maat
maat copied to clipboard
Open-source symbolic execution framework: https://maat.re
Hello, This is a suggestion to detect when the symbolic engine got stuck. For example, when the user provided a too *ambitious* setup of from the symbolic engine, it could...
Hello, I think it could be very handy to have such feature. Currently, only instruction counter is available to stop the engine without using hook mechanism. Of course, there is...
Hello, Following the documentation and tutorial related to event, it seems that `mem_access` is not currently accessible for write fashion from Python bindings. ```python def mem_written_callback(m: MaatEngine): print(f"Writing mem at...
Hello, I wonder if manipulating the attribute `info.branch.taken` allows internally to trigger solver in order to pursue exploration of both branches. To clarify: ```asm test esi, esi mov eax, 336F9B7Fh...
We would really benefit from being able to simplify constraint patterns usually generated by conditional branches, such as: ```` (ITE[0==ITE[ecx_init !cond ````
We should support other solvers backends. Being able to export constraints in the SMTlib v2 format would also be really nice. - [x] Export constraints to smtlibv2 - [ ]...
Mostly a draft to see if there is interest. The changes are quite minimal, the only functional change I made was the `mulhshr` function because MSVC doesn't support `uint128_t`. I...
Hi, I would like to use `maat` with simple projects but I have troubles running, for instance, `id`. My code is the following: ``` from maat import * m =...
Looks like `maat::ExprITE::hash()` can get into infinite recursion and crash [here](https://github.com/trailofbits/maat/blob/ded6d7b0a77491a1c0b36fa132d99f0e667e8116/src/expression/expression.cpp#L1362). Here is a backtrace: ``` (gdb) where #0 0x00007f8f62c8d9cb in maat::ExprITE::hash() () from /root/.cache/pypoetry/virtualenvs/reface-mFqyHumy-py3.9/lib/python3.9/site-packages/maat.cpython-39-x86_64-linux-gnu.so #1 0x00007f8f62c8d9ed in maat::ExprITE::hash() ()...