signature:
def sys_writev ( self , fd , iov , count ) :
    """Works just like C { sys _ write } except that multiple buffers are written out .
 : rtype : int
 : param fd : the file descriptor of the file to write .
 : param iov : the buffer where the the bytes to write are taken .
 : param count : amount of C { iov } buffers to write into the file .
 : return : the amount of bytes written in total ."""

implementation:
cpu = self . current
ptrsize = cpu . address_bit_size
sizeof_iovec = 2 * ( ptrsize // 8 )
total = 0
try :
    write_fd = self . _get_fd ( fd )
except FdError as e :
    logger . error ( f"writev: Not a valid file descriptor ({fd})" )
    return - e . err
for i in range ( 0 , count ) :
    buf = cpu . read_int ( iov + i * sizeof_iovec , ptrsize )
    size = cpu . read_int ( iov + i * sizeof_iovec + ( sizeof_iovec // 2 ) , ptrsize )
    data = [ Operators . CHR ( cpu . read_int ( buf + i , 8 ) ) for i in range ( size ) ]
    data = self . _transform_write_data ( data )
    write_fd . write ( data )
    self . syscall_trace . append ( ( "_write" , fd , data ) )
    total += size
return total


signature:
def sys_set_thread_area ( self , user_info ) :
    """Sets a thread local storage ( TLS ) area . Sets the base address of the GS segment .
 : rtype : int
 : param user _ info : the TLS array entry set corresponds to the value of C { u _ info - > entry _ number } .
 : return : C { 0 } on success ."""

implementation:
n = self . current . read_int ( user_info , 32 )
pointer = self . current . read_int ( user_info + 4 , 32 )
m = self . current . read_int ( user_info + 8 , 32 )
flags = self . current . read_int ( user_info + 12 , 32 )
assert n == 0xffffffff
assert flags == 0x51
# TODO : fix
self . current . GS = 0x63
self . current . set_descriptor ( self . current . GS , pointer , 0x4000 , 'rw' )
self . current . write_int ( user_info , ( 0x63 - 3 ) // 8 , 32 )
return 0


signature:
def sys_getrandom ( self , buf , size , flags ) :
    """The getrandom system call fills the buffer with random bytes of buflen .
 The source of random ( / dev / random or / dev / urandom ) is decided based on
 the flags value .
 Manticore ' s implementation simply fills a buffer with zeroes - - choosing
 determinism over true randomness .
 : param buf : address of buffer to be filled with random bytes
 : param size : number of random bytes
 : param flags : source of random ( / dev / random or / dev / urandom )
 : return : number of bytes copied to buf"""

implementation:
GRND_NONBLOCK = 0x0001
GRND_RANDOM = 0x0002
if size == 0 :
    return 0
if buf not in self . current . memory :
    logger . info ( "getrandom: Provided an invalid address. Returning EFAULT" )
    return - errno . EFAULT
if flags & ~ ( GRND_NONBLOCK | GRND_RANDOM ) :
    return - errno . EINVAL
self . current . write_bytes ( buf , '\x00' * size )
return size


signature:
def syscall ( self ) :
    """Syscall dispatcher ."""

implementation:
index = self . _syscall_abi . syscall_number ( )
try :
    table = getattr ( linux_syscalls , self . current . machine )
    name = table . get ( index , None )
    implementation = getattr ( self , name )
except ( AttributeError , KeyError ) :
    if name is not None :
        raise SyscallNotImplemented ( index , name )
    else :
        raise Exception ( f"Bad syscall index, {index}" )
return self . _syscall_abi . invoke ( implementation )


signature:
def sched ( self ) :
    """Yield CPU .
 This will choose another process from the running list and change
 current running process . May give the same cpu if only one running
 process ."""

implementation:
if len ( self . procs ) > 1 :
    logger . debug ( "SCHED:" )
    logger . debug ( f"\tProcess: {self.procs!r}" )
    logger . debug ( f"\tRunning: {self.running!r}" )
    logger . debug ( f"\tRWait: {self.rwait!r}" )
    logger . debug ( f"\tTWait: {self.twait!r}" )
    logger . debug ( f"\tTimers: {self.timers!r}" )
    logger . debug ( f"\tCurrent clock: {self.clocks}" )
    logger . debug ( f"\tCurrent cpu: {self._current}" )
if len ( self . running ) == 0 :
    logger . debug ( "None running checking if there is some process waiting for a timeout" )
    if all ( [ x is None for x in self . timers ] ) :
        raise Deadlock ( )
    self . clocks = min ( x for x in self . timers if x is not None ) + 1
    self . check_timers ( )
    assert len ( self . running ) != 0 , "DEADLOCK!"
    self . _current = self . running [ 0 ]
    return
next_index = ( self . running . index ( self . _current ) + 1 ) % len ( self . running )
next_running_idx = self . running [ next_index ]
if len ( self . procs ) > 1 :
    logger . debug ( f"\tTransfer control from process {self._current} to {next_running_idx}" )
self . _current = next_running_idx


signature:
def wait ( self , readfds , writefds , timeout ) :
    """Wait for file descriptors or timeout .
 Adds the current process in the correspondent waiting list and
 yield the cpu to another running process ."""

implementation:
logger . debug ( "WAIT:" )
logger . debug ( f"\tProcess {self._current} is going to wait for [ {readfds!r} {writefds!r} {timeout!r} ]" )
logger . debug ( f"\tProcess: {self.procs!r}" )
logger . debug ( f"\tRunning: {self.running!r}" )
logger . debug ( f"\tRWait: {self.rwait!r}" )
logger . debug ( f"\tTWait: {self.twait!r}" )
logger . debug ( f"\tTimers: {self.timers!r}" )
for fd in readfds :
    self . rwait [ fd ] . add ( self . _current )
for fd in writefds :
    self . twait [ fd ] . add ( self . _current )
if timeout is not None :
    self . timers [ self . _current ] = self . clocks + timeout
procid = self . _current
# self . sched ( )
next_index = ( self . running . index ( procid ) + 1 ) % len ( self . running )
self . _current = self . running [ next_index ]
logger . debug ( f"\tTransfer control from process {procid} to {self._current}" )
logger . debug ( f"\tREMOVING {procid!r} from {self.running!r}. Current: {self._current!r}" )
self . running . remove ( procid )
if self . _current not in self . running :
    logger . debug ( "\tCurrent not running. Checking for timers..." )
    self . _current = None
    self . check_timers ( )


signature:
def awake ( self , procid ) :
    """Remove procid from waitlists and reestablish it in the running list"""

implementation:
logger . debug ( f"Remove procid:{procid} from waitlists and reestablish it in the running list" )
for wait_list in self . rwait :
    if procid in wait_list :
        wait_list . remove ( procid )
for wait_list in self . twait :
    if procid in wait_list :
        wait_list . remove ( procid )
self . timers [ procid ] = None
self . running . append ( procid )
if self . _current is None :
    self . _current = procid


signature:
def signal_receive ( self , fd ) :
    """Awake one process waiting to receive data on fd"""

implementation:
connections = self . connections
if connections ( fd ) and self . twait [ connections ( fd ) ] :
    procid = random . sample ( self . twait [ connections ( fd ) ] , 1 ) [ 0 ]
    self . awake ( procid )


signature:
def signal_transmit ( self , fd ) :
    """Awake one process waiting to transmit data on fd"""

implementation:
connection = self . connections ( fd )
if connection is None or connection >= len ( self . rwait ) :
    return
procs = self . rwait [ connection ]
if procs :
    procid = random . sample ( procs , 1 ) [ 0 ]
    self . awake ( procid )


signature:
def check_timers ( self ) :
    """Awake process if timer has expired"""

implementation:
if self . _current is None : # Advance the clocks . Go to future ! !
    advance = min ( [ self . clocks ] + [ x for x in self . timers if x is not None ] ) + 1
    logger . debug ( f"Advancing the clock from {self.clocks} to {advance}" )
    self . clocks = advance
for procid in range ( len ( self . timers ) ) :
    if self . timers [ procid ] is not None :
        if self . clocks > self . timers [ procid ] :
            self . procs [ procid ] . PC += self . procs [ procid ] . instruction . size
            self . awake ( procid )


signature:
def execute ( self ) :
    """Execute one cpu instruction in the current thread ( only one supported ) .
 : rtype : bool
 : return : C { True }
 : todo : This is where we could implement a simple schedule ."""

implementation:
try :
    self . current . execute ( )
    self . clocks += 1
    if self . clocks % 10000 == 0 :
        self . check_timers ( )
        self . sched ( )
except ( Interruption , Syscall ) as e :
    try :
        self . syscall ( )
        if hasattr ( e , 'on_handled' ) :
            e . on_handled ( )
    except RestartSyscall :
        pass
return True


signature:
def sys_fstat64 ( self , fd , buf ) :
    """Determines information about a file based on its file descriptor ( for Linux 64 bits ) .
 : rtype : int
 : param fd : the file descriptor of the file that is being inquired .
 : param buf : a buffer where data about the file will be stored .
 : return : C { 0 } on success , EBADF when called with bad fd
 : todo : Fix device number ."""

implementation:
try :
    stat = self . _get_fd ( fd ) . stat ( )
except FdError as e :
    logger . info ( "Calling fstat with invalid fd, returning EBADF" )
    return - e . err
def add ( width , val ) :
    fformat = { 2 : 'H' , 4 : 'L' , 8 : 'Q' } [ width ]
    return struct . pack ( '<' + fformat , val )
def to_timespec ( ts ) :
    return struct . pack ( '<LL' , int ( ts ) , int ( ts % 1 * 1e9 ) )
bufstat = add ( 8 , stat . st_dev )
# unsigned long long st _ dev ;
bufstat += add ( 8 , stat . st_ino )
# unsigned long long _ _ st _ ino ;
bufstat += add ( 4 , stat . st_mode )
# unsigned int st _ mode ;
bufstat += add ( 4 , stat . st_nlink )
# unsigned int st _ nlink ;
bufstat += add ( 4 , stat . st_uid )
# unsigned long st _ uid ;
bufstat += add ( 4 , stat . st_gid )
# unsigned long st _ gid ;
bufstat += add ( 8 , stat . st_rdev )
# unsigned long long st _ rdev ;
bufstat += add ( 8 , 0 )
# unsigned long long _ _ pad1;
bufstat += add ( 8 , stat . st_size )
# long long st _ size ;
bufstat += add ( 4 , stat . st_blksize )
# int st _ blksize ;
bufstat += add ( 4 , 0 )
# int _ _ pad2;
bufstat += add ( 8 , stat . st_blocks )
# unsigned long long st _ blocks ;
bufstat += to_timespec ( stat . st_atime )
# unsigned long st _ atime ;
bufstat += to_timespec ( stat . st_mtime )
# unsigned long st _ mtime ;
bufstat += to_timespec ( stat . st_ctime )
# unsigned long st _ ctime ;
bufstat += add ( 4 , 0 )
# unsigned int _ _ unused4;
bufstat += add ( 4 , 0 )
# unsigned int _ _ unused5;
self . current . write_bytes ( buf , bufstat )
return 0


signature:
def _interp_total_size ( interp ) :
    """Compute total load size of interpreter .
 : param ELFFile interp : interpreter ELF . so
 : return : total load size of interpreter , not aligned
 : rtype : int"""

implementation:
load_segs = [ x for x in interp . iter_segments ( ) if x . header . p_type == 'PT_LOAD' ]
last = load_segs [ - 1 ]
return last . header . p_vaddr + last . header . p_memsz


signature:
def sys_open ( self , buf , flags , mode ) :
    """A version of open ( 2 ) that includes a special case for a symbolic path .
 When given a symbolic path , it will create a temporary file with
 64 bytes of symbolic bytes as contents and return that instead .
 : param buf : address of zero - terminated pathname
 : param flags : file access bits
 : param mode : file permission mode"""

implementation:
offset = 0
symbolic_path = issymbolic ( self . current . read_int ( buf , 8 ) )
if symbolic_path :
    import tempfile
    fd , path = tempfile . mkstemp ( )
    with open ( path , 'wb+' ) as f :
        f . write ( '+' * 64 )
    self . symbolic_files . append ( path )
    buf = self . current . memory . mmap ( None , 1024 , 'rw ' , data_init = path )
rv = super ( ) . sys_open ( buf , flags , mode )
if symbolic_path :
    self . current . memory . munmap ( buf , 1024 )
return rv


signature:
def sys_openat ( self , dirfd , buf , flags , mode ) :
    """A version of openat that includes a symbolic path and symbolic directory file descriptor
 : param dirfd : directory file descriptor
 : param buf : address of zero - terminated pathname
 : param flags : file access bits
 : param mode : file permission mode"""

implementation:
if issymbolic ( dirfd ) :
    logger . debug ( "Ask to read from a symbolic directory file descriptor!!" )
    # Constrain to a valid fd and one past the end of fds
    self . constraints . add ( dirfd >= 0 )
    self . constraints . add ( dirfd <= len ( self . files ) )
    raise ConcretizeArgument ( self , 0 )
if issymbolic ( buf ) :
    logger . debug ( "Ask to read to a symbolic buffer" )
    raise ConcretizeArgument ( self , 1 )
return super ( ) . sys_openat ( dirfd , buf , flags , mode )


signature:
def sys_getrandom ( self , buf , size , flags ) :
    """The getrandom system call fills the buffer with random bytes of buflen .
 The source of random ( / dev / random or / dev / urandom ) is decided based on the flags value .
 : param buf : address of buffer to be filled with random bytes
 : param size : number of random bytes
 : param flags : source of random ( / dev / random or / dev / urandom )
 : return : number of bytes copied to buf"""

implementation:
if issymbolic ( buf ) :
    logger . debug ( "sys_getrandom: Asked to generate random to a symbolic buffer address" )
    raise ConcretizeArgument ( self , 0 )
if issymbolic ( size ) :
    logger . debug ( "sys_getrandom: Asked to generate random of symbolic number of bytes" )
    raise ConcretizeArgument ( self , 1 )
if issymbolic ( flags ) :
    logger . debug ( "sys_getrandom: Passed symbolic flags" )
    raise ConcretizeArgument ( self , 2 )
return super ( ) . sys_getrandom ( buf , size , flags )


signature:
def _read_string ( self , cpu , buf ) :
    """Reads a null terminated concrete buffer form memory
 : todo : FIX . move to cpu or memory"""

implementation:
filename = ""
for i in range ( 0 , 1024 ) :
    c = Operators . CHR ( cpu . read_int ( buf + i , 8 ) )
    if c == '\x00' :
        break
    filename += c
return filename


signature:
def load ( self , filename ) :
    """Loads a CGC - ELF program in memory and prepares the initial CPU state
 and the stack .
 : param filename : pathname of the file to be executed ."""

implementation:
CGC_MIN_PAGE_SIZE = 4096
CGC_MIN_ALIGN = CGC_MIN_PAGE_SIZE
TASK_SIZE = 0x80000000
def CGC_PAGESTART ( _v ) :
    return ( ( _v ) & ~ ( CGC_MIN_ALIGN - 1 ) )
def CGC_PAGEOFFSET ( _v ) :
    return ( ( _v ) & ( CGC_MIN_ALIGN - 1 ) )
def CGC_PAGEALIGN ( _v ) :
    return ( ( ( _v ) + CGC_MIN_ALIGN - 1 ) & ~ ( CGC_MIN_ALIGN - 1 ) )
def BAD_ADDR ( x ) :
    return ( ( x ) >= TASK_SIZE )
# load elf See https : / / github . com / CyberdyneNYC / linux - source - 3.13.2 - cgc / blob / master / fs / binfmt _ cgc . c
# read the ELF object file
cgc = CGCElf ( filename )
logger . info ( "Loading %s as a %s elf" % ( filename , cgc . arch ) )
# make cpu and memory ( Only 1 thread in Decree )
cpu = self . _mk_proc ( )
bss = brk = 0
start_code = 0xffffffff
end_code = start_data = end_data = 0
for ( vaddr , memsz , perms , name , offset , filesz ) in cgc . maps ( ) :
    if vaddr < start_code :
        start_code = vaddr
    if start_data < vaddr :
        start_data = vaddr
    if vaddr > TASK_SIZE or filesz > memsz or memsz > TASK_SIZE or TASK_SIZE - memsz < vaddr :
        raise Exception ( "Set_brk can never work. avoid overflows" )
    # CGCMAP - -
    addr = None
    if filesz > 0 :
        hint = CGC_PAGESTART ( vaddr )
        size = CGC_PAGEALIGN ( filesz + CGC_PAGEOFFSET ( vaddr ) )
        offset = CGC_PAGESTART ( offset )
        addr = cpu . memory . mmapFile ( hint , size , perms , name , offset )
        assert not BAD_ADDR ( addr )
        lo = CGC_PAGEALIGN ( vaddr + filesz )
        hi = CGC_PAGEALIGN ( vaddr + memsz )
    else : # for 0 filesz , we have to include the first page as bss .
        lo = CGC_PAGESTART ( vaddr + filesz )
        hi = CGC_PAGEALIGN ( vaddr + memsz )
    # map anon pages for the rest ( no prefault )
    if hi - lo > 0 :
        zaddr = cpu . memory . mmap ( lo , hi - lo , perms )
        assert not BAD_ADDR ( zaddr )
    lo = vaddr + filesz
    hi = CGC_PAGEALIGN ( vaddr + memsz )
    if hi - lo > 0 :
        old_perms = cpu . memory . perms ( lo )
        cpu . memory . mprotect ( lo , hi - lo , 'rw' )
        try :
            cpu . memory [ lo : hi ] = '\x00' * ( hi - lo )
        except Exception as e :
            logger . debug ( "Exception zeroing main elf fractional pages: %s" % str ( e ) )
        cpu . memory . mprotect ( lo , hi , old_perms )
    if addr is None :
        addr = zaddr
    assert addr is not None
    k = vaddr + filesz
    if k > bss :
        bss = k
    if 'x' in perms and end_code < k :
        end_code = k
    if end_data < k :
        end_data = k
    k = vaddr + memsz
    if k > brk :
        brk = k
bss = brk
stack_base = 0xbaaaaffc
stack_size = 0x800000
stack = cpu . memory . mmap ( 0xbaaab000 - stack_size , stack_size , 'rwx' ) + stack_size - 4
assert ( stack_base ) in cpu . memory and ( stack_base - stack_size + 4 ) in cpu . memory
# Only one thread in Decree
status , thread = next ( cgc . threads ( ) )
assert status == 'Running'
logger . info ( "Setting initial cpu state" )
# set initial CPU state
cpu . write_register ( 'EAX' , 0x0 )
cpu . write_register ( 'ECX' , cpu . memory . mmap ( CGC_PAGESTART ( 0x4347c000 ) , CGC_PAGEALIGN ( 4096 + CGC_PAGEOFFSET ( 0x4347c000 ) ) , 'rwx' ) )
cpu . write_register ( 'EDX' , 0x0 )
cpu . write_register ( 'EBX' , 0x0 )
cpu . write_register ( 'ESP' , stack )
cpu . write_register ( 'EBP' , 0x0 )
cpu . write_register ( 'ESI' , 0x0 )
cpu . write_register ( 'EDI' , 0x0 )
cpu . write_register ( 'EIP' , thread [ 'EIP' ] )
cpu . write_register ( 'RFLAGS' , 0x202 )
cpu . write_register ( 'CS' , 0x0 )
cpu . write_register ( 'SS' , 0x0 )
cpu . write_register ( 'DS' , 0x0 )
cpu . write_register ( 'ES' , 0x0 )
cpu . write_register ( 'FS' , 0x0 )
cpu . write_register ( 'GS' , 0x0 )
cpu . memory . mmap ( 0x4347c000 , 0x1000 , 'r' )
# cpu . memory [ 0x4347c000:0x4347d000 ] = ' A ' 0x1000
logger . info ( "Entry point: %016x" , cpu . EIP )
logger . info ( "Stack start: %016x" , cpu . ESP )
logger . info ( "Brk: %016x" , brk )
logger . info ( "Mappings:" )
for m in str ( cpu . memory ) . split ( '\n' ) :
    logger . info ( "  %s" , m )
return [ cpu ]


signature:
def sys_allocate ( self , cpu , length , isX , addr ) :
    """allocate - allocate virtual memory
 The allocate system call creates a new allocation in the virtual address
 space of the calling process . The length argument specifies the length of
 the allocation in bytes which will be rounded up to the hardware page size .
 The kernel chooses the address at which to create the allocation ; the
 address of the new allocation is returned in * addr as the result of the call .
 All newly allocated memory is readable and writeable . In addition , the
 is _ X argument is a boolean that allows newly allocated memory to be marked
 as executable ( non - zero ) or non - executable ( zero ) .
 The allocate function is invoked through system call number 5.
 : param cpu : current CPU
 : param length : the length of the allocation in bytes
 : param isX : boolean that allows newly allocated memory to be marked as executable
 : param addr : the address of the new allocation is returned in * addr
 : return : On success , allocate returns zero and a pointer to the allocated area
 is returned in * addr . Otherwise , an error code is returned
 and * addr is undefined .
 EINVAL length is zero .
 EINVAL length is too large .
 EFAULT addr points to an invalid address .
 ENOMEM No memory is available or the process ' maximum number of allocations
 would have been exceeded ."""

implementation:
# TODO : check 4 bytes from addr
if addr not in cpu . memory :
    logger . info ( "ALLOCATE: addr points to invalid address. Returning EFAULT" )
    return Decree . CGC_EFAULT
perms = [ 'rw ' , 'rwx' ] [ bool ( isX ) ]
try :
    result = cpu . memory . mmap ( None , length , perms )
except Exception as e :
    logger . info ( "ALLOCATE exception %s. Returning ENOMEM %r" , str ( e ) , length )
    return Decree . CGC_ENOMEM
cpu . write_int ( addr , result , 32 )
logger . info ( "ALLOCATE(%d, %s, 0x%08x) -> 0x%08x" % ( length , perms , addr , result ) )
self . syscall_trace . append ( ( "_allocate" , - 1 , length ) )
return 0


signature:
def sys_random ( self , cpu , buf , count , rnd_bytes ) :
    """random - fill a buffer with random data
 The random system call populates the buffer referenced by buf with up to
 count bytes of random data . If count is zero , random returns 0 and optionally
 sets * rx _ bytes to zero . If count is greater than SSIZE _ MAX , the result is unspecified .
 : param cpu : current CPU
 : param buf : a memory buffer
 : param count : max number of bytes to receive
 : param rnd _ bytes : if valid , points to the actual number of random bytes
 : return : 0 On success
 EINVAL count is invalid .
 EFAULT buf or rnd _ bytes points to an invalid address ."""

implementation:
ret = 0
if count != 0 :
    if count > Decree . CGC_SSIZE_MAX or count < 0 :
        ret = Decree . CGC_EINVAL
    else : # TODO check count bytes from buf
        if buf not in cpu . memory or ( buf + count ) not in cpu . memory :
            logger . info ( "RANDOM: buf points to invalid address. Returning EFAULT" )
            return Decree . CGC_EFAULT
        with open ( "/dev/urandom" , "rb" ) as f :
            data = f . read ( count )
        self . syscall_trace . append ( ( "_random" , - 1 , data ) )
        cpu . write_bytes ( buf , data )
# TODO check 4 bytes from rx _ bytes
if rnd_bytes :
    if rnd_bytes not in cpu . memory :
        logger . info ( "RANDOM: Not valid rnd_bytes. Returning EFAULT" )
        return Decree . CGC_EFAULT
    cpu . write_int ( rnd_bytes , len ( data ) , 32 )
logger . info ( "RANDOM(0x%08x, %d, 0x%08x) -> <%s>)" % ( buf , count , rnd_bytes , repr ( data [ : 10 ] ) ) )
return ret


signature:
def sys_receive ( self , cpu , fd , buf , count , rx_bytes ) :
    """receive - receive bytes from a file descriptor
 The receive system call reads up to count bytes from file descriptor fd to the
 buffer pointed to by buf . If count is zero , receive returns 0 and optionally
 sets * rx _ bytes to zero .
 : param cpu : current CPU .
 : param fd : a valid file descriptor
 : param buf : a memory buffer
 : param count : max number of bytes to receive
 : param rx _ bytes : if valid , points to the actual number of bytes received
 : return : 0 Success
 EBADF fd is not a valid file descriptor or is not open
 EFAULT buf or rx _ bytes points to an invalid address ."""

implementation:
data = ''
if count != 0 :
    if not self . _is_open ( fd ) :
        logger . info ( "RECEIVE: Not valid file descriptor on receive. Returning EBADF" )
        return Decree . CGC_EBADF
    # TODO check count bytes from buf
    if buf not in cpu . memory : # or not buf + count in cpu . memory :
        logger . info ( "RECEIVE: buf points to invalid address. Returning EFAULT" )
        return Decree . CGC_EFAULT
    # import random
    # count = random . randint ( 1 , count )
    if fd > 2 and self . files [ fd ] . is_empty ( ) :
        cpu . PC -= cpu . instruction . size
        self . wait ( [ fd ] , [ ] , None )
        raise RestartSyscall ( )
    # get some potential delay
    # if random . randint ( 5 ) = = 0 and count > 1:
    # count = count / 2
    # Read the data and put it in memory
    data = self . files [ fd ] . receive ( count )
    self . syscall_trace . append ( ( "_receive" , fd , data ) )
    cpu . write_bytes ( buf , data )
    self . signal_receive ( fd )
# TODO check 4 bytes from rx _ bytes
if rx_bytes :
    if rx_bytes not in cpu . memory :
        logger . info ( "RECEIVE: Not valid file descriptor on receive. Returning EFAULT" )
        return Decree . CGC_EFAULT
    cpu . write_int ( rx_bytes , len ( data ) , 32 )
logger . info ( "RECEIVE(%d, 0x%08x, %d, 0x%08x) -> <%s> (size:%d)" % ( fd , buf , count , rx_bytes , repr ( data ) [ : min ( count , 10 ) ] , len ( data ) ) )
return 0


signature:
def sys_transmit ( self , cpu , fd , buf , count , tx_bytes ) :
    """transmit - send bytes through a file descriptor
 The transmit system call writes up to count bytes from the buffer pointed
 to by buf to the file descriptor fd . If count is zero , transmit returns 0
 and optionally sets * tx _ bytes to zero .
 : param cpu current CPU
 : param fd a valid file descriptor
 : param buf a memory buffer
 : param count number of bytes to send
 : param tx _ bytes if valid , points to the actual number of bytes transmitted
 : return : 0 Success
 EBADF fd is not a valid file descriptor or is not open .
 EFAULT buf or tx _ bytes points to an invalid address ."""

implementation:
data = [ ]
if count != 0 :
    if not self . _is_open ( fd ) :
        logger . error ( "TRANSMIT: Not valid file descriptor. Returning EBADFD %d" , fd )
        return Decree . CGC_EBADF
    # TODO check count bytes from buf
    if buf not in cpu . memory or ( buf + count ) not in cpu . memory :
        logger . debug ( "TRANSMIT: buf points to invalid address. Rerurning EFAULT" )
        return Decree . CGC_EFAULT
    if fd > 2 and self . files [ fd ] . is_full ( ) :
        cpu . PC -= cpu . instruction . size
        self . wait ( [ ] , [ fd ] , None )
        raise RestartSyscall ( )
    for i in range ( 0 , count ) :
        value = Operators . CHR ( cpu . read_int ( buf + i , 8 ) )
        if not isinstance ( value , str ) :
            logger . debug ( "TRANSMIT: Writing symbolic values to file %d" , fd )
            # value = str ( value )
        data . append ( value )
    self . files [ fd ] . transmit ( data )
    logger . info ( "TRANSMIT(%d, 0x%08x, %d, 0x%08x) -> <%.24r>" % ( fd , buf , count , tx_bytes , '' . join ( [ str ( x ) for x in data ] ) ) )
    self . syscall_trace . append ( ( "_transmit" , fd , data ) )
    self . signal_transmit ( fd )
# TODO check 4 bytes from tx _ bytes
if tx_bytes :
    if tx_bytes not in cpu . memory :
        logger . debug ( "TRANSMIT: Not valid tx_bytes pointer on transmit. Returning EFAULT" )
        return Decree . CGC_EFAULT
    cpu . write_int ( tx_bytes , len ( data ) , 32 )
return 0


signature:
def sys_terminate ( self , cpu , error_code ) :
    """Exits all threads in a process
 : param cpu : current CPU .
 : raises Exception : ' Finished '"""

implementation:
procid = self . procs . index ( cpu )
self . sched ( )
self . running . remove ( procid )
# self . procs [ procid ] = None # let it there so we can report ?
if issymbolic ( error_code ) :
    logger . info ( "TERMINATE PROC_%02d with symbolic exit code [%d,%d]" , procid , solver . minmax ( self . constraints , error_code ) )
else :
    logger . info ( "TERMINATE PROC_%02d %x" , procid , error_code )
if len ( self . running ) == 0 :
    raise TerminateState ( f'Process exited correctly. Code: {error_code}' )
return error_code


signature:
def sys_deallocate ( self , cpu , addr , size ) :
    """deallocate - remove allocations
 The deallocate system call deletes the allocations for the specified
 address range , and causes further references to the addresses within the
 range to generate invalid memory accesses . The region is also
 automatically deallocated when the process is terminated .
 The address addr must be a multiple of the page size . The length parameter
 specifies the size of the region to be deallocated in bytes . All pages
 containing a part of the indicated range are deallocated , and subsequent
 references will terminate the process . It is not an error if the indicated
 range does not contain any allocated pages .
 The deallocate function is invoked through system call number 6.
 : param cpu : current CPU
 : param addr : the starting address to unmap .
 : param size : the size of the portion to unmap .
 : return 0 On success
 EINVAL addr is not page aligned .
 EINVAL length is zero .
 EINVAL any part of the region being deallocated is outside the valid
 address range of the process .
 : param cpu : current CPU .
 : return : C { 0 } on success ."""

implementation:
logger . info ( "DEALLOCATE(0x%08x, %d)" % ( addr , size ) )
if addr & 0xfff != 0 :
    logger . info ( "DEALLOCATE: addr is not page aligned" )
    return Decree . CGC_EINVAL
if size == 0 :
    logger . info ( "DEALLOCATE:length is zero" )
    return Decree . CGC_EINVAL
# unlikely AND WRONG ! ! !
# if addr > Decree . CGC _ SSIZE _ MAX or addr + size > Decree . CGC _ SSIZE _ MAX :
# logger . info ( " DEALLOCATE : part of the region being deallocated is outside the valid address range of the process " )
# return Decree . CGC _ EINVAL
cpu . memory . munmap ( addr , size )
self . syscall_trace . append ( ( "_deallocate" , - 1 , size ) )
return 0


signature:
def sys_fdwait ( self , cpu , nfds , readfds , writefds , timeout , readyfds ) :
    """fdwait - wait for file descriptors to become ready"""

implementation:
logger . debug ( "FDWAIT(%d, 0x%08x, 0x%08x, 0x%08x, 0x%08x)" % ( nfds , readfds , writefds , timeout , readyfds ) )
if timeout :
    if timeout not in cpu . memory : # todo : size
        logger . info ( "FDWAIT: timeout is pointing to invalid memory. Returning EFAULT" )
        return Decree . CGC_EFAULT
if readyfds :
    if readyfds not in cpu . memory :
        logger . info ( "FDWAIT: readyfds pointing to invalid memory. Returning EFAULT" )
        return Decree . CGC_EFAULT
writefds_wait = set ( )
writefds_ready = set ( )
fds_bitsize = ( nfds + 7 ) & ~ 7
if writefds :
    if writefds not in cpu . memory :
        logger . info ( "FDWAIT: writefds pointing to invalid memory. Returning EFAULT" )
        return Decree . CGC_EFAULT
    bits = cpu . read_int ( writefds , fds_bitsize )
    for fd in range ( nfds ) :
        if ( bits & 1 << fd ) :
            if self . files [ fd ] . is_full ( ) :
                writefds_wait . add ( fd )
            else :
                writefds_ready . add ( fd )
readfds_wait = set ( )
readfds_ready = set ( )
if readfds :
    if readfds not in cpu . memory :
        logger . info ( "FDWAIT: readfds pointing to invalid memory. Returning EFAULT" )
        return Decree . CGC_EFAULT
    bits = cpu . read_int ( readfds , fds_bitsize )
    for fd in range ( nfds ) :
        if ( bits & 1 << fd ) :
            if self . files [ fd ] . is_empty ( ) :
                readfds_wait . add ( fd )
            else :
                readfds_ready . add ( fd )
n = len ( readfds_ready ) + len ( writefds_ready )
if n == 0 : # TODO FIX timeout symbolic
    if timeout != 0 :
        seconds = cpu . read_int ( timeout , 32 )
        microseconds = cpu . read_int ( timeout + 4 , 32 )
        logger . info ( "FDWAIT: waiting for read on fds: {%s} and write to: {%s} timeout: %d" , repr ( list ( readfds_wait ) ) , repr ( list ( writefds_wait ) ) , microseconds + 1000 * seconds )
        to = microseconds + 1000 * seconds
        # no ready file , wait
    else :
        to = None
        logger . info ( "FDWAIT: waiting for read on fds: {%s} and write to: {%s} timeout: INDIFENITELY" , repr ( list ( readfds_wait ) ) , repr ( list ( writefds_wait ) ) )
    cpu . PC -= cpu . instruction . size
    self . wait ( readfds_wait , writefds_wait , to )
    raise RestartSyscall ( )
# When coming back from a timeout remember
# not to backtrack instruction and set EAX to 0 ! : ( ugliness alert !
if readfds :
    bits = 0
    for fd in readfds_ready :
        bits |= 1 << fd
    for byte in range ( 0 , nfds , 8 ) :
        cpu . write_int ( readfds , ( bits >> byte ) & 0xff , 8 )
if writefds :
    bits = 0
    for fd in writefds_ready :
        bits |= 1 << fd
    for byte in range ( 0 , nfds , 8 ) :
        cpu . write_int ( writefds , ( bits >> byte ) & 0xff , 8 )
logger . info ( "FDWAIT: continuing. Some file is ready Readyfds: %08x" , readyfds )
if readyfds :
    cpu . write_int ( readyfds , n , 32 )
self . syscall_trace . append ( ( "_fdwait" , - 1 , None ) )
return 0


signature:
def int80 ( self , cpu ) :
    """32 bit dispatcher .
 : param cpu : current CPU .
 _ terminate , transmit , receive , fdwait , allocate , deallocate and random"""

implementation:
syscalls = { 0x00000001 : self . sys_terminate , 0x00000002 : self . sys_transmit , 0x00000003 : self . sys_receive , 0x00000004 : self . sys_fdwait , 0x00000005 : self . sys_allocate , 0x00000006 : self . sys_deallocate , 0x00000007 : self . sys_random , }
if cpu . EAX not in syscalls . keys ( ) :
    raise TerminateState ( f"32 bit DECREE system call number {cpu.EAX} Not Implemented" )
func = syscalls [ cpu . EAX ]
logger . debug ( "SYSCALL32: %s (nargs: %d)" , func . __name__ , func . __code__ . co_argcount )
nargs = func . __code__ . co_argcount
args = [ cpu , cpu . EBX , cpu . ECX , cpu . EDX , cpu . ESI , cpu . EDI , cpu . EBP ]
cpu . EAX = func ( * args [ : nargs - 1 ] )


signature:
def sched ( self ) :
    """Yield CPU .
 This will choose another process from the RUNNNIG list and change
 current running process . May give the same cpu if only one running
 process ."""

implementation:
if len ( self . procs ) > 1 :
    logger . info ( "SCHED:" )
    logger . info ( "\tProcess: %r" , self . procs )
    logger . info ( "\tRunning: %r" , self . running )
    logger . info ( "\tRWait: %r" , self . rwait )
    logger . info ( "\tTWait: %r" , self . twait )
    logger . info ( "\tTimers: %r" , self . timers )
    logger . info ( "\tCurrent clock: %d" , self . clocks )
    logger . info ( "\tCurrent cpu: %d" , self . _current )
if len ( self . running ) == 0 :
    logger . info ( "None running checking if there is some process waiting for a timeout" )
    if all ( [ x is None for x in self . timers ] ) :
        raise Deadlock ( )
    self . clocks = min ( [ x for x in self . timers if x is not None ] ) + 1
    self . check_timers ( )
    assert len ( self . running ) != 0 , "DEADLOCK!"
    self . _current = self . running [ 0 ]
    return
next_index = ( self . running . index ( self . _current ) + 1 ) % len ( self . running )
next = self . running [ next_index ]
if len ( self . procs ) > 1 :
    logger . info ( "\tTransfer control from process %d to %d" , self . _current , next )
self . _current = next


signature:
def wait ( self , readfds , writefds , timeout ) :
    """Wait for filedescriptors or timeout .
 Adds the current process to the corresponding waiting list and
 yields the cpu to another running process ."""

implementation:
logger . info ( "WAIT:" )
logger . info ( "\tProcess %d is going to wait for [ %r %r %r ]" , self . _current , readfds , writefds , timeout )
logger . info ( "\tProcess: %r" , self . procs )
logger . info ( "\tRunning: %r" , self . running )
logger . info ( "\tRWait: %r" , self . rwait )
logger . info ( "\tTWait: %r" , self . twait )
logger . info ( "\tTimers: %r" , self . timers )
for fd in readfds :
    self . rwait [ fd ] . add ( self . _current )
for fd in writefds :
    self . twait [ fd ] . add ( self . _current )
if timeout is not None :
    self . timers [ self . _current ] = self . clocks + timeout
else :
    self . timers [ self . _current ] = None
procid = self . _current
# self . sched ( )
next_index = ( self . running . index ( procid ) + 1 ) % len ( self . running )
self . _current = self . running [ next_index ]
logger . info ( "\tTransfer control from process %d to %d" , procid , self . _current )
logger . info ( "\tREMOVING %r from %r. Current: %r" , procid , self . running , self . _current )
self . running . remove ( procid )
if self . _current not in self . running :
    logger . info ( "\tCurrent not running. Checking for timers..." )
    self . _current = None
    if all ( [ x is None for x in self . timers ] ) :
        raise Deadlock ( )
    self . check_timers ( )


signature:
def signal_transmit ( self , fd ) :
    """Awake one process waiting to transmit data on fd"""

implementation:
connections = self . connections
if connections ( fd ) and self . rwait [ connections ( fd ) ] :
    procid = random . sample ( self . rwait [ connections ( fd ) ] , 1 ) [ 0 ]
    self . awake ( procid )


signature:
def execute ( self ) :
    """Execute one cpu instruction in the current thread ( only one supported ) .
 : rtype : bool
 : return : C { True }
 : todo : This is where we could implement a simple schedule ."""

implementation:
try :
    self . current . execute ( )
    self . clocks += 1
    if self . clocks % 10000 == 0 :
        self . check_timers ( )
        self . sched ( )
except Interruption as e :
    if e . N != 0x80 :
        raise
    try :
        self . int80 ( self . current )
    except RestartSyscall :
        pass
return True


signature:
def sys_receive ( self , cpu , fd , buf , count , rx_bytes ) :
    """Symbolic version of Decree . sys _ receive"""

implementation:
if issymbolic ( fd ) :
    logger . info ( "Ask to read from a symbolic file descriptor!!" )
    cpu . PC = cpu . PC - cpu . instruction . size
    raise SymbolicSyscallArgument ( cpu , 0 )
if issymbolic ( buf ) :
    logger . info ( "Ask to read to a symbolic buffer" )
    cpu . PC = cpu . PC - cpu . instruction . size
    raise SymbolicSyscallArgument ( cpu , 1 )
if issymbolic ( count ) :
    logger . info ( "Ask to read a symbolic number of bytes " )
    cpu . PC = cpu . PC - cpu . instruction . size
    raise SymbolicSyscallArgument ( cpu , 2 )
if issymbolic ( rx_bytes ) :
    logger . info ( "Ask to return size to a symbolic address " )
    cpu . PC = cpu . PC - cpu . instruction . size
    raise SymbolicSyscallArgument ( cpu , 3 )
return super ( ) . sys_receive ( cpu , fd , buf , count , rx_bytes )


signature:
def sys_transmit ( self , cpu , fd , buf , count , tx_bytes ) :
    """Symbolic version of Decree . sys _ transmit"""

implementation:
if issymbolic ( fd ) :
    logger . info ( "Ask to write to a symbolic file descriptor!!" )
    cpu . PC = cpu . PC - cpu . instruction . size
    raise SymbolicSyscallArgument ( cpu , 0 )
if issymbolic ( buf ) :
    logger . info ( "Ask to write to a symbolic buffer" )
    cpu . PC = cpu . PC - cpu . instruction . size
    raise SymbolicSyscallArgument ( cpu , 1 )
if issymbolic ( count ) :
    logger . info ( "Ask to write a symbolic number of bytes " )
    cpu . PC = cpu . PC - cpu . instruction . size
    raise SymbolicSyscallArgument ( cpu , 2 )
if issymbolic ( tx_bytes ) :
    logger . info ( "Ask to return size to a symbolic address " )
    cpu . PC = cpu . PC - cpu . instruction . size
    raise SymbolicSyscallArgument ( cpu , 3 )
return super ( ) . sys_transmit ( cpu , fd , buf , count , tx_bytes )


signature:
def sync ( f ) :
    """Synchronization decorator ."""

implementation:
def new_function ( self , * args , ** kw ) :
    self . _lock . acquire ( )
    try :
        return f ( self , * args , ** kw )
    finally :
        self . _lock . release ( )
return new_function


signature:
def fromdescriptor ( cls , desc ) :
    """Create a : class : ` ~ manticore . core . workspace . Store ` instance depending on the descriptor .
 Valid descriptors :
 * fs : < path >
 * redis : < hostname > : < port >
 * mem :
 : param str desc : Store descriptor
 : return : Store instance"""

implementation:
type_ , uri = ( 'fs' , None ) if desc is None else desc . split ( ':' , 1 )
for subclass in cls . __subclasses__ ( ) :
    if subclass . store_type == type_ :
        return subclass ( uri )
raise NotImplementedError ( f"Storage type '{type_}' not supported." )


signature:
def save_value ( self , key , value ) :
    """Save an arbitrary , serializable ` value ` under ` key ` .
 : param str key : A string identifier under which to store the value .
 : param value : A serializable value
 : return :"""

implementation:
with self . save_stream ( key ) as s :
    s . write ( value )


signature:
def load_value ( self , key , binary = False ) :
    """Load an arbitrary value identified by ` key ` .
 : param str key : The key that identifies the value
 : return : The loaded value"""

implementation:
with self . load_stream ( key , binary = binary ) as s :
    return s . read ( )


signature:
def save_stream ( self , key , binary = False ) :
    """Return a managed file - like object into which the calling code can write
 arbitrary data .
 : param key :
 : return : A managed stream - like object"""

implementation:
s = io . BytesIO ( ) if binary else io . StringIO ( )
yield s
self . save_value ( key , s . getvalue ( ) )


signature:
def load_stream ( self , key , binary = False ) :
    """Return a managed file - like object from which the calling code can read
 previously - serialized data .
 : param key :
 : return : A managed stream - like object"""

implementation:
value = self . load_value ( key , binary = binary )
yield io . BytesIO ( value ) if binary else io . StringIO ( value )


signature:
def save_state ( self , state , key ) :
    """Save a state to storage .
 : param manticore . core . StateBase state :
 : param str key :
 : return :"""

implementation:
with self . save_stream ( key , binary = True ) as f :
    self . _serializer . serialize ( state , f )


signature:
def load_state ( self , key , delete = True ) :
    """Load a state from storage .
 : param key : key that identifies state
 : rtype : manticore . core . StateBase"""

implementation:
with self . load_stream ( key , binary = True ) as f :
    state = self . _serializer . deserialize ( f )
    if delete :
        self . rm ( key )
    return state


signature:
def save_stream ( self , key , binary = False ) :
    """Yield a file object representing ` key `
 : param str key : The file to save to
 : param bool binary : Whether we should treat it as binary
 : return :"""

implementation:
mode = 'wb' if binary else 'w'
with open ( os . path . join ( self . uri , key ) , mode ) as f :
    yield f


signature:
def load_stream ( self , key , binary = False ) :
    """: param str key : name of stream to load
 : param bool binary : Whether we should treat it as binary
 : return :"""

implementation:
with open ( os . path . join ( self . uri , key ) , 'rb' if binary else 'r' ) as f :
    yield f


signature:
def rm ( self , key ) :
    """Remove file identified by ` key ` .
 : param str key : The file to delete"""

implementation:
path = os . path . join ( self . uri , key )
os . remove ( path )


signature:
def ls ( self , glob_str ) :
    """Return just the filenames that match ` glob _ str ` inside the store directory .
 : param str glob _ str : A glob string , i . e . ' state _ * '
 : return : list of matched keys"""

implementation:
path = os . path . join ( self . uri , glob_str )
return [ os . path . split ( s ) [ 1 ] for s in glob . glob ( path ) ]


signature:
def _get_id ( self ) :
    """Get a unique state id .
 : rtype : int"""

implementation:
id_ = self . _last_id . value
self . _last_id . value += 1
return id_


signature:
def load_state ( self , state_id , delete = True ) :
    """Load a state from storage identified by ` state _ id ` .
 : param state _ id : The state reference of what to load
 : return : The deserialized state
 : rtype : State"""

implementation: return self . _store . load_state ( f'{self._prefix}{state_id:08x}{self._suffix}' , delete = delete )


signature:
def save_state ( self , state , state_id = None ) :
    """Save a state to storage , return identifier .
 : param state : The state to save
 : param int state _ id : If not None force the state id potentially overwriting old states
 : return : New state id
 : rtype : int"""

implementation:
assert isinstance ( state , StateBase )
if state_id is None :
    state_id = self . _get_id ( )
else :
    self . rm_state ( state_id )
self . _store . save_state ( state , f'{self._prefix}{state_id:08x}{self._suffix}' )
return state_id


signature:
def _named_stream ( self , name , binary = False ) :
    """Create an indexed output stream i . e . ' test _ 000001 . name '
 : param name : Identifier for the stream
 : return : A context - managed stream - like object"""

implementation:
with self . _store . save_stream ( self . _named_key ( name ) , binary = binary ) as s :
    yield s


implementation:
size = int ( t . lexer . lexmatch . group ( 'size' ) )
t . value = ( 'uint' , size )
return t


implementation:
size = int ( t . lexer . lexmatch . group ( 'size' ) )
t . value = ( 'int' , size )
return t


implementation:
M = int ( t . lexer . lexmatch . group ( 'M' ) )
N = int ( t . lexer . lexmatch . group ( 'N' ) )
t . value = ( "ufixed" , M , N )
return t


implementation:
size = int ( t . lexer . lexmatch . group ( 'nbytes' ) )
t . value = ( 'bytesM' , size )
return t


signature:
def p_dynamic_fixed_type ( p ) :
    """T : T LBRAKET NUMBER RBRAKET"""

implementation:
reps = int ( p [ 3 ] )
base_type = p [ 1 ]
p [ 0 ] = ( 'array' , reps , base_type )


signature:
def cmp_regs ( cpu , should_print = False ) :
    """Compare registers from a remote gdb session to current mcore .
 : param manticore . core . cpu Cpu : Current cpu
 : param bool should _ print : Whether to print values to stdout
 : return : Whether or not any differences were detected
 : rtype : bool"""

implementation:
differing = False
gdb_regs = gdb . getCanonicalRegisters ( )
for name in sorted ( gdb_regs ) :
    vg = gdb_regs [ name ]
    if name . endswith ( 'psr' ) :
        name = 'apsr'
    v = cpu . read_register ( name . upper ( ) )
    if should_print :
        logger . debug ( f'{name} gdb:{vg:x} mcore:{v:x}' )
    if vg != v :
        if should_print :
            logger . warning ( '^^ unequal' )
        differing = True
if differing :
    logger . debug ( qemu . correspond ( None ) )
return differing


signature:
def post_mcore ( state , last_instruction ) :
    """Handle syscalls ( import memory ) and bail if we diverge"""

implementation:
global in_helper
# Synchronize qemu state to manticore ' s after a system call
if last_instruction . mnemonic . lower ( ) == 'svc' : # Synchronize all writes that have happened
    writes = state . cpu . memory . pop_record_writes ( )
    if writes :
        logger . debug ( "Got %d writes" , len ( writes ) )
    for addr , val in writes :
        gdb . setByte ( addr , val [ 0 ] )
    # Write return val to gdb
    gdb_r0 = gdb . getR ( 'R0' )
    if gdb_r0 != state . cpu . R0 :
        logger . debug ( f"Writing 0x{state.cpu.R0:x} to R0 (overwriting 0x{gdb.getR('R0'):x})" )
    for reg in state . cpu . canonical_registers :
        if reg . endswith ( 'PSR' ) or reg in ( 'R15' , 'PC' ) :
            continue
        val = state . cpu . read_register ( reg )
        gdb . setR ( reg , val )
# Ignore Linux kernel helpers
if ( state . cpu . PC >> 16 ) == 0xffff :
    in_helper = True
    return
# If we executed a few instructions of a helper , we need to sync Manticore ' s
# state to GDB as soon as we stop executing a helper .
if in_helper :
    for reg in state . cpu . canonical_registers :
        if reg . endswith ( 'PSR' ) :
            continue
        # Don ' t sync pc
        if reg == 'R15' :
            continue
        gdb . setR ( reg , state . cpu . read_register ( reg ) )
    in_helper = False
if cmp_regs ( state . cpu ) :
    cmp_regs ( state . cpu , should_print = True )
    state . abandon ( )


signature:
def sync_svc ( state ) :
    """Mirror some service calls in manticore . Happens after qemu executed a SVC
 instruction , but before manticore did ."""

implementation:
syscall = state . cpu . R7
# Grab idx from manticore since qemu could have exited
name = linux_syscalls . armv7 [ syscall ]
logger . debug ( f"Syncing syscall: {name}" )
try : # Make sure mmap returns the same address
    if 'mmap' in name :
        returned = gdb . getR ( 'R0' )
        logger . debug ( f"Syncing mmap ({returned:x})" )
        state . cpu . write_register ( 'R0' , returned )
    if 'exit' in name :
        return
except ValueError :
    for reg in state . cpu . canonical_registers :
        print ( f'{reg}: {state.cpu.read_register(reg):x}' )
    raise


signature:
def initialize ( state ) :
    """Synchronize the stack and register state ( manticore - > qemu )"""

implementation:
logger . debug ( f"Copying {stack_top - state.cpu.SP} bytes in the stack.." )
stack_bottom = min ( state . cpu . SP , gdb . getR ( 'SP' ) )
for address in range ( stack_bottom , stack_top ) :
    b = state . cpu . read_int ( address , 8 )
    gdb . setByte ( address , chr ( b ) )
logger . debug ( "Done" )
# Qemu fd ' s start at 5 , ours at 3 . Add two filler fds
mcore_stdout = state . platform . files [ 1 ]
state . platform . files . append ( mcore_stdout )
state . platform . files . append ( mcore_stdout )
# Sync gdb ' s regs
for gdb_reg in gdb . getCanonicalRegisters ( ) :
    if gdb_reg . endswith ( 'psr' ) :
        mcore_reg = 'APSR'
    else :
        mcore_reg = gdb_reg . upper ( )
    value = state . cpu . read_register ( mcore_reg )
    gdb . setR ( gdb_reg , value )


signature:
def to_constant ( expression ) :
    """Iff the expression can be simplified to a Constant get the actual concrete value .
 This discards / ignore any taint"""

implementation:
value = simplify ( expression )
if isinstance ( value , Expression ) and value . taint :
    raise ValueError ( "Can not simplify tainted values to constant" )
if isinstance ( value , Constant ) :
    return value . value
elif isinstance ( value , Array ) :
    if expression . index_max :
        ba = bytearray ( )
        for i in range ( expression . index_max ) :
            value_i = simplify ( value [ i ] )
            if not isinstance ( value_i , Constant ) :
                break
            ba . append ( value_i . value )
        else :
            return bytes ( ba )
        return expression
return value


signature:
def visit ( self , node , use_fixed_point = False ) :
    """The entry point of the visitor .
 The exploration algorithm is a DFS post - order traversal
 The implementation used two stacks instead of a recursion
 The final result is store in self . result
 : param node : Node to explore
 : type node : Expression
 : param use _ fixed _ point : if True , it runs _ methods until a fixed point is found
 : type use _ fixed _ point : Bool"""

implementation:
cache = self . _cache
visited = set ( )
stack = [ ]
stack . append ( node )
while stack :
    node = stack . pop ( )
    if node in cache :
        self . push ( cache [ node ] )
    elif isinstance ( node , Operation ) :
        if node in visited :
            operands = [ self . pop ( ) for _ in range ( len ( node . operands ) ) ]
            value = self . _method ( node , * operands )
            visited . remove ( node )
            self . push ( value )
            cache [ node ] = value
        else :
            visited . add ( node )
            stack . append ( node )
            stack . extend ( node . operands )
    else :
        self . push ( self . _method ( node ) )
if use_fixed_point :
    old_value = None
    new_value = self . pop ( )
    while old_value is not new_value :
        self . visit ( new_value )
        old_value = new_value
        new_value = self . pop ( )
    self . push ( new_value )


signature:
def _method ( self , expression , * args ) :
    """Overload Visitor . _ method because we want to stop to iterate over the
 visit _ functions as soon as a valid visit _ function is found"""

implementation:
assert expression . __class__ . __mro__ [ - 1 ] is object
for cls in expression . __class__ . __mro__ :
    sort = cls . __name__
    methodname = 'visit_%s' % sort
    method = getattr ( self , methodname , None )
    if method is not None :
        method ( expression , * args )
        return
return


signature:
def visit_Operation ( self , expression , * operands ) :
    """constant folding , if all operands of an expression are a Constant do the math"""

implementation:
operation = self . operations . get ( type ( expression ) , None )
if operation is not None and all ( isinstance ( o , Constant ) for o in operands ) :
    value = operation ( * ( x . value for x in operands ) )
    if isinstance ( expression , BitVec ) :
        return BitVecConstant ( expression . size , value , taint = expression . taint )
    else :
        isinstance ( expression , Bool )
        return BoolConstant ( value , taint = expression . taint )
else :
    if any ( operands [ i ] is not expression . operands [ i ] for i in range ( len ( operands ) ) ) :
        expression = self . _rebuild ( expression , operands )
return expression


implementation:
if all ( isinstance ( o , Constant ) for o in operands ) :
    expression = constant_folder ( expression )
if self . _changed ( expression , operands ) :
    expression = self . _rebuild ( expression , operands )
return expression


signature:
def visit_BitVecConcat ( self , expression , * operands ) :
    """concat ( extract ( k1 , 0 , a ) , extract ( sizeof ( a ) - k1 , k1 , a ) ) = = > a
 concat ( extract ( k1 , beg , a ) , extract ( end , k1 , a ) ) = = > extract ( beg , end , a )"""

implementation:
op = expression . operands [ 0 ]
value = None
end = None
begining = None
for o in operands : # If found a non BitVecExtract , do not apply
    if not isinstance ( o , BitVecExtract ) :
        return None
    # Set the value for the first item
    if value is None :
        value = o . value
        begining = o . begining
        end = o . end
    else : # If concat of extracts of different values do not apply
        if value is not o . value :
            return None
        # If concat of non contiguous extracs do not apply
        if begining != o . end + 1 :
            return None
        # update begining variable
        begining = o . begining
if value is not None :
    if end + 1 == value . size and begining == 0 :
        return value
    else :
        return BitVecExtract ( value , begining , end - begining + 1 , taint = expression . taint )


signature:
def visit_BitVecExtract ( self , expression , * operands ) :
    """extract ( sizeof ( a ) , 0 ) ( a ) = = > a
 extract ( 16 , 0 ) ( concat ( a , b , c , d ) ) = > concat ( c , d )
 extract ( m , M ) ( and / or / xor a b ) = > and / or / xor ( ( extract ( m , M ) a ) ( extract ( m , M ) a )"""

implementation:
op = expression . operands [ 0 ]
begining = expression . begining
end = expression . end
size = end - begining + 1
# extract ( sizeof ( a ) , 0 ) ( a ) = = > a
if begining == 0 and end + 1 == op . size :
    return op
elif isinstance ( op , BitVecExtract ) :
    return BitVecExtract ( op . value , op . begining + begining , size , taint = expression . taint )
elif isinstance ( op , BitVecConcat ) :
    new_operands = [ ]
    bitcount = 0
    for item in reversed ( op . operands ) :
        if begining >= item . size :
            begining -= item . size
        else :
            if bitcount < expression . size :
                new_operands . append ( item )
            bitcount += item . size
    if begining != expression . begining :
        return BitVecExtract ( BitVecConcat ( sum ( [ x . size for x in new_operands ] ) , * reversed ( new_operands ) ) , begining , expression . size , taint = expression . taint )
if isinstance ( op , ( BitVecAnd , BitVecOr , BitVecXor ) ) :
    bitoperand_a , bitoperand_b = op . operands
    return op . __class__ ( BitVecExtract ( bitoperand_a , begining , expression . size ) , BitVecExtract ( bitoperand_b , begining , expression . size ) , taint = expression . taint )


signature:
def visit_BitVecAdd ( self , expression , * operands ) :
    """a + 0 = = > a
 0 + a = = > a"""

implementation:
left = expression . operands [ 0 ]
right = expression . operands [ 1 ]
if isinstance ( right , BitVecConstant ) :
    if right . value == 0 :
        return left
if isinstance ( left , BitVecConstant ) :
    if left . value == 0 :
        return right


signature:
def visit_BitVecSub ( self , expression , * operands ) :
    """a - 0 = = > 0
 ( a + b ) - b = = > a
 ( b + a ) - b = = > a"""

implementation:
left = expression . operands [ 0 ]
right = expression . operands [ 1 ]
if isinstance ( left , BitVecAdd ) :
    if self . _same_constant ( left . operands [ 0 ] , right ) :
        return left . operands [ 1 ]
    elif self . _same_constant ( left . operands [ 1 ] , right ) :
        return left . operands [ 0 ]


signature:
def visit_BitVecOr ( self , expression , * operands ) :
    """a | 0 = > a
 0 | a = > a
 0xfffff & a = > 0xfffff
 a & 0xfffff = > 0xfffff"""

implementation:
left = expression . operands [ 0 ]
right = expression . operands [ 1 ]
if isinstance ( right , BitVecConstant ) :
    if right . value == 0 :
        return left
    elif right . value == left . mask :
        return right
    elif isinstance ( left , BitVecOr ) :
        left_left = left . operands [ 0 ]
        left_right = left . operands [ 1 ]
        if isinstance ( right , Constant ) :
            return BitVecOr ( left_left , ( left_right | right ) , taint = expression . taint )
elif isinstance ( left , BitVecConstant ) :
    return BitVecOr ( right , left , taint = expression . taint )


signature:
def visit_BitVecAnd ( self , expression , * operands ) :
    """ct & x = > x & ct move constants to the right
 a & 0 = > 0 remove zero
 a & 0xfffff = > a remove full mask
 ( b & ct2 ) & ct = > b & ( ct & ct2 ) associative property
 ( a & ( b | c ) = > a & b | a & c distribute over |"""

implementation:
left = expression . operands [ 0 ]
right = expression . operands [ 1 ]
if isinstance ( right , BitVecConstant ) :
    if right . value == 0 :
        return right
    elif right . value == right . mask :
        return left
    elif isinstance ( left , BitVecAnd ) :
        left_left = left . operands [ 0 ]
        left_right = left . operands [ 1 ]
        if isinstance ( right , Constant ) :
            return BitVecAnd ( left_left , left_right & right , taint = expression . taint )
    elif isinstance ( left , BitVecOr ) :
        left_left = left . operands [ 0 ]
        left_right = left . operands [ 1 ]
        return BitVecOr ( right & left_left , right & left_right , taint = expression . taint )
elif isinstance ( left , BitVecConstant ) :
    return BitVecAnd ( right , left , taint = expression . taint )


signature:
def visit_BitVecShiftLeft ( self , expression , * operands ) :
    """a < < 0 = > a remove zero
 a < < ct = > 0 if ct > sizeof ( a ) remove big constant shift"""

implementation:
left = expression . operands [ 0 ]
right = expression . operands [ 1 ]
if isinstance ( right , BitVecConstant ) :
    if right . value == 0 :
        return left
    elif right . value >= right . size :
        return left


signature:
def visit_ArraySelect ( self , expression , * operands ) :
    """ArraySelect ( ArrayStore ( ( ArrayStore ( x0 , v0 ) . . . ) , xn , vn ) , x0)
 - > v0"""

implementation:
arr , index = operands
if isinstance ( arr , ArrayVariable ) :
    return
if isinstance ( index , BitVecConstant ) :
    ival = index . value
    # props are slow and using them in tight loops should be avoided , esp when they offer no additional validation
    # arr . _ operands [ 1 ] = arr . index , arr . _ operands [ 0 ] = arr . array
    while isinstance ( arr , ArrayStore ) and isinstance ( arr . _operands [ 1 ] , BitVecConstant ) and arr . _operands [ 1 ] . _value != ival :
        arr = arr . _operands [ 0 ]
# arr . array
if isinstance ( index , BitVecConstant ) and isinstance ( arr , ArrayStore ) and isinstance ( arr . index , BitVecConstant ) and arr . index . value == index . value :
    return arr . value
else :
    if arr is not expression . array :
        return arr . select ( index )


signature:
def _type_size ( ty ) :
    """Calculate ` static ` type size"""

implementation:
if ty [ 0 ] in ( 'int' , 'uint' , 'bytesM' , 'function' ) :
    return 32
elif ty [ 0 ] in ( 'tuple' ) :
    result = 0
    for ty_i in ty [ 1 ] :
        result += ABI . _type_size ( ty_i )
    return result
elif ty [ 0 ] in ( 'array' ) :
    rep = ty [ 1 ]
    result = 32
    # offset link
    return result
elif ty [ 0 ] in ( 'bytes' , 'string' ) :
    result = 32
    # offset link
    return result
raise ValueError


signature:
def function_call ( type_spec , * args ) :
    """Build transaction data from function signature and arguments"""

implementation:
m = re . match ( r"(?P<name>[a-zA-Z_][a-zA-Z_0-9]*)(?P<type>\(.*\))" , type_spec )
if not m :
    raise EthereumError ( "Function signature expected" )
ABI . _check_and_warn_num_args ( type_spec , * args )
result = ABI . function_selector ( type_spec )
# Funcid
result += ABI . serialize ( m . group ( 'type' ) , * args )
return result


signature:
def serialize ( ty , * values , ** kwargs ) :
    """Serialize value using type specification in ty .
 ABI . serialize ( ' int256 ' , 1000)
 ABI . serialize ( ' ( int , int256 ) ' , 1000 , 2000)"""

implementation:
try :
    parsed_ty = abitypes . parse ( ty )
except Exception as e : # Catch and rebrand parsing errors
    raise EthereumError ( str ( e ) )
if parsed_ty [ 0 ] != 'tuple' :
    if len ( values ) > 1 :
        raise ValueError ( 'too many values passed for non-tuple' )
    values = values [ 0 ]
    if isinstance ( values , str ) :
        values = values . encode ( )
else : # implement type forgiveness for bytesM / string types
# allow python strs also to be used for Solidity bytesM / string types
    values = tuple ( val . encode ( ) if isinstance ( val , str ) else val for val in values )
result , dyn_result = ABI . _serialize ( parsed_ty , values )
return result + dyn_result


signature:
def function_selector ( method_name_and_signature ) :
    """Makes a function hash id from a method signature"""

implementation:
s = sha3 . keccak_256 ( )
s . update ( method_name_and_signature . encode ( ) )
return bytes ( s . digest ( ) [ : 4 ] )


signature:
def _serialize_uint ( value , size = 32 , padding = 0 ) :
    """Translates a python integral or a BitVec into a 32 byte string , MSB first"""

implementation:
if size <= 0 or size > 32 :
    raise ValueError
from . account import EVMAccount
# because of circular import
if not isinstance ( value , ( int , BitVec , EVMAccount ) ) :
    raise ValueError
if issymbolic ( value ) : # FIXME This temporary array variable should be obtained from a specific constraint store
    bytes = ArrayVariable ( index_bits = 256 , index_max = 32 , value_bits = 8 , name = 'temp{}' . format ( uuid . uuid1 ( ) ) )
    if value . size <= size * 8 :
        value = Operators . ZEXTEND ( value , size * 8 )
    else : # automatically truncate , e . g . if they passed a BitVec ( 256 ) for an ` address ` argument ( 160 bits )
        value = Operators . EXTRACT ( value , 0 , size * 8 )
    bytes = ArrayProxy ( bytes . write_BE ( padding , value , size ) )
else :
    value = int ( value )
    bytes = bytearray ( )
    for _ in range ( padding ) :
        bytes . append ( 0 )
    for position in reversed ( range ( size ) ) :
        bytes . append ( Operators . EXTRACT ( value , position * 8 , 8 ) )
assert len ( bytes ) == size + padding
return bytes


signature:
def _serialize_int ( value , size = 32 , padding = 0 ) :
    """Translates a signed python integral or a BitVec into a 32 byte string , MSB first"""

implementation:
if size <= 0 or size > 32 :
    raise ValueError
if not isinstance ( value , ( int , BitVec ) ) :
    raise ValueError
if issymbolic ( value ) :
    buf = ArrayVariable ( index_bits = 256 , index_max = 32 , value_bits = 8 , name = 'temp{}' . format ( uuid . uuid1 ( ) ) )
    value = Operators . SEXTEND ( value , value . size , size * 8 )
    buf = ArrayProxy ( buf . write_BE ( padding , value , size ) )
else :
    value = int ( value )
    buf = bytearray ( )
    for _ in range ( padding ) :
        buf . append ( 0 )
    for position in reversed ( range ( size ) ) :
        buf . append ( Operators . EXTRACT ( value , position * 8 , 8 ) )
return buf


signature:
def _deserialize_uint ( data , nbytes = 32 , padding = 0 , offset = 0 ) :
    """Read a ` nbytes ` bytes long big endian unsigned integer from ` data ` starting at ` offset `
 : param data : sliceable buffer ; symbolic buffer of Eth ABI encoded data
 : param nbytes : number of bytes to read starting from least significant byte
 : rtype : int or Expression"""

implementation:
assert isinstance ( data , ( bytearray , Array ) )
value = ABI . _readBE ( data , nbytes , padding = True , offset = offset )
value = Operators . ZEXTEND ( value , ( nbytes + padding ) * 8 )
return value


signature:
def _deserialize_int ( data , nbytes = 32 , padding = 0 ) :
    """Read a ` nbytes ` bytes long big endian signed integer from ` data ` starting at ` offset `
 : param data : sliceable buffer ; symbolic buffer of Eth ABI encoded data
 : param nbytes : number of bytes to read starting from least significant byte
 : rtype : int or Expression"""

implementation:
assert isinstance ( data , ( bytearray , Array ) )
value = ABI . _readBE ( data , nbytes , padding = True )
value = Operators . SEXTEND ( value , nbytes * 8 , ( nbytes + padding ) * 8 )
if not issymbolic ( value ) : # sign bit on
    if value & ( 1 << ( nbytes * 8 - 1 ) ) :
        value = - ( ( ( ~ value ) + 1 ) & ( ( 1 << ( nbytes * 8 ) ) - 1 ) )
return value


signature:
def concretized_args ( ** policies ) :
    """Make sure an EVM instruction has all of its arguments concretized according to
 provided policies .
 Example decoration :
 @ concretized _ args ( size = ' ONE ' , address = ' ' )
 def LOG ( self , address , size , * topics ) :
 The above will make sure that the | size | parameter to LOG is Concretized when symbolic
 according to the ' ONE ' policy and concretize | address | with the default policy .
 : param policies : A kwargs list of argument names and their respective policies .
 Provide None or ' ' as policy to use default .
 : return : A function decorator"""

implementation:
def concretizer ( func ) :
    @ wraps ( func )
    def wrapper ( * args , ** kwargs ) :
        spec = inspect . getfullargspec ( func )
        for arg , policy in policies . items ( ) :
            assert arg in spec . args , "Concretizer argument not found in wrapped function."
            # index is 0 - indexed , but ConcretizeArgument is 1 - indexed . However , this is correct
            # since implementation method is always a bound method ( self is param 0)
            index = spec . args . index ( arg )
            if not issymbolic ( args [ index ] ) :
                continue
            if not policy :
                policy = 'SAMPLED'
            if policy == "ACCOUNTS" :
                value = args [ index ]
                world = args [ 0 ] . world
                # special handler for EVM only policy
                cond = world . _constraint_to_accounts ( value , ty = 'both' , include_zero = True )
                world . constraints . add ( cond )
                policy = 'ALL'
            raise ConcretizeArgument ( index , policy = policy )
        return func ( * args , ** kwargs )
    wrapper . __signature__ = inspect . signature ( func )
    return wrapper
return concretizer


signature:
def to_dict ( self , mevm ) :
    """Only meant to be used with concrete Transaction objects ! ( after calling . concretize ( ) )"""

implementation: return dict ( type = self . sort , from_address = self . caller , from_name = mevm . account_name ( self . caller ) , to_address = self . address , to_name = mevm . account_name ( self . address ) , value = self . value , gas = self . gas , data = binascii . hexlify ( self . data ) . decode ( ) )


signature:
def dump ( self , stream , state , mevm , conc_tx = None ) :
    """Concretize and write a human readable version of the transaction into the stream . Used during testcase
 generation .
 : param stream : Output stream to write to . Typically a file .
 : param manticore . ethereum . State state : state that the tx exists in
 : param manticore . ethereum . ManticoreEVM mevm : manticore instance
 : return :"""

implementation:
from . . ethereum import ABI
# circular imports
from . . ethereum . manticore import flagged
is_something_symbolic = False
if conc_tx is None :
    conc_tx = self . concretize ( state )
# The result if any RETURN or REVERT
stream . write ( "Type: %s (%d)\n" % ( self . sort , self . depth ) )
caller_solution = conc_tx . caller
caller_name = mevm . account_name ( caller_solution )
stream . write ( "From: %s(0x%x) %s\n" % ( caller_name , caller_solution , flagged ( issymbolic ( self . caller ) ) ) )
address_solution = conc_tx . address
address_name = mevm . account_name ( address_solution )
stream . write ( "To: %s(0x%x) %s\n" % ( address_name , address_solution , flagged ( issymbolic ( self . address ) ) ) )
stream . write ( "Value: %d %s\n" % ( conc_tx . value , flagged ( issymbolic ( self . value ) ) ) )
stream . write ( "Gas used: %d %s\n" % ( conc_tx . gas , flagged ( issymbolic ( self . gas ) ) ) )
tx_data = conc_tx . data
stream . write ( "Data: 0x{} {}\n" . format ( binascii . hexlify ( tx_data ) . decode ( ) , flagged ( issymbolic ( self . data ) ) ) )
if self . return_data is not None :
    return_data = conc_tx . return_data
    stream . write ( "Return_data: 0x{} {}\n" . format ( binascii . hexlify ( return_data ) . decode ( ) , flagged ( issymbolic ( self . return_data ) ) ) )
metadata = mevm . get_metadata ( self . address )
if self . sort == 'CREATE' :
    if metadata is not None :
        conc_args_data = conc_tx . data [ len ( metadata . _init_bytecode ) : ]
        arguments = ABI . deserialize ( metadata . get_constructor_arguments ( ) , conc_args_data )
        # TODO confirm : arguments should all be concrete ?
        is_argument_symbolic = any ( map ( issymbolic , arguments ) )
        # is this redundant since arguments are all concrete ?
        stream . write ( 'Function call:\n' )
        stream . write ( "Constructor(" )
        stream . write ( ',' . join ( map ( repr , map ( state . solve_one , arguments ) ) ) )
        # is this redundant since arguments are all concrete ?
        stream . write ( ') -> %s %s\n' % ( self . result , flagged ( is_argument_symbolic ) ) )
if self . sort == 'CALL' :
    if metadata is not None :
        calldata = conc_tx . data
        is_calldata_symbolic = issymbolic ( self . data )
        function_id = calldata [ : 4 ]
        # hope there is enough data
        signature = metadata . get_func_signature ( function_id )
        function_name = metadata . get_func_name ( function_id )
        if signature :
            _ , arguments = ABI . deserialize ( signature , calldata )
        else :
            arguments = ( calldata , )
        return_data = None
        if self . result == 'RETURN' :
            ret_types = metadata . get_func_return_types ( function_id )
            return_data = conc_tx . return_data
            return_values = ABI . deserialize ( ret_types , return_data )
        # function return
        is_return_symbolic = issymbolic ( self . return_data )
        stream . write ( '\n' )
        stream . write ( "Function call:\n" )
        stream . write ( "%s(" % function_name )
        stream . write ( ',' . join ( map ( repr , arguments ) ) )
        stream . write ( ') -> %s %s\n' % ( self . result , flagged ( is_calldata_symbolic ) ) )
        if return_data is not None :
            if len ( return_values ) == 1 :
                return_values = return_values [ 0 ]
            stream . write ( 'return: %r %s\n' % ( return_values , flagged ( is_return_symbolic ) ) )
        is_something_symbolic = is_calldata_symbolic or is_return_symbolic
stream . write ( '\n\n' )
return is_something_symbolic


signature:
def _get_memfee ( self , address , size = 1 ) :
    """This calculates the amount of extra gas needed for accessing to
 previously unused memory .
 : param address : base memory offset
 : param size : size of the memory access"""

implementation:
if not issymbolic ( size ) and size == 0 :
    return 0
address = self . safe_add ( address , size )
allocated = self . allocated
GMEMORY = 3
GQUADRATICMEMDENOM = 512
# 1 gas per 512 quadwords
old_size = Operators . ZEXTEND ( Operators . UDIV ( self . safe_add ( allocated , 31 ) , 32 ) , 512 )
new_size = Operators . ZEXTEND ( Operators . UDIV ( self . safe_add ( address , 31 ) , 32 ) , 512 )
old_totalfee = self . safe_mul ( old_size , GMEMORY ) + Operators . UDIV ( self . safe_mul ( old_size , old_size ) , GQUADRATICMEMDENOM )
new_totalfee = self . safe_mul ( new_size , GMEMORY ) + Operators . UDIV ( self . safe_mul ( new_size , new_size ) , GQUADRATICMEMDENOM )
memfee = new_totalfee - old_totalfee
flag = Operators . UGT ( new_totalfee , old_totalfee )
return Operators . ITEBV ( 512 , size == 0 , 0 , Operators . ITEBV ( 512 , flag , memfee , 0 ) )


signature:
def read_code ( self , address , size = 1 ) :
    """Read size byte from bytecode .
 If less than size bytes are available result will be pad with \x00"""

implementation:
assert address < len ( self . bytecode )
value = self . bytecode [ address : address + size ]
if len ( value ) < size :
    value += '\x00' * ( size - len ( value ) )
    # pad with null ( spec )
return value


signature:
def instruction ( self ) :
    """Current instruction pointed by self . pc"""

implementation:
# FIXME check if pc points to invalid instruction
# if self . pc > = len ( self . bytecode ) :
# return InvalidOpcode ( ' Code out of range ' )
# if self . pc in self . invalid :
# raise InvalidOpcode ( ' Opcode inside a PUSH immediate ' )
try :
    _decoding_cache = getattr ( self , '_decoding_cache' )
except Exception :
    _decoding_cache = self . _decoding_cache = { }
pc = self . pc
if isinstance ( pc , Constant ) :
    pc = pc . value
if pc in _decoding_cache :
    return _decoding_cache [ pc ]
def getcode ( ) :
    bytecode = self . bytecode
    for pc_i in range ( pc , len ( bytecode ) ) :
        yield simplify ( bytecode [ pc_i ] ) . value
    while True :
        yield 0
instruction = EVMAsm . disassemble_one ( getcode ( ) , pc = pc , fork = DEFAULT_FORK )
_decoding_cache [ pc ] = instruction
return instruction


signature:
def _push ( self , value ) :
    """Push into the stack
 ITEM0
 ITEM1
 ITEM2
 sp - > { empty }"""

implementation:
assert isinstance ( value , int ) or isinstance ( value , BitVec ) and value . size == 256
if len ( self . stack ) >= 1024 :
    raise StackOverflow ( )
if isinstance ( value , int ) :
    value = value & TT256M1
value = simplify ( value )
if isinstance ( value , Constant ) and not value . taint :
    value = value . value
self . stack . append ( value )


signature:
def _top ( self , n = 0 ) :
    """Read a value from the top of the stack without removing it"""

implementation:
if len ( self . stack ) - n < 0 :
    raise StackUnderflow ( )
return self . stack [ n - 1 ]


signature:
def _checkpoint ( self ) :
    """Save and / or get a state checkpoint previous to current instruction"""

implementation:
# Fixme [ felipe ] add a with self . disabled _ events context mangr to Eventful
if self . _checkpoint_data is None :
    if not self . _published_pre_instruction_events :
        self . _published_pre_instruction_events = True
        self . _publish ( 'will_decode_instruction' , self . pc )
        self . _publish ( 'will_execute_instruction' , self . pc , self . instruction )
        self . _publish ( 'will_evm_execute_instruction' , self . instruction , self . _top_arguments ( ) )
    pc = self . pc
    instruction = self . instruction
    old_gas = self . gas
    allocated = self . _allocated
    # FIXME Not clear which exception should trigger first . OOG or insuficient stack
    # this could raise an insuficient stack exception
    arguments = self . _pop_arguments ( )
    fee = self . _calculate_gas ( * arguments )
    self . _checkpoint_data = ( pc , old_gas , instruction , arguments , fee , allocated )
return self . _checkpoint_data


signature:
def _rollback ( self ) :
    """Revert the stack , gas , pc and memory allocation so it looks like before executing the instruction"""

implementation:
last_pc , last_gas , last_instruction , last_arguments , fee , allocated = self . _checkpoint_data
self . _push_arguments ( last_arguments )
self . _gas = last_gas
self . _pc = last_pc
self . _allocated = allocated
self . _checkpoint_data = None


signature:
def _check_jmpdest ( self ) :
    """If the previous instruction was a JUMP / JUMPI and the conditional was
 True , this checks that the current instruction must be a JUMPDEST .
 Here , if symbolic , the conditional ` self . _ check _ jumpdest ` would be
 already constrained to a single concrete value ."""

implementation:
should_check_jumpdest = self . _check_jumpdest
if issymbolic ( should_check_jumpdest ) :
    should_check_jumpdest_solutions = solver . get_all_values ( self . constraints , should_check_jumpdest )
    if len ( should_check_jumpdest_solutions ) != 1 :
        raise EthereumError ( "Conditional not concretized at JMPDEST check" )
    should_check_jumpdest = should_check_jumpdest_solutions [ 0 ]
if should_check_jumpdest :
    self . _check_jumpdest = False
    pc = self . pc . value if isinstance ( self . pc , Constant ) else self . pc
    if pc not in self . _valid_jumpdests :
        raise InvalidOpcode ( )


signature:
def _store ( self , offset , value , size = 1 ) :
    """Stores value in memory as a big endian"""

implementation:
self . memory . write_BE ( offset , value , size )
for i in range ( size ) :
    self . _publish ( 'did_evm_write_memory' , offset + i , Operators . EXTRACT ( value , ( size - i - 1 ) * 8 , 8 ) )


signature:
def DIV ( self , a , b ) :
    """Integer division operation"""

implementation:
try :
    result = Operators . UDIV ( a , b )
except ZeroDivisionError :
    result = 0
return Operators . ITEBV ( 256 , b == 0 , 0 , result )


signature:
def SDIV ( self , a , b ) :
    """Signed integer division operation ( truncated )"""

implementation:
s0 , s1 = to_signed ( a ) , to_signed ( b )
try :
    result = ( Operators . ABS ( s0 ) // Operators . ABS ( s1 ) * Operators . ITEBV ( 256 , ( s0 < 0 ) != ( s1 < 0 ) , - 1 , 1 ) )
except ZeroDivisionError :
    result = 0
result = Operators . ITEBV ( 256 , b == 0 , 0 , result )
if not issymbolic ( result ) :
    result = to_signed ( result )
return result


signature:
def MOD ( self , a , b ) :
    """Modulo remainder operation"""

implementation:
try :
    result = Operators . ITEBV ( 256 , b == 0 , 0 , a % b )
except ZeroDivisionError :
    result = 0
return result


signature:
def SMOD ( self , a , b ) :
    """Signed modulo remainder operation"""

implementation:
s0 , s1 = to_signed ( a ) , to_signed ( b )
sign = Operators . ITEBV ( 256 , s0 < 0 , - 1 , 1 )
try :
    result = ( Operators . ABS ( s0 ) % Operators . ABS ( s1 ) ) * sign
except ZeroDivisionError :
    result = 0
return Operators . ITEBV ( 256 , s1 == 0 , 0 , result )


signature:
def ADDMOD ( self , a , b , c ) :
    """Modulo addition operation"""

implementation:
try :
    result = Operators . ITEBV ( 256 , c == 0 , 0 , ( a + b ) % c )
except ZeroDivisionError :
    result = 0
return result


signature:
def EXP_gas ( self , base , exponent ) :
    """Calculate extra gas fee"""

implementation:
EXP_SUPPLEMENTAL_GAS = 10
# cost of EXP exponent per byte
def nbytes ( e ) :
    result = 0
    for i in range ( 32 ) :
        result = Operators . ITEBV ( 512 , Operators . EXTRACT ( e , i * 8 , 8 ) != 0 , i + 1 , result )
    return result
return EXP_SUPPLEMENTAL_GAS * nbytes ( exponent )


signature:
def SIGNEXTEND ( self , size , value ) :
    """Extend length of two ' s complement signed integer"""

implementation:
# FIXME maybe use Operators . SEXTEND
testbit = Operators . ITEBV ( 256 , size <= 31 , size * 8 + 7 , 257 )
result1 = ( value | ( TT256 - ( 1 << testbit ) ) )
result2 = ( value & ( ( 1 << testbit ) - 1 ) )
result = Operators . ITEBV ( 256 , ( value & ( 1 << testbit ) ) != 0 , result1 , result2 )
return Operators . ITEBV ( 256 , size <= 31 , result , value )


signature:
def LT ( self , a , b ) :
    """Less - than comparison"""

implementation: return Operators . ITEBV ( 256 , Operators . ULT ( a , b ) , 1 , 0 )


signature:
def GT ( self , a , b ) :
    """Greater - than comparison"""

implementation: return Operators . ITEBV ( 256 , Operators . UGT ( a , b ) , 1 , 0 )


signature:
def SGT ( self , a , b ) :
    """Signed greater - than comparison"""

implementation:
# http : / / gavwood . com / paper . pdf
s0 , s1 = to_signed ( a ) , to_signed ( b )
return Operators . ITEBV ( 256 , s0 > s1 , 1 , 0 )


signature:
def BYTE ( self , offset , value ) :
    """Retrieve single byte from word"""

implementation:
offset = Operators . ITEBV ( 256 , offset < 32 , ( 31 - offset ) * 8 , 256 )
return Operators . ZEXTEND ( Operators . EXTRACT ( value , offset , 8 ) , 256 )


signature:
def SHA3 ( self , start , size ) :
    """Compute Keccak - 256 hash"""

implementation:
# read memory from start to end
# http : / / gavwood . com / paper . pdf
data = self . try_simplify_to_constant ( self . read_buffer ( start , size ) )
if issymbolic ( data ) :
    known_sha3 = { }
    # Broadcast the signal
    self . _publish ( 'on_symbolic_sha3' , data , known_sha3 )
    # This updates the local copy of sha3 with the pairs we need to explore
    value = 0
    # never used
    known_hashes_cond = False
    for key , hsh in known_sha3 . items ( ) :
        assert not issymbolic ( key ) , "Saved sha3 data,hash pairs should be concrete"
        cond = key == data
        known_hashes_cond = Operators . OR ( cond , known_hashes_cond )
        value = Operators . ITEBV ( 256 , cond , hsh , value )
    return value
value = sha3 . keccak_256 ( data ) . hexdigest ( )
value = int ( value , 16 )
self . _publish ( 'on_concrete_sha3' , data , value )
logger . info ( "Found a concrete SHA3 example %r -> %x" , data , value )
return value


signature:
def CALLDATALOAD ( self , offset ) :
    """Get input data of current environment"""

implementation:
if issymbolic ( offset ) :
    if solver . can_be_true ( self . _constraints , offset == self . _used_calldata_size ) :
        self . constraints . add ( offset == self . _used_calldata_size )
    raise ConcretizeArgument ( 1 , policy = 'SAMPLED' )
self . _use_calldata ( offset , 32 )
data_length = len ( self . data )
bytes = [ ]
for i in range ( 32 ) :
    try :
        c = Operators . ITEBV ( 8 , offset + i < data_length , self . data [ offset + i ] , 0 )
    except IndexError : # offset + i is concrete and outside data
        c = 0
    bytes . append ( c )
return Operators . CONCAT ( 256 , * bytes )


signature:
def CALLDATACOPY ( self , mem_offset , data_offset , size ) :
    """Copy input data in current environment to memory"""

implementation:
if issymbolic ( size ) :
    if solver . can_be_true ( self . _constraints , size <= len ( self . data ) + 32 ) :
        self . constraints . add ( size <= len ( self . data ) + 32 )
    raise ConcretizeArgument ( 3 , policy = 'SAMPLED' )
if issymbolic ( data_offset ) :
    if solver . can_be_true ( self . _constraints , data_offset == self . _used_calldata_size ) :
        self . constraints . add ( data_offset == self . _used_calldata_size )
    raise ConcretizeArgument ( 2 , policy = 'SAMPLED' )
# account for calldata usage
self . _use_calldata ( data_offset , size )
self . _allocate ( mem_offset , size )
for i in range ( size ) :
    try :
        c = Operators . ITEBV ( 8 , data_offset + i < len ( self . data ) , Operators . ORD ( self . data [ data_offset + i ] ) , 0 )
    except IndexError : # data _ offset + i is concrete and outside data
        c = 0
    self . _store ( mem_offset + i , c )


signature:
def CODECOPY ( self , mem_offset , code_offset , size ) :
    """Copy code running in current environment to memory"""

implementation:
self . _allocate ( mem_offset , size )
GCOPY = 3
# cost to copy one 32 byte word
copyfee = self . safe_mul ( GCOPY , Operators . UDIV ( self . safe_add ( size , 31 ) , 32 ) )
self . _consume ( copyfee )
if issymbolic ( size ) :
    max_size = solver . max ( self . constraints , size )
else :
    max_size = size
for i in range ( max_size ) :
    if issymbolic ( i < size ) :
        default = Operators . ITEBV ( 8 , i < size , 0 , self . _load ( mem_offset + i , 1 ) )
        # Fixme . unnecessary memory read
    else :
        if i < size :
            default = 0
        else :
            default = self . _load ( mem_offset + i , 1 )
    if issymbolic ( code_offset ) :
        value = Operators . ITEBV ( 8 , code_offset + i >= len ( self . bytecode ) , default , self . bytecode [ code_offset + i ] )
    else :
        if code_offset + i >= len ( self . bytecode ) :
            value = default
        else :
            value = self . bytecode [ code_offset + i ]
    self . _store ( mem_offset + i , value )
self . _publish ( 'did_evm_read_code' , code_offset , size )


signature:
def EXTCODECOPY ( self , account , address , offset , size ) :
    """Copy an account ' s code to memory"""

implementation:
extbytecode = self . world . get_code ( account )
self . _allocate ( address + size )
for i in range ( size ) :
    if offset + i < len ( extbytecode ) :
        self . _store ( address + i , extbytecode [ offset + i ] )
    else :
        self . _store ( address + i , 0 )


signature:
def MLOAD ( self , address ) :
    """Load word from memory"""

implementation:
self . _allocate ( address , 32 )
value = self . _load ( address , 32 )
return value


signature:
def MSTORE ( self , address , value ) :
    """Save word to memory"""

implementation:
if istainted ( self . pc ) :
    for taint in get_taints ( self . pc ) :
        value = taint_with ( value , taint )
self . _allocate ( address , 32 )
self . _store ( address , value , 32 )


signature:
def MSTORE8 ( self , address , value ) :
    """Save byte to memory"""

implementation:
if istainted ( self . pc ) :
    for taint in get_taints ( self . pc ) :
        value = taint_with ( value , taint )
self . _allocate ( address , 1 )
self . _store ( address , Operators . EXTRACT ( value , 0 , 8 ) , 1 )


signature:
def SLOAD ( self , offset ) :
    """Load word from storage"""

implementation:
storage_address = self . address
self . _publish ( 'will_evm_read_storage' , storage_address , offset )
value = self . world . get_storage_data ( storage_address , offset )
self . _publish ( 'did_evm_read_storage' , storage_address , offset , value )
return value


signature:
def SSTORE ( self , offset , value ) :
    """Save word to storage"""

implementation:
storage_address = self . address
self . _publish ( 'will_evm_write_storage' , storage_address , offset , value )
# refund = Operators . ITEBV ( 256,
# previous _ value ! = 0,
# Operators . ITEBV ( 256 , value ! = 0 , 0 , GSTORAGEREFUND ) ,
if istainted ( self . pc ) :
    for taint in get_taints ( self . pc ) :
        value = taint_with ( value , taint )
self . world . set_storage_data ( storage_address , offset , value )
self . _publish ( 'did_evm_write_storage' , storage_address , offset , value )


signature:
def JUMPI ( self , dest , cond ) :
    """Conditionally alter the program counter"""

implementation:
self . pc = Operators . ITEBV ( 256 , cond != 0 , dest , self . pc + self . instruction . size )
# This set ups a check for JMPDEST in the next instruction if cond ! = 0
self . _set_check_jmpdest ( cond != 0 )


signature:
def SWAP ( self , * operands ) :
    """Exchange 1st and 2nd stack items"""

implementation:
a = operands [ 0 ]
b = operands [ - 1 ]
return ( b , ) + operands [ 1 : - 1 ] + ( a , )


signature:
def CREATE ( self , value , offset , size ) :
    """Create a new account with associated code"""

implementation:
address = self . world . create_account ( address = EVMWorld . calculate_new_address ( sender = self . address , nonce = self . world . get_nonce ( self . address ) ) )
self . world . start_transaction ( 'CREATE' , address , data = self . read_buffer ( offset , size ) , caller = self . address , value = value , gas = self . gas )
raise StartTx ( )


implementation:
tx = self . world . last_transaction
# At this point last and current tx are the same .
address = tx . address
if tx . result == 'RETURN' :
    self . world . set_code ( tx . address , tx . return_data )
else :
    self . world . delete_account ( address )
    address = 0
return address


signature:
def CALLCODE ( self , gas , _ignored_ , value , in_offset , in_size , out_offset , out_size ) :
    """Message - call into this account with alternative account ' s code"""

implementation:
self . world . start_transaction ( 'CALLCODE' , address = self . address , data = self . read_buffer ( in_offset , in_size ) , caller = self . address , value = value , gas = gas )
raise StartTx ( )


signature:
def RETURN ( self , offset , size ) :
    """Halt execution returning output data"""

implementation:
data = self . read_buffer ( offset , size )
raise EndTx ( 'RETURN' , data )


signature:
def SELFDESTRUCT ( self , recipient ) :
    """Halt execution and register account for later deletion"""

implementation:
# This may create a user account
recipient = Operators . EXTRACT ( recipient , 0 , 160 )
address = self . address
# FIXME for on the known addresses
if issymbolic ( recipient ) :
    logger . info ( "Symbolic recipient on self destruct" )
    recipient = solver . get_value ( self . constraints , recipient )
if recipient not in self . world :
    self . world . create_account ( address = recipient )
self . world . send_funds ( address , recipient , self . world . get_balance ( address ) )
self . world . delete_account ( address )
raise EndTx ( 'SELFDESTRUCT' )


signature:
def human_transactions ( self ) :
    """Completed human transaction"""

implementation:
txs = [ ]
for tx in self . transactions :
    if tx . depth == 0 :
        txs . append ( tx )
return tuple ( txs )


signature:
def current_vm ( self ) :
    """current vm"""

implementation:
try :
    _ , _ , _ , _ , vm = self . _callstack [ - 1 ]
    return vm
except IndexError :
    return None


signature:
def current_transaction ( self ) :
    """current tx"""

implementation:
try :
    tx , _ , _ , _ , _ = self . _callstack [ - 1 ]
    if tx . result is not None : # That tx finished . No current tx .
        return None
    return tx
except IndexError :
    return None


signature:
def current_human_transaction ( self ) :
    """Current ongoing human transaction"""

implementation:
try :
    tx , _ , _ , _ , _ = self . _callstack [ 0 ]
    if tx . result is not None : # That tx finished . No current tx .
        return None
    assert tx . depth == 0
    return tx
except IndexError :
    return None


signature:
def get_storage_data ( self , storage_address , offset ) :
    """Read a value from a storage slot on the specified account
 : param storage _ address : an account address
 : param offset : the storage slot to use .
 : type offset : int or BitVec
 : return : the value
 : rtype : int or BitVec"""

implementation:
value = self . _world_state [ storage_address ] [ 'storage' ] . get ( offset , 0 )
return simplify ( value )


signature:
def set_storage_data ( self , storage_address , offset , value ) :
    """Writes a value to a storage slot in specified account
 : param storage _ address : an account address
 : param offset : the storage slot to use .
 : type offset : int or BitVec
 : param value : the value to write
 : type value : int or BitVec"""

implementation: self . _world_state [ storage_address ] [ 'storage' ] [ offset ] = value


signature:
def get_storage_items ( self , address ) :
    """Gets all items in an account storage
 : param address : account address
 : return : all items in account storage . items are tuple of ( index , value ) . value can be symbolic
 : rtype : list [ ( storage _ index , storage _ value ) ]"""

implementation:
storage = self . _world_state [ address ] [ 'storage' ]
items = [ ]
array = storage . array
while not isinstance ( array , ArrayVariable ) :
    items . append ( ( array . index , array . value ) )
    array = array . array
return items


signature:
def has_storage ( self , address ) :
    """True if something has been written to the storage .
 Note that if a slot has been erased from the storage this function may
 lose any meaning ."""

implementation:
storage = self . _world_state [ address ] [ 'storage' ]
array = storage . array
while not isinstance ( array , ArrayVariable ) :
    if isinstance ( array , ArrayStore ) :
        return True
    array = array . array
return False


signature:
def block_hash ( self , block_number = None , force_recent = True ) :
    """Calculates a block ' s hash
 : param block _ number : the block number for which to calculate the hash , defaulting to the most recent block
 : param force _ recent : if True ( the default ) return zero for any block that is in the future or older than 256 blocks
 : return : the block hash"""

implementation:
if block_number is None :
    block_number = self . block_number ( ) - 1
# We are not maintaining an actual - block - chain - so we just generate
# some hashes for each virtual block
value = sha3 . keccak_256 ( ( repr ( block_number ) + 'NONCE' ) . encode ( ) ) . hexdigest ( )
value = int ( value , 16 )
if force_recent : # 0 is left on the stack if the looked for block number is greater or equal
# than the current block number or more than 256 blocks behind the current
# block . ( Current block hash is unknown from inside the tx )
    bnmax = Operators . ITEBV ( 256 , self . block_number ( ) > 256 , 256 , self . block_number ( ) )
    value = Operators . ITEBV ( 256 , Operators . OR ( block_number >= self . block_number ( ) , block_number < bnmax ) , 0 , value )
return value


signature:
def new_address ( self , sender = None , nonce = None ) :
    """Create a fresh 160bit address"""

implementation:
if sender is not None and nonce is None :
    nonce = self . get_nonce ( sender )
new_address = self . calculate_new_address ( sender , nonce )
if sender is None and new_address in self :
    return self . new_address ( sender , nonce )
return new_address


signature:
def create_account ( self , address = None , balance = 0 , code = None , storage = None , nonce = None ) :
    """Low level account creation . No transaction is done .
 : param address : the address of the account , if known . If omitted , a new address will be generated as closely to the Yellow Paper as possible .
 : param balance : the initial balance of the account in Wei
 : param code : the runtime code of the account , if a contract
 : param storage : storage array
 : param nonce : the nonce for the account ; contracts should have a nonce greater than or equal to 1"""

implementation:
if code is None :
    code = bytes ( )
else :
    if not isinstance ( code , ( bytes , Array ) ) :
        raise EthereumError ( 'Wrong code type' )
# nonce default to initial nonce
if nonce is None : # As per EIP 161 , contract accounts are initialized with a nonce of 1
    nonce = 1 if code else 0
if address is None :
    address = self . new_address ( )
if not isinstance ( address , int ) :
    raise EthereumError ( 'You must provide an address' )
if address in self . accounts : # FIXME account may have been created via selfdestruct destination
# or CALL and may contain some ether already , though if it was a
# selfdestructed address , it can not be reused
    raise EthereumError ( 'The account already exists' )
if storage is None : # Uninitialized values in a storage are 0 by spec
    storage = self . constraints . new_array ( index_bits = 256 , value_bits = 256 , name = f'STORAGE_{address:x}' , avoid_collisions = True , default = 0 )
else :
    if isinstance ( storage , ArrayProxy ) :
        if storage . index_bits != 256 or storage . value_bits != 256 :
            raise TypeError ( "An ArrayProxy 256bits -> 256bits is needed" )
    else :
        if any ( ( k < 0 or k >= 1 << 256 for k , v in storage . items ( ) ) ) :
            raise TypeError ( "Need a dict like object that maps 256 bits keys to 256 bits values" )
    # Hopefully here we have a mapping from 256b to 256b
self . _world_state [ address ] = { }
self . _world_state [ address ] [ 'nonce' ] = nonce
self . _world_state [ address ] [ 'balance' ] = balance
self . _world_state [ address ] [ 'storage' ] = storage
self . _world_state [ address ] [ 'code' ] = code
# adds hash of new address
data = binascii . unhexlify ( '{:064x}{:064x}' . format ( address , 0 ) )
value = sha3 . keccak_256 ( data ) . hexdigest ( )
value = int ( value , 16 )
self . _publish ( 'on_concrete_sha3' , data , value )
return address


signature:
def create_contract ( self , price = 0 , address = None , caller = None , balance = 0 , init = None , gas = None ) :
    """Create a contract account . Sends a transaction to initialize the contract
 : param address : the address of the new account , if known . If omitted , a new address will be generated as closely to the Yellow Paper as possible .
 : param balance : the initial balance of the account in Wei
 : param init : the initialization code of the contract
 The way that the Solidity compiler expects the constructor arguments to
 be passed is by appending the arguments to the byte code produced by the
 Solidity compiler . The arguments are formatted as defined in the Ethereum
 ABI2 . The arguments are then copied from the init byte array to the EVM
 memory through the CODECOPY opcode with appropriate values on the stack .
 This is done when the byte code in the init byte array is actually run
 on the network ."""

implementation:
expected_address = self . create_account ( self . new_address ( sender = caller ) )
if address is None :
    address = expected_address
elif caller is not None and address != expected_address :
    raise EthereumError ( f"Error: contract created from address {hex(caller)} with nonce {self.get_nonce(caller)} was expected to be at address {hex(expected_address)}, but create_contract was called with address={hex(address)}" )
self . start_transaction ( 'CREATE' , address , price , init , caller , balance , gas = gas )
self . _process_pending_transaction ( )
return address


signature:
def start_transaction ( self , sort , address , price = None , data = None , caller = None , value = 0 , gas = 2300 ) :
    """Initiate a transaction
 : param sort : the type of transaction . CREATE or CALL or DELEGATECALL
 : param address : the address of the account which owns the code that is executing .
 : param price : the price of gas in the transaction that originated this execution .
 : param data : the byte array that is the input data to this execution
 : param caller : the address of the account which caused the code to be executing . A 160 - bit code used for identifying Accounts
 : param value : the value , in Wei , passed to this account as part of the same procedure as execution . One Ether is defined as being 10 * * 18 Wei .
 : param bytecode : the byte array that is the machine code to be executed .
 : param gas : gas budget for this transaction ."""

implementation:
assert self . _pending_transaction is None , "Already started tx"
self . _pending_transaction = PendingTransaction ( sort , address , price , data , caller , value , gas )


signature:
def _get_expand_imm_carry ( self , carryIn ) :
    """Manually compute the carry bit produced by expanding an immediate operand ( see ARMExpandImm _ C )"""

implementation:
insn = struct . unpack ( '<I' , self . cpu . instruction . bytes ) [ 0 ]
unrotated = insn & Mask ( 8 )
shift = Operators . EXTRACT ( insn , 8 , 4 )
_ , carry = self . cpu . _shift ( unrotated , cs . arm . ARM_SFT_ROR , 2 * shift , carryIn )
return carry