trailofbits/manticore
3,855 نجوم·500 تفرعات·Python·AGPL-3.0·1 مشاهدةblog.trailofbits.com/2017/04/27/manticore-symbolic-execution-for-humans↗
Manticore
Manticore is a symbolic execution engine designed for the analysis of binary executables and smart contracts. It functions as an automated vulnerability scanner and verification platform that systematically traverses program execution paths to identify security flaws, validate business invariants, and ensure software properties hold true under all possible input conditions.
The engine distinguishes itself through a unified instruction set abstraction that enables consistent analysis across diverse architectures and contract formats. It provides a programmatic interface for deep customization, allowing users to define custom exploration strategies, model non-standard instruction sets, and simulate complex system call environments to suit specific research or auditing requirements.
Beyond core path exploration, the platform supports the generation of both symbolic and concrete inputs to help reproduce identified states or trigger specific code branches. It incorporates event-driven hooks that allow for the integration of custom logic during analysis milestones, facilitating the monitoring and modification of symbolic states as the engine executes target code.
The project is implemented in Python and provides a framework for configuring simulation environments, including the definition of blockchain accounts and transaction contexts for contract verification.
Features
- Symbolic Execution Engines - Explores program execution paths using symbolic inputs to identify vulnerabilities and verify properties in binary code and smart contracts.
- Smart Contract Security Analysis - Provides comprehensive symbolic analysis of smart contracts to identify security vulnerabilities and verify business logic across transaction sequences.
- Binary Analysis Tools - Analyzes executable files and machine instructions to detect hidden errors and generate concrete inputs that trigger specific program states.
- Intermediate Representations - Maps diverse machine architectures to a unified intermediate representation to allow consistent symbolic analysis across different binary and contract formats.
- Constraint Solvers - Uses external mathematical solvers to determine the feasibility of execution paths by checking if symbolic conditions can be satisfied.
- Smart Contract Vulnerability Detection - Verifies the correctness of blockchain contract logic by symbolically executing transactions to detect vulnerabilities and ensure invariants hold true.
- Vulnerability Research - Analyzes compiled binary executables to discover hidden execution paths, identify potential security flaws, and generate inputs that trigger crashes.
- Vulnerability Scanners - Traverses code paths to discover crashes and unexpected behaviors by mapping system calls and CPU instructions to symbolic states.
- Property Verification - Proves that code adheres to defined safety properties by exploring all possible execution states and identifying inputs that violate those conditions.
- Execution Path Explorers - Systematically traverses the tree of possible program execution branches to identify reachable states and potential vulnerabilities within the target code.
- Invariant Verifications - Validates smart contract invariants by executing symbolic transactions to ensure business logic correctness under all possible inputs.
- Instruction-To-Function Mappings - Allows users to map specific opcodes to symbolic state changes to ensure accurate program execution modeling during complex analysis tasks.
- Exploration Strategy Customizers - Provides a programmatic interface to define custom hooks and exploration strategies to tailor how the engine traverses code paths and identifies issues.
- Executable Format Support - Provides a unified interface to examine various target formats including smart contracts, binary executables, and virtual machine modules across different instruction sets.
- Concrete Input Generators - Produces specific input values that trigger identified program states or reach target code paths to help developers reproduce bugs discovered during analysis.
- Custom Instruction Models - Models and analyzes non-standard or custom CPU architectures by defining symbolic instruction effects to support specialized hardware or virtual machine environments.
- System-Call Interception - Simulates operating system interactions by intercepting requests and updating the symbolic CPU state to model environmental dependencies during analysis.
- System State Simulation - Allows mapping operating system requests to internal methods that manipulate symbolic CPU states to simulate environment interactions during deep code analysis.
- Symbolic Input Generators - Creates specific input values that satisfy complex program conditions to reach target states or trigger identified vulnerabilities during the symbolic analysis process.
- Event-Driven Hooks - Provides a subscription-based mechanism that triggers custom logic during specific execution milestones to monitor or modify the symbolic state.
- Execution Event Hooks - Enables users to execute custom logic during specific analysis milestones by subscribing to internal event streams to track or modify execution flow.
- Runtime and Embeddings - Symbolic execution tool for analyzing WebAssembly binaries.
- Security Analysis Tools - Symbolic execution tool for smart contracts and binaries.
