Skip to content

symbolizeRegister result is different with setConcreteRegisterValue result ? #1304

@badguy123

Description

@badguy123

HI, i write some code and obfuscate it, when i use ctx.symbolizeRegister set register value, the result is right, but when i use ctx.setConcreteRegisterValue set register with a symbol, the ctx.liftToLLVM return error ir. is i missing something?

my source code:

int fun(int a, int b){
    
    if(a > 0){
        ++b;
    }
    else{
        --b;
    }
    
    return a + b;
}

my triton code:

int main(int argc, const char **argv) {
    //read file
    std::vector<uint8> buffer = read_file("/Users/c/Desktop/AOT/main_bcf");
    
    /* Init the triton context */
    triton::Context ctx;
    int base = 0;
    int begin = 0x3d1c;
    int end = 0x3f00;
    std::ostream& outs = std::cout;
    // llvm::LLVMContext  c;
    // ast::TritonToLLVM lifter(c);

    ctx.setArchitecture(ARCH_AARCH64);

    // ctx.setConcreteRegisterValue(ctx.registers.aarch64_w0, uint512(1));
    // ctx.setConcreteRegisterValue(ctx.registers.aarch64_w1, uint512(2));

    ctx.symbolizeRegister(ctx.registers.aarch64_w0, "a");
    ctx.symbolizeRegister(ctx.registers.aarch64_w1, "b");

    ctx.setConcreteMemoryAreaValue(base, buffer);

    uint512 pc = begin;
    do{
        auto insn = ctx.disassembly(uint64(pc), 1);
        outs << insn.back() << "\n";

        if(pc == end) break;

        ctx.processing(insn.back());
        pc = ctx.getConcreteRegisterValue(ctx.registers.aarch64_pc);

    }while(pc);

    
    auto x = ctx.getRegisterAst(ctx.registers.aarch64_w0);
    // outs << x->evaluate() << "\n";
    auto synt = ctx.synthesize(x);

    // reurn((_ extract 31 0) ((_ zero_extend 32) (bvadd (bvadd (bvadd a (_ bv0 32)) (bvadd b (_ bv4294967295 32))) (_ bv0 32))))
    // outs << synt.getOutput() << "\n"; 
    ctx.liftToLLVM(outs, synt.getOutput());
    return 0;
}

when set register value w0 = 1, w1 = 2, x->evaluate() return 4
when set register symbol, ctx.liftToLLVM return error IR:

; ModuleID = 'tritonModule'
source_filename = "tritonModule"

define i32 @__triton(i32 %SymVar_0, i32 %SymVar_1) {
entry:
  %0 = add i32 %SymVar_1, -1
  %1 = add i32 %SymVar_0, 0
  %2 = add i32 %1, %0
  %3 = add i32 %2, 0
  %4 = zext i32 %3 to i64
  %5 = trunc i64 %4 to i32
  ret i32 %5
}

this is macho arm64 file
main_bcf.zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions