ROSE  0.11.4.0
BinaryFeasiblePath.h
1 #ifndef ROSE_BinaryAnalysis_FeasiblePath_H
2 #define ROSE_BinaryAnalysis_FeasiblePath_H
3 #include <rosePublicConfig.h>
4 #ifdef ROSE_BUILD_BINARY_ANALYSIS_SUPPORT
5 
6 #include <BaseSemantics2.h>
7 #include <BinarySmtSolver.h>
8 #include <BinarySymbolicExprParser.h>
9 #include <Partitioner2/CfgPath.h>
10 #include <RoseException.h>
11 #include <Sawyer/CommandLine.h>
12 #include <Sawyer/Message.h>
13 #include <boost/filesystem/path.hpp>
14 
15 namespace Rose {
16 namespace BinaryAnalysis {
17 
21 class FeasiblePath {
23  // Types and public data members
25 public:
27  class Exception: public Rose::Exception {
28  public:
29  Exception(const std::string &what)
30  : Rose::Exception(what) {}
31  ~Exception() throw () {}
32  };
33 
35  enum SearchMode {
39  };
40 
45  };
46 
52  };
53 
55  enum IoMode { READ, WRITE };
56 
58  enum MayOrMust { MAY, MUST };
59 
61  typedef std::set<rose_addr_t> AddressSet;
62 
69  struct Expression {
71  std::string parsable;
74  Expression() {}
75  /*implicit*/ Expression(const std::string &parsable): parsable(parsable) {}
76  /*implicit*/ Expression(const SymbolicExpr::Ptr &expr): expr(expr) {}
77 
78  void print(std::ostream&) const;
79  };
80 
82  struct Settings {
83  // Path feasibility
86  size_t maxVertexVisit;
87  size_t maxPathLength;
88  size_t maxCallDepth;
90  std::vector<Expression> assertions;
91  std::vector<std::string> assertionLocations;
92  std::vector<rose_addr_t> summarizeFunctions;
94  std::string solverName;
101  std::vector<rose_addr_t> ipRewrite;
103  size_t maxExprSize;
105  // Null dereferences
106  struct NullDeref {
107  bool check;
109  bool constOnly;
110  rose_addr_t minValid;
112  NullDeref()
113  : check(false), mode(MUST), constOnly(false), minValid(1024) {}
114  } nullDeref;
116  std::string exprParserDoc;
120  : searchMode(SEARCH_SINGLE_DFS), maxVertexVisit((size_t)-1), maxPathLength(200), maxCallDepth((size_t)-1),
121  maxRecursionDepth((size_t)-1), nonAddressIsFeasible(true), solverName("best"),
122  memoryParadigm(LIST_BASED_MEMORY), processFinalVertex(false), ignoreSemanticFailure(false),
123  kCycleCoefficient(0.0), edgeVisitOrder(VISIT_NATURAL), trackingCodeCoverage(true), maxExprSize(UNLIMITED) {}
124  };
125 
127  struct Statistics {
133  Statistics()
134  : maxVertexVisitHits(0), maxPathLengthHits(0), maxCallDepthHits(0), maxRecursionDepthHits(0) {}
135  };
136 
139 
148 
150  struct VarDetail {
151  std::string registerName;
152  std::string firstAccessMode;
156  size_t memSize;
157  size_t memByteNumber;
160  VarDetail(): firstAccessInsn(NULL), memSize(0), memByteNumber(0) {}
161  std::string toString() const;
162  };
163 
166 
171  public:
172  enum Action {
175  };
176 
177  virtual ~PathProcessor() {}
178 
193  virtual Action found(const FeasiblePath &analyzer, const Partitioner2::CfgPath &path,
195  const SmtSolverPtr &solver) { return CONTINUE; }
196 
226  virtual void nullDeref(const FeasiblePath &analyzer, const Partitioner2::CfgPath &path, SgAsmInstruction *insn,
229 
265  virtual void memoryIo(const FeasiblePath &analyzer, const Partitioner2::CfgPath &path, SgAsmInstruction *insn,
269  };
270 
275  rose_addr_t address;
276  int64_t stackDelta;
277  std::string name;
280  FunctionSummary(): stackDelta(SgAsmInstruction::INVALID_STACK_DELTA) {}
281 
283  FunctionSummary(const Partitioner2::ControlFlowGraph::ConstVertexIterator &cfgFuncVertex, uint64_t stackDelta);
284  };
285 
288 
293  public:
296  protected:
297  FunctionSummarizer() {}
298  public:
300  virtual void init(const FeasiblePath &analysis, FunctionSummary &summary /*in,out*/,
301  const Partitioner2::Function::Ptr &function,
302  Partitioner2::ControlFlowGraph::ConstVertexIterator cfgCallTarget) = 0;
303 
308  virtual bool process(const FeasiblePath &analysis, const FunctionSummary &summary,
310 
316  returnValue(const FeasiblePath &analysis, const FunctionSummary &summary,
318  };
319 
321  // Private data members
323 private:
324  const Partitioner2::Partitioner *partitioner_; // binary analysis context
325  RegisterDictionary *registers_; // registers augmented with "path" pseudo-register
326  RegisterDescriptor REG_RETURN_; // FIXME[Robb P Matzke 2016-10-11]: see source
327  Settings settings_;
328  FunctionSummaries functionSummaries_;
329  Partitioner2::CfgVertexMap vmap_; // relates CFG vertices to path vertices
330  Partitioner2::ControlFlowGraph paths_; // all possible paths, feasible or otherwise
331  Partitioner2::CfgConstVertexSet pathsBeginVertices_;// vertices of paths_ where searching starts
332  Partitioner2::CfgConstVertexSet pathsEndVertices_; // vertices of paths_ where searching stops
333  bool isDirectedSearch_; // use pathsEndVertices_?
334  Partitioner2::CfgConstEdgeSet cfgAvoidEdges_; // CFG edges to avoid
335  Partitioner2::CfgConstVertexSet cfgEndAvoidVertices_;// CFG end-of-path and other avoidance vertices
336  FunctionSummarizer::Ptr functionSummarizer_; // user-defined function for handling function summaries
337  AddressSet reachedBlockVas_; // basic block addresses reached during analysis
338  InstructionSemantics2::BaseSemantics::StatePtr initialState_; // set by setInitialState.
339  Statistics stats_; // statistical results of the analysis
340  static Sawyer::Attribute::Id POST_STATE; // stores semantic state after executing the insns for a vertex
341  static Sawyer::Attribute::Id POST_INSN_LENGTH; // path length in instructions at end of vertex
342  static Sawyer::Attribute::Id EFFECTIVE_K; // (double) effective maximimum path length
343 
344 
346  // Construction, destruction
348 public:
351  : registers_(NULL), isDirectedSearch_(true) {}
352 
353  virtual ~FeasiblePath() {}
354 
356  void reset() {
357  partitioner_ = NULL;
358  registers_ = NULL;
359  REG_PATH = REG_RETURN_ = RegisterDescriptor();
360  functionSummaries_.clear();
361  vmap_.clear();
362  paths_.clear();
363  pathsBeginVertices_.clear();
364  pathsEndVertices_.clear();
365  isDirectedSearch_ = true;
366  cfgAvoidEdges_.clear();
367  cfgEndAvoidVertices_.clear();
368  reachedBlockVas_.clear();
369  resetStatistics();
370  }
371 
374  stats_ = Statistics();
375  }
376 
378  static void initDiagnostics();
379 
380 
382  // Settings affecting behavior
384 public:
388  const Settings& settings() const { return settings_; }
389  Settings& settings() { return settings_; }
390  void settings(const Settings &s) { settings_ = s; }
398 
400  static std::string expressionDocumentation();
401 
402 
404  // Overridable processing functions
406 public:
413  buildVirtualCpu(const Partitioner2::Partitioner&, const Partitioner2::CfgPath*, PathProcessor*, const SmtSolver::Ptr&);
414 
421  virtual void
423  const Partitioner2::ControlFlowGraph::ConstVertexIterator &pathsBeginVertex);
424 
429  virtual void
431  const InstructionSemantics2::BaseSemantics::DispatcherPtr &cpu, size_t pathInsnIndex);
432 
436  virtual void
437  processIndeterminateBlock(const Partitioner2::ControlFlowGraph::ConstVertexIterator &vertex,
439  size_t pathInsnIndex);
440 
444  virtual void
445  processFunctionSummary(const Partitioner2::ControlFlowGraph::ConstVertexIterator &pathsVertex,
447  size_t pathInsnIndex);
448 
452  virtual void
454  const Partitioner2::ControlFlowGraph::ConstVertexIterator &pathsVertex,
455  size_t &pathInsnIndex /*in,out*/);
456 
458  virtual bool
459  shouldSummarizeCall(const Partitioner2::ControlFlowGraph::ConstVertexIterator &pathVertex,
461  const Partitioner2::ControlFlowGraph::ConstVertexIterator &cfgCallTarget);
462 
464  virtual bool
465  shouldInline(const Partitioner2::CfgPath &path, const Partitioner2::ControlFlowGraph::ConstVertexIterator &cfgCallTarget);
466 
475  FunctionSummarizer::Ptr functionSummarizer() const { return functionSummarizer_; }
476  void functionSummarizer(const FunctionSummarizer::Ptr &f) { functionSummarizer_ = f; }
479  // Utilities
482 public:
484  Partitioner2::ControlFlowGraph::ConstVertexIterator
485  pathToCfg(const Partitioner2::ControlFlowGraph::ConstVertexIterator &pathVertex) const;
486 
490 
493 
495  bool isFunctionCall(const Partitioner2::ControlFlowGraph::ConstVertexIterator&) const;
496 
498  void printPathVertex(std::ostream &out, const Partitioner2::ControlFlowGraph::Vertex &pathVertex,
499  size_t &insnIdx /*in,out*/) const;
500 
504  void printPath(std::ostream &out, const Partitioner2::CfgPath&) const;
505 
511  const Partitioner2::ControlFlowGraph::ConstVertexIterator &beginVertex,
512  const Partitioner2::CfgConstVertexSet &endVertices);
513 
515  // Functions for describing the search space
517 public:
518 
527  void
529  const Partitioner2::CfgConstVertexSet &cfgBeginVertices,
530  const Partitioner2::CfgConstVertexSet &cfgEndVertices,
533  void
534  setSearchBoundary(const Partitioner2::Partitioner &partitioner,
535  const Partitioner2::ControlFlowGraph::ConstVertexIterator &cfgBeginVertex,
536  const Partitioner2::ControlFlowGraph::ConstVertexIterator &cfgEndVertex,
539  void
540  setSearchBoundary(const Partitioner2::Partitioner &partitioner,
541  const Partitioner2::CfgConstVertexSet &cfgBeginVertices,
544  void
545  setSearchBoundary(const Partitioner2::Partitioner &partitioner,
546  const Partitioner2::ControlFlowGraph::ConstVertexIterator &cfgBeginVertex,
556  bool isDirectedSearch() const {
557  return isDirectedSearch_;
558  }
559 
561  // Functions for searching for paths
563 public:
568  void depthFirstSearch(PathProcessor &pathProcessor);
569 
570 
572  // Functions for getting the results
574 public:
579  const Partitioner2::Partitioner& partitioner() const;
580 
584  const FunctionSummaries& functionSummaries() const {
585  return functionSummaries_;
586  }
587 
592  const FunctionSummary& functionSummary(rose_addr_t entryVa) const;
593 
595  const VarDetail& varDetail(const InstructionSemantics2::BaseSemantics::StatePtr&, const std::string &varName) const;
596 
598  const VarDetails& varDetails(const InstructionSemantics2::BaseSemantics::StatePtr&) const;
599 
602 
605 
611  double pathEffectiveK(const Partitioner2::CfgPath&) const;
612 
619  static size_t pathLength(const Partitioner2::CfgPath&);
620 
625  return stats_;
626  }
627 
629  // Functions for code coverage
631 public:
636  const AddressSet& reachedBlockVas() const;
637 
639  // Private supporting functions
641 private:
642  // Check that analysis settings are valid, or throw an exception.
643  void checkSettings() const;
644 
645  static rose_addr_t virtualAddress(const Partitioner2::ControlFlowGraph::ConstVertexIterator &vertex);
646 
647  void insertCallSummary(const Partitioner2::ControlFlowGraph::ConstVertexIterator &pathsCallSite,
649  const Partitioner2::ControlFlowGraph::ConstEdgeIterator &cfgCallEdge);
650 
651  boost::filesystem::path emitPathGraph(size_t callId, size_t graphId); // emit paths graph to "rose-debug" directory
652 
653  // Pop an edge (or more) from the path and follow some other edge. Also, adjust the SMT solver's stack in a similar
654  // way. The SMT solver will have an initial state, plus one pushed state per edge of the path.
655  void backtrack(Partitioner2::CfgPath &path /*in,out*/, const SmtSolver::Ptr&);
656 
657  // Process one edge of a path to find any path constraints. When called, the cpu's current state should be the virtual
658  // machine state at it exists just prior to executing the target vertex of the specified edge.
659  //
660  // Returns a null pointer if the edge's assertion is trivially unsatisfiable, such as when the edge points to a basic block
661  // whose address doesn't match the contents of the instruction pointer register after executing the edge's source
662  // block. Otherwise, returns a symbolic expression which must be tree if the edge is feasible. For trivially feasible
663  // edges, the return value is the constant 1 (one bit wide; i.e., true).
664  SymbolicExpr::Ptr pathEdgeConstraint(const Partitioner2::ControlFlowGraph::ConstEdgeIterator &pathEdge,
666 
667  // Parse the expression if it's a parsable string, otherwise return the expression as is. */
668  Expression parseExpression(Expression, const std::string &where, SymbolicExprParser&) const;
669 
670  SymbolicExpr::Ptr expandExpression(const Expression&, SymbolicExprParser&);
671 
672  // Based on the last vertex of the path, insert user-specified assertions into the SMT solver.
673  void insertAssertions(const SmtSolver::Ptr&, const Partitioner2::CfgPath&,
674  const std::vector<Expression> &assertions, bool atEndOfPath, SymbolicExprParser&);
675 
676  // Size of vertex. How much of "k" does this vertex consume?
677  static size_t vertexSize(const Partitioner2::ControlFlowGraph::ConstVertexIterator&);
678 
679  // Insert the edge assertion and any applicable user assertions (after delayed expansion of the expressions' register
680  // and memory references), and run the solver, returning its result.
682  solvePathConstraints(SmtSolver::Ptr&, const Partitioner2::CfgPath&, const SymbolicExpr::Ptr &edgeAssertion,
683  const std::vector<Expression> &userAssertions, bool atEndOfPath, SymbolicExprParser&);
684 
685  // Mark vertex as being reached
686  void markAsReached(const Partitioner2::ControlFlowGraph::ConstVertexIterator&);
687 };
688 
689 } // namespace
690 } // namespace
691 
692 std::ostream& operator<<(std::ostream&, const Rose::BinaryAnalysis::FeasiblePath::Expression&);
693 
694 // Convert string to feasible path expression during command-line parsing
695 namespace Sawyer {
696  namespace CommandLine {
697  template<>
698  struct LexicalCast<Rose::BinaryAnalysis::FeasiblePath::Expression> {
699  static Rose::BinaryAnalysis::FeasiblePath::Expression convert(const std::string &src) {
701  }
702  };
703  }
704 }
705 
706 #endif
707 #endif
std::string firstAccessMode
How was variable first accessed ("read" or "write").
size_t maxPathLengthHits
Number of times settings.maxPathLength was hit (effective K).
std::vector< rose_addr_t > summarizeFunctions
Functions to always summarize.
Sawyer::Container::Map< rose_addr_t, FunctionSummary > FunctionSummaries
Summaries for multiple functions.
MayOrMust mode
Check for addrs that may or must be null.
boost::shared_ptr< RiscOperators > RiscOperatorsPtr
Shared-ownership pointer to a RISC operators object.
InstructionSemantics2::BaseSemantics::StatePtr initialState() const
Get the initial state before the first path vertex.
EdgeVisitOrder edgeVisitOrder
Order in which to visit edges.
virtual InstructionSemantics2::SymbolicSemantics::SValuePtr returnValue(const FeasiblePath &analysis, const FunctionSummary &summary, const InstructionSemantics2::SymbolicSemantics::RiscOperatorsPtr &ops)=0
Return value for function.
size_t maxCallDepthHits
Number of times settings.maxCallDepth was hit.
rose_addr_t address
Address of summarized function.
SemanticMemoryParadigm memoryParadigm
Type of memory state when there's a choice to be made.
bool trackingCodeCoverage
If set, track which block addresses are reached.
const size_t UNLIMITED(-1)
Effictively unlimited size.
double pathEffectiveK(const Partitioner2::CfgPath &) const
Effective maximum path length.
void printPathVertex(std::ostream &out, const Partitioner2::ControlFlowGraph::Vertex &pathVertex, size_t &insnIdx) const
Print one vertex of a path for debugging.
std::string parsable
String to be parsed as an expression.
Information stored per V_USER_DEFINED path vertex.
Sawyer::Container::Map< std::string, FeasiblePath::VarDetail > VarDetails
Variable detail by name.
void setSearchBoundary(const Partitioner2::Partitioner &partitioner, const Partitioner2::CfgConstVertexSet &cfgBeginVertices, const Partitioner2::CfgConstVertexSet &cfgEndVertices, const Partitioner2::CfgConstVertexSet &cfgAvoidVertices=Partitioner2::CfgConstVertexSet(), const Partitioner2::CfgConstEdgeSet &cfgAvoidEdges=Partitioner2::CfgConstEdgeSet())
Specify search boundary.
void depthFirstSearch(PathProcessor &pathProcessor)
Find all feasible paths.
virtual void processIndeterminateBlock(const Partitioner2::ControlFlowGraph::ConstVertexIterator &vertex, const InstructionSemantics2::BaseSemantics::DispatcherPtr &cpu, size_t pathInsnIndex)
Process an indeterminate block.
Base class for machine instructions.
Sawyer::Optional< rose_addr_t > returnFrom
This variable is the return value from the specified function.
void clear()
Erase all values.
Definition: Set.h:262
Collection of streams.
Definition: Message.h:1599
boost::shared_ptr< class RiscOperators > RiscOperatorsPtr
Shared-ownership pointer to symbolic RISC operations.
FeasiblePath()
Constructs a new feasible path analyzer.
SearchMode
How to search for paths.
virtual void nullDeref(const FeasiblePath &analyzer, const Partitioner2::CfgPath &path, SgAsmInstruction *insn, const InstructionSemantics2::BaseSemantics::RiscOperatorsPtr &cpu, const SmtSolverPtr &solver, IoMode ioMode, const InstructionSemantics2::BaseSemantics::SValuePtr &addr)
Function invoked whenever a null pointer dereference is detected.
virtual bool process(const FeasiblePath &analysis, const FunctionSummary &summary, const InstructionSemantics2::SymbolicSemantics::RiscOperatorsPtr &ops)=0
Invoked when the analysis traverses the summary.
boost::shared_ptr< State > StatePtr
Shared-ownership pointer to a semantic state.
virtual void processFunctionSummary(const Partitioner2::ControlFlowGraph::ConstVertexIterator &pathsVertex, const InstructionSemantics2::BaseSemantics::DispatcherPtr &cpu, size_t pathInsnIndex)
Process a function summary vertex.
RegisterDescriptor REG_PATH
Descriptor of path pseudo-registers.
size_t maxRecursionDepthHits
Number of times settings.maxRecursionDepth was hit.
std::string name
Name of summarized function.
Sawyer::Optional< size_t > firstAccessIdx
Instruction position in path where this var was first read.
A collection of related switch declarations.
Sawyer::Optional< boost::chrono::duration< double > > smtTimeout
Max seconds allowed per SMT solve call.
Main namespace for the ROSE library.
Parses symbolic expressions from text.
Satisfiable
Satisfiability constants.
size_t maxCallDepth
Max length of path in terms of function calls.
size_t maxExprSize
Maximum symbolic expression size before replacement.
struct Rose::BinaryAnalysis::FeasiblePath::Settings::NullDeref nullDeref
Settings for null-dereference analysis.
Blast everything at once to the SMT solver.
Name space for the entire library.
std::vector< std::string > assertionLocations
Locations at which "constraints" are checked.
size_t maxVertexVisitHits
Number of times settings.maxVertexVisit was hit.
const FunctionSummaries & functionSummaries() const
Function summary information.
Partitioner2::CfgConstVertexSet cfgToPaths(const Partitioner2::CfgConstVertexSet &) const
Convert CFG vertices to path vertices.
virtual bool shouldInline(const Partitioner2::CfgPath &path, const Partitioner2::ControlFlowGraph::ConstVertexIterator &cfgCallTarget)
Determines whether a function call should be inlined.
std::vector< rose_addr_t > ipRewrite
An even number of from,to pairs for rewriting the insn ptr reg.
boost::shared_ptr< Dispatcher > DispatcherPtr
Shared-ownership pointer to a semantics instruction dispatcher.
static std::string expressionDocumentation()
Documentation for the symbolic expression parser.
void settings(const Settings &s)
Property: Settings used by this analysis.
size_t maxPathLength
Limit path length in terms of number of instructions.
bool constOnly
If true, check only constants or sets of constants.
Base class for callbacks for function summaries.
AddressIntervalSet location
Location where constraint applies.
void clear()
Remove all entries from this container.
Visit edges in reverse of the natural order.
virtual void memoryIo(const FeasiblePath &analyzer, const Partitioner2::CfgPath &path, SgAsmInstruction *insn, const InstructionSemantics2::BaseSemantics::RiscOperatorsPtr &cpu, const SmtSolverPtr &solver, IoMode ioMode, const InstructionSemantics2::BaseSemantics::SValuePtr &addr, const InstructionSemantics2::BaseSemantics::SValuePtr &value)
Function invoked every time a memory reference occurs.
bool isDirectedSearch() const
Property: Whether search is directed or not.
static InstructionSemantics2::BaseSemantics::StatePtr pathPostState(const Partitioner2::CfgPath &, size_t vertexIdx)
Get the state at the end of the specified vertex.
FunctionSummary()
Construct empty function summary.
bool nonAddressIsFeasible
Indeterminate/undiscovered vertices are feasible?
size_t maxVertexVisit
Max times to visit a particular vertex in one path.
Describes (part of) a physical CPU register.
size_t maxRecursionDepth
Max path length in terms of recursive function calls.
void reset()
Reset to initial state without changing settings.
A path through a control flow graph.
Definition: CfgPath.h:18
rose_addr_t minValid
Minnimum address that is not treated as a null dereference.
Information about a variable seen on a path.
virtual Action found(const FeasiblePath &analyzer, const Partitioner2::CfgPath &path, const InstructionSemantics2::BaseSemantics::DispatcherPtr &cpu, const SmtSolverPtr &solver)
Function invoked whenever a complete path is found.
FunctionSummarizer::Ptr functionSummarizer() const
Property: Function summary handling.
Exception for errors specific to feasible path analysis.
virtual bool shouldSummarizeCall(const Partitioner2::ControlFlowGraph::ConstVertexIterator &pathVertex, const Partitioner2::ControlFlowGraph &cfg, const Partitioner2::ControlFlowGraph::ConstVertexIterator &cfgCallTarget)
Determines whether a function call should be summarized instead of inlined.
bool isFunctionCall(const Partitioner2::ControlFlowGraph::ConstVertexIterator &) const
True if vertex is a function call.
SymbolicExpr::Ptr expr
Symbolic expression.
bool ignoreSemanticFailure
Whether to ignore instructions with no semantic info.
SearchMode searchMode
Method to use when searching for feasible paths.
size_t Id
Attribute identification.
Definition: Attribute.h:140
void clear()
Remove all vertices and edges.
Definition: Graph.h:1978
bool pathEndsWithFunctionCall(const Partitioner2::CfgPath &) const
True if path ends with a function call.
void printPath(std::ostream &out, const Partitioner2::CfgPath &) const
Print the path to the specified output stream.
Statistics statistics() const
Cumulative statistics about prior analyses.
void resetStatistics()
Reset only statistics.
std::set< rose_addr_t > AddressSet
Set of basic block addresses.
virtual InstructionSemantics2::BaseSemantics::DispatcherPtr buildVirtualCpu(const Partitioner2::Partitioner &, const Partitioner2::CfgPath *, PathProcessor *, const SmtSolver::Ptr &)
Create the virtual CPU.
const Settings & settings() const
Property: Settings used by this analysis.
size_t memByteNumber
Byte number for memory access.
int64_t stackDelta
Stack delta for summarized function.
Base class for reference counted objects.
Definition: SharedObject.h:64
double kCycleCoefficient
Coefficient for adjusting maxPathLengh during CFG cycles.
static Sawyer::CommandLine::SwitchGroup commandLineSwitches(Settings &settings)
Describe command-line switches.
Sawyer::SharedPointer< FunctionSummarizer > Ptr
Reference counting pointer.
static Sawyer::Message::Facility mlog
Diagnostic output.
virtual void processVertex(const InstructionSemantics2::BaseSemantics::DispatcherPtr &cpu, const Partitioner2::ControlFlowGraph::ConstVertexIterator &pathsVertex, size_t &pathInsnIndex)
Process one vertex.
bool isAnyEndpointReachable(const Partitioner2::ControlFlowGraph &cfg, const Partitioner2::ControlFlowGraph::ConstVertexIterator &beginVertex, const Partitioner2::CfgConstVertexSet &endVertices)
Determine whether any ending vertex is reachable.
const VarDetails & varDetails(const InstructionSemantics2::BaseSemantics::StatePtr &) const
Details about all variables by name.
void clear()
Remove all edges or vertices from this set.
static size_t pathLength(const Partitioner2::CfgPath &)
Total length of path.
Partitioner2::ControlFlowGraph::ConstVertexIterator pathToCfg(const Partitioner2::ControlFlowGraph::ConstVertexIterator &pathVertex) const
Convert path vertex to a CFG vertex.
Visit edges in their natural, forward order.
const FunctionSummary & functionSummary(rose_addr_t entryVa) const
Function summary information.
const Partitioner2::Partitioner & partitioner() const
Property: Partitioner currently in use.
Defines registers available for a particular architecture.
Definition: Registers.h:38
const VarDetail & varDetail(const InstructionSemantics2::BaseSemantics::StatePtr &, const std::string &varName) const
Details about a variable.
virtual void processBasicBlock(const Partitioner2::BasicBlock::Ptr &bblock, const InstructionSemantics2::BaseSemantics::DispatcherPtr &cpu, size_t pathInsnIndex)
Process instructions for one basic block on the specified virtual CPU.
SymbolicExpr::Ptr memAddress
Address where variable is located.
Partitions instructions into basic blocks and functions.
Definition: Partitioner.h:322
Base class for all ROSE exceptions.
Definition: RoseException.h:9
const AddressSet & reachedBlockVas() const
Property: Addresses reached during analysis.
std::string solverName
Type of SMT solver.
EdgeVisitOrder
Edge visitation order.
void functionSummarizer(const FunctionSummarizer::Ptr &f)
Property: Function summary handling.
Settings & settings()
Property: Settings used by this analysis.
size_t memSize
Size of total memory access in bytes.
Container associating values with keys.
Definition: Sawyer/Map.h:66
std::string exprParserDoc
String documenting how expressions are parsed, empty for default.
bool processFinalVertex
Whether to process the last vertex of the path.
SgAsmInstruction * firstAccessInsn
Instruction address where this var was first read.
Settings that control this analysis.
static void initDiagnostics()
Initialize diagnostic output.
bool check
If true, look for null dereferences along the paths.
virtual void setInitialState(const InstructionSemantics2::BaseSemantics::DispatcherPtr &cpu, const Partitioner2::ControlFlowGraph::ConstVertexIterator &pathsBeginVertex)
Initialize state for first vertex of path.
Sawyer::Optional< rose_addr_t > initialStackPtr
Concrete value to use for stack pointer register initial value.
SemanticMemoryParadigm
Organization of semantic memory.
std::vector< Expression > assertions
Constraints to be satisfied at some point along the path.
virtual void init(const FeasiblePath &analysis, FunctionSummary &summary, const Partitioner2::Function::Ptr &function, Partitioner2::ControlFlowGraph::ConstVertexIterator cfgCallTarget)=0
Invoked when a new summary is created.