MCPcopy Create free account

hub / github.com/GhostFrankWu/SAEG / functions

Functions115 in github.com/GhostFrankWu/SAEG

⨍ Functions 115◇ Types & classes 29
↓ 22 callersMethodwarped_io
(self, state, data_to_send=None, check_alive=True, has_newline=True)
aeg_module/binary_interactive.py:87
↓ 21 callersFunctiondump_payload
(sim_state, reset_stdin=True)
aeg_module/utils.py:168
↓ 17 callersMethodget_flag
(self, state, payload, has_newline=True)
aeg_module/binary_interactive.py:128
↓ 16 callersMethodr2_op
(self, op_)
aeg_module/challenge.py:169
↓ 11 callersMethodclose
(self)
aeg_module/binary_interactive.py:119
↓ 8 callersMethod__copy__
(self)
aeg_module/binary_interactive.py:35
↓ 6 callersMethodrun
(self, state_raw: angr.SimState, challenge: Challenge, new_mem: list)
aeg_module/mod_tricks.py:21
↓ 5 callersFunctionlocal_aeg
(file_name, flirt_file=None, lib=None, d=None, timeout=300, debug=False, interactive=False, conc
saeg.py:42
↓ 4 callersMethod__init__
(self, challenge)
aeg_module/mod_sim_procedure.py:17
↓ 4 callersMethodconnect
Note: this function will close the current process, and run every leak and mitigation path for the new process
aeg_module/binary_interactive.py:48
↓ 4 callersMethodget_r2
(self)
aeg_module/challenge.py:164
↓ 3 callersFunctionasset_path
(root, asset_name)
test_extra_dataset.py:74
↓ 3 callersFunctionchmod_x_glob
(pattern)
saeg.py:21
↓ 3 callersFunctionget_max_str_len
(state, start, right=0x200, binary_search=False)
aeg_module/utils.py:257
↓ 3 callersFunctionget_max_successive_symbolic_byte
(_symbolic_list)
aeg_module/utils.py:328
↓ 3 callersFunctionreorder_successors
(sim: angr.SimProcedure, successors: list)
aeg_module/utils.py:298
↓ 3 callersMethodrun
(self, dst)
aeg_module/mod_sim_procedure.py:21
↓ 3 callersMethodsatisfy
(self, binary: InteractiveBinary, try_lazy=False)
aeg_module/mod_tricks.py:28
↓ 3 callersFunctionstrip_zero_in_payload
(payload, is_raw=False)
aeg_module/utils.py:286
↓ 2 callersMethodcheck_alive
(self)
aeg_module/binary_interactive.py:78
↓ 2 callersFunctionchmod_x
(path)
saeg.py:17
↓ 2 callersFunctionchmod_x_children
(path)
test_extra_dataset.py:58
↓ 2 callersFunctiondo_addr_leak
(state, stdin, stdout, binary)
aeg_module/mod_technique.py:73
↓ 2 callersFunctiongenerate_leak_string
(state: angr.SimState, string_length: int, mem_addr, binary_)
aeg_module/utils.py:210
↓ 2 callersFunctionget_shellcode
(target_property)
aeg_module/utils.py:241
↓ 2 callersFunctionr2_func_addr
(func)
aeg_module/utils.py:47
↓ 2 callersFunctionrun_exp
(_exp, _debug=False, start_time=time.time())
saeg.py:26
↓ 2 callersMethodsend_payload
(self, state, payload, check_alive=True)
aeg_module/binary_interactive.py:143
↓ 2 callersMethodstep
(self, simgr, stash="active", **kwargs)
aeg_module/mod_technique.py:15
↓ 1 callersMethod__init__
(self, addr, chunk_size, real_addr, free=False, tag=None)
aeg_module/mod_sim_procedure_heap.py:11
↓ 1 callersMethod__init__
(self, deferred_stash="deferred")
aeg_module/mod_technique.py:7
↓ 1 callersMethod_init_func
(self)
aeg_module/challenge.py:60
↓ 1 callersMethod_init_hook_table
(self)
aeg_module/challenge.py:35
↓ 1 callersFunction_leak_got
(state_raw: angr.SimState, challenge, new_mem: list, align_=False)
aeg_module/mod_leak.py:114
↓ 1 callersFunctioncheck_addr_leak
(state_raw)
aeg_module/mod_technique.py:41
↓ 1 callersFunctioncheck_win
(sim_mgr, project, challenge)
aeg_module/mod_technique.py:216
↓ 1 callersFunctioncheck_win_deterministic
(sim_mgr, project, challenge)
aeg_module/mod_technique.py:239
↓ 1 callersFunctionchmod_x
(path)
test_extra_dataset.py:54
↓ 1 callersFunctionclean_flags
()
test_extra_dataset.py:69
↓ 1 callersMethoddo_hook
(self, angr_proj, base=0)
aeg_module/challenge.py:19
↓ 1 callersMethodexploit
(self)
aeg_module/aeg_main.py:40
↓ 1 callersFunctionget_chunk_by_addr
(binary, addr)
aeg_module/utils.py:305
↓ 1 callersFunctionget_chunk_by_tag
(binary, tag)
aeg_module/utils.py:315
↓ 1 callersFunctionget_func_block_by_r2
(binary)
aeg_module/utils.py:185
↓ 1 callersFunctionget_one_gadget
(challenge)
aeg_module/utils.py:229
↓ 1 callersMethodget_segment_address_copy
(self)
aeg_module/challenge.py:177
↓ 1 callersFunctionget_win_functions
:return: address list that possibly are win functions use R2 as backend, we may also use angr as backend greedy search win functions, xre
aeg_module/utils.py:51
↓ 1 callersFunctiongreedy_backward_search
(challenge, target_addr, start_addr=None, max_depth=8)
aeg_module/utils.py:112
↓ 1 callersFunctionhook_libc_start_main
(angr_proj, entry, libc_procedure)
aeg_module/utils.py:347
↓ 1 callersFunctioninit_exploits
()
aeg_module/mod_exploit.py:41
↓ 1 callersFunctioninit_leaks
()
aeg_module/mod_leak.py:106
↓ 1 callersFunctionpre_process_flirt
(challenge)
aeg_module/utils.py:143
↓ 1 callersMethodpreprocess
(self)
aeg_module/challenge.py:15
↓ 1 callersFunctionret2dl
(state: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary, align_=False)
aeg_module/mod_exploit.py:216
↓ 1 callersFunctionret2libc
(state: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary, align_=False)
aeg_module/mod_exploit.py:183
↓ 1 callersFunctionret2win
(state_raw: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary, align_=False)
aeg_module/mod_exploit.py:134
↓ 1 callersMethodrun
(self, state_raw: angr.SimState, challenge: Challenge, new_mem: list)
aeg_module/mod_exploit.py:19
↓ 1 callersMethodrun
(self, state: angr.SimState, ___, __)
aeg_module/mod_leak.py:41
↓ 1 callersMethodrun
(self, state: angr.SimState, __, ___)
aeg_module/mod_leak.py:69
↓ 1 callersFunctionrun_extra_tests
(timeout, debug, concurrent)
test_extra_dataset.py:87
↓ 1 callersMethodsim_explore
(self, sim_mgr, project, challenge, branch_depth, start_time, explore_depth)
aeg_module/aeg_main.py:104
↓ 1 callersFunctionstack_pivot
(state_raw: angr.SimState, challenge: Challenge, new_mem: list)
aeg_module/mod_exploit.py:66
↓ 1 callersFunctiontask_concurrent
(test_set, task_name, concurrent)
test_extra_dataset.py:78
↓ 1 callersMethodunconstrained_explorer
(self, state, project: angr.Project, challenge: Challenge, binary: InteractiveBinary)
aeg_module/aeg_main.py:150
↓ 1 callersMethodwarped_io_strip_zero
(self, state, data_to_send=None, check_alive=True, is_raw=False)
aeg_module/binary_interactive.py:116
↓ 1 callersFunctionwrite_flags
()
test_extra_dataset.py:64
Method__init__
(self, binary, flag_path=None, ip=None, port=None, timeout=5000, flirt=None, libc=None, ld=None,
aeg_module/aeg_main.py:22
Method__init__
(self, trick_name, trick_func, require_disabled_protections, required_information)
aeg_module/mod_tricks.py:11
Method__init__
(self, challenge)
aeg_module/mod_sim_procedure_heap.py:20
Method__init__
(self, exploit_name, exploit_func, require_disabled_protections, required_information, least_width)
aeg_module/mod_exploit.py:8
Method__init__
(self, overflow_addr, overflow_size, overflow_value, call_back_tag)
aeg_module/utils.py:40
Method__init__
(self, leak_name, leak_function, required_information, leak_target)
aeg_module/mod_leak.py:10
Method__init__
(self, payload, pattern, offset=0)
aeg_module/mod_leak.py:35
Method__init__
(self, payload, pattern, offset=0)
aeg_module/mod_leak.py:63
Method__init__
(self, binary, flag_path=None, libc=None, ld=None)
aeg_module/challenge.py:114
Method__init__
(self, challenge)
aeg_module/mod_sim_procedure.py:45
Method__init__
(self, challenge)
aeg_module/mod_sim_procedure.py:67
Method__init__
(self)
aeg_module/mod_sim_procedure.py:156
Method__init__
(self, challenge)
aeg_module/mod_sim_procedure.py:195
Method__init__
(self, file, flag_path, challenge, io_property, io_seg_addr, arch_bytes, leak_path=None, ip=N
aeg_module/binary_interactive.py:7
Method__init__
(self, stdin, stdout, stdin_group)
aeg_module/mod_technique.py:28
Method__init__
(self, challenge)
aeg_module/mod_technique.py:279
Function_leak_got_align
(state_raw: angr.SimState, challenge, new_mem: list)
aeg_module/mod_leak.py:183
Methodafter_main
(self, _, __, ___, ____, ______)
aeg_module/mod_sim_procedure.py:135
Methodafter_main
(self)
aeg_module/mod_sim_procedure.py:143
Methodafter_main
(self)
aeg_module/mod_sim_procedure.py:151
Functionanalyze_leak_detail
()
aeg_module/utils.py:198
Functioncheck_mem_write
we can directly solve the constraints, but we check overflow every time to reduce the cost of solving
aeg_module/mod_technique.py:167
Functionjmp2shellcode
(state_raw: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary)
aeg_module/mod_exploit.py:125
Functionlittle_endian
(data_, arch_bits)
aeg_module/utils.py:202
Functionret2backdoor
(state: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary)
aeg_module/mod_exploit.py:204
Functionret2dl_align
(state: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary)
aeg_module/mod_exploit.py:251
Functionret2gg
(state: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary)
aeg_module/mod_exploit.py:255
Functionret2libc_align
(state: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary)
aeg_module/mod_exploit.py:200
Functionret2og
(state_raw: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary)
aeg_module/mod_exploit.py:166
Functionret2shellcode
(state_raw: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary)
aeg_module/mod_exploit.py:99
Functionret2win_align
(state: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary)
aeg_module/mod_exploit.py:151
Functionret2win_obo
(state_raw: angr.SimState, challenge: Challenge, new_mem: list, binary: InteractiveBinary)
aeg_module/mod_exploit.py:155
Methodrun
(self, sim_size)
aeg_module/mod_sim_procedure_heap.py:24
Methodrun
(self, state: angr.SimState, challenge, new_mem: list)
aeg_module/mod_leak.py:18
next →1–100 of 115, ranked by callers