angr / ci-settings

Docker image and azure templates for angr's CI

angr

angr is a platform-agnostic binary analysis framework. It is brought to you by the Computer Security Lab at UC Santa Barbara, SEFCOM at Arizona State University, their associated CTF team, Shellphish, the open source community, and @rhelmot.

Project Links

Homepage: https://angr.io

Project repository: https://github.com/angr/angr

Documentation: https://docs.angr.io

API Documentation: https://api.angr.io/en/latest/

What is angr?

angr is a suite of Python 3 libraries that let you load a binary and do a lot of cool things to it:

• Disassembly and intermediate-representation lifting
• Program instrumentation
• Symbolic execution
• Control-flow analysis
• Data-dependency analysis
• Value-set analysis (VSA)
• Decompilation

The most common angr operation is loading a binary: p = angr.Project('/bin/bash') If you do this in an enhanced REPL like IPython, you can use tab-autocomplete to browse the top-level-accessible methods and their docstrings.

The short version of "how to install angr" is mkvirtualenv --python=$(which python3) angr && python -m pip install angr.

Example

angr does a lot of binary analysis stuff. To get you started, here's a simple example of using symbolic execution to get a flag in a CTF challenge.

import angr

project = angr.Project("angr-doc/examples/defcamp_r100/r100", auto_load_libs=False)

@project.hook(0x400844)
def print_flag(state):
    print("FLAG SHOULD BE:", state.posix.dumps(0))
    project.terminate_execution()

project.execute()

Quick Start

• Install Instructions
• Documentation as HTML and sources in the angr Github repository
• Dive right in: top-level-accessible methods
• Examples using angr to solve CTF challenges.
• API Reference
• awesome-angr repo

ci-settings's Issues

Configure PR test results to work with fork PRs

Test multiple python versions in nightly CI

Currently all of our tests are run against the oldest supported version of python in both the standard and nightly CI configurations. Recently we have observed cases where newer python versions caused some tests to fail. While duplicating our tests for >=3 python versions would significantly increase the time before merging a PR, we have the resources to do this as part of nightly tests.

archive_url.py is broken

docker run -it --rm angr/ci:2 <build url>

The above sounds awesome. Unfortunately, it is a total scam!

$ docker run -it --rm -v /var/run/docker.sock:/var/run/docker.sock --privileged angr/ci:2 'https://dev.azure.com/angr/archr/_build/results?buildId=5020'
Traceback (most recent call last):
  File "/root/scripts/archive_url.py", line 8, in <module>
    api_url = re.search('https:[^"]*Builds/[0-9]*', requests.get(url).text).group(0)
AttributeError: 'NoneType' object has no attribute 'group'
http://: Invalid host name.

Add email notification to nightly tests

Clone binaries-private for nightly tests

rename angr/tests/manual_real_firmware.py when we do this

Make the ci image a resource that can be edited in the azure pipelines GUI

Remove fidget from CI

Separate pylint run for files under angr/procedures

We should have a separate pylintrc and pylint process for files under angr/procedures. Specifically, we should disable arguments-differ,unused-argument,no-self-use,missing-module-docstring,attribute-defined-outside-init while linting simprocedures.

Don't sync PRs if the target PR is merged

I have no idea to what extent this is an issue, but we should add logic to not sync with PRs if the linked PR has been merged already.

Remove colorguard from CI

This is an old repo that isn't actively used anymore.

Remove angrop from the released repos

Recreating a build locally fails due to error in script

The instructions in README.md for recreating a CI build locally do not work correctly:

$ docker run -it angr/ci:2 "https://dev.azure.com/angr/angr/_build/results?buildId=3494"
Traceback (most recent call last):
  File "/root/scripts/archive_url.py", line 8, in <module>
    api_url = re.search('https:[^"]*Builds/[0-9]*', requests.get(url).text).group(0)
AttributeError: 'NoneType' object has no attribute 'group'
http://: Invalid host name.

Move to PEP 517

I find that CI is using python setup.py bdist_wheel and all of projects of angr have been added pyproject.toml. So using python -m build the same as setuptools document is more prefered.

Add a static type checker step

If the errors from mypy are significant, then we probably would want to make this a comparison similar to the linter.

Make descriptive error messages show up in the github interface

I can't find any documentation for this, but I believe that we can change the "Bash exited with code 1" message to whatever we want by emitting a line that looks like ##[error]My error message goes here.

Automatic releases

Outline of the release process

• Grab master versions for all repos
• Run nightly tests for each of those commits
  • Also run tests on windows or macos?
• Create release commits
  • Tag release commits
  • Push tags to GitHub
  • Create GitHub release entry?
  • Attempt to merge release tag into master, create a PR in the event of failure
• Build source distributions
• Verify packages can be installed
• Build wheels for each supported platform
  • linux
  • windows
  • macos
• Upload wheels and sdist to pypi

Refactor CI scripts into a pip-installable package

Currently the CI consists of a handful of scripts and configuration files that have been created over time carefully curated into a container image. This makes them difficult to use outside of the context of that docker image unless you know exactly what you are doing. It would be an improvement to refactor these scripts to provide an interface that can be used something like this:

# Install step
pip install --user angr-ci

# Build step
angr-ci build --python=`which python3.6` --repo=angr/angr --branch=master --artifact=angr-master-py36.tar.gz

# Test step
angr-ci test --artifact=angr-master-py36.tar.gz --worker=0/10 --include-slow

This would also open the door to making it easy to build and test on a matrix OS/python combinations, as well as improve long-term maintainability.

Automatically install all optional dependencies

Currently we have all optional dependencies manually specified, we should add some sort of logic to do this programatically so that new optional dependencies don't require an update to the CI image. setuptools doesn't currently seem to have a good way to do this. We could attempt parsing the setup.py ourselves, but I think it would be preferable to add a flag to setuptools to enable this if at all possible.

archr is not released

This appears to be a regression resulting from the changes to release angr 9.2.

Upgrade ubuntu base

ci-settings/docker/Dockerfile

Line 1 in 514bc0b

FROM ubuntu:bionic

The beaver is dead. Long live the fossa.

This base contains libc-2.27. While the rest of angr might be living in the past, archr is not. The testcases for archr are failing because of this ancient beaver. Upgrading should resolve angr/archr#70.