machine
(*** Turing Machines in Coq *)
(** Some preliminary types we'll use *)
CoInductive CoList (A: Type) := CONS (a:A) (t:CoList A) | NIL.
Arguments CONS [A] _ _.
Arguments NIL [A].
CoInductive Delay A := HERE (a:A) | LATER (_:Delay A).
@ivg
ivg / ddtbd-debug.recipe
Last active March 16, 2019 08:41
Double Dereferences under Tainted Branch Detector
(extend ddtbd)
;; debugging stuff
(option primus-propagate-taint-to-attributes)
(option print-bir-attr tainted-reg)
(option print-bir-attr tainted-ptr)
(option print-bir-attr tainted-regs)
(option print-bir-attr tainted-ptrs)
(option dump bir:out.bir)
(option primus-print-obs enter-term read)
open Core_kernel
open Bap.Std
open Bap_primus.Std
open Bap_taint.Std
open Format
include Self()
type state = {
path_taints : Taint.Object.Set.t
}
@ivg
ivg / path_check.ml
Created September 27, 2017 12:27
Verifies a safety condition on all paths
open Core_kernel.Std
open Bap.Std
open Graphlib.Std
open Format
include Self()
module CG = Graphs.Callgraph
module CFG = Graphs.Tid
module DAG = Graphlib.Make(Tid)(Unit)
@ivg
ivg / cyclomatic.ml
Created September 27, 2017 12:22
Computes cyclomatic complexity of all functions in a binary Raw
open Core_kernel.Std
open Bap.Std
open Graphlib.Std
module G = Graphs.Cfg
let complexity graph =
let edges = Seq.length (G.edges graph) in
let nodes = Seq.length (G.nodes graph) in
let parts = Graphlib.strong_components (module G) graph |>
@ivg
ivg / cyclomatic.py
Created September 27, 2017 12:20
Computes cyclomatic complexity of all functions in a binary
import bap
import networkx as nx
def build_cfg(sub):
G = nx.DiGraph()
entry = sub.blks[0].id.number
G.add_node(entry)
for blk in sub.blks:
for jmp in blk.jmps:
if jmp.constr == 'Goto' and jmp.target.constr == 'Direct':
@ivg
ivg / Vagrant
Created September 26, 2017 13:34
BAP Vagrant file with the emacs development environment
Vagrant.configure(2) do |config|
config.vm.box = "ubuntu/trusty64"
config.vm.provider "virtualbox" do |vb|
vb.memory = "4096"
end
config.vm.provision "shell", privileged: false, inline: <<-SHELL
sudo add-apt-repository --yes ppa:avsm/ppa
sudo apt-get update
sudo apt-get --yes install opam
opam init --auto-setup --comp=4.02.3 --yes
@ivg
ivg / mips.ml
Created March 9, 2017 19:55
Minimal MIPS lifter for BAP
open Core_kernel.Std
open Bap.Std
open Or_error.Monad_infix
module Insn = Disasm_expert.Basic.Insn
module Mips = struct
(** Defines the register map *)
module CPU = struct
let mem = Var.create "mem" @@ mem32_t `r8