Query on Symbolic Execution. about miasm

[commial]

Hi @bsmondal,

What you're actually using here is the DependencyGraph, which is using itself the symbolic execution to render solutions.
Apparently, you've used the explicit version. That is to say, ask Miasm to give me all implicated lines, and if they represent different paths, yield each ones.

That's what you have in the *.dot files.
Then, using the .emul method, you can symbolic executes each solution history / path / implicated lines to obtain the equation of the result. That's the output: EAX: (@32[(ESP_init+0x4)]+(- @32[(ESP_init+0x8)])) <=> EAX: Arg1 - Arg2 <=> ret = a - b.

So, at this point, there is no value for a, b or op. This is, in fact, the interest of the algorithm.
Now if you want to obtain a value for op reaching each solution, you have to used the implicit DependencyGraph, a version which also tracks implicit (coming from control flow) dependencies.
You'll need the z3 Python dependency.

I advise you to modify expression to inject ABI + signature information (@32[(ESP_init+0x4)] -> Arg_A, ...). This will prevent your having memory constraint in the result.

See #152 for a very similar example.

[bsmondal]

Hi @commial

Thanks a lot. It works fine. I was getting some error during z3 installation. But its solve now. That's why it takes time to check and give you feedback.