Security analysis tool for EVM bytecode. Supports smart contracts built for Ethereum, Hedera, Quorum, Vechain, Roostock, Tron and other EVM-compatible blockchains.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
mythril/setup.py

342 lines
9.5 KiB

from setuptools import setup, find_packages
from setuptools.command.install import install
import os
# Package version (vX.Y.Z). It must match git tag being used for CircleCI
# deployment; otherwise the build will failed.
VERSION = "v0.16.32"
class VerifyVersionCommand(install):
"""Custom command to verify that the git tag matches our version"""
description = 'verify that the git tag matches our version'
def run(self):
tag = os.getenv('CIRCLE_TAG')
if (tag != VERSION):
info = "Git tag: {0} does not match the version of this app: {1}".format(tag, VERSION)
sys.exit(info)
long_description = '''
7 years ago
Mythril is a security analysis tool for Ethereum smart contracts. It
uses concolic analysis to detect various types of issues. Use it to
analyze source code or as a nmap-style black-box blockchain scanner (an
"ethermap" if you will).
7 years ago
Installation and setup
----------------------
Install from Pypi:
.. code:: bash
7 years ago
$ pip install mythril
7 years ago
Or, clone the GitHub repo to install the newest master branch:
.. code:: bash
$ git clone https://github.com/b-mueller/mythril/
$ cd mythril
$ python setup.py install
7 years ago
Note that Mythril requires Python 3.5 to work.
7 years ago
7 years ago
Function signatures
~~~~~~~~~~~~~~~~~~~
Whenever you disassemble or analyze binary code, Mythril will try to
resolve function names using its local signature database. The database
must be provided at ``~/.mythril/signatures.json``. You can start out
with the `default file <signatures.json>`__ as follows:
::
$ cd ~/.mythril
$ wget https://raw.githubusercontent.com/b-mueller/mythril/master/signatures.json
When you analyze Solidity code, new function signatures are added to the
database automatically.
7 years ago
7 years ago
Security analysis
-----------------
7 years ago
7 years ago
Run ``myth -x`` with one of the input options described below to run the
analysis. This will run the Python modules in the
`/analysis/modules <https://github.com/b-mueller/mythril/tree/master/mythril/analysis/modules>`__
directory.
Mythril detects a range of `security issues <security_checks.md>`__,
including integer underflows, owner-overwrite-to-Ether-withdrawal, and
others. However, the analysis will not detect business logic issues and
is not equivalent to formal verification.
Analyzing Solidity code
7 years ago
~~~~~~~~~~~~~~~~~~~~~~~
7 years ago
In order to work with Solidity source code files, the `solc command line
compiler <http://solidity.readthedocs.io/en/develop/using-the-compiler.html>`__
needs to be installed and in path. You can then provide the source
file(s) as positional arguments, e.g.:
.. code:: bash
$ myth -x myContract.sol
Alternatively, compile the code on `Remix <http://remix.ethereum.org>`__
and pass the runtime binary code to Mythril:
.. code:: bash
$ myth -x -c "0x5060(...)"
If you have multiple interdependent contracts, pass them to Mythril as
separate input files. Mythril will map the first contract to address
"0x0000(..)", the second one to "0x1111(...)", and so forth (make sure
that contract addresses are set accordingly in the source). The contract
passed in the first argument will be executed as the "main" contract.
.. code:: bash
$ myth -x myContract.sol myLibrary.sol
Working with on-chain contracts
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To analyze contracts on the blockchain you need an Ethereum node. By
default, Mythril will query a local node via RPC. Alternatively, you can
use `INFURA <https://infura.io>`__:
::
$ myth --infura-mainnet -x -a 0x5c436ff914c458983414019195e0f4ecbef9e6dd
If you are planning to do batch operations or use the contract search
features, running a
`go-ethereum <https://github.com/ethereum/go-ethereum>`__ node is
recommended. Start your local node as follows:
.. code:: bash
$ geth --rpc --rpcapi eth,debug --syncmode fast
Specify the target contract with the ``-a`` option:
.. code:: bash
$ myth -x -a 0x5c436ff914c458983414019195e0f4ecbef9e6dd -v1
Adding the ``-l`` flag will cause Mythril to automatically retrieve
dependencies, such as library contracts:
.. code:: bash
$ myth -x -a 0xEbFD99838cb0c132016B9E117563CB41f2B02264 -l -v1
Control flow graph
------------------
The ``-g FILENAME`` option generates an `interactive jsViz
graph <http://htmlpreview.github.io/?https://github.com/b-mueller/mythril/blob/master/static/mythril.html>`__:
.. code:: bash
$ myth -g ./graph.html -a 0xEbFD99838cb0c132016B9E117563CB41f2B02264 -l
.. figure:: https://raw.githubusercontent.com/b-mueller/mythril/master/static/callgraph7.png
:alt: Call graph
callgraph
[STRIKEOUT:The "bounce" effect, while awesome (and thus enabled by
default), sometimes messes up the graph layout.] Try adding the
``--enable-physics`` flag for a very entertaining "bounce" effect that
unfortunately completely destroys usability.
Blockchain exploration
----------------------
Mythril builds its own contract database to enable fast search
7 years ago
operations. This enables operations like those described in the
`legendary "Mitch Brenner" blog
post <https://medium.com/@rtaylor30/how-i-snatched-your-153-037-eth-after-a-bad-tinder-date-d1d84422a50b>`__
in [STRIKEOUT:seconds] minutes instead of days. Unfortunately, the
initial sync process is slow. You don't need to sync the whole
blockchain right away though: If you abort the syncing process with
``ctrl+c``, it will be auto-resumed the next time you run the
``--init-db`` command.
7 years ago
.. code:: bash
7 years ago
$ myth --init-db
7 years ago
Starting synchronization from latest block: 4323706
Processing block 4323000, 3 individual contracts in database
(...)
The default behavior is to only sync contracts with a non-zero balance.
You can disable this behavior with the ``--sync-all`` flag, but be aware
that this will result in a huge (as in: dozens of GB) database.
7 years ago
7 years ago
Searching from the command line
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
7 years ago
The search feature allows you to find contract instances that contain
specific function calls and opcode sequences. It supports simple boolean
expressions, such as:
7 years ago
.. code:: bash
7 years ago
$ myth --search "func#changeMultisig(address)#"
$ myth --search "code#PUSH1 0x50,POP#"
$ myth --search "func#changeMultisig(address)# and code#PUSH1 0x50#"
7 years ago
7 years ago
Reading contract storage
~~~~~~~~~~~~~~~~~~~~~~~~
You can read the contents of storage slots from a deployed contract as
follows.
.. code:: bash
./myth --storage 0 -a "0x76799f77587738bfeef09452df215b63d2cfb08a"
0x0000000000000000000000000000000000000000000000000000000000000003
Utilities
---------
7 years ago
Disassembler
~~~~~~~~~~~~
Use the ``-d`` flag to disassemble code. The disassembler accepts a
bytecode string or a contract address as its input.
.. code:: bash
7 years ago
$ myth -d -c "0x6060"
0 PUSH1 0x60
Specifying an address via ``-a ADDRESS`` will download the contract code
7 years ago
from your node.
7 years ago
.. code:: bash
7 years ago
$ myth -d -a "0x2a0c0dbecc7e4d658f48e01e3fa353f44050c208"
0 PUSH1 0x60
2 PUSH1 0x40
4 MSTORE
7 years ago
(...)
1135 - FUNCTION safeAdd(uint256,uint256) -
1136 CALLVALUE
1137 ISZERO
7 years ago
Finding cross-references
7 years ago
~~~~~~~~~~~~~~~~~~~~~~~~
7 years ago
It is often useful to find other contracts referenced by a particular
7 years ago
contract. E.g.:
7 years ago
.. code:: bash
7 years ago
$ myth --search "code#DELEGATECALL#"
7 years ago
Matched contract with code hash 07459966443977122e639cbf7804c446
Address: 0x76799f77587738bfeef09452df215b63d2cfb08a, balance: 1000000000000000
7 years ago
$ myth --xrefs -a 0x76799f77587738bfeef09452df215b63d2cfb08a
7 years ago
5b9e8728e316bbeb692d22daaab74f6cbf2c4691
7 years ago
Calculating function hashes
~~~~~~~~~~~~~~~~~~~~~~~~~~~
7 years ago
7 years ago
To print the Keccak hash for a given function signature:
7 years ago
7 years ago
.. code:: bash
7 years ago
7 years ago
$ myth --hash "setOwner(address)"
0x13af4035
7 years ago
Credit
------
7 years ago
- JSON RPC library is adapted from
`ethjsonrpc <https://github.com/ConsenSys/ethjsonrpc>`__ (it doesn't
seem to be maintained anymore, and I needed to make some changes to
it).
- The signature data in ``signatures.json`` was initially obtained from
the `Ethereum Function Signature
Database <https://www.4byte.directory>`__.
'''
setup(
name='mythril',
version=VERSION[1:],
7 years ago
description='Security analysis tool for Ethereum smart contracts',
long_description=long_description,
url='https://github.com/b-mueller/mythril',
author='Bernhard Mueller',
7 years ago
author_email='bernhard.mueller11@gmail.com',
license='MIT',
classifiers=[
'Development Status :: 3 - Alpha',
'Intended Audience :: Science/Research',
'Topic :: Software Development :: Disassemblers',
'License :: OSI Approved :: MIT License',
'Programming Language :: Python :: 2',
'Programming Language :: Python :: 2.7',
'Programming Language :: Python :: 3',
'Programming Language :: Python :: 3.3',
'Programming Language :: Python :: 3.4',
'Programming Language :: Python :: 3.5',
],
7 years ago
keywords='hacking disassembler security ethereum',
packages=find_packages(exclude=['contrib', 'docs', 'tests']),
install_requires=[
'ethereum>=2.3.0',
'ZODB>=5.3.0',
7 years ago
'z3-solver>=4.5',
'laser-ethereum>=0.5.20',
'requests',
'BTrees',
'py-solc',
'plyvel',
'pytest',
'eth_abi>=1.0.0',
'eth-utils>=1.0.1',
'eth-account>=0.1.0a2',
'eth-hash>=0.1.0',
'eth-keyfile>=0.5.1',
'eth-keys>=0.2.0b3',
'eth-rlp>=0.1.0',
'eth-tester>=0.1.0b21',
'coverage',
'jinja2',
'attrs',
'rlp<1.0.0'
],
7 years ago
python_requires='>=3.5',
extras_require={
},
7 years ago
include_package_data=True,
scripts=['myth'],
cmdclass = {
'verify': VerifyVersionCommand,
}
7 years ago
)