(self, addr=None, initial_prefix=None, brk=None, stack_end=None, stack_size=1024*1024*8, stdin=None,
                    thread_idx=None, permissions_backer=None, **kwargs)
return state
Initialize a blank state.

        All parameters are optional.

        :param addr:            The execution start address.
        :param initial_prefix:
        :param stack_end:       The end of the stack (i.e., the byte after the last valid stack address).
        :param stack_size:      The number of bytes to allocate for stack space
        :param brk:             The address of the process' break.
        :return:                The initialized SimState.

        Any additional arguments will be passed to the SimState constructor
Initialize a blank state.
Initialize a blank state .
def state_blank(self, addr=None, initial_prefix=None, brk=None, stack_end=None, stack_size=1024*1024*8, stdin=None,
                    thread_idx=None, permissions_backer=None, **kwargs):
        """
        Initialize a blank state.

        All parameters are optional.

        :param addr:            The execution start address.
        :param initial_prefix:
        :param stack_end:       The end of the stack (i.e., the byte after the last valid stack address).
        :param stack_size:      The number of bytes to allocate for stack space
        :param brk:             The address of the process' break.
        :return:                The initialized SimState.

        Any additional arguments will be passed to the SimState constructor
        """
        # TODO: move ALL of this into the SimState constructor
        if kwargs.get('mode', None) is None:
            kwargs['mode'] = self.project._default_analysis_mode
        if permissions_backer is not None:
            kwargs['permissions_map'] = permissions_backer[1]
            kwargs['default_permissions'] = 7 if permissions_backer[0] else 3
        if kwargs.get('cle_memory_backer', None) is None:
            kwargs['cle_memory_backer'] = self.project.loader
        if kwargs.get('os_name', None) is None:
            kwargs['os_name'] = self.name
        actual_stack_end = stack_end
        if stack_end is None:
            stack_end = self.arch.initial_sp

        if kwargs.get('permissions_map', None) is None:
            # just a dict of address ranges to permission bits
            permission_map = { }
            for obj in self.project.loader.all_objects:
                for seg in obj.segments:
                    perms = 0
                    # bit values based off of protection bit values from sys/mman.h
                    if seg.is_readable:
                        perms |= 1  # PROT_READ
                    if seg.is_writable:
                        perms |= 2  # PROT_WRITE
                    if seg.is_executable:
                        perms |= 4  # PROT_EXEC
                    permission_map[(seg.min_addr, seg.max_addr)] = perms
            kwargs['permissions_map'] = permission_map
        if self.project.loader.main_object.execstack:
            stack_perms = 1 | 2 | 4  # RWX
        else:
            stack_perms = 1 | 2  # RW

        state = SimState(self.project, stack_end=stack_end, stack_size=stack_size, stack_perms=stack_perms, **kwargs)

        if stdin is not None and not isinstance(stdin, SimFileBase):
            if type(stdin) is type:
                stdin = stdin(name='stdin', has_end=False)
            else:
                if isinstance(stdin, claripy.Bits):
                    num_bytes = len(stdin) // self.project.arch.byte_width
                else:
                    num_bytes = len(stdin)
                _l.warning("stdin is constrained to %d bytes (has_end=True). If you are only providing the first "
                           "%d bytes instead of the entire stdin, please use "
                           "stdin=SimFileStream(name='stdin', content=your_first_n_bytes, has_end=False).",
                           num_bytes, num_bytes)
                stdin = SimFileStream(name='stdin', content=stdin, has_end=True)

        last_addr = self.project.loader.main_object.max_addr
        actual_brk = (last_addr - last_addr % 0x1000 + 0x1000) if brk is None else brk
        state.register_plugin('posix', SimSystemPosix(stdin=stdin, brk=actual_brk))

        if initial_prefix is not None:
            for reg in state.arch.default_symbolic_registers:
                state.registers.store(reg, state.solver.BVS(
                    initial_prefix + "_" + reg,
                    state.arch.bits,
                    explicit_name=True,
                    key=('reg', reg),
                    eternal=True))

        if state.arch.sp_offset is not None:
            state.regs.sp = stack_end

        for reg, val, is_addr, mem_region in state.arch.default_register_values:
            region_base = None  # so pycharm does not complain

            if is_addr:
                if isinstance(mem_region, tuple):
                    # unpack it
                    mem_region, region_base = mem_region
                elif mem_region == 'global':
                    # Backward compatibility
                    region_base = 0
                else:
                    raise AngrSimOSError('You must specify the base address for memory region "%s". ' % mem_region)

            # special case for stack_end overriding sp default
            if actual_stack_end is not None and state.arch.registers[reg][0] == state.arch.sp_offset:
                continue

            if o.ABSTRACT_MEMORY in state.options and is_addr:
                address = claripy.ValueSet(state.arch.bits, mem_region, region_base, val)
                state.registers.store(reg, address)
            else:
                state.registers.store(reg, val)

        if addr is None:
            state.regs.ip = self.project.entry

        thread_name = self.project.loader.main_object.threads[thread_idx] if thread_idx is not None else None
        for reg, val in self.project.loader.main_object.thread_registers(thread_name).items():
            if reg in ('fs', 'gs', 'cs', 'ds', 'es', 'ss') and state.arch.name == 'X86':
                state.registers.store(reg, val >> 16)  # oh boy big hack
            elif reg in state.arch.registers or reg in ('flags', 'eflags', 'rflags'):
                state.registers.store(reg, val)
            elif reg == 'fctrl':
                state.regs.fpround = (val & 0xC00) >> 10
            elif reg == 'fstat':
                state.regs.fc3210 = (val & 0x4700)
            elif reg == 'ftag':
                empty_bools = [((val >> (x * 2)) & 3) == 3 for x in range(8)]
                tag_chars = [claripy.BVV(0 if x else 1, 8) for x in empty_bools]
                for i, tag in enumerate(tag_chars):
                    setattr(state.regs, 'fpu_t%d' % i, tag)
            elif reg in ('fiseg', 'fioff', 'foseg', 'fooff', 'fop'):
                pass
            elif reg == 'mxcsr':
                state.regs.sseround = (val & 0x600) >> 9
            else:
                _l.error("What is this register %s I have to translate?", reg)


        if addr is not None:
            state.regs.ip = addr

        # set up the "root history" node
        state.scratch.ins_addr = addr
        state.scratch.bbl_addr = addr
        state.scratch.stmt_idx = 0
        state.history.jumpkind = 'Ijk_Boring'

        return state
def state_blank ( self , addr = None , initial_prefix = None , brk = None , stack_end = None , stack_size = 1024 * 1024 * 8 , stdin = None , thread_idx = None , permissions_backer = None , * * kwargs ) : # TODO: move ALL of this into the SimState constructor if kwargs . get ( 'mode' , None ) is None : kwargs [ 'mode' ] = self . project . _default_analysis_mode if permissions_backer is not None : kwargs [ 'permissions_map' ] = permissions_backer [ 1 ] kwargs [ 'default_permissions' ] = 7 if permissions_backer [ 0 ] else 3 if kwargs . get ( 'cle_memory_backer' , None ) is None : kwargs [ 'cle_memory_backer' ] = self . project . loader if kwargs . get ( 'os_name' , None ) is None : kwargs [ 'os_name' ] = self . name actual_stack_end = stack_end if stack_end is None : stack_end = self . arch . initial_sp if kwargs . get ( 'permissions_map' , None ) is None : # just a dict of address ranges to permission bits permission_map = { } for obj in self . project . loader . all_objects : for seg in obj . segments : perms = 0 # bit values based off of protection bit values from sys/mman.h if seg . is_readable : perms |= 1 # PROT_READ if seg . is_writable : perms |= 2 # PROT_WRITE if seg . is_executable : perms |= 4 # PROT_EXEC permission_map [ ( seg . min_addr , seg . max_addr ) ] = perms kwargs [ 'permissions_map' ] = permission_map if self . project . loader . main_object . execstack : stack_perms = 1 | 2 | 4 # RWX else : stack_perms = 1 | 2 # RW state = SimState ( self . project , stack_end = stack_end , stack_size = stack_size , stack_perms = stack_perms , * * kwargs ) if stdin is not None and not isinstance ( stdin , SimFileBase ) : if type ( stdin ) is type : stdin = stdin ( name = 'stdin' , has_end = False ) else : if isinstance ( stdin , claripy . Bits ) : num_bytes = len ( stdin ) // self . project . arch . byte_width else : num_bytes = len ( stdin ) _l . warning ( "stdin is constrained to %d bytes (has_end=True). If you are only providing the first " "%d bytes instead of the entire stdin, please use " "stdin=SimFileStream(name='stdin', content=your_first_n_bytes, has_end=False)." , num_bytes , num_bytes ) stdin = SimFileStream ( name = 'stdin' , content = stdin , has_end = True ) last_addr = self . project . loader . main_object . max_addr actual_brk = ( last_addr - last_addr % 0x1000 + 0x1000 ) if brk is None else brk state . register_plugin ( 'posix' , SimSystemPosix ( stdin = stdin , brk = actual_brk ) ) if initial_prefix is not None : for reg in state . arch . default_symbolic_registers : state . registers . store ( reg , state . solver . BVS ( initial_prefix + "_" + reg , state . arch . bits , explicit_name = True , key = ( 'reg' , reg ) , eternal = True ) ) if state . arch . sp_offset is not None : state . regs . sp = stack_end for reg , val , is_addr , mem_region in state . arch . default_register_values : region_base = None # so pycharm does not complain if is_addr : if isinstance ( mem_region , tuple ) : # unpack it mem_region , region_base = mem_region elif mem_region == 'global' : # Backward compatibility region_base = 0 else : raise AngrSimOSError ( 'You must specify the base address for memory region "%s". ' % mem_region ) # special case for stack_end overriding sp default if actual_stack_end is not None and state . arch . registers [ reg ] [ 0 ] == state . arch . sp_offset : continue if o . ABSTRACT_MEMORY in state . options and is_addr : address = claripy . ValueSet ( state . arch . bits , mem_region , region_base , val ) state . registers . store ( reg , address ) else : state . registers . store ( reg , val ) if addr is None : state . regs . ip = self . project . entry thread_name = self . project . loader . main_object . threads [ thread_idx ] if thread_idx is not None else None for reg , val in self . project . loader . main_object . thread_registers ( thread_name ) . items ( ) : if reg in ( 'fs' , 'gs' , 'cs' , 'ds' , 'es' , 'ss' ) and state . arch . name == 'X86' : state . registers . store ( reg , val >> 16 ) # oh boy big hack elif reg in state . arch . registers or reg in ( 'flags' , 'eflags' , 'rflags' ) : state . registers . store ( reg , val ) elif reg == 'fctrl' : state . regs . fpround = ( val & 0xC00 ) >> 10 elif reg == 'fstat' : state . regs . fc3210 = ( val & 0x4700 ) elif reg == 'ftag' : empty_bools = [ ( ( val >> ( x * 2 ) ) & 3 ) == 3 for x in range ( 8 ) ] tag_chars = [ claripy . BVV ( 0 if x else 1 , 8 ) for x in empty_bools ] for i , tag in enumerate ( tag_chars ) : setattr ( state . regs , 'fpu_t%d' % i , tag ) elif reg in ( 'fiseg' , 'fioff' , 'foseg' , 'fooff' , 'fop' ) : pass elif reg == 'mxcsr' : state . regs . sseround = ( val & 0x600 ) >> 9 else : _l . error ( "What is this register %s I have to translate?" , reg ) if addr is not None : state . regs . ip = addr # set up the "root history" node state . scratch . ins_addr = addr state . scratch . bbl_addr = addr state . scratch . stmt_idx = 0 state . history . jumpkind = 'Ijk_Boring' return state