{"id":13421686,"url":"https://github.com/trailofbits/manticore","last_synced_at":"2025-05-13T22:04:48.091Z","repository":{"id":37587552,"uuid":"81612762","full_name":"trailofbits/manticore","owner":"trailofbits","description":"Symbolic execution tool","archived":false,"fork":false,"pushed_at":"2023-09-15T20:21:13.000Z","size":45602,"stargazers_count":3743,"open_issues_count":276,"forks_count":478,"subscribers_count":129,"default_branch":"master","last_synced_at":"2025-04-12T09:42:45.000Z","etag":null,"topics":["binary-analysis","blockchain","emulation","ethereum","program-analysis","python","security","smt","symbolic-execution","testing","z3"],"latest_commit_sha":null,"homepage":"https://blog.trailofbits.com/2017/04/27/manticore-symbolic-execution-for-humans/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/trailofbits.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":"CITATION.cff","codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2017-02-10T22:28:34.000Z","updated_at":"2025-04-11T12:55:50.000Z","dependencies_parsed_at":"2023-02-11T06:45:42.761Z","dependency_job_id":"a534e179-a9bd-43db-840b-dbd6cab6ef30","html_url":"https://github.com/trailofbits/manticore","commit_stats":{"total_commits":1090,"total_committers":107,"mean_commits":"10.186915887850468","dds":0.8183486238532109,"last_synced_commit":"2425d3114ebebfdbf88bd736e8d6037353a367b8"},"previous_names":[],"tags_count":28,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trailofbits%2Fmanticore","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trailofbits%2Fmanticore/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trailofbits%2Fmanticore/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trailofbits%2Fmanticore/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/trailofbits","download_url":"https://codeload.github.com/trailofbits/manticore/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251337620,"owners_count":21573407,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["binary-analysis","blockchain","emulation","ethereum","program-analysis","python","security","smt","symbolic-execution","testing","z3"],"created_at":"2024-07-30T23:00:28.237Z","updated_at":"2025-04-28T15:26:53.110Z","avatar_url":"https://github.com/trailofbits.png","language":"Python","readme":"# :warning: Project is in Maintenance Mode :warning:\n\nThis project is no longer internally developed and maintained. However, we are happy to review and accept small, well-written pull requests by the community. We will only consider bug fixes and minor enhancements.\n\nAny new or currently open issues and discussions shall be answered and supported by the community.\n\n# Manticore\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/trailofbits/manticore/master/docs/images/manticore.png\" width=\"256\" title=\"Manticore\"\u003e\n\u003c/p\u003e\n\u003cbr /\u003e\n\n\n[![Build Status](https://img.shields.io/github/actions/workflow/status/trailofbits/manticore/ci.yml?branch=master)](https://github.com/trailofbits/manticore/actions?query=workflow%3ACI)\n[![Coverage Status](https://coveralls.io/repos/github/trailofbits/manticore/badge.svg)](https://coveralls.io/github/trailofbits/manticore)\n[![PyPI Version](https://badge.fury.io/py/manticore.svg)](https://badge.fury.io/py/manticore)\n[![Slack Status](https://slack.empirehacking.nyc/badge.svg)](https://slack.empirehacking.nyc)\n[![Documentation Status](https://readthedocs.org/projects/manticore/badge/?version=latest)](http://manticore.readthedocs.io/en/latest/?badge=latest)\n[![Example Status](https://img.shields.io/github/actions/workflow/status/trailofbits/manticore-examples/ci.yml?branch=master)](https://github.com/trailofbits/manticore-examples/actions?query=workflow%3ACI)\n[![LGTM Total Alerts](https://img.shields.io/lgtm/alerts/g/trailofbits/manticore.svg?logo=lgtm\u0026logoWidth=18)](https://lgtm.com/projects/g/trailofbits/manticore/alerts/)\n\n\n\nManticore is a symbolic execution tool for the analysis of smart contracts and binaries.\n\n## Features\n\n- **Program Exploration**: Manticore can execute a program with symbolic inputs and explore all the possible states it can reach\n- **Input Generation**: Manticore can automatically produce concrete inputs that result in a given program state\n- **Error Discovery**: Manticore can detect crashes and other failure cases in binaries and smart contracts\n- **Instrumentation**: Manticore provides fine-grained control of state exploration via event callbacks and instruction hooks\n- **Programmatic Interface**: Manticore exposes programmatic access to its analysis engine via a Python API\n\nManticore can analyze the following types of programs:\n\n- Ethereum smart contracts (EVM bytecode)\n- Linux ELF binaries (x86, x86_64, aarch64, and ARMv7)\n- WASM Modules\n\n## Installation\n\n\u003e Note: We recommend installing Manticore in a [virtual environment](https://packaging.python.org/guides/installing-using-pip-and-virtual-environments/#installing-virtualenv)\n to prevent conflicts with other projects or packages\n\nOption 1: Installing from PyPI:\n\n```bash\npip install manticore\n```\n\nOption 2: Installing from PyPI, with extra dependencies needed to execute native binaries:\n\n```bash\npip install \"manticore[native]\"\n```\n\nOption 3: Installing a nightly development build:\n\n```bash\npip install --pre \"manticore[native]\"\n```\n\nOption 4: Installing from the `master` branch:\n\n```bash\ngit clone https://github.com/trailofbits/manticore.git\ncd manticore\npip install -e \".[native]\"\n```\n\nOption 5: Install via Docker:\n\n```bash\ndocker pull trailofbits/manticore\n```\n\nOnce installed, the `manticore` CLI tool and Python API will be available.\n\nFor a development installation, see our [wiki](https://github.com/trailofbits/manticore/wiki/Hacking-on-Manticore).\n\n## Usage\n\n### CLI\n\nManticore has a command line interface which can perform a basic symbolic analysis of a binary or smart contract. \nAnalysis results will be placed into a workspace directory beginning with `mcore_`. For information about the workspace, see the [wiki](https://github.com/trailofbits/manticore/wiki/What's-in-the-workspace%3F).\n\n#### EVM\nManticore CLI automatically detects you are trying to test a contract if (for ex.)\n the contract has a `.sol` or a `.vy` extension. See a [demo](https://asciinema.org/a/154012).\n\u003cdetails\u003e\n  \u003csummary\u003eClick to expand:\u003c/summary\u003e\n  \n```bash\n$ manticore examples/evm/umd_example.sol \n [9921] m.main:INFO: Registered plugins: DetectUninitializedMemory, DetectReentrancySimple, DetectExternalCallAndLeak, ...\n [9921] m.e.manticore:INFO: Starting symbolic create contract\n [9921] m.e.manticore:INFO: Starting symbolic transaction: 0\n [9921] m.e.manticore:INFO: 4 alive states, 6 terminated states\n [9921] m.e.manticore:INFO: Starting symbolic transaction: 1\n [9921] m.e.manticore:INFO: 16 alive states, 22 terminated states\n[13761] m.c.manticore:INFO: Generated testcase No. 0 - STOP(3 txs)\n[13754] m.c.manticore:INFO: Generated testcase No. 1 - STOP(3 txs)\n...\n[13743] m.c.manticore:INFO: Generated testcase No. 36 - THROW(3 txs)\n[13740] m.c.manticore:INFO: Generated testcase No. 37 - THROW(3 txs)\n[9921] m.c.manticore:INFO: Results in ~/manticore/mcore_gsncmlgx\n```\n\u003c/details\u003e\n\n##### Manticore-verifier\n\nAn alternative CLI tool is provided that simplifies contract testing and \nallows writing properties methods in the same high-level language the contract uses.\nCheckout manticore-verifier [documentation](http://manticore.readthedocs.io/en/latest/verifier.html).\nSee a [demo](https://asciinema.org/a/xd0XYe6EqHCibae0RP6c7sJVE)\n\n#### Native\n\u003cdetails\u003e\n  \u003csummary\u003eClick to expand:\u003c/summary\u003e\n  \n```bash\n$ manticore examples/linux/basic\n[9507] m.n.manticore:INFO: Loading program examples/linux/basic\n[9507] m.c.manticore:INFO: Generated testcase No. 0 - Program finished with exit status: 0\n[9507] m.c.manticore:INFO: Generated testcase No. 1 - Program finished with exit status: 0\n[9507] m.c.manticore:INFO: Results in ~/manticore/mcore_7u7hgfay\n[9507] m.n.manticore:INFO: Total time: 2.8029580116271973\n```\n\u003c/details\u003e\n\n\n### API\n\nManticore provides a Python programming interface which can be used to implement powerful custom analyses.\n\n#### EVM\nFor Ethereum smart contracts, the API can be used for detailed verification of arbitrary contract properties. Users can set the starting conditions, \nexecute symbolic transactions, and then review discovered states to ensure invariants for a contract hold.\n\u003cdetails\u003e\n  \u003csummary\u003eClick to expand:\u003c/summary\u003e\n  \n```python\nfrom manticore.ethereum import ManticoreEVM\ncontract_src=\"\"\"\ncontract Adder {\n    function incremented(uint value) public returns (uint){\n        if (value == 1)\n            revert();\n        return value + 1;\n    }\n}\n\"\"\"\nm = ManticoreEVM()\n\nuser_account = m.create_account(balance=10000000)\ncontract_account = m.solidity_create_contract(contract_src,\n                                              owner=user_account,\n                                              balance=0)\nvalue = m.make_symbolic_value()\n\ncontract_account.incremented(value)\n\nfor state in m.ready_states:\n    print(\"can value be 1? {}\".format(state.can_be_true(value == 1)))\n    print(\"can value be 200? {}\".format(state.can_be_true(value == 200)))\n```\n\u003c/details\u003e\n\n#### Native\nIt is also possible to use the API to create custom analysis tools for Linux binaries. Tailoring the initial state helps avoid state explosion\nproblems that commonly occur when using the CLI. \n\n\u003cdetails\u003e\n  \u003csummary\u003eClick to expand:\u003c/summary\u003e\n  \n```python\n# example Manticore script\nfrom manticore.native import Manticore\n\nm = Manticore.linux('./example')\n\n@m.hook(0x400ca0)\ndef hook(state):\n  cpu = state.cpu\n  print('eax', cpu.EAX)\n  print(cpu.read_int(cpu.ESP))\n\n  m.kill()  # tell Manticore to stop\n\nm.run()\n```\n\u003c/details\u003e\n\n\n#### WASM\nManticore can also evaluate WebAssembly functions over symbolic inputs for property validation or general analysis. \n\n\u003cdetails\u003e\n  \u003csummary\u003eClick to expand:\u003c/summary\u003e\n  \n```python\nfrom manticore.wasm import ManticoreWASM\n\nm = ManticoreWASM(\"collatz.wasm\")\n\ndef arg_gen(state):\n    # Generate a symbolic argument to pass to the collatz function.\n    # Possible values: 4, 6, 8\n    arg = state.new_symbolic_value(32, \"collatz_arg\")\n    state.constrain(arg \u003e 3)\n    state.constrain(arg \u003c 9)\n    state.constrain(arg % 2 == 0)\n    return [arg]\n\n\n# Run the collatz function with the given argument generator.\nm.collatz(arg_gen)\n\n# Manually collect return values\n# Prints 2, 3, 8\nfor idx, val_list in enumerate(m.collect_returns()):\n    print(\"State\", idx, \"::\", val_list[0])\n```\n\u003c/details\u003e\n\n## Requirements\n* Manticore requires Python 3.7 or greater \n* Manticore officially supports the latest LTS version of Ubuntu provided by Github Actions\n  * Manticore has experimental support for EVM and WASM (but not native Linux binaries) on MacOS \n* We recommend running with increased stack size. This can be done by running `ulimit -s 100000` or by passing `--ulimit stack=100000000:100000000` to `docker run`\n\n### Compiling Smart Contracts\n* Ethereum smart contract analysis requires the [`solc`](https://github.com/ethereum/solidity) program in your `$PATH`.\n* Manticore uses [crytic-compile](https://github.com/crytic/crytic-compile) to build smart contracts. If you're having compilation issues, consider running \n`crytic-compile` on your code directly to make it easier to identify any issues. \n* We're still in the process of implementing full support for the EVM Istanbul instruction semantics, so certain opcodes may not be supported.\nIn a pinch, you can try compiling with Solidity 0.4.x to avoid generating those instructions. \n\n## Using a different solver (Yices, Z3, CVC4)\nManticore relies on an external solver supporting smtlib2. Currently Z3, Yices and CVC4 are supported and can be selected via command-line or configuration settings.\nIf Yices is available, Manticore will use it by default. If not, it will fall back to Z3 or CVC4. If you want to manually choose which solver to use, you can do so like this:\n```manticore --smt.solver Z3```\n### Installing CVC4\nFor more details go to https://cvc4.github.io/. Otherwise, just get the binary and use it.\n\n        sudo wget -O /usr/bin/cvc4 https://github.com/CVC4/CVC4/releases/download/1.7/cvc4-1.7-x86_64-linux-opt\n        sudo chmod +x /usr/bin/cvc4\n\n### Installing Yices\nYices is incredibly fast. More details here https://yices.csl.sri.com/\n\n        sudo add-apt-repository ppa:sri-csl/formal-methods\n        sudo apt-get update\n        sudo apt-get install yices2\n\n## Getting Help\n\nFeel free to stop by our #manticore slack channel in [Empire Hacking](https://slack.empirehacking.nyc/) for help using or extending Manticore.\n\nDocumentation is available in several places:\n\n  * The [wiki](https://github.com/trailofbits/manticore/wiki) contains information about getting started with Manticore and contributing\n\n  * The [API reference](http://manticore.readthedocs.io/en/latest/) has more thorough and in-depth documentation on our API\n    \n  * The [examples](examples) directory has some small examples that showcase API features\n\n  * The [manticore-examples](https://github.com/trailofbits/manticore-examples) repository has some more involved examples, including some real CTF problems\n\nIf you'd like to file a bug report or feature request, please use our [issues](https://github.com/trailofbits/manticore/issues/choose) page. \n\nFor questions and clarifications, please visit the [discussion](https://github.com/trailofbits/manticore/discussions) page.\n\n## License\n\nManticore is licensed and distributed under the AGPLv3 license. [Contact us](mailto:opensource@trailofbits.com) if you're looking for an exception to the terms.\n\n## Publications\n- [Manticore: A User-Friendly Symbolic Execution Framework for Binaries and Smart Contracts](https://arxiv.org/abs/1907.03890), Mark Mossberg, Felipe Manzano, Eric Hennenfent, Alex Groce, Gustavo Grieco, Josselin Feist, Trent Brunson, Artem Dinaburg - ASE 19\n\nIf you are using Manticore in academic work, consider applying to the [Crytic $10k Research Prize](https://blog.trailofbits.com/2019/11/13/announcing-the-crytic-10k-research-prize/).\n\n## Demo Video from ASE 2019\n[![Brief Manticore demo video](https://img.youtube.com/vi/o6pmBJZpKAc/1.jpg)](https://youtu.be/o6pmBJZpKAc)\n\n## Tool Integrations \n\n- [MATE: Merged Analysis To prevent Exploits](https://github.com/GaloisInc/MATE)\n  * [Mantiserve:](https://galoisinc.github.io/MATE/mantiserve.html) REST API interaction with Manticore to start, kill, and check Manticore instance\n  * [Dwarfcore:](https://galoisinc.github.io/MATE/dwarfcore.html) Plugins and detectors for use within Mantiserve engine during exploration \n  * [Under-constrained symbolic execution](https://github.com/GaloisInc/MATE/blob/main/doc/under-constrained-manticore.rst) Interface for symbolically exploring single functions with Manticore\n","funding_links":[],"categories":["Tools","Python","Software Development","Static analysis","Security Testing","Non-Web Embeddings","Developer Tools","Resources","Roadmap","Python (1887)","[Ethereum](https://ethereum.org/en/)","Reverse Engine","开源项目","\u003ca name=\"tools\"\u003e\u003c/a\u003e Tools","\u003ca id=\"1d9dec1320a5d774dc8e0e7604edfcd3\"\u003e\u003c/a\u003e工具-新添加的","Code Analyzers","Symbolic Execution"],"sub_categories":["Bug finding tools","Risk Management","By Purpose","Formal Verification","Whitepapers","安全审计","\u003ca name=\"sast\"\u003e SAST/DAST/Unity Test Analysis","\u003ca id=\"8f1b9c5c2737493524809684b934d49a\"\u003e\u003c/a\u003e文章\u0026\u0026视频","Binaries","Programming Languages that Compile zk-SNARK Circuits and Proofs"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrailofbits%2Fmanticore","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftrailofbits%2Fmanticore","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrailofbits%2Fmanticore/lists"}