Skip to content
This repository has been archived by the owner on Apr 28, 2023. It is now read-only.

Commit

Permalink
Capitalize 'Python' (#405)
Browse files Browse the repository at this point in the history
  • Loading branch information
mborgerson authored Mar 30, 2022
1 parent 9b1d865 commit 18a6950
Show file tree
Hide file tree
Showing 21 changed files with 51 additions and 51 deletions.
6 changes: 3 additions & 3 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -77,10 +77,10 @@ Largely a bugfix release, but with a few bonus treats:
## angr 8.18.10.1

Welcome to angr 8!
The biggest change for this major version bump is the transition to python 3.
The biggest change for this major version bump is the transition to Python 3.
You can read about this, as well as a few other breaking changes, in the [migration guide](MIGRATION.md).

- Switch to python 3
- Switch to Python 3
- Refactor to Clemory to clean up the API and speed things up drastically
- Remove `object.symbols_by_addr` (dict) and add `object.symbols` (sorted list); add `fuzzy` parameter to `loader.find_symbol`
- CFGFast is much, much faster now. CFGAccurate has been renamed to CFGEmulated.
Expand Down Expand Up @@ -212,7 +212,7 @@ The following are the major changes:
- angr: we have deprecated `project.factory.sim_run` and changed it to to `project.factory.successors`, and it now generates a `SimSuccessors` object.
- angr: `project.factory.sim_block` has been deprecated and replaced with `project.factory.successors(default_engine=True)`.
- angr: angr syscalls are no longer hooks. Instead, the syscall table is now in `project._simos.syscall_table`. This will be made "public" after a usability refactor. If you were using `project.is_hooked(addr)` to see if an address has a related SimProcedure, now you probably want to check if there is a related syscall as well (using `project._simos.syscall_table.get_by_addr(addr) is not None`).
- pyvex: to support custom lifters to VEX, pyvex has introduced the concept of backend lifters. Lifters can be written in pure python to produce VEX IR, allowing for extendability of angr's VEX-based analyses to other hardware architectures.
- pyvex: to support custom lifters to VEX, pyvex has introduced the concept of backend lifters. Lifters can be written in pure Python to produce VEX IR, allowing for extendability of angr's VEX-based analyses to other hardware architectures.

As usual, there are many other improvements and minor bugfixes.

Expand Down
6 changes: 3 additions & 3 deletions INSTALL.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@

angr is a library for Python 3.8+, and must be installed into your Python environment before it can be used.

We highly recommend using a [python virtual environment](https://virtualenvwrapper.readthedocs.org/en/latest/) to install and use angr. Several of angr's dependencies (z3, pyvex) require libraries of native code that are forked from their originals, and if you already have libz3 or libVEX installed, you definitely don't want to overwrite the official shared objects with ours. In general, don't expect support for problems arising from installing angr outside of a virtualenv.
We highly recommend using a [Python virtual environment](https://virtualenvwrapper.readthedocs.org/en/latest/) to install and use angr. Several of angr's dependencies (z3, pyvex) require libraries of native code that are forked from their originals, and if you already have libz3 or libVEX installed, you definitely don't want to overwrite the official shared objects with ours. In general, don't expect support for problems arising from installing angr outside of a virtualenv.

### Dependencies

All of the python dependencies should be handled by pip and/or the setup.py scripts. You will, however, need to build some C to get from here to the end, so you'll need a good build environment as well as the python development headers. At some point in the dependency install process, you'll install the python library cffi, but (on linux, at least) it won't run unless you install your operating system's libffi package.
All of the Python dependencies should be handled by pip and/or the setup.py scripts. You will, however, need to build some C to get from here to the end, so you'll need a good build environment as well as the Python development headers. At some point in the dependency install process, you'll install the Python library cffi, but (on linux, at least) it won't run unless you install your operating system's libffi package.

On Ubuntu, you will want: `sudo apt-get install python3-dev libffi-dev build-essential virtualenvwrapper`. If you are trying out angr Management, you will also need the [PySide 2 requirements](https://wiki.qt.io/Qt_for_Python/GettingStarted).

Expand Down Expand Up @@ -105,7 +105,7 @@ You can branch/edit/recompile the various modules in-place, and it will automati

The angr-dev repository has a setup.bat script that creates the same setup as above, though it's not as magical as setup.sh.
Since we'll be building C code, you must be in the visual studio developer command prompt.
*Make sure that if you're using a 64-bit python interpreter, you're also using the 64-bit build tools* (`VsDevCmd.bat -arch=x64`)
*Make sure that if you're using a 64-bit Python interpreter, you're also using the 64-bit build tools* (`VsDevCmd.bat -arch=x64`)

```bash
pip install virtualenv
Expand Down
2 changes: 1 addition & 1 deletion api-doc/MAINTENANCE.txt
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ $ make html
DEALING WITH LAYOUT
-------------------

So the thing about Sphinx is that it's not a python-specific framework, it's a general-purpose
So the thing about Sphinx is that it's not a Python-specific framework, it's a general-purpose
documentation generator. Sphinx docs are written in ReStructured Text (rst), a
superset-cum-bastard-clone of Markdown. In order to do te neat thing where our docstrings are
added to the documentation, there's this cool Sphinx plugin called "autodoc", which does
Expand Down
4 changes: 2 additions & 2 deletions docs/analyses/cfg.md
Original file line number Diff line number Diff line change
Expand Up @@ -88,11 +88,11 @@ Functions have several important properties!
- `entry_func.block_addrs` is a set of addresses at which basic blocks belonging to the function begin.
- `entry_func.blocks` is the set of basic blocks belonging to the function, that you can explore and disassemble using capstone.
- `entry_func.string_references()` returns a list of all the constant strings that were referred to at any point in the function.
They are formatted as `(addr, string)` tuples, where addr is the address in the binary's data section the string lives, and string is a python string that contains the value of the string.
They are formatted as `(addr, string)` tuples, where addr is the address in the binary's data section the string lives, and string is a Python string that contains the value of the string.
- `entry_func.returning` is a boolean value signifying whether or not the function can return.
`False` indicates that all paths do not return.
- `entry_func.callable` is an angr Callable object referring to this function.
You can call it like a python function with python arguments and get back an actual result (may be symbolic) as if you ran the function with those arguments!
You can call it like a Python function with Python arguments and get back an actual result (may be symbolic) as if you ran the function with those arguments!
- `entry_func.transition_graph` is a NetworkX DiGraph describing control flow within the function itself. It resembles the control-flow graphs IDA displays on a per-function level.
- `entry_func.name` is the name of the function.
- `entry_func.has_unresolved_calls` and `entry.has_unresolved_jumps` have to do with detecting imprecision within the CFG.
Expand Down
2 changes: 1 addition & 1 deletion docs/analysis_writing.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ Let's see how to run our new analysis:

### Working with projects

Via some python magic, your analysis will automatically have the project upon which you are running it under the `self.project` property.
Via some Python magic, your analysis will automatically have the project upon which you are running it under the `self.project` property.
Use this to interact with your project and analyze it!

```python
Expand Down
2 changes: 1 addition & 1 deletion docs/angr_management.md
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ Additionally, you can pass any sort of object you like to `workspace.viz()` and
### Writing plugins

angr management has a very flexible plugin framework.
A plugin is a python file containing a subclass of `angrmanagement.plugins.BasePlugin`.
A plugin is a Python file containing a subclass of `angrmanagement.plugins.BasePlugin`.
Plugin files will be automatically loaded from the `plugins` module of angr management, and also from `~/.local/share/angr-management/plugins`.
These paths are configurable through the program configuration, but at the time of writing, this is not exposed in the UI.

Expand Down
6 changes: 3 additions & 3 deletions docs/claripy.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ Claripy exposes the following design:

- Claripy ASTs (the subclasses of claripy.ast.Base) provide a unified way to interact with concrete and symbolic expressions
- `Frontend`s provide different paradigms for evaluating these expressions. For example, the `FullFrontend` solves expressions using something like an SMT solver backend, while `LightFrontend` handles them by using an abstract (and approximating) data domain backend.
- Each `Frontend` needs to, at some point, do actual operation and evaluations on an AST. ASTs don't support this on their own. Instead, `Backend`s translate ASTs into backend objects (i.e., python primitives for `BackendConcrete`, Z3 expressions for `BackendZ3`, strided intervals for `BackendVSA`, etc) and handle any appropriate state-tracking objects (such as tracking the solver state in the case of `BackendZ3`). Roughly speaking, frontends take ASTs as inputs and use backends to `backend.convert()` those ASTs into backend objects that can be evaluated and otherwise reasoned about.
- Each `Frontend` needs to, at some point, do actual operation and evaluations on an AST. ASTs don't support this on their own. Instead, `Backend`s translate ASTs into backend objects (i.e., Python primitives for `BackendConcrete`, Z3 expressions for `BackendZ3`, strided intervals for `BackendVSA`, etc) and handle any appropriate state-tracking objects (such as tracking the solver state in the case of `BackendZ3`). Roughly speaking, frontends take ASTs as inputs and use backends to `backend.convert()` those ASTs into backend objects that can be evaluated and otherwise reasoned about.
- `FrontendMixin`s customize the operation of `Frontend`s. For example, `ModelCacheMixin` caches solutions from an SMT solver.
- The combination of a Frontend, a number of FrontendMixins, and a number of Backends comprise a claripy `Solver`.

Expand Down Expand Up @@ -72,7 +72,7 @@ You can combine these conditions in different ways.

The usefulness of this will become apparent when we discuss Claripy solvers.

In general, Claripy supports all of the normal python operations (+, -, |, ==, etc), and provides additional ones via the Claripy instance object. Here's a list of available operations from the latter.
In general, Claripy supports all of the normal Python operations (+, -, |, ==, etc), and provides additional ones via the Claripy instance object. Here's a list of available operations from the latter.

| Name | Description | Example |
|------|-------------|---------|
Expand All @@ -98,7 +98,7 @@ In general, Claripy supports all of the normal python operations (+, -, |, ==, e
| SGT | Signed greater than. | Check if x is greater than y: `claripy.SGT(x, y)` |


**NOTE:** The default python `>`, `<`, `>=`, and `<=` are unsigned in Claripy. This is different than their behavior in Z3, because it seems more natural in binary analysis.
**NOTE:** The default Python `>`, `<`, `>=`, and `<=` are unsigned in Claripy. This is different than their behavior in Z3, because it seems more natural in binary analysis.

## Solvers

Expand Down
2 changes: 1 addition & 1 deletion docs/examples.md
Original file line number Diff line number Diff line change
Expand Up @@ -172,7 +172,7 @@ Concepts presented: exploration to vulnerability, programmatic find condition
This is the first in a series of "tutorial scripts" I'll be making which use angr to find exploitable conditions in binaries.
The first example is a very simple program.
The script finds a path from the main entry point to `strcpy`, but **only** when we control the source buffer of the `strcpy` operation.
To hit the right path, angr has to solve for a password argument, but angr solved this in less than 2 seconds on my machine using the standard python interpreter.
To hit the right path, angr has to solve for a password argument, but angr solved this in less than 2 seconds on my machine using the standard Python interpreter.
The script might look large, but that's only because I've heavily commented it to be more helpful to beginners.
The challenge binary is [here](https://github.com/angr/angr-doc/tree/master/examples/strcpy_find/strcpy_test) and the script is [here](https://github.com/angr/angr-doc/tree/master/examples/strcpy_find/solve.py).

Expand Down
6 changes: 3 additions & 3 deletions docs/faq.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ logging.getLogger('angr').setLevel('DEBUG')
You may want to use `INFO` or whatever else instead.
By default, angr will enable logging at the `WARNING` level.

Each angr module has its own logger string, usually all the python modules above it in the hierarchy, plus itself, joined with dots.
Each angr module has its own logger string, usually all the Python modules above it in the hierarchy, plus itself, joined with dots.
For example, `angr.analyses.cfg`.
Because of the way the python logging module works, you can set the verbosity for all submodules in a module by setting a verbosity level for the parent module.
Because of the way the Python logging module works, you can set the verbosity for all submodules in a module by setting a verbosity level for the parent module.
For example, `logging.getLogger('angr.analyses').setLevel('INFO')` will make the CFG, as well as all other analyses, log at the INFO level.

## Why is angr so slow?
Expand Down Expand Up @@ -66,7 +66,7 @@ If you see an odd ARM address, that just means the code at `address - 1` is in T

## How do I serialize angr objects?
[Pickle](https://docs.python.org/2/library/pickle.html) will work.
However, python will default to using an extremely old pickle protocol that does not support more complex python data structures, so you must specify a [more advanced data stream format](https://docs.python.org/2/library/pickle.html#data-stream-format).
However, Python will default to using an extremely old pickle protocol that does not support more complex Python data structures, so you must specify a [more advanced data stream format](https://docs.python.org/2/library/pickle.html#data-stream-format).
The easiest way to do this is `pickle.dumps(obj, -1)`.

## What does `UnsupportedIROpError("floating point support disabled")` mean?
Expand Down
2 changes: 1 addition & 1 deletion docs/java_support.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ This also includes Android apps using a combination of compiled Java and native
**Java support is experimental!**
_Contribution from the community is highly encouraged! Pull requests are very welcomed!_

We implemented Java support by lifting the compiled Java code, both Java and DEX bytecode, leveraging our Soot python wrapper: [pysoot](https://github.com/angr/pysoot).
We implemented Java support by lifting the compiled Java code, both Java and DEX bytecode, leveraging our Soot Python wrapper: [pysoot](https://github.com/angr/pysoot).
`pysoot` extracts a fully serializable interface from Android apps and Java code (unfortunately, as of now, it only works on Linux).
For every class of the generated IR (for instance, `SootMethod`), you can nicely print its instructions (in a format similar to `Soot` `shimple`) using `print()` or `str()`.

Expand Down
6 changes: 3 additions & 3 deletions docs/loading.md
Original file line number Diff line number Diff line change
Expand Up @@ -176,7 +176,7 @@ A relocation's corresponding import symbol can be accessed as `.symbol`.
The address the relocation will write to is accessable through any of the address identifiers you can use for Symbol, and you can get a reference to the object requesting the relocation with `.owner` as well.

```python
# Relocations don't have a good pretty-printing, so those addresses are python-internal, unrelated to our program
# Relocations don't have a good pretty-printing, so those addresses are Python-internal, unrelated to our program
>>> proj.loader.shared_objects['libc.so.6'].imports
{'__libc_enable_secure': <cle.backends.elf.relocation.amd64.R_X86_64_GLOB_DAT at 0x7ff5c5fce780>,
'__tls_get_addr': <cle.backends.elf.relocation.amd64.R_X86_64_JUMP_SLOT at 0x7ff5c6018358>,
Expand Down Expand Up @@ -240,7 +240,7 @@ To refer to a backend, use the name from this table:

## Symbolic Function Summaries

By default, Project tries to replace external calls to library functions by using symbolic summaries termed _SimProcedures_ - effectively just python functions that imitate the library function's effect on the state. We've implemented [a whole bunch of functions](https://github.com/angr/angr/tree/master/angr/procedures) as SimProcedures. These builtin procedures are available in the `angr.SIM_PROCEDURES` dictionary, which is two-leveled, keyed first on the package name \(libc, posix, win32, stubs\) and then on the name of the library function. Executing a SimProcedure instead of the actual library function that gets loaded from your system makes analysis a LOT more tractable, at the cost of [some potential inaccuracies](/docs/gotchas.md).
By default, Project tries to replace external calls to library functions by using symbolic summaries termed _SimProcedures_ - effectively just Python functions that imitate the library function's effect on the state. We've implemented [a whole bunch of functions](https://github.com/angr/angr/tree/master/angr/procedures) as SimProcedures. These builtin procedures are available in the `angr.SIM_PROCEDURES` dictionary, which is two-leveled, keyed first on the package name \(libc, posix, win32, stubs\) and then on the name of the library function. Executing a SimProcedure instead of the actual library function that gets loaded from your system makes analysis a LOT more tractable, at the cost of [some potential inaccuracies](/docs/gotchas.md).

When no such summary is available for a given function:

Expand All @@ -252,7 +252,7 @@ When no such summary is available for a given function:

#### Hooking

The mechanism by which angr replaces library code with a python summary is called hooking, and you can do it too! When performing simulation, at every step angr checks if the current address has been hooked, and if so, runs the hook instead of the binary code at that address. The API to let you do this is `proj.hook(addr, hook)`, where `hook` is a SimProcedure instance. You can manage your project's hooks with `.is_hooked`, `.unhook`, and `.hooked_by`, which should hopefully not require explanation.
The mechanism by which angr replaces library code with a Python summary is called hooking, and you can do it too! When performing simulation, at every step angr checks if the current address has been hooked, and if so, runs the hook instead of the binary code at that address. The API to let you do this is `proj.hook(addr, hook)`, where `hook` is a SimProcedure instance. You can manage your project's hooks with `.is_hooked`, `.unhook`, and `.hooked_by`, which should hopefully not require explanation.

There is an alternate API for hooking an address that lets you specify your own off-the-cuff function to use as a hook, by using `proj.hook(addr)` as a function decorator. If you do this, you can also optionally specify a `length` keyword argument to make execution jump some number of bytes forward after your hook finishes.

Expand Down
4 changes: 2 additions & 2 deletions docs/migration-8.md
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# Migrating to angr 8

angr has moved from python 2 to python 3!
angr has moved from Python 2 to Python 3!
We took this opportunity of a major version bump to make a few breaking API changes that improve quality-of-life.

## What do I need to know for migrating my scripts to python 3?
## What do I need to know for migrating my scripts to Python 3?

To begin, just the standard py3k changes, the relevant parts of which we'll rehash here as a reference guide:

Expand Down
Loading

0 comments on commit 18a6950

Please sign in to comment.