mirror of https://github.com/ConsenSys/mythril
Bernhard Mueller
7 years ago
parent
31c5bbdc70
commit
670097302a
@ -1,154 +0,0 @@ |
||||
Mythril |
||||
======= |
||||
|
||||
Mythril is a reverse engineering and bug hunting framework for the Ethereum blockchain. |
||||
|
||||
Be responsible! |
||||
--------------- |
||||
|
||||
The purpose of project is to aid discovery of vulnerable smart contracts on the Ethereum mainnet and |
||||
support research for novel security flaws. If you do find an exploitable issue or vulnerable |
||||
contract instances, please `do the right |
||||
thing <https://en.wikipedia.org/wiki/Responsible_disclosure>`__. Also, note that vulnerability |
||||
branding ("etherbleed", "chainshock",...) is highly discouraged as it will annoy the author and |
||||
others in the security community. |
||||
|
||||
Installation and setup |
||||
---------------------- |
||||
|
||||
Install from Pypi: |
||||
|
||||
.. code:: bash |
||||
|
||||
$ pip install mythril |
||||
|
||||
Or, clone the GitHub repo to install the newest master branch: |
||||
|
||||
.. code:: bash |
||||
|
||||
$ git clone https://github.com/b-mueller/mythril/ |
||||
$ cd mythril |
||||
$ python setup.py install |
||||
|
||||
You also need a `go-ethereum <https://github.com/ethereum/go-ethereum>`__ node that is synced with |
||||
the network (not that Mythril uses non-standard RPC APIs offered by go-ethereum, so other clients |
||||
likely won't work). Start the node as follows: |
||||
|
||||
.. code:: bash |
||||
|
||||
$ geth --rpc --rpcapi eth,admin,debug --syncmode fast |
||||
|
||||
Database initialization |
||||
~~~~~~~~~~~~~~~~~~~~~~~ |
||||
|
||||
Mythril builds its own contract database using RPC sync. Unfortunately, this process is slow - |
||||
however, you don't need to sync the whole blockchain right away. If you abort the syncing process |
||||
with ``ctrl+c``, it will auto-resume the next time you run the ``--init-db`` command. |
||||
|
||||
.. code:: bash |
||||
|
||||
$ mythril --init-db |
||||
Starting synchronization from latest block: 4323706 |
||||
Processing block 4323000, 3 individual contracts in database |
||||
(...) |
||||
|
||||
The default behavior is to only sync contracts with a non-zero balance. You can disable this |
||||
behavior with the ``--sync-all`` flag, but note that this will result in a very large |
||||
(multi-gigabyte) database. |
||||
|
||||
Command line usage |
||||
------------------ |
||||
|
||||
The ``mythril`` command line tool allows you to easily access most of Mythril's functionality. |
||||
|
||||
Searching the database |
||||
~~~~~~~~~~~~~~~~~~~~~~ |
||||
|
||||
The search feature allows you to find contract instances that contain specific function calls and |
||||
opcode sequences. It supports simple boolean expressions, such as: |
||||
|
||||
.. code:: bash |
||||
|
||||
$ mythril --search "func#changeMultisig(address)#" |
||||
$ mythril --search "code#PUSH1 0x50,POP#" |
||||
$ mythril --search "func#changeMultisig(address)# and code#PUSH1 0x50#" |
||||
|
||||
Disassembler |
||||
~~~~~~~~~~~~ |
||||
|
||||
You can also disassemble and trace code using the ``-d`` and ``-t`` flags, respectively. When |
||||
tracing, the code is run in the PyEthereum virtual machine with the (optional) input data passed via |
||||
the ``--data`` flag. |
||||
|
||||
:: |
||||
|
||||
$ mythril -d -a "0x3665f2bf19ee5e207645f3e635bf0f4961d661c0" |
||||
PUSH1 0x60 |
||||
PUSH1 0x40 |
||||
(...) |
||||
$ mythril -t -a "0x3665f2bf19ee5e207645f3e635bf0f4961d661c0" |
||||
vm storage={'storage': {}, 'nonce': '0', 'balance': '0', 'code': '0x'} gas=b'21000' stack=[] address=b'6e\xf2\xbf\x19\xee^ vE\xf3\xe65\xbf\x0fIa\xd6a\xc0' depth=0 steps=0 inst=96 pushvalue=96 pc=b'0' op=PUSH1 |
||||
vm op=PUSH1 gas=b'20997' stack=[b'96'] depth=0 steps=1 inst=96 pushvalue=64 pc=b'2' |
||||
vm op=MSTORE gas=b'20994' stack=[b'96', b'64'] depth=0 steps=2 inst=82 pc=b'4' |
||||
|
||||
Do note however that the disassembly / debugging functionality is still quite bare-bones. For manual |
||||
analysis & debugging I recommend using `remix <https://remix.ethereum.org/>`__ and |
||||
`etherscan <https://etherscan.io>`__. |
||||
|
||||
Finding cross-references |
||||
^^^^^^^^^^^^^^^^^^^^^^^^ |
||||
|
||||
It is often useful to know what other addresses are referenced by a particular contract. Let's say |
||||
you are looking for conditions similar to the `Parity Multisig Wallet |
||||
Bug <http://hackingdistributed.com/2017/07/22/deep-dive-parity-bug/>`__. First, you want to find a |
||||
list of contracts that use the ``DELEGATECALL`` opcode: |
||||
|
||||
:: |
||||
|
||||
$ mythril --search "code#DELEGATECALL#" |
||||
Matched contract with code hash 05e8f07600bd384d82a71aaccaf4b3d3 |
||||
Address: 0x432f96e95d249351391583cef9cbda38f26238c8, balance: 1000000000000000 |
||||
Matched contract with code hash 07459966443977122e639cbf7804c446 |
||||
Address: 0x76799f77587738bfeef09452df215b63d2cfb08a, balance: 1000000000000000 |
||||
Address: 0x3582d2a3b67d63ed10f1ecaef0dca71b9283b543, balance: 92000000000000000000 |
||||
Address: 0x4b9bc00c35f7cee95c65c3c9836040c37dec9772, balance: 89000000000000000000 |
||||
Address: 0x156d5687a201affb3f1e632dcfb9fde4b0128211, balance: 29500000000000000000 |
||||
(...) |
||||
|
||||
You can then use the ``--xrefs`` flag to find other contracts referenced by each of those contracts: |
||||
|
||||
:: |
||||
|
||||
$ mythril/mythril --xrefs 07459966443977122e639cbf7804c446 |
||||
5b9e8728e316bbeb692d22daaab74f6cbf2c4691 |
||||
|
||||
Then, head to Etherscan to check out the source code, or use the tracer to dynamically test for |
||||
issues. |
||||
|
||||
Custom scripts |
||||
-------------- |
||||
|
||||
By combining Mythril and `PyEthereum <https://github.com/ethereum/pyethereum>`__ modules you can |
||||
perform more complex static/dynamic analysis tasks. |
||||
|
||||
-- TODO: Add example(s) -- |
||||
|
||||
Issues |
||||
------ |
||||
|
||||
The RPC database sync is not a very good solution. I explored some other options, including: |
||||
|
||||
- Using PyEthereum: I encountered issues syncing PyEthereum with Homestead. Also, PyEthApp only |
||||
supports Python 2.7, which causes issues with other important packages. |
||||
- Accessing the Go-Ethereum LevelDB: This would be a great option. However, PyEthereum database |
||||
code seems unable to deal with Go-Ethereum's LevelDB. It would take quite a bit of effort to |
||||
figure this out. |
||||
- IPC might allow for faster sync then RPC - haven't tried it yet. |
||||
|
||||
I'm writing this in my spare time, so contributors would be highly welcome! |
||||
|
||||
Credit |
||||
------ |
||||
|
||||
JSON RPC library is adapted from `ethjsonrpc <https://github.com/ConsenSys/ethjsonrpc>`__ (it |
||||
doesn't seem to be maintained anymore, and I needed to make some changes to it). |
||||
Loading…
Reference in new issue