Instruction:
How would you code a function in Python 3 to
close a file descriptor.

Response:
def sys_close(self, fd):
        """
        Closes a file descriptor
        :rtype: int
        :param fd: the file descriptor to close.
        :return: C{0} on success.
        """
        if self._is_fd_open(fd):
            self._close(fd)
        else:
            return -errno.EBADF
        logger.debug(f'sys_close({fd})')
        return 0


Instruction:
How would you explain what the following Python 3 function does
def sys_readlink(self, path, buf, bufsize):
        if bufsize <= 0:
            return -errno.EINVAL
        filename = self.current.read_string(path)
        if filename == '/proc/self/exe':
            data = os.path.abspath(self.program)
        else:
            data = os.readlink(filename)[:bufsize]
        self.current.write_bytes(buf, data)
        return len(data)

Response: This function reads the link at the specified path and writes it to the buffer.


Instruction:
Create a Python 3 function to
wrap for sys_mmap2. Returns the pgoff of the first page.

Response:
def sys_mmap_pgoff(self, address, size, prot, flags, fd, offset):
        """Wrapper for mmap2"""
        return self.sys_mmap2(address, size, prot, flags, fd, offset)


Instruction:
Can you generate the documentation for the following Python 3 function
def sys_mmap(self, address, size, prot, flags, fd, offset):

        if address == 0:
            address = None

        cpu = self.current
        if flags & 0x10:
            cpu.memory.munmap(address, size)

        perms = perms_from_protflags(prot)

        if flags & 0x20:
            result = cpu.memory.mmap(address, size, perms)
        elif fd == 0:
            assert offset == 0
            result = cpu.memory.mmap(address, size, perms)
            data = self.files[fd].read(size)
            cpu.write_bytes(result, data)
        else:
            # FIXME Check if file should be symbolic input and do as with fd0
            result = cpu.memory.mmapFile(address, size, perms, self.files[fd].name, offset)

        actually_mapped = f'0x{result:016x}'
        if address is None or result != address:
            address = address or 0
            actually_mapped += f' [requested: 0x{address:016x}]'

        if flags & 0x10 != 0 and result != address:
            cpu.memory.munmap(result, size)
            result = -1

        return result

Response: This function maps memory space to the virtual address space of the calling process.


Instruction:
Can you tell what is the following Python 3 function doing
def sys_mprotect(self, start, size, prot):
        perms = perms_from_protflags(prot)
        ret = self.current.memory.mprotect(start, size, perms)
        return 0

Response: Sets protection on a region of memory.


Instruction:
Can you create a Python 3 function that
works just like C{sys_read} except that data is read into multiple buffers. :rtype: int :param fd: the file descriptor of the file to read. :param iov: the buffer where the the bytes to read are stored. :param count: amount of C{iov} buffers to read from the file. :return: the amount of bytes read in total.

Response:
def sys_readv(self, fd, iov, count):
        """
        Works just like C{sys_read} except that data is read into multiple buffers.
        :rtype: int

        :param fd: the file descriptor of the file to read.
        :param iov: the buffer where the the bytes to read are stored.
        :param count: amount of C{iov} buffers to read from the file.
        :return: the amount of bytes read in total.
        """
        cpu = self.current
        ptrsize = cpu.address_bit_size
        sizeof_iovec = 2 * (ptrsize // 8)
        total = 0
        for i in range(0, count):
            buf = cpu.read_int(iov + i * sizeof_iovec, ptrsize)
            size = cpu.read_int(iov + i * sizeof_iovec + (sizeof_iovec // 2),
                                ptrsize)

            data = self.files[fd].read(size)
            total += len(data)
            cpu.write_bytes(buf, data)
            self.syscall_trace.append(("_read", fd, data))
        return total


Instruction:
Create a Python 3 function to
work just like C{sys_write} except that multiple buffers are written out. :rtype: int :param fd: the file descriptor of the file to write. :param iov: the buffer where the the bytes to write are taken. :param count: amount of C{iov} buffers to write into the file. :return: the amount of bytes written in total.

Response:
def sys_writev(self, fd, iov, count):
        """
        Works just like C{sys_write} except that multiple buffers are written out.
        :rtype: int

        :param fd: the file descriptor of the file to write.
        :param iov: the buffer where the the bytes to write are taken.
        :param count: amount of C{iov} buffers to write into the file.
        :return: the amount of bytes written in total.
        """
        cpu = self.current
        ptrsize = cpu.address_bit_size
        sizeof_iovec = 2 * (ptrsize // 8)
        total = 0
        try:
            write_fd = self._get_fd(fd)
        except FdError as e:
            logger.error(f"writev: Not a valid file descriptor ({fd})")
            return -e.err

        for i in range(0, count):
            buf = cpu.read_int(iov + i * sizeof_iovec, ptrsize)
            size = cpu.read_int(iov + i * sizeof_iovec + (sizeof_iovec // 2), ptrsize)

            data = [Operators.CHR(cpu.read_int(buf + i, 8)) for i in range(size)]
            data = self._transform_write_data(data)
            write_fd.write(data)
            self.syscall_trace.append(("_write", fd, data))
            total += size
        return total


Instruction:
Here you have a function in Python 3, explain what it does
def sys_set_thread_area(self, user_info):
        n = self.current.read_int(user_info, 32)
        pointer = self.current.read_int(user_info + 4, 32)
        m = self.current.read_int(user_info + 8, 32)
        flags = self.current.read_int(user_info + 12, 32)
        assert n == 0xffffffff
        assert flags == 0x51  # TODO: fix
        self.current.GS = 0x63
        self.current.set_descriptor(self.current.GS, pointer, 0x4000, 'rw')
        self.current.write_int(user_info, (0x63 - 3) // 8, 32)
        return 0

Response: Sets a thread local storage area.


Instruction:
Can you generate a brief explanation for the following Python 3 code
def syscall(self):

        index = self._syscall_abi.syscall_number()

        try:
            table = getattr(linux_syscalls, self.current.machine)
            name = table.get(index, None)
            implementation = getattr(self, name)
        except (AttributeError, KeyError):
            if name is not None:
                raise SyscallNotImplemented(index, name)
            else:
                raise Exception(f"Bad syscall index, {index}")

        return self._syscall_abi.invoke(implementation)

Response: Returns the syscall that is currently running on this machine.


Instruction:
Create a Python 3 function for
yielding CPU. This will choose another process from the running list and change current running process.

Response:
def sched(self):
        """ Yield CPU.
            This will choose another process from the running list and change
            current running process. May give the same cpu if only one running
            process.
        """
        if len(self.procs) > 1:
            logger.debug("SCHED:")
            logger.debug(f"\tProcess: {self.procs!r}")
            logger.debug(f"\tRunning: {self.running!r}")
            logger.debug(f"\tRWait: {self.rwait!r}")
            logger.debug(f"\tTWait: {self.twait!r}")
            logger.debug(f"\tTimers: {self.timers!r}")
            logger.debug(f"\tCurrent clock: {self.clocks}")
            logger.debug(f"\tCurrent cpu: {self._current}")

        if len(self.running) == 0:
            logger.debug("None running checking if there is some process waiting for a timeout")
            if all([x is None for x in self.timers]):
                raise Deadlock()
            self.clocks = min(x for x in self.timers if x is not None) + 1
            self.check_timers()
            assert len(self.running) != 0, "DEADLOCK!"
            self._current = self.running[0]
            return
        next_index = (self.running.index(self._current) + 1) % len(self.running)
        next_running_idx = self.running[next_index]
        if len(self.procs) > 1:
            logger.debug(f"\tTransfer control from process {self._current} to {next_running_idx}")
        self._current = next_running_idx


Instruction:
Here you have a function in Python 3, explain what it does
def wait(self, readfds, writefds, timeout):
        logger.debug("WAIT:")
        logger.debug(f"\tProcess {self._current} is going to wait for [ {readfds!r} {writefds!r} {timeout!r} ]")
        logger.debug(f"\tProcess: {self.procs!r}")
        logger.debug(f"\tRunning: {self.running!r}")
        logger.debug(f"\tRWait: {self.rwait!r}")
        logger.debug(f"\tTWait: {self.twait!r}")
        logger.debug(f"\tTimers: {self.timers!r}")

        for fd in readfds:
            self.rwait[fd].add(self._current)
        for fd in writefds:
            self.twait[fd].add(self._current)
        if timeout is not None:
            self.timers[self._current] = self.clocks + timeout
        procid = self._current
        # self.sched()
        next_index = (self.running.index(procid) + 1) % len(self.running)
        self._current = self.running[next_index]
        logger.debug(f"\tTransfer control from process {procid} to {self._current}")
        logger.debug(f"\tREMOVING {procid!r} from {self.running!r}. Current: {self._current!r}")
        self.running.remove(procid)
        if self._current not in self.running:
            logger.debug("\tCurrent not running. Checking for timers...")
            self._current = None
            self.check_timers()

Response: Wait for a set of file descriptors or timeout.


Instruction:
Can you tell what is the following Python 3 function doing
def awake(self, procid):
        logger.debug(f"Remove procid:{procid} from waitlists and reestablish it in the running list")
        for wait_list in self.rwait:
            if procid in wait_list:
                wait_list.remove(procid)
        for wait_list in self.twait:
            if procid in wait_list:
                wait_list.remove(procid)
        self.timers[procid] = None
        self.running.append(procid)
        if self._current is None:
            self._current = procid

Response: Remove the procid from waitlists and reestablish it in the running list


Instruction:
How would you code a function in Python 3 to
signal that a process is waiting to receive data on fd

Response:
def signal_receive(self, fd):
        """ Awake one process waiting to receive data on fd """
        connections = self.connections
        if connections(fd) and self.twait[connections(fd)]:
            procid = random.sample(self.twait[connections(fd)], 1)[0]
            self.awake(procid)


Instruction:
Explain what the following Python 3 code does
def signal_transmit(self, fd):
        connection = self.connections(fd)
        if connection is None or connection >= len(self.rwait):
            return

        procs = self.rwait[connection]
        if procs:
            procid = random.sample(procs, 1)[0]
            self.awake(procid)

Response: Signal that a process is waiting to transmit data on fd.


Instruction:
Can you generate the documentation for the following Python 3 function
def check_timers(self):
        if self._current is None:
            # Advance the clocks. Go to future!!
            advance = min([self.clocks] + [x for x in self.timers if x is not None]) + 1
            logger.debug(f"Advancing the clock from {self.clocks} to {advance}")
            self.clocks = advance
        for procid in range(len(self.timers)):
            if self.timers[procid] is not None:
                if self.clocks > self.timers[procid]:
                    self.procs[procid].PC += self.procs[procid].instruction.size
                    self.awake(procid)

Response: Awake process if timer has expired


Instruction:
Implement a Python 3 function for
executing one cpu instruction in the current thread.

Response:
def execute(self):
        """
        Execute one cpu instruction in the current thread (only one supported).
        :rtype: bool
        :return: C{True}

        :todo: This is where we could implement a simple schedule.
        """
        try:
            self.current.execute()
            self.clocks += 1
            if self.clocks % 10000 == 0:
                self.check_timers()
                self.sched()
        except (Interruption, Syscall) as e:
            try:
                self.syscall()
                if hasattr(e, 'on_handled'):
                    e.on_handled()
            except RestartSyscall:
                pass

        return True


Instruction:
Write a Python 3 script to
determine information about a file based on its file descriptor (for Linux 64 bits). :rtype: int :param fd: the file descriptor of the file that is being inquired. :param buf: a buffer where data about the file will be stored. :return: C{0} on success, EBADF when called with bad fd :todo: Fix device number.

Response:
def sys_fstat64(self, fd, buf):
        """
        Determines information about a file based on its file descriptor (for Linux 64 bits).
        :rtype: int
        :param fd: the file descriptor of the file that is being inquired.
        :param buf: a buffer where data about the file will be stored.
        :return: C{0} on success, EBADF when called with bad fd
        :todo: Fix device number.
        """

        try:
            stat = self._get_fd(fd).stat()
        except FdError as e:
            logger.info("Calling fstat with invalid fd, returning EBADF")
            return -e.err

        def add(width, val):
            fformat = {2: 'H', 4: 'L', 8: 'Q'}[width]
            return struct.pack('<' + fformat, val)

        def to_timespec(ts):
            return struct.pack('<LL', int(ts), int(ts % 1 * 1e9))

        bufstat = add(8, stat.st_dev)        # unsigned long long      st_dev;
        bufstat += add(8, stat.st_ino)        # unsigned long long   __st_ino;
        bufstat += add(4, stat.st_mode)       # unsigned int    st_mode;
        bufstat += add(4, stat.st_nlink)      # unsigned int    st_nlink;
        bufstat += add(4, stat.st_uid)        # unsigned long   st_uid;
        bufstat += add(4, stat.st_gid)        # unsigned long   st_gid;
        bufstat += add(8, stat.st_rdev)       # unsigned long long st_rdev;
        bufstat += add(8, 0)                  # unsigned long long __pad1;
        bufstat += add(8, stat.st_size)       # long long       st_size;
        bufstat += add(4, stat.st_blksize)    # int   st_blksize;
        bufstat += add(4, 0)                  # int   __pad2;
        bufstat += add(8, stat.st_blocks)     # unsigned long long st_blocks;
        bufstat += to_timespec(stat.st_atime)  # unsigned long   st_atime;
        bufstat += to_timespec(stat.st_mtime)  # unsigned long   st_mtime;
        bufstat += to_timespec(stat.st_ctime)  # unsigned long   st_ctime;
        bufstat += add(4, 0)                   # unsigned int __unused4;
        bufstat += add(4, 0)                   # unsigned int __unused5;

        self.current.write_bytes(buf, bufstat)
        return 0


Instruction:
Write a Python 3 script to
compute total load size of interpreter.

Response:
def _interp_total_size(interp):
        """
        Compute total load size of interpreter.

        :param ELFFile interp: interpreter ELF .so
        :return: total load size of interpreter, not aligned
        :rtype: int
        """
        load_segs = [x for x in interp.iter_segments() if x.header.p_type == 'PT_LOAD']
        last = load_segs[-1]
        return last.header.p_vaddr + last.header.p_memsz


Instruction:
Can you generate a brief explanation for the following Python 3 code
def _read_string(self, cpu, buf):
        filename = ""
        for i in range(0, 1024):
            c = Operators.CHR(cpu.read_int(buf + i, 8))
            if c == '\x00':
                break
            filename += c
        return filename

Response: Reads a null terminated concrete buffer form memory


Instruction:
Create a Python 3 function to
load a CGC - ELF program in memory and prepares the initial CPU state and stack state.

Response:
def load(self, filename):
        """
        Loads a CGC-ELF program in memory and prepares the initial CPU state
        and the stack.

        :param filename: pathname of the file to be executed.
        """
        CGC_MIN_PAGE_SIZE = 4096
        CGC_MIN_ALIGN = CGC_MIN_PAGE_SIZE
        TASK_SIZE = 0x80000000

        def CGC_PAGESTART(_v):
            return ((_v) & ~ (CGC_MIN_ALIGN - 1))

        def CGC_PAGEOFFSET(_v):
            return ((_v) & (CGC_MIN_ALIGN - 1))

        def CGC_PAGEALIGN(_v):
            return (((_v) + CGC_MIN_ALIGN - 1) & ~(CGC_MIN_ALIGN - 1))

        def BAD_ADDR(x):
            return ((x) >= TASK_SIZE)

        # load elf See https://github.com/CyberdyneNYC/linux-source-3.13.2-cgc/blob/master/fs/binfmt_cgc.c
        # read the ELF object file
        cgc = CGCElf(filename)
        logger.info("Loading %s as a %s elf" % (filename, cgc.arch))
        # make cpu and memory (Only 1 thread in Decree)
        cpu = self._mk_proc()

        bss = brk = 0
        start_code = 0xffffffff
        end_code = start_data = end_data = 0

        for (vaddr, memsz, perms, name, offset, filesz) in cgc.maps():
            if vaddr < start_code:
                start_code = vaddr
            if start_data < vaddr:
                start_data = vaddr

            if vaddr > TASK_SIZE or filesz > memsz or \
                    memsz > TASK_SIZE or TASK_SIZE - memsz < vaddr:
                raise Exception("Set_brk can never work. avoid overflows")

            # CGCMAP--
            addr = None
            if filesz > 0:
                hint = CGC_PAGESTART(vaddr)
                size = CGC_PAGEALIGN(filesz + CGC_PAGEOFFSET(vaddr))
                offset = CGC_PAGESTART(offset)
                addr = cpu.memory.mmapFile(hint, size, perms, name, offset)
                assert not BAD_ADDR(addr)

                lo = CGC_PAGEALIGN(vaddr + filesz)
                hi = CGC_PAGEALIGN(vaddr + memsz)
            else:
                # for 0 filesz, we have to include the first page as bss.
                lo = CGC_PAGESTART(vaddr + filesz)
                hi = CGC_PAGEALIGN(vaddr + memsz)

            # map anon pages for the rest (no prefault)
            if hi - lo > 0:
                zaddr = cpu.memory.mmap(lo, hi - lo, perms)
                assert not BAD_ADDR(zaddr)

            lo = vaddr + filesz
            hi = CGC_PAGEALIGN(vaddr + memsz)
            if hi - lo > 0:
                old_perms = cpu.memory.perms(lo)
                cpu.memory.mprotect(lo, hi - lo, 'rw')
                try:
                    cpu.memory[lo:hi] = '\x00' * (hi - lo)
                except Exception as e:
                    logger.debug("Exception zeroing main elf fractional pages: %s" % str(e))
                cpu.memory.mprotect(lo, hi, old_perms)

            if addr is None:
                addr = zaddr
            assert addr is not None

            k = vaddr + filesz
            if k > bss:
                bss = k
            if 'x' in perms and end_code < k:
                end_code = k
            if end_data < k:
                end_data = k

            k = vaddr + memsz
            if k > brk:
                brk = k

        bss = brk
        stack_base = 0xbaaaaffc
        stack_size = 0x800000
        stack = cpu.memory.mmap(0xbaaab000 - stack_size, stack_size, 'rwx') + stack_size - 4
        assert (stack_base) in cpu.memory and (stack_base - stack_size + 4) in cpu.memory

        # Only one thread in Decree
        status, thread = next(cgc.threads())
        assert status == 'Running'

        logger.info("Setting initial cpu state")
        # set initial CPU state
        cpu.write_register('EAX', 0x0)
        cpu.write_register('ECX', cpu.memory.mmap(CGC_PAGESTART(0x4347c000),
                                                  CGC_PAGEALIGN(4096 + CGC_PAGEOFFSET(0x4347c000)),
                                                  'rwx'))
        cpu.write_register('EDX', 0x0)
        cpu.write_register('EBX', 0x0)
        cpu.write_register('ESP', stack)
        cpu.write_register('EBP', 0x0)
        cpu.write_register('ESI', 0x0)
        cpu.write_register('EDI', 0x0)
        cpu.write_register('EIP', thread['EIP'])
        cpu.write_register('RFLAGS', 0x202)
        cpu.write_register('CS', 0x0)
        cpu.write_register('SS', 0x0)
        cpu.write_register('DS', 0x0)
        cpu.write_register('ES', 0x0)
        cpu.write_register('FS', 0x0)
        cpu.write_register('GS', 0x0)

        cpu.memory.mmap(0x4347c000, 0x1000, 'r')
        # cpu.memory[0x4347c000:0x4347d000] = 'A' 0x1000

        logger.info("Entry point: %016x", cpu.EIP)
        logger.info("Stack start: %016x", cpu.ESP)
        logger.info("Brk: %016x", brk)
        logger.info("Mappings:")
        for m in str(cpu.memory).split('\n'):
            logger.info("  %s", m)
        return [cpu]


Instruction:
Write a Python 3 function that can
allocate - allocate virtual memory The allocate system call creates a new allocation in the virtual address space of the calling process. The length argument specifies the length of the allocation in bytes which will be rounded up to the hardware page size. The kernel chooses the address at which to create the allocation; the address of the new allocation is returned in *addr as the result of the call. All newly allocated memory is readable and writeable. In addition, the is_X argument is a boolean that allows newly allocated memory to be marked as executable (non-zero) or non-executable (zero). The allocate function is invoked through system call number 5. :param cpu: current CPU :param length: the length of the allocation in bytes :param isX: boolean that allows newly allocated memory to be marked as executable :param addr: the address of the new allocation is returned in *addr :return: On success, allocate returns zero and a pointer to the allocated area is returned in *addr. Otherwise, an error code is returned and *addr is undefined. EINVAL length is zero. EINVAL length is too large. EFAULT addr points to an invalid address. ENOMEM No memory is available or the process' maximum number of allocations would have been exceeded.

Response:
def sys_allocate(self, cpu, length, isX, addr):
        """ allocate - allocate virtual memory

           The  allocate  system call creates a new allocation in the virtual address
           space of the calling process.  The length argument specifies the length of
           the allocation in bytes which will be rounded up to the hardware page size.

           The kernel chooses the address at which to create the allocation; the
           address of the new allocation is returned in *addr as the result of the call.

           All newly allocated memory is readable and writeable. In addition, the
           is_X argument is a boolean that allows newly allocated memory to be marked
           as executable (non-zero) or non-executable (zero).

           The allocate function is invoked through system call number 5.

           :param cpu: current CPU
           :param length: the length of the allocation in bytes
           :param isX: boolean that allows newly allocated memory to be marked as executable
           :param addr: the address of the new allocation is returned in *addr

           :return: On success, allocate returns zero and a pointer to the allocated area
                               is returned in *addr.  Otherwise, an error code is returned
                               and *addr is undefined.
                   EINVAL   length is zero.
                   EINVAL   length is too large.
                   EFAULT   addr points to an invalid address.
                   ENOMEM   No memory is available or the process' maximum number of allocations
                            would have been exceeded.
        """
        # TODO: check 4 bytes from addr
        if addr not in cpu.memory:
            logger.info("ALLOCATE: addr points to invalid address. Returning EFAULT")
            return Decree.CGC_EFAULT

        perms = ['rw ', 'rwx'][bool(isX)]
        try:
            result = cpu.memory.mmap(None, length, perms)
        except Exception as e:
            logger.info("ALLOCATE exception %s. Returning ENOMEM %r", str(e), length)
            return Decree.CGC_ENOMEM
        cpu.write_int(addr, result, 32)
        logger.info("ALLOCATE(%d, %s, 0x%08x) -> 0x%08x" % (length, perms, addr, result))
        self.syscall_trace.append(("_allocate", -1, length))
        return 0


Instruction:
Can you tell what is the following Python 3 function doing
def sys_random(self, cpu, buf, count, rnd_bytes):

        ret = 0
        if count != 0:
            if count > Decree.CGC_SSIZE_MAX or count < 0:
                ret = Decree.CGC_EINVAL
            else:
                # TODO check count bytes from buf
                if buf not in cpu.memory or (buf + count) not in cpu.memory:
                    logger.info("RANDOM: buf points to invalid address. Returning EFAULT")
                    return Decree.CGC_EFAULT

                with open("/dev/urandom", "rb") as f:
                    data = f.read(count)

                self.syscall_trace.append(("_random", -1, data))
                cpu.write_bytes(buf, data)

        # TODO check 4 bytes from rx_bytes
        if rnd_bytes:
            if rnd_bytes not in cpu.memory:
                logger.info("RANDOM: Not valid rnd_bytes. Returning EFAULT")
                return Decree.CGC_EFAULT
            cpu.write_int(rnd_bytes, len(data), 32)

        logger.info("RANDOM(0x%08x, %d, 0x%08x) -> <%s>)" % (buf, count, rnd_bytes, repr(data[:10])))
        return ret

Response: This function is used to fill a random buffer with random data.


Instruction:
How would you explain what the following Python 3 function does
def sys_receive(self, cpu, fd, buf, count, rx_bytes):
        data = ''
        if count != 0:
            if not self._is_open(fd):
                logger.info("RECEIVE: Not valid file descriptor on receive. Returning EBADF")
                return Decree.CGC_EBADF

            # TODO check count bytes from buf
            if buf not in cpu.memory:  # or not  buf+count in cpu.memory:
                logger.info("RECEIVE: buf points to invalid address. Returning EFAULT")
                return Decree.CGC_EFAULT

            #import random
            #count = random.randint(1,count)
            if fd > 2 and self.files[fd].is_empty():
                cpu.PC -= cpu.instruction.size
                self.wait([fd], [], None)
                raise RestartSyscall()

            # get some potential delay
            # if random.randint(5) == 0 and count > 1:
            #    count = count/2

            # Read the data and put it in memory
            data = self.files[fd].receive(count)
            self.syscall_trace.append(("_receive", fd, data))
            cpu.write_bytes(buf, data)

            self.signal_receive(fd)

        # TODO check 4 bytes from rx_bytes
        if rx_bytes:
            if rx_bytes not in cpu.memory:
                logger.info("RECEIVE: Not valid file descriptor on receive. Returning EFAULT")
                return Decree.CGC_EFAULT
            cpu.write_int(rx_bytes, len(data), 32)

        logger.info("RECEIVE(%d, 0x%08x, %d, 0x%08x) -> <%s> (size:%d)" % (fd, buf, count, rx_bytes, repr(data)[:min(count, 10)], len(data)))
        return 0

Response: This function handles the receive system call. It reads up to count bytes from a file descriptor fd to the memory buffer and sets rx_bytes to zero.


Instruction:
Make a summary of the following Python 3 code
def sys_transmit(self, cpu, fd, buf, count, tx_bytes):
        data = []
        if count != 0:

            if not self._is_open(fd):
                logger.error("TRANSMIT: Not valid file descriptor. Returning EBADFD %d", fd)
                return Decree.CGC_EBADF

            # TODO check count bytes from buf
            if buf not in cpu.memory or (buf + count) not in cpu.memory:
                logger.debug("TRANSMIT: buf points to invalid address. Rerurning EFAULT")
                return Decree.CGC_EFAULT

            if fd > 2 and self.files[fd].is_full():
                cpu.PC -= cpu.instruction.size
                self.wait([], [fd], None)
                raise RestartSyscall()

            for i in range(0, count):
                value = Operators.CHR(cpu.read_int(buf + i, 8))
                if not isinstance(value, str):
                    logger.debug("TRANSMIT: Writing symbolic values to file %d", fd)
                    #value = str(value)
                data.append(value)
            self.files[fd].transmit(data)

            logger.info("TRANSMIT(%d, 0x%08x, %d, 0x%08x) -> <%.24r>" % (fd, buf, count, tx_bytes, ''.join([str(x) for x in data])))
            self.syscall_trace.append(("_transmit", fd, data))
            self.signal_transmit(fd)

        # TODO check 4 bytes from tx_bytes
        if tx_bytes:
            if tx_bytes not in cpu.memory:
                logger.debug("TRANSMIT: Not valid tx_bytes pointer on transmit. Returning EFAULT")
                return Decree.CGC_EFAULT
            cpu.write_int(tx_bytes, len(data), 32)

        return 0

Response: Transmit a number of bytes from a memory buffer to a file descriptor.


Instruction:
Can you generate a brief explanation for the following Python 3 code
def sys_terminate(self, cpu, error_code):
        procid = self.procs.index(cpu)
        self.sched()
        self.running.remove(procid)
        # self.procs[procid] = None #let it there so we can report?
        if issymbolic(error_code):
            logger.info("TERMINATE PROC_%02d with symbolic exit code [%d,%d]", procid, solver.minmax(self.constraints, error_code))
        else:
            logger.info("TERMINATE PROC_%02d %x", procid, error_code)
        if len(self.running) == 0:
            raise TerminateState(f'Process exited correctly. Code: {error_code}')
        return error_code

Response: Terminate all threads in a process.


Instruction:
Can you generate a brief explanation for the following Python 3 code
def sys_deallocate(self, cpu, addr, size):
        logger.info("DEALLOCATE(0x%08x, %d)" % (addr, size))

        if addr & 0xfff != 0:
            logger.info("DEALLOCATE: addr is not page aligned")
            return Decree.CGC_EINVAL
        if size == 0:
            logger.info("DEALLOCATE:length is zero")
            return Decree.CGC_EINVAL
        # unlikely AND WRONG!!!
        # if addr > Decree.CGC_SSIZE_MAX or addr+size > Decree.CGC_SSIZE_MAX:
        #    logger.info("DEALLOCATE: part of the region being deallocated is outside the valid address range of the process")
        #    return Decree.CGC_EINVAL

        cpu.memory.munmap(addr, size)
        self.syscall_trace.append(("_deallocate", -1, size))
        return 0

Response: This function deallocates memory for the specified memory area and returns the number of pages that were deallocated.


Instruction:
Explain what the following Python 3 code does
def sched(self):
        if len(self.procs) > 1:
            logger.info("SCHED:")
            logger.info("\tProcess: %r", self.procs)
            logger.info("\tRunning: %r", self.running)
            logger.info("\tRWait: %r", self.rwait)
            logger.info("\tTWait: %r", self.twait)
            logger.info("\tTimers: %r", self.timers)
            logger.info("\tCurrent clock: %d", self.clocks)
            logger.info("\tCurrent cpu: %d", self._current)

        if len(self.running) == 0:
            logger.info("None running checking if there is some process waiting for a timeout")
            if all([x is None for x in self.timers]):
                raise Deadlock()
            self.clocks = min([x for x in self.timers if x is not None]) + 1
            self.check_timers()
            assert len(self.running) != 0, "DEADLOCK!"
            self._current = self.running[0]
            return
        next_index = (self.running.index(self._current) + 1) % len(self.running)
        next = self.running[next_index]
        if len(self.procs) > 1:
            logger.info("\tTransfer control from process %d to %d", self._current, next)
        self._current = next

Response:
Yield CPU.
            This will choose another process from the RUNNNIG list and change
            current running process.


Instruction:
Can you generate a brief explanation for the following Python 3 code
def wait(self, readfds, writefds, timeout):
        logger.info("WAIT:")
        logger.info("\tProcess %d is going to wait for [ %r %r %r ]", self._current, readfds, writefds, timeout)
        logger.info("\tProcess: %r", self.procs)
        logger.info("\tRunning: %r", self.running)
        logger.info("\tRWait: %r", self.rwait)
        logger.info("\tTWait: %r", self.twait)
        logger.info("\tTimers: %r", self.timers)

        for fd in readfds:
            self.rwait[fd].add(self._current)
        for fd in writefds:
            self.twait[fd].add(self._current)
        if timeout is not None:
            self.timers[self._current] = self.clocks + timeout
        else:
            self.timers[self._current] = None
        procid = self._current
        # self.sched()
        next_index = (self.running.index(procid) + 1) % len(self.running)
        self._current = self.running[next_index]
        logger.info("\tTransfer control from process %d to %d", procid, self._current)
        logger.info("\tREMOVING %r from %r. Current: %r", procid, self.running, self._current)
        self.running.remove(procid)
        if self._current not in self.running:
            logger.info("\tCurrent not running. Checking for timers...")
            self._current = None
            if all([x is None for x in self.timers]):
                raise Deadlock()
            self.check_timers()

Response: Wait for filedescriptors or timeout.


Instruction:
Can you generate a brief explanation for the following Python 3 code
def signal_transmit(self, fd):
        connections = self.connections
        if connections(fd) and self.rwait[connections(fd)]:
            procid = random.sample(self.rwait[connections(fd)], 1)[0]
            self.awake(procid)

Response: Signal that a process is waiting to transmit data on fd


Instruction:
Create a Python 3 function to
execute one cpu instruction in the current thread.

Response:
def execute(self):
        """
        Execute one cpu instruction in the current thread (only one supported).
        :rtype: bool
        :return: C{True}

        :todo: This is where we could implement a simple schedule.
        """
        try:
            self.current.execute()
            self.clocks += 1
            if self.clocks % 10000 == 0:
                self.check_timers()
                self.sched()
        except Interruption as e:
            if e.N != 0x80:
                raise
            try:
                self.int80(self.current)
            except RestartSyscall:
                pass

        return True


Instruction:
Make a summary of the following Python 3 code
def sys_transmit(self, cpu, fd, buf, count, tx_bytes):
        if issymbolic(fd):
            logger.info("Ask to write to a symbolic file descriptor!!")
            cpu.PC = cpu.PC - cpu.instruction.size
            raise SymbolicSyscallArgument(cpu, 0)

        if issymbolic(buf):
            logger.info("Ask to write to a symbolic buffer")
            cpu.PC = cpu.PC - cpu.instruction.size
            raise SymbolicSyscallArgument(cpu, 1)

        if issymbolic(count):
            logger.info("Ask to write a symbolic number of bytes ")
            cpu.PC = cpu.PC - cpu.instruction.size
            raise SymbolicSyscallArgument(cpu, 2)

        if issymbolic(tx_bytes):
            logger.info("Ask to return size to a symbolic address ")
            cpu.PC = cpu.PC - cpu.instruction.size
            raise SymbolicSyscallArgument(cpu, 3)

        return super().sys_transmit(cpu, fd, buf, count, tx_bytes)

Response: This method is a convenience method that handles the sys_transmit system call.


Instruction:
Given the following Python 3 function, write the documentation
def fromdescriptor(cls, desc):
        type_, uri = ('fs', None) if desc is None else desc.split(':', 1)
        for subclass in cls.__subclasses__():
            if subclass.store_type == type_:
                return subclass(uri)
        raise NotImplementedError(f"Storage type '{type_}' not supported.")

Response: Create a new store instance based on the given descriptor.


Instruction:
Given the following Python 3 function, write the documentation
def save_value(self, key, value):
        with self.save_stream(key) as s:
            s.write(value)

Response: Save an arbitrary serializable value under key.


Instruction:
How would you code a function in Python 3 to
load an arbitrary value identified by key.

Response:
def load_value(self, key, binary=False):
        """
        Load an arbitrary value identified by `key`.

        :param str key: The key that identifies the value
        :return: The loaded value
        """
        with self.load_stream(key, binary=binary) as s:
            return s.read()


Instruction:
Explain what the following Python 3 code does
def save_stream(self, key, binary=False):
        s = io.BytesIO() if binary else io.StringIO()
        yield s
        self.save_value(key, s.getvalue())

Response: A context manager that saves a value into a managed file - like object.


Instruction:
How would you explain what the following Python 3 function does
def load_stream(self, key, binary=False):
        value = self.load_value(key, binary=binary)
        yield io.BytesIO(value) if binary else io.StringIO(value)

Response: Load a managed file - like object from which the calling code can read the previously - serialized data.


Instruction:
Can you implement a function in Python 3 that
saves a state to storage.

Response:
def save_state(self, state, key):
        """
        Save a state to storage.

        :param manticore.core.StateBase state:
        :param str key:
        :return:
        """
        with self.save_stream(key, binary=True) as f:
            self._serializer.serialize(state, f)


Instruction:
Can you implement a function in Python 3 that
loads a state from storage.

Response:
def load_state(self, key, delete=True):
        """
        Load a state from storage.

        :param key: key that identifies state
        :rtype: manticore.core.StateBase
        """
        with self.load_stream(key, binary=True) as f:
            state = self._serializer.deserialize(f)
            if delete:
                self.rm(key)
            return state


Instruction:
Can you implement a function in Python 3 that
yields a file object representing key

Response:
def save_stream(self, key, binary=False):
        """
        Yield a file object representing `key`

        :param str key: The file to save to
        :param bool binary: Whether we should treat it as binary
        :return:
        """
        mode = 'wb' if binary else 'w'
        with open(os.path.join(self.uri, key), mode) as f:
            yield f


Instruction:
Write a Python 3 function for
loading a file from the cache store.

Response:
def load_stream(self, key, binary=False):
        """
        :param str key: name of stream to load
        :param bool binary: Whether we should treat it as binary
        :return:
        """
        with open(os.path.join(self.uri, key), 'rb' if binary else 'r') as f:
            yield f


Instruction:
Can you generate a brief explanation for the following Python 3 code
def rm(self, key):
        path = os.path.join(self.uri, key)
        os.remove(path)

Response: Removes the file identified by key.


Instruction:
Implement a function in Python 3 to
return just the filenames that match glob_str inside the store directory.

Response:
def ls(self, glob_str):
        """
        Return just the filenames that match `glob_str` inside the store directory.

        :param str glob_str: A glob string, i.e. 'state_*'
        :return: list of matched keys
        """
        path = os.path.join(self.uri, glob_str)
        return [os.path.split(s)[1] for s in glob.glob(path)]


Instruction:
Can you implement a function in Python 3 that
gets a unique state id.

Response:
def _get_id(self):
        """
        Get a unique state id.

        :rtype: int
        """
        id_ = self._last_id.value
        self._last_id.value += 1
        return id_


Instruction:
Can you generate the documentation for the following Python 3 function
def load_state(self, state_id, delete=True):
        return self._store.load_state(f'{self._prefix}{state_id:08x}{self._suffix}', delete=delete)

Response: Load a state from storage identified by state_id.


Instruction:
Write a Python 3 function that can
save a state to storage.

Response:
def save_state(self, state, state_id=None):
        """
        Save a state to storage, return identifier.

        :param state: The state to save
        :param int state_id: If not None force the state id potentially overwriting old states
        :return: New state id
        :rtype: int
        """
        assert isinstance(state, StateBase)
        if state_id is None:
            state_id = self._get_id()
        else:
            self.rm_state(state_id)

        self._store.save_state(state, f'{self._prefix}{state_id:08x}{self._suffix}')
        return state_id


Instruction:
How would you code a function in Python 3 to
create an indexed output stream i. e. test_00000001. name

Response:
def _named_stream(self, name, binary=False):
        """
        Create an indexed output stream i.e. 'test_00000001.name'

        :param name: Identifier for the stream
        :return: A context-managed stream-like object
        """
        with self._store.save_stream(self._named_key(name), binary=binary) as s:
            yield s


Instruction:
Here you have a function in Python 3, explain what it does
def t_INTN(t):
    r"int(?P<size>256|248|240|232|224|216|208|200|192|184|176|168|160|152|144|136|128|120|112|104|96|88|80|72|64|56|48|40|32|24|16|8)"
    size = int(t.lexer.lexmatch.group('size'))
    t.value = ('int', size)
    return t

Response: r IntN | Int64 | Int32 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64 | Int64


Instruction:
Can you generate a brief explanation for the following Python 3 code
def t_UFIXEDMN(t):
    r"ufixed(?P<M>256|248|240|232|224|216|208|200|192|184|176|168|160|152|144|136|128|120|112|104|96|88|80|72|64|56|48|40|32|24|16|8)x(?P<N>80|79|78|77|76|75|74|73|72|71|70|69|68|67|66|65|64|63|62|61|60|59|58|57|56|55|54|53|52|51|50|49|48|47|46|45|44|43|42|41|40|39|38|37|36|35|34|33|32|31|30|29|28|27|26|25|24|23|22|21|20|19|18|17|16|15|14|13|12|11|10|9|8|7|6|5|4|3|2|1)"
    M = int(t.lexer.lexmatch.group('M'))
    N = int(t.lexer.lexmatch.group('N'))
    t.value = ("ufixed", M, N)
    return t

Response: t_UFIXEDMN - Matches fixed M and N.


Instruction:
How would you explain what the following Python 3 function does
def p_dynamic_fixed_type(p):
    reps = int(p[3])
    base_type = p[1]
    p[0] = ('array', reps, base_type)

Response: Dynamically set the dynamic type of the base element.


Instruction:
Can you tell what is the following Python 3 function doing
def cmp_regs(cpu, should_print=False):
    differing = False
    gdb_regs = gdb.getCanonicalRegisters()
    for name in sorted(gdb_regs):
        vg = gdb_regs[name]
        if name.endswith('psr'):
            name = 'apsr'
        v = cpu.read_register(name.upper())
        if should_print:
            logger.debug(f'{name} gdb:{vg:x} mcore:{v:x}')
        if vg != v:
            if should_print:
                logger.warning('^^ unequal')
            differing = True
    if differing:
        logger.debug(qemu.correspond(None))
    return differing

Response: Compare the canonical registers of a single object to the current one.


Instruction:
Write a Python 3 script to
synchronize the state of the current state of the current state of the Manticore and the GDB state if necessary.

Response:
def post_mcore(state, last_instruction):
    """
    Handle syscalls (import memory) and bail if we diverge
    """
    global in_helper

    # Synchronize qemu state to manticore's after a system call
    if last_instruction.mnemonic.lower() == 'svc':
        # Synchronize all writes that have happened
        writes = state.cpu.memory.pop_record_writes()
        if writes:
            logger.debug("Got %d writes", len(writes))
        for addr, val in writes:
            gdb.setByte(addr, val[0])

        # Write return val to gdb
        gdb_r0 = gdb.getR('R0')
        if gdb_r0 != state.cpu.R0:
            logger.debug(f"Writing 0x{state.cpu.R0:x} to R0 (overwriting 0x{gdb.getR('R0'):x})")
        for reg in state.cpu.canonical_registers:
            if reg.endswith('PSR') or reg in ('R15', 'PC'):
                continue
            val = state.cpu.read_register(reg)
            gdb.setR(reg, val)

    # Ignore Linux kernel helpers
    if (state.cpu.PC >> 16) == 0xffff:
        in_helper = True
        return

    # If we executed a few instructions of a helper, we need to sync Manticore's
    # state to GDB as soon as we stop executing a helper.
    if in_helper:
        for reg in state.cpu.canonical_registers:
            if reg.endswith('PSR'):
                continue
            # Don't sync pc
            if reg == 'R15':
                continue
            gdb.setR(reg, state.cpu.read_register(reg))
        in_helper = False

    if cmp_regs(state.cpu):
        cmp_regs(state.cpu, should_print=True)
        state.abandon()


Instruction:
How would you explain what the following Python 3 function does
def sync_svc(state):
    syscall = state.cpu.R7 # Grab idx from manticore since qemu could have exited
    name = linux_syscalls.armv7[syscall]

    logger.debug(f"Syncing syscall: {name}")

    try:
        # Make sure mmap returns the same address
        if 'mmap' in name:
            returned = gdb.getR('R0')
            logger.debug(f"Syncing mmap ({returned:x})")
            state.cpu.write_register('R0', returned)
        if 'exit' in name:
            return
    except ValueError:
        for reg in state.cpu.canonical_registers:
            print(f'{reg}: {state.cpu.read_register(reg):x}')
        raise

Response: Synchronize some service calls in manticore.


Instruction:
Implement a function in Python 3 to
synchronize the stack and register state.

Response:
def initialize(state):
    """
    Synchronize the stack and register state (manticore->qemu)
    """
    logger.debug(f"Copying {stack_top - state.cpu.SP} bytes in the stack..")
    stack_bottom = min(state.cpu.SP, gdb.getR('SP'))
    for address in range(stack_bottom, stack_top):
        b = state.cpu.read_int(address, 8)
        gdb.setByte(address, chr(b))

    logger.debug("Done")

    # Qemu fd's start at 5, ours at 3. Add two filler fds
    mcore_stdout = state.platform.files[1]
    state.platform.files.append(mcore_stdout)
    state.platform.files.append(mcore_stdout)

    # Sync gdb's regs
    for gdb_reg in gdb.getCanonicalRegisters():
        if gdb_reg.endswith('psr'):
            mcore_reg = 'APSR'
        else:
            mcore_reg = gdb_reg.upper()
        value = state.cpu.read_register(mcore_reg)
        gdb.setR(gdb_reg, value)


Instruction:
Create a Python 3 function to
simplify the expression to a Constant and returns the actual concrete value.

Response:
def to_constant(expression):
    """
        Iff the expression can be simplified to a Constant get the actual concrete value.
        This discards/ignore any taint
    """
    value = simplify(expression)
    if isinstance(value, Expression) and value.taint:
        raise ValueError("Can not simplify tainted values to constant")
    if isinstance(value, Constant):
        return value.value
    elif isinstance(value, Array):
        if expression.index_max:
            ba = bytearray()
            for i in range(expression.index_max):
                value_i = simplify(value[i])
                if not isinstance(value_i, Constant):
                    break
                ba.append(value_i.value)
            else:
                return bytes(ba)
            return expression
    return value


Instruction:
Can you generate the documentation for the following Python 3 function
def _method(self, expression, *args):
        assert expression.__class__.__mro__[-1] is object
        for cls in expression.__class__.__mro__:
            sort = cls.__name__
            methodname = 'visit_%s' % sort
            method = getattr(self, methodname, None)
            if method is not None:
                method(expression, *args)
                return
        return

Response:
Overload Visitor. _method because we want to iterate over the the
            classes and call the method on them.


Instruction:
How would you explain what the following Python 3 function does
def visit_Operation(self, expression, *operands):
        operation = self.operations.get(type(expression), None)
        if operation is not None and \
                all(isinstance(o, Constant) for o in operands):
            value = operation(*(x.value for x in operands))
            if isinstance(expression, BitVec):
                return BitVecConstant(expression.size, value, taint=expression.taint)
            else:
                isinstance(expression, Bool)
                return BoolConstant(value, taint=expression.taint)
        else:
            if any(operands[i] is not expression.operands[i] for i in range(len(operands))):
                expression = self._rebuild(expression, operands)
        return expression

Response: visit an operation expression and return the result


Instruction:
Implement a function in Python 3 to
rebuild the expression if any operands are changed

Response:
def visit_Operation(self, expression, *operands):
        """ constant folding, if all operands of an expression are a Constant do the math """
        if all(isinstance(o, Constant) for o in operands):
            expression = constant_folder(expression)
        if self._changed(expression, operands):
            expression = self._rebuild(expression, operands)
        return expression


Instruction:
Can you generate a brief explanation for the following Python 3 code
def visit_BitVecConcat(self, expression, *operands):
        op = expression.operands[0]

        value = None
        end = None
        begining = None
        for o in operands:
            # If found a non BitVecExtract, do not apply
            if not isinstance(o, BitVecExtract):
                return None
            # Set the value for the first item
            if value is None:
                value = o.value
                begining = o.begining
                end = o.end
            else:
                # If concat of extracts of different values do not apply
                if value is not o.value:
                    return None
                # If concat of non contiguous extracs do not apply
                if begining != o.end + 1:
                    return None
                # update begining variable
                begining = o.begining

        if value is not None:
            if end + 1 == value.size and begining == 0:
                return value
            else:
                return BitVecExtract(value, begining, end - begining + 1, taint=expression.taint)

Response: Return the value of the first bit - vector element that is a concatenation of the operands.


Instruction:
Can you implement a function in Python 3 that
visits the BitVecExtract expression and return the corresponding object.

Response:
def visit_BitVecExtract(self, expression, *operands):
        """ extract(sizeof(a), 0)(a)  ==> a
            extract(16, 0)( concat(a,b,c,d) ) => concat(c, d)
            extract(m,M)(and/or/xor a b ) => and/or/xor((extract(m,M) a) (extract(m,M) a)
        """
        op = expression.operands[0]
        begining = expression.begining
        end = expression.end
        size = end - begining + 1

        # extract(sizeof(a), 0)(a)  ==> a
        if begining == 0 and end + 1 == op.size:
            return op
        elif isinstance(op, BitVecExtract):
            return BitVecExtract(op.value, op.begining + begining, size, taint=expression.taint)
        elif isinstance(op, BitVecConcat):
            new_operands = []
            bitcount = 0
            for item in reversed(op.operands):
                if begining >= item.size:
                    begining -= item.size
                else:
                    if bitcount < expression.size:
                        new_operands.append(item)
                    bitcount += item.size
            if begining != expression.begining:
                return BitVecExtract(BitVecConcat(sum([x.size for x in new_operands]), *reversed(new_operands)),
                                     begining, expression.size, taint=expression.taint)
        if isinstance(op, (BitVecAnd, BitVecOr, BitVecXor)):
            bitoperand_a, bitoperand_b = op.operands
            return op.__class__(BitVecExtract(bitoperand_a, begining, expression.size), BitVecExtract(bitoperand_b, begining, expression.size), taint=expression.taint)


Instruction:
Write a Python 3 function that can
return the result of the addition of the two entries.

Response:
def visit_BitVecAdd(self, expression, *operands):
        """ a + 0  ==> a
            0 + a  ==> a
        """
        left = expression.operands[0]
        right = expression.operands[1]
        if isinstance(right, BitVecConstant):
            if right.value == 0:
                return left
        if isinstance(left, BitVecConstant):
            if left.value == 0:
                return right


Instruction:
Can you generate the documentation for the following Python 3 function
def visit_BitVecSub(self, expression, *operands):
        left = expression.operands[0]
        right = expression.operands[1]
        if isinstance(left, BitVecAdd):
            if self._same_constant(left.operands[0], right):
                return left.operands[1]
            elif self._same_constant(left.operands[1], right):
                return left.operands[0]

Response: Visit the sub expression.


Instruction:
Explain what the following Python 3 code does
def visit_BitVecOr(self, expression, *operands):
        left = expression.operands[0]
        right = expression.operands[1]
        if isinstance(right, BitVecConstant):
            if right.value == 0:
                return left
            elif right.value == left.mask:
                return right
            elif isinstance(left, BitVecOr):
                left_left = left.operands[0]
                left_right = left.operands[1]
                if isinstance(right, Constant):
                    return BitVecOr(left_left, (left_right | right), taint=expression.taint)
        elif isinstance(left, BitVecConstant):
            return BitVecOr(right, left, taint=expression.taint)

Response: Visit the Or expression.


Instruction:
Given the following Python 3 function, write the documentation
def visit_BitVecAnd(self, expression, *operands):
        left = expression.operands[0]
        right = expression.operands[1]
        if isinstance(right, BitVecConstant):
            if right.value == 0:
                return right
            elif right.value == right.mask:
                return left
            elif isinstance(left, BitVecAnd):
                left_left = left.operands[0]
                left_right = left.operands[1]
                if isinstance(right, Constant):
                    return BitVecAnd(left_left, left_right & right, taint=expression.taint)
            elif isinstance(left, BitVecOr):
                left_left = left.operands[0]
                left_right = left.operands[1]
                return BitVecOr(right & left_left, right & left_right, taint=expression.taint)

        elif isinstance(left, BitVecConstant):
            return BitVecAnd(right, left, taint=expression.taint)

Response: visit_BitVecAnd returns a BitVecAnd expression


Instruction:
Can you tell what is the following Python 3 function doing
def visit_BitVecShiftLeft(self, expression, *operands):
        left = expression.operands[0]
        right = expression.operands[1]
        if isinstance(right, BitVecConstant):
            if right.value == 0:
                return left
            elif right.value >= right.size:
                return left

Response:
a << 0 => a                       remove zero
            a << ct => 0 if ct > sizeof(a)    remove big constant shift


Instruction:
Here you have a function in Python 3, explain what it does
def visit_ArraySelect(self, expression, *operands):
        arr, index = operands
        if isinstance(arr, ArrayVariable):
            return

        if isinstance(index, BitVecConstant):
            ival = index.value

            # props are slow and using them in tight loops should be avoided, esp when they offer no additional validation
            # arr._operands[1] = arr.index, arr._operands[0] = arr.array
            while isinstance(arr, ArrayStore) and isinstance(arr._operands[1], BitVecConstant) and arr._operands[1]._value != ival:
                arr = arr._operands[0]  # arr.array

        if isinstance(index, BitVecConstant) and isinstance(arr, ArrayStore) and isinstance(arr.index, BitVecConstant) and arr.index.value == index.value:
            return arr.value
        else:
            if arr is not expression.array:
                return arr.select(index)

Response: Visit the ArraySelect expression and return the value of the array entry.


Instruction:
Create a Python 3 function for
calculating the size of a static type.

Response:
def _type_size(ty):
        """ Calculate `static` type size """
        if ty[0] in ('int', 'uint', 'bytesM', 'function'):
            return 32
        elif ty[0] in ('tuple'):
            result = 0
            for ty_i in ty[1]:
                result += ABI._type_size(ty_i)
            return result
        elif ty[0] in ('array'):
            rep = ty[1]
            result = 32  # offset link
            return result
        elif ty[0] in ('bytes', 'string'):
            result = 32  # offset link
            return result
        raise ValueError


Instruction:
Can you create a Python 3 function that
builds transaction data from function signature and arguments

Response:
def function_call(type_spec, *args):
        """
        Build transaction data from function signature and arguments
        """
        m = re.match(r"(?P<name>[a-zA-Z_][a-zA-Z_0-9]*)(?P<type>\(.*\))", type_spec)
        if not m:
            raise EthereumError("Function signature expected")

        ABI._check_and_warn_num_args(type_spec, *args)

        result = ABI.function_selector(type_spec)  # Funcid
        result += ABI.serialize(m.group('type'), *args)
        return result


Instruction:
Can you create a Python 3 function that
serializes value using type specification in ty.

Response:
def serialize(ty, *values, **kwargs):
        """
        Serialize value using type specification in ty.
        ABI.serialize('int256', 1000)
        ABI.serialize('(int, int256)', 1000, 2000)
        """
        try:
            parsed_ty = abitypes.parse(ty)
        except Exception as e:
            # Catch and rebrand parsing errors
            raise EthereumError(str(e))

        if parsed_ty[0] != 'tuple':
            if len(values) > 1:
                raise ValueError('too many values passed for non-tuple')
            values = values[0]
            if isinstance(values, str):
                values = values.encode()
        else:
            # implement type forgiveness for bytesM/string types
            # allow python strs also to be used for Solidity bytesM/string types
            values = tuple(val.encode() if isinstance(val, str) else val for val in values)

        result, dyn_result = ABI._serialize(parsed_ty, values)
        return result + dyn_result


Instruction:
Can you generate the documentation for the following Python 3 function
def function_selector(method_name_and_signature):
        s = sha3.keccak_256()
        s.update(method_name_and_signature.encode())
        return bytes(s.digest()[:4])

Response: Makes a function hash id from a method name and signature


Instruction:
Make a summary of the following Python 3 code
def _serialize_uint(value, size=32, padding=0):
        if size <= 0 or size > 32:
            raise ValueError

        from .account import EVMAccount  # because of circular import
        if not isinstance(value, (int, BitVec, EVMAccount)):
            raise ValueError
        if issymbolic(value):
            # FIXME This temporary array variable should be obtained from a specific constraint store
            bytes = ArrayVariable(index_bits=256, index_max=32, value_bits=8, name='temp{}'.format(uuid.uuid1()))
            if value.size <= size * 8:
                value = Operators.ZEXTEND(value, size * 8)
            else:
                # automatically truncate, e.g. if they passed a BitVec(256) for an `address` argument (160 bits)
                value = Operators.EXTRACT(value, 0, size * 8)
            bytes = ArrayProxy(bytes.write_BE(padding, value, size))
        else:
            value = int(value)
            bytes = bytearray()
            for _ in range(padding):
                bytes.append(0)
            for position in reversed(range(size)):
                bytes.append(Operators.EXTRACT(value, position * 8, 8))
        assert len(bytes) == size + padding
        return bytes

Response: Translates a python integer or a BitVec into a 32 byte string MSB first


Instruction:
How would you implement a function in Python 3 that
serializes a signed python integer or a BitVec into a 32 byte string MSB first.

Response:
def _serialize_int(value, size=32, padding=0):
        """
        Translates a signed python integral or a BitVec into a 32 byte string, MSB first
        """
        if size <= 0 or size > 32:
            raise ValueError
        if not isinstance(value, (int, BitVec)):
            raise ValueError
        if issymbolic(value):
            buf = ArrayVariable(index_bits=256, index_max=32, value_bits=8, name='temp{}'.format(uuid.uuid1()))
            value = Operators.SEXTEND(value, value.size, size * 8)
            buf = ArrayProxy(buf.write_BE(padding, value, size))
        else:
            value = int(value)
            buf = bytearray()
            for _ in range(padding):
                buf.append(0)

            for position in reversed(range(size)):
                buf.append(Operators.EXTRACT(value, position * 8, 8))
        return buf


Instruction:
Can you generate a brief explanation for the following Python 3 code
def _deserialize_uint(data, nbytes=32, padding=0, offset=0):
        assert isinstance(data, (bytearray, Array))
        value = ABI._readBE(data, nbytes, padding=True, offset=offset)
        value = Operators.ZEXTEND(value, (nbytes + padding) * 8)
        return value

Response: Deserialize an unsigned integer from the data buffer starting at offset.


Instruction:
Create a Python 3 function for
reading a `nbytes` bytes long big endian signed integer from `data` starting at `offset` :param data: sliceable buffer; symbolic buffer of Eth ABI encoded data :param nbytes: number of bytes to read starting from least significant byte :rtype: int or Expression

Response:
def _deserialize_int(data, nbytes=32, padding=0):
        """
        Read a `nbytes` bytes long big endian signed integer from `data` starting at `offset`

        :param data: sliceable buffer; symbolic buffer of Eth ABI encoded data
        :param nbytes: number of bytes to read starting from least significant byte
        :rtype: int or Expression
        """
        assert isinstance(data, (bytearray, Array))
        value = ABI._readBE(data, nbytes, padding=True)
        value = Operators.SEXTEND(value, nbytes * 8, (nbytes + padding) * 8)
        if not issymbolic(value):
            # sign bit on
            if value & (1 << (nbytes * 8 - 1)):
                value = -(((~value) + 1) & ((1 << (nbytes * 8)) - 1))
        return value


Instruction:
Create a Python 3 function for
making sure an EVM instruction has all of its arguments concretized according to provided policies. Example decoration: @concretized_args(size='ONE', address='') def LOG(self, address, size, *topics): ... The above will make sure that the |size| parameter to LOG is Concretized when symbolic according to the 'ONE' policy and concretize |address| with the default policy. :param policies: A kwargs list of argument names and their respective policies. Provide None or '' as policy to use default. :return: A function decorator

Response:
def concretized_args(**policies):
    """
    Make sure an EVM instruction has all of its arguments concretized according to
    provided policies.

    Example decoration:

        @concretized_args(size='ONE', address='')
        def LOG(self, address, size, *topics):
            ...

    The above will make sure that the |size| parameter to LOG is Concretized when symbolic
    according to the 'ONE' policy and concretize |address| with the default policy.

    :param policies: A kwargs list of argument names and their respective policies.
                         Provide None or '' as policy to use default.
    :return: A function decorator
    """
    def concretizer(func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            spec = inspect.getfullargspec(func)
            for arg, policy in policies.items():
                assert arg in spec.args, "Concretizer argument not found in wrapped function."
                # index is 0-indexed, but ConcretizeArgument is 1-indexed. However, this is correct
                # since implementation method is always a bound method (self is param 0)
                index = spec.args.index(arg)
                if not issymbolic(args[index]):
                    continue
                if not policy:
                    policy = 'SAMPLED'

                if policy == "ACCOUNTS":
                    value = args[index]
                    world = args[0].world
                    #special handler for EVM only policy
                    cond = world._constraint_to_accounts(value, ty='both', include_zero=True)
                    world.constraints.add(cond)
                    policy = 'ALL'
                raise ConcretizeArgument(index, policy=policy)
            return func(*args, **kwargs)
        wrapper.__signature__ = inspect.signature(func)
        return wrapper
    return concretizer


Instruction:
Can you write a function in Python 3 where it
returns a dictionary representation of the current object.

Response:
def to_dict(self, mevm):
        """
        Only meant to be used with concrete Transaction objects! (after calling .concretize())
        """
        return dict(type=self.sort,
                    from_address=self.caller,
                    from_name=mevm.account_name(self.caller),
                    to_address=self.address,
                    to_name=mevm.account_name(self.address),
                    value=self.value,
                    gas=self.gas,
                    data=binascii.hexlify(self.data).decode())


Instruction:
Can you generate the documentation for the following Python 3 function
def dump(self, stream, state, mevm, conc_tx=None):
        from ..ethereum import ABI  # circular imports
        from ..ethereum.manticore import flagged

        is_something_symbolic = False

        if conc_tx is None:
            conc_tx = self.concretize(state)

        # The result if any RETURN or REVERT
        stream.write("Type: %s (%d)\n" % (self.sort, self.depth))

        caller_solution = conc_tx.caller

        caller_name = mevm.account_name(caller_solution)
        stream.write("From: %s(0x%x) %s\n" % (caller_name, caller_solution, flagged(issymbolic(self.caller))))

        address_solution = conc_tx.address
        address_name = mevm.account_name(address_solution)

        stream.write("To: %s(0x%x) %s\n" % (address_name, address_solution, flagged(issymbolic(self.address))))
        stream.write("Value: %d %s\n" % (conc_tx.value, flagged(issymbolic(self.value))))
        stream.write("Gas used: %d %s\n" % (conc_tx.gas, flagged(issymbolic(self.gas))))

        tx_data = conc_tx.data

        stream.write("Data: 0x{} {}\n".format(binascii.hexlify(tx_data).decode(), flagged(issymbolic(self.data))))

        if self.return_data is not None:
            return_data = conc_tx.return_data

            stream.write("Return_data: 0x{} {}\n".format(binascii.hexlify(return_data).decode(), flagged(issymbolic(self.return_data))))

        metadata = mevm.get_metadata(self.address)
        if self.sort == 'CREATE':
            if metadata is not None:

                conc_args_data = conc_tx.data[len(metadata._init_bytecode):]
                arguments = ABI.deserialize(metadata.get_constructor_arguments(), conc_args_data)

                # TODO confirm: arguments should all be concrete?

                is_argument_symbolic = any(map(issymbolic, arguments))  # is this redundant since arguments are all concrete?
                stream.write('Function call:\n')
                stream.write("Constructor(")
                stream.write(','.join(map(repr, map(state.solve_one, arguments))))  # is this redundant since arguments are all concrete?
                stream.write(') -> %s %s\n' % (self.result, flagged(is_argument_symbolic)))

        if self.sort == 'CALL':
            if metadata is not None:
                calldata = conc_tx.data
                is_calldata_symbolic = issymbolic(self.data)

                function_id = calldata[:4]  # hope there is enough data
                signature = metadata.get_func_signature(function_id)
                function_name = metadata.get_func_name(function_id)
                if signature:
                    _, arguments = ABI.deserialize(signature, calldata)
                else:
                    arguments = (calldata,)

                return_data = None
                if self.result == 'RETURN':
                    ret_types = metadata.get_func_return_types(function_id)
                    return_data = conc_tx.return_data
                    return_values = ABI.deserialize(ret_types, return_data)  # function return

                is_return_symbolic = issymbolic(self.return_data)

                stream.write('\n')
                stream.write("Function call:\n")
                stream.write("%s(" % function_name)
                stream.write(','.join(map(repr, arguments)))
                stream.write(') -> %s %s\n' % (self.result, flagged(is_calldata_symbolic)))

                if return_data is not None:
                    if len(return_values) == 1:
                        return_values = return_values[0]

                    stream.write('return: %r %s\n' % (return_values, flagged(is_return_symbolic)))
                is_something_symbolic = is_calldata_symbolic or is_return_symbolic

        stream.write('\n\n')
        return is_something_symbolic

Response: Dump the current state of the current transaction into the stream.


Instruction:
Explain what the following Python 3 code does
def _get_memfee(self, address, size=1):
        if not issymbolic(size) and size == 0:
            return 0

        address = self.safe_add(address, size)
        allocated = self.allocated
        GMEMORY = 3
        GQUADRATICMEMDENOM = 512  # 1 gas per 512 quadwords
        old_size = Operators.ZEXTEND(Operators.UDIV(self.safe_add(allocated, 31), 32), 512)
        new_size = Operators.ZEXTEND(Operators.UDIV(self.safe_add(address, 31), 32), 512)

        old_totalfee = self.safe_mul(old_size, GMEMORY) + Operators.UDIV(self.safe_mul(old_size, old_size), GQUADRATICMEMDENOM)
        new_totalfee = self.safe_mul(new_size, GMEMORY) + Operators.UDIV(self.safe_mul(new_size, new_size), GQUADRATICMEMDENOM)
        memfee = new_totalfee - old_totalfee
        flag = Operators.UGT(new_totalfee, old_totalfee)
        return Operators.ITEBV(512, size == 0, 0, Operators.ITEBV(512, flag, memfee, 0))

Response: This calculates the amount of extra gas needed for accessing the previously unused memory.


Instruction:
Can you write a function in Python 3 where it
reads size byte from bytecode.

Response:
def read_code(self, address, size=1):
        """
        Read size byte from bytecode.
        If less than size bytes are available result will be pad with \x00
        """
        assert address < len(self.bytecode)
        value = self.bytecode[address:address + size]
        if len(value) < size:
            value += '\x00' * (size - len(value))  # pad with null (spec)
        return value


Instruction:
Can you generate the documentation for the following Python 3 function
def instruction(self):
        # FIXME check if pc points to invalid instruction
        # if self.pc >= len(self.bytecode):
        #    return InvalidOpcode('Code out of range')
        # if self.pc in self.invalid:
        #    raise InvalidOpcode('Opcode inside a PUSH immediate')
        try:
            _decoding_cache = getattr(self, '_decoding_cache')
        except Exception:
            _decoding_cache = self._decoding_cache = {}

        pc = self.pc
        if isinstance(pc, Constant):
            pc = pc.value

        if pc in _decoding_cache:
            return _decoding_cache[pc]

        def getcode():
            bytecode = self.bytecode
            for pc_i in range(pc, len(bytecode)):
                yield simplify(bytecode[pc_i]).value
            while True:
                yield 0
        instruction = EVMAsm.disassemble_one(getcode(), pc=pc, fork=DEFAULT_FORK)
        _decoding_cache[pc] = instruction
        return instruction

Response: Return the instruction that corresponds to this instruction.


Instruction:
How would you code a function in Python 3 to
push into the stack.

Response:
def _push(self, value):
        """
        Push into the stack

              ITEM0
              ITEM1
              ITEM2
        sp->  {empty}
        """
        assert isinstance(value, int) or isinstance(value, BitVec) and value.size == 256
        if len(self.stack) >= 1024:
            raise StackOverflow()

        if isinstance(value, int):
            value = value & TT256M1

        value = simplify(value)
        if isinstance(value, Constant) and not value.taint:
            value = value.value
        self.stack.append(value)


Instruction:
Write a Python 3 script for
reading a value from the top of the stack without removing it

Response:
def _top(self, n=0):
        """Read a value from the top of the stack without removing it"""
        if len(self.stack) - n < 0:
            raise StackUnderflow()
        return self.stack[n - 1]


Instruction:
Explain what the following Python 3 code does
def _checkpoint(self):
        #Fixme[felipe] add a with self.disabled_events context mangr to Eventful
        if self._checkpoint_data is None:
            if not self._published_pre_instruction_events:
                self._published_pre_instruction_events = True
                self._publish('will_decode_instruction', self.pc)
                self._publish('will_execute_instruction', self.pc, self.instruction)
                self._publish('will_evm_execute_instruction', self.instruction, self._top_arguments())

            pc = self.pc
            instruction = self.instruction
            old_gas = self.gas
            allocated = self._allocated
            #FIXME Not clear which exception should trigger first. OOG or insuficient stack
            # this could raise an insuficient stack exception
            arguments = self._pop_arguments()
            fee = self._calculate_gas(*arguments)
            self._checkpoint_data = (pc, old_gas, instruction, arguments, fee, allocated)
        return self._checkpoint_data

Response: Save and return a state checkpoint previous to current instruction


Instruction:
Given the following Python 3 function, write the documentation
def _rollback(self):
        last_pc, last_gas, last_instruction, last_arguments, fee, allocated = self._checkpoint_data
        self._push_arguments(last_arguments)
        self._gas = last_gas
        self._pc = last_pc
        self._allocated = allocated
        self._checkpoint_data = None

Response: Revert the stack gas pc and memory allocation so it looks like before executing the instruction


Instruction:
Make a summary of the following Python 3 code
def _check_jmpdest(self):
        should_check_jumpdest = self._check_jumpdest
        if issymbolic(should_check_jumpdest):
            should_check_jumpdest_solutions = solver.get_all_values(self.constraints, should_check_jumpdest)
            if len(should_check_jumpdest_solutions) != 1:
                raise EthereumError("Conditional not concretized at JMPDEST check")
            should_check_jumpdest = should_check_jumpdest_solutions[0]

        if should_check_jumpdest:
            self._check_jumpdest = False

            pc = self.pc.value if isinstance(self.pc, Constant) else self.pc

            if pc not in self._valid_jumpdests:
                raise InvalidOpcode()

Response: Checks that the current instruction is a JUMPDEST.


Instruction:
Can you generate a brief explanation for the following Python 3 code
def _store(self, offset, value, size=1):
        self.memory.write_BE(offset, value, size)
        for i in range(size):
            self._publish('did_evm_write_memory', offset + i, Operators.EXTRACT(value, (size - i - 1) * 8, 8))

Response: Stores value in memory as a big endian


Instruction:
Can you generate a brief explanation for the following Python 3 code
def SDIV(self, a, b):
        s0, s1 = to_signed(a), to_signed(b)
        try:
            result = (Operators.ABS(s0) // Operators.ABS(s1) * Operators.ITEBV(256, (s0 < 0) != (s1 < 0), -1, 1))
        except ZeroDivisionError:
            result = 0
        result = Operators.ITEBV(256, b == 0, 0, result)
        if not issymbolic(result):
            result = to_signed(result)
        return result

Response: Signed integer division operation.


Instruction:
Here you have a function in Python 3, explain what it does
def SMOD(self, a, b):
        s0, s1 = to_signed(a), to_signed(b)
        sign = Operators.ITEBV(256, s0 < 0, -1, 1)
        try:
            result = (Operators.ABS(s0) % Operators.ABS(s1)) * sign
        except ZeroDivisionError:
            result = 0

        return Operators.ITEBV(256, s1 == 0, 0, result)

Response: Signed modulo remainder operation


Instruction:
Create a Python 3 function for
calculating extra gas fee for a given base and exponent

Response:
def EXP_gas(self, base, exponent):
        """Calculate extra gas fee"""
        EXP_SUPPLEMENTAL_GAS = 10   # cost of EXP exponent per byte

        def nbytes(e):
            result = 0
            for i in range(32):
                result = Operators.ITEBV(512, Operators.EXTRACT(e, i * 8, 8) != 0, i + 1, result)
            return result
        return EXP_SUPPLEMENTAL_GAS * nbytes(exponent)


Instruction:
Can you generate the documentation for the following Python 3 function
def SIGNEXTEND(self, size, value):
        # FIXME maybe use Operators.SEXTEND
        testbit = Operators.ITEBV(256, size <= 31, size * 8 + 7, 257)
        result1 = (value | (TT256 - (1 << testbit)))
        result2 = (value & ((1 << testbit) - 1))
        result = Operators.ITEBV(256, (value & (1 << testbit)) != 0, result1, result2)
        return Operators.ITEBV(256, size <= 31, result, value)

Response: Extend length of two s complement signed integer


Instruction:
Given the following Python 3 function, write the documentation
def LT(self, a, b):
        return Operators.ITEBV(256, Operators.ULT(a, b), 1, 0)

Response: get a less - than expression


Instruction:
Given the following Python 3 function, write the documentation
def GT(self, a, b):
        return Operators.ITEBV(256, Operators.UGT(a, b), 1, 0)

Response: get the greater - than comparison


Instruction:
Can you generate a brief explanation for the following Python 3 code
def SGT(self, a, b):
        # http://gavwood.com/paper.pdf
        s0, s1 = to_signed(a), to_signed(b)
        return Operators.ITEBV(256, s0 > s1, 1, 0)

Response: Signed greater - than comparison


Instruction:
Write a Python 3 function for
retrieving single byte from word

Response:
def BYTE(self, offset, value):
        """Retrieve single byte from word"""
        offset = Operators.ITEBV(256, offset < 32, (31 - offset) * 8, 256)
        return Operators.ZEXTEND(Operators.EXTRACT(value, offset, 8), 256)


Instruction:
How would you code a function in Python 3 to
compute the Keccak - 256 hash of the data in the memory starting at start and size.

Response:
def SHA3(self, start, size):
        """Compute Keccak-256 hash"""
        # read memory from start to end
        # http://gavwood.com/paper.pdf
        data = self.try_simplify_to_constant(self.read_buffer(start, size))

        if issymbolic(data):
            known_sha3 = {}
            # Broadcast the signal
            self._publish('on_symbolic_sha3', data, known_sha3)  # This updates the local copy of sha3 with the pairs we need to explore

            value = 0  # never used
            known_hashes_cond = False
            for key, hsh in known_sha3.items():
                assert not issymbolic(key), "Saved sha3 data,hash pairs should be concrete"
                cond = key == data
                known_hashes_cond = Operators.OR(cond, known_hashes_cond)
                value = Operators.ITEBV(256, cond, hsh, value)
            return value

        value = sha3.keccak_256(data).hexdigest()
        value = int(value, 16)
        self._publish('on_concrete_sha3', data, value)
        logger.info("Found a concrete SHA3 example %r -> %x", data, value)
        return value


Instruction:
Implement a Python 3 function for
getting input data of current environment

Response:
def CALLDATALOAD(self, offset):
        """Get input data of current environment"""

        if issymbolic(offset):
            if solver.can_be_true(self._constraints, offset == self._used_calldata_size):
                self.constraints.add(offset == self._used_calldata_size)
            raise ConcretizeArgument(1, policy='SAMPLED')

        self._use_calldata(offset, 32)

        data_length = len(self.data)

        bytes = []
        for i in range(32):
            try:
                c = Operators.ITEBV(8, offset + i < data_length, self.data[offset + i], 0)
            except IndexError:
                # offset + i is concrete and outside data
                c = 0

            bytes.append(c)
        return Operators.CONCAT(256, *bytes)


Instruction:
Implement a Python 3 function for
copying input data in current environment to memory

Response:
def CALLDATACOPY(self, mem_offset, data_offset, size):
        """Copy input data in current environment to memory"""

        if issymbolic(size):
            if solver.can_be_true(self._constraints, size <= len(self.data) + 32):
                self.constraints.add(size <= len(self.data) + 32)
            raise ConcretizeArgument(3, policy='SAMPLED')

        if issymbolic(data_offset):
            if solver.can_be_true(self._constraints, data_offset == self._used_calldata_size):
                self.constraints.add(data_offset == self._used_calldata_size)
            raise ConcretizeArgument(2, policy='SAMPLED')

        #account for calldata usage
        self._use_calldata(data_offset, size)
        self._allocate(mem_offset, size)
        for i in range(size):
            try:
                c = Operators.ITEBV(8, data_offset + i < len(self.data), Operators.ORD(self.data[data_offset + i]), 0)
            except IndexError:
                # data_offset + i is concrete and outside data
                c = 0
            self._store(mem_offset + i, c)


Instruction:
Given the following Python 3 function, write the documentation
def CODECOPY(self, mem_offset, code_offset, size):

        self._allocate(mem_offset, size)
        GCOPY = 3             # cost to copy one 32 byte word
        copyfee = self.safe_mul(GCOPY, Operators.UDIV(self.safe_add(size, 31), 32))
        self._consume(copyfee)

        if issymbolic(size):
            max_size = solver.max(self.constraints, size)
        else:
            max_size = size

        for i in range(max_size):
            if issymbolic(i < size):
                default = Operators.ITEBV(8, i < size, 0, self._load(mem_offset + i, 1))  # Fixme. unnecessary memory read
            else:
                if i < size:
                    default = 0
                else:
                    default = self._load(mem_offset + i, 1)

            if issymbolic(code_offset):
                value = Operators.ITEBV(8, code_offset + i >= len(self.bytecode), default, self.bytecode[code_offset + i])
            else:
                if code_offset + i >= len(self.bytecode):
                    value = default
                else:
                    value = self.bytecode[code_offset + i]
            self._store(mem_offset + i, value)
        self._publish('did_evm_read_code', code_offset, size)

Response: Copy code running in current environment to memory


Instruction:
Write a Python 3 function for
copying an account s code to memory

Response:
def EXTCODECOPY(self, account, address, offset, size):
        """Copy an account's code to memory"""
        extbytecode = self.world.get_code(account)
        self._allocate(address + size)

        for i in range(size):
            if offset + i < len(extbytecode):
                self._store(address + i, extbytecode[offset + i])
            else:
                self._store(address + i, 0)


Instruction:
Create a Python 3 function to
load word from memory.

Response:
def MLOAD(self, address):
        """Load word from memory"""
        self._allocate(address, 32)
        value = self._load(address, 32)
        return value


Instruction:
Write a Python 3 function for
saving word to memory

Response:
def MSTORE(self, address, value):
        """Save word to memory"""
        if istainted(self.pc):
            for taint in get_taints(self.pc):
                value = taint_with(value, taint)
        self._allocate(address, 32)
        self._store(address, value, 32)


Instruction:
Write a Python 3 script to
save byte to memory.

Response:
def MSTORE8(self, address, value):
        """Save byte to memory"""
        if istainted(self.pc):
            for taint in get_taints(self.pc):
                value = taint_with(value, taint)
        self._allocate(address, 1)
        self._store(address, Operators.EXTRACT(value, 0, 8), 1)


Instruction:
How would you code a function in Python 3 to
load word from storage

Response:
def SLOAD(self, offset):
        """Load word from storage"""
        storage_address = self.address
        self._publish('will_evm_read_storage', storage_address, offset)
        value = self.world.get_storage_data(storage_address, offset)
        self._publish('did_evm_read_storage', storage_address, offset, value)
        return value


Instruction:
Implement a Python 3 function for
saving word to storage

Response:
def SSTORE(self, offset, value):
        """Save word to storage"""
        storage_address = self.address
        self._publish('will_evm_write_storage', storage_address, offset, value)
        #refund = Operators.ITEBV(256,
        #                         previous_value != 0,
        #                         Operators.ITEBV(256, value != 0, 0, GSTORAGEREFUND),
        #                         0)

        if istainted(self.pc):
            for taint in get_taints(self.pc):
                value = taint_with(value, taint)
        self.world.set_storage_data(storage_address, offset, value)
        self._publish('did_evm_write_storage', storage_address, offset, value)


Instruction:
Implement a function in Python 3 to
exchange 1st and 2nd stack items

Response:
def SWAP(self, *operands):
        """Exchange 1st and 2nd stack items"""
        a = operands[0]
        b = operands[-1]
        return (b,) + operands[1:-1] + (a,)


Instruction:
Explain what the following Python 3 code does
def CREATE(self, value, offset, size):
        address = self.world.create_account(address=EVMWorld.calculate_new_address(sender=self.address, nonce=self.world.get_nonce(self.address)))
        self.world.start_transaction('CREATE',
                                     address,
                                     data=self.read_buffer(offset, size),
                                     caller=self.address,
                                     value=value,
                                     gas=self.gas)

        raise StartTx()

Response: Create a new account with associated code


Instruction:
Write a Python 3 function for
creating a new account with associated code

Response:
def CREATE(self, value, offset, size):
        """Create a new account with associated code"""
        tx = self.world.last_transaction  # At this point last and current tx are the same.
        address = tx.address
        if tx.result == 'RETURN':
            self.world.set_code(tx.address, tx.return_data)
        else:
            self.world.delete_account(address)
            address = 0
        return address


Instruction:
Can you generate the documentation for the following Python 3 function
def CALLCODE(self, gas, _ignored_, value, in_offset, in_size, out_offset, out_size):
        self.world.start_transaction('CALLCODE',
                                     address=self.address,
                                     data=self.read_buffer(in_offset, in_size),
                                     caller=self.address,
                                     value=value,
                                     gas=gas)
        raise StartTx()

Response: Message - call into this account with alternative account s code


Instruction:
Explain what the following Python 3 code does
def RETURN(self, offset, size):
        data = self.read_buffer(offset, size)
        raise EndTx('RETURN', data)

Response: Halt execution returning output data


Instruction:
Here you have a function in Python 3, explain what it does
def SELFDESTRUCT(self, recipient):
        #This may create a user account
        recipient = Operators.EXTRACT(recipient, 0, 160)
        address = self.address
        #FIXME for on the known addresses
        if issymbolic(recipient):
            logger.info("Symbolic recipient on self destruct")
            recipient = solver.get_value(self.constraints, recipient)

        if recipient not in self.world:
            self.world.create_account(address=recipient)

        self.world.send_funds(address, recipient, self.world.get_balance(address))
        self.world.delete_account(address)

        raise EndTx('SELFDESTRUCT')

Response: Halt execution and register account for later deletion


Instruction:
Here you have a function in Python 3, explain what it does
def human_transactions(self):
        txs = []
        for tx in self.transactions:
            if tx.depth == 0:
                txs.append(tx)
        return tuple(txs)

Response: Returns a tuple of all human transactions.


Instruction:
Given the following Python 3 function, write the documentation
def current_vm(self):
        try:
            _, _, _, _, vm = self._callstack[-1]
            return vm
        except IndexError:
            return None

Response: get the current vm


Instruction:
Create a Python 3 function for
returning the current transaction ID.

Response:
def current_transaction(self):
        """current tx"""
        try:
            tx, _, _, _, _ = self._callstack[-1]
            if tx.result is not None:
                #That tx finished. No current tx.
                return None
            return tx
        except IndexError:
            return None


Instruction:
Create a Python 3 function to
return the current human transaction ID.

Response:
def current_human_transaction(self):
        """Current ongoing human transaction"""
        try:
            tx, _, _, _, _ = self._callstack[0]
            if tx.result is not None:
                #That tx finished. No current tx.
                return None
            assert tx.depth == 0
            return tx
        except IndexError:
            return None


Instruction:
Can you generate a brief explanation for the following Python 3 code
def get_storage_data(self, storage_address, offset):
        value = self._world_state[storage_address]['storage'].get(offset, 0)
        return simplify(value)

Response: Read a value from a storage slot on the specified account


Instruction:
How would you code a function in Python 3 to
write a value to a storage slot in the specified account

Response:
def set_storage_data(self, storage_address, offset, value):
        """
        Writes a value to a storage slot in specified account

        :param storage_address: an account address
        :param offset: the storage slot to use.
        :type offset: int or BitVec
        :param value: the value to write
        :type value: int or BitVec
        """
        self._world_state[storage_address]['storage'][offset] = value


Instruction:
How would you explain what the following Python 3 function does
def get_storage_items(self, address):
        storage = self._world_state[address]['storage']
        items = []
        array = storage.array
        while not isinstance(array, ArrayVariable):
            items.append((array.index, array.value))
            array = array.array
        return items

Response: Gets all items in an account storage.


Instruction:
Can you tell what is the following Python 3 function doing
def has_storage(self, address):
        storage = self._world_state[address]['storage']
        array = storage.array
        while not isinstance(array, ArrayVariable):
            if isinstance(array, ArrayStore):
                return True
            array = array.array
        return False

Response: Returns True if something has been written to the storage.


Instruction:
Write a Python 3 script to
calculate a block s hash based on the block number.

Response:
def block_hash(self, block_number=None, force_recent=True):
        """
        Calculates a block's hash
        :param block_number: the block number for which to calculate the hash, defaulting to the most recent block
        :param force_recent: if True (the default) return zero for any block that is in the future or older than 256 blocks
        :return: the block hash
        """
        if block_number is None:
            block_number = self.block_number() - 1

        # We are not maintaining an actual -block-chain- so we just generate
        # some hashes for each virtual block
        value = sha3.keccak_256((repr(block_number) + 'NONCE').encode()).hexdigest()
        value = int(value, 16)

        if force_recent:
            # 0 is left on the stack if the looked for block number is greater or equal
            # than the current block number or more than 256 blocks behind the current
            # block. (Current block hash is unknown from inside the tx)
            bnmax = Operators.ITEBV(256, self.block_number() > 256, 256, self.block_number())
            value = Operators.ITEBV(256, Operators.OR(block_number >= self.block_number(), block_number < bnmax), 0, value)

        return value


Instruction:
Write a Python 3 function that can
create a fresh 160bit address

Response:
def new_address(self, sender=None, nonce=None):
        """Create a fresh 160bit address"""
        if sender is not None and nonce is None:
            nonce = self.get_nonce(sender)

        new_address = self.calculate_new_address(sender, nonce)
        if sender is None and new_address in self:
            return self.new_address(sender, nonce)
        return new_address


Instruction:
Write a Python 3 function that can
create a new Wei - related account.

Response:
def create_account(self, address=None, balance=0, code=None, storage=None, nonce=None):
        """
        Low level account creation. No transaction is done.
        :param address: the address of the account, if known. If omitted, a new address will be generated as closely to the Yellow Paper as possible.
        :param balance: the initial balance of the account in Wei
        :param code: the runtime code of the account, if a contract
        :param storage: storage array
        :param nonce: the nonce for the account; contracts should have a nonce greater than or equal to 1
        """
        if code is None:
            code = bytes()
        else:
            if not isinstance(code, (bytes, Array)):
                raise EthereumError('Wrong code type')

        # nonce default to initial nonce
        if nonce is None:
            # As per EIP 161, contract accounts are initialized with a nonce of 1
            nonce = 1 if code else 0

        if address is None:
            address = self.new_address()

        if not isinstance(address, int):
            raise EthereumError('You must provide an address')

        if address in self.accounts:
            # FIXME account may have been created via selfdestruct destination
            # or CALL and may contain some ether already, though if it was a
            # selfdestructed address, it can not be reused
            raise EthereumError('The account already exists')

        if storage is None:
            # Uninitialized values in a storage are 0 by spec
            storage = self.constraints.new_array(index_bits=256, value_bits=256, name=f'STORAGE_{address:x}', avoid_collisions=True, default=0)
        else:
            if isinstance(storage, ArrayProxy):
                if storage.index_bits != 256 or storage.value_bits != 256:
                    raise TypeError("An ArrayProxy 256bits -> 256bits is needed")
            else:
                if any((k < 0 or k >= 1 << 256 for k, v in storage.items())):
                    raise TypeError("Need a dict like object that maps 256 bits keys to 256 bits values")
            # Hopefully here we have a mapping from 256b to 256b

        self._world_state[address] = {}
        self._world_state[address]['nonce'] = nonce
        self._world_state[address]['balance'] = balance
        self._world_state[address]['storage'] = storage
        self._world_state[address]['code'] = code

        # adds hash of new address
        data = binascii.unhexlify('{:064x}{:064x}'.format(address, 0))
        value = sha3.keccak_256(data).hexdigest()
        value = int(value, 16)
        self._publish('on_concrete_sha3', data, value)

        return address