cozy.project — cozy 1.1 documentation

# `cozy.project`

## Module Contents

### Classes

`Project` | Represents a project for a single executable

class cozy.project.Project(binary_path: str, fun_prototypes: dict[str | int, str] | None = None, load_debug_info: bool = False)

  Represents a project for a single executable

  Variables:

    - angr_proj (angr.Project) – The angr project created for this cozy project.

    - fun_prototypes (dict[str | int, str]) – Maps function names or function addresses to their type signatures.

  Constructor for a project.

  Parameters:

    - binary_path (str) – The path to the binary to analyze.

    - fun_prototypes (dict[str | int, str] | None) – Initial dictionary that maps function names or addresses to their type signatures. If None is passed, fun_prototypes is initialized to the empty dictionary.

  property cfg

    Returns the control flow graph for this project. This property will cache the cfg in a pickle file to speed up future runs. This means if you change the underlying program you will need to delete the .cfg.pickle file located in the same directory as your executable.

  property arch

    Returns the underlying angr project architecture

  object_ranges(obj_filter: collections.abc.Callable[[cle.Backend], bool] | None = None) → list[range]

    Returns the ranges of the objects stored in the executable (for example: ELF objects). If obj_filter is specified, only objects that pass the filter make it into the return list.

    Parameters:

      obj_filter (Callable[[Backend], bool] | None) – Used to filter certain objects from the output list.

    Returns:

      A list of memory ranges.

    Return type:

      list[range]

  find_symbol_addr(sym_name: str) → int

    Finds the rebased addressed of a symbol. Functions are the most common symbol type.

    Parameters:

      sym_name (str) – The symbol to lookup.

    Returns:

      The rebased symbol address

    Return type:

      int

  add_prototype(fun: str | int, fun_prototype: str) → None

    Adds a function prototype to this project.

    Parameters:

      - fun (str | int) – The function’s name or address.

      - fun_prototype (str) – The function’s type signature.

    Returns:

      None

    Return type:

      None

  session(start_fun: str | int | None = None) → cozy.session.Session

    Returns a new session derived from this project.

    Parameters:

      start_fun (str | int | None) – The name or address of the function which this session will start with. If None is specified, then the program will start at the entry point (main function).

    Returns:

      The fresh session.

    Return type:

      Session

  hook_symbol(symbol_name: str, simproc_class: type[angr.SimProcedure], kwargs=None, replace: bool | None = None) → int

    Hooks a symbol in the angr project. If the symbol is one from libc, this method will also replace what is stored in `angr.SIM_PROCEDURES["libc"][symbol_name]`.

    Parameters:

      - symbol_name (str) – The name of the symbol to hook.

      - simproc_class (type[SimProcedure]) – The class to use to hook the symbol. Note that this is not an instance of SimProcedure, but is instead a reference to the class itself.

      - kwargs – These are the keyword arguments that will be passed to the procedure’s run method eventually.

      - replace (bool | None) – Control the behavior on finding that the address is already hooked. If true, silently replace the hook. If false, warn and do not replace the hook. If none (default), warn and replace the hook.

    Return type:

      int

    Returns:

      The address of the new symbol.