ROSE  0.11.109.0
TaintSemantics.h
1 #ifndef ROSE_BinaryAnalysis_InstructionSemantics_TaintSemantics_H
2 #define ROSE_BinaryAnalysis_InstructionSemantics_TaintSemantics_H
3 #include <featureTests.h>
4 #ifdef ROSE_ENABLE_BINARY_ANALYSIS
5 #include <Rose/BinaryAnalysis/InstructionSemantics/SymbolicSemantics.h>
6 
7 #include <Rose/BinaryAnalysis/BasicTypes.h>
8 #include <Rose/BinaryAnalysis/SymbolicExpression.h>
9 
10 namespace Rose {
11 namespace BinaryAnalysis { // documented elsewhere
12 namespace InstructionSemantics { // documented elsewhere
13 
15 namespace TaintSemantics {
16 
18 enum class Taintedness {
19  BOTTOM,
20  UNTAINTED,
21  TAINTED,
22  TOP
23 };
24 
25 using ExprPtr = SymbolicSemantics::ExprPtr;
26 using ExprNode = SymbolicSemantics::ExprNode;
27 
29 // Merging values
31 
34 
37 
38 
40 // Semantic values
42 
45 
48 
61  Taintedness taintedness_ = Taintedness::BOTTOM;
62 
63 public:
66 
68  using Ptr = SValuePtr;
69 
70 protected:
72  // Serialization
73 #ifdef ROSE_HAVE_BOOST_SERIALIZATION_LIB
74 private:
75  friend class boost::serialization::access;
76 
77  template<class S>
78  void serialize(S &s, const unsigned /*version*/) {
79  s & BOOST_SERIALIZATION_BASE_OBJECT_NVP(Super);
80  }
81 #endif
82 
84  // Real constructors
85 protected:
86  SValue() {} // needed for serialization
87 
88  explicit SValue(size_t nbits): Super(nbits) {}
89 
90  SValue(size_t nbits, uint64_t number): Super(nbits, number) {}
91 
92  SValue(ExprPtr expr): Super(expr) {}
93 
95  // Static allocating constructors
96 public:
98  static SValuePtr instance() {
100  }
101 
107  static SValuePtr instance_bottom(size_t nbits) {
109  }
110 
112  static SValuePtr instance_undefined(size_t nbits) {
114  }
115 
117  static SValuePtr instance_unspecified(size_t nbits) {
119  }
120 
122  static SValuePtr instance_integer(size_t nbits, uint64_t value) {
123  return SValuePtr(new SValue(SymbolicExpression::makeIntegerConstant(nbits, value)));
124  }
125 
128  ASSERT_not_null(value);
129  return SValuePtr(new SValue(value));
130  }
131 
133  // Virtual allocating constructors
134 public:
135  virtual BaseSemantics::SValuePtr bottom_(size_t nbits) const override {
136  return instance_bottom(nbits);
137  }
138 
139  /* Instantiate a new data-flow bottom value of specified width.
140  *
141  * The symbolic value is what is set to bottom in this case. The taintedness is always set to bottom by all the static
142  * allocating constructors. If you need a different taintedness then you need to change it with the @ref taintedness
143  * property. */
144  virtual BaseSemantics::SValuePtr undefined_(size_t nbits) const override {
145  return instance_undefined(nbits);
146  }
147 
148  virtual BaseSemantics::SValuePtr unspecified_(size_t nbits) const override {
149  return instance_unspecified(nbits);
150  }
151 
152  virtual BaseSemantics::SValuePtr number_(size_t nbits, uint64_t value) const override {
153  return instance_integer(nbits, value);
154  }
155 
156  virtual BaseSemantics::SValuePtr boolean_(bool value) const override {
157  return instance_integer(1, value?1:0);
158  }
159 
160  virtual BaseSemantics::SValuePtr copy(size_t new_width=0) const override {
161  SValuePtr retval(new SValue(*this));
162  if (new_width!=0 && new_width!=retval->nBits())
163  retval->set_width(new_width);
164  return retval;
165  }
166 
169  const SmtSolverPtr&) const override;
170 
172  // Dynamic pointer casts
173 public:
175  static SValuePtr promote(const BaseSemantics::SValuePtr &v) { // hot
176  SValuePtr retval = v.dynamicCast<SValue>();
177  ASSERT_not_null(retval);
178  return retval;
179  }
180 
182  // Override virtual methods...
183 public:
184  virtual void print(std::ostream&, BaseSemantics::Formatter&) const override;
185 
186  virtual void hash(Combinatorics::Hasher&) const override;
187 
188 protected: // when implementing use these names; but when calling, use the camelCase names
189  virtual bool may_equal(const BaseSemantics::SValuePtr &other,
190  const SmtSolverPtr &solver = SmtSolverPtr()) const override;
191  virtual bool must_equal(const BaseSemantics::SValuePtr &other,
192  const SmtSolverPtr &solver = SmtSolverPtr()) const override;
193 
194 
196  // Additional methods first declared in this class...
197 public:
203  Taintedness taintedness() const;
204  void taintedness(Taintedness);
207 public:
208  // Merge two taintedness values
209  static Taintedness mergeTaintedness(Taintedness, Taintedness);
210 };
211 
212 
214 // Register state
216 
217 using RegisterState = SymbolicSemantics::RegisterState;
218 using RegisterStatePtr = SymbolicSemantics::RegisterStatePtr;
219 
220 
222 // Memory state
224 
225 using MemoryListState = SymbolicSemantics::MemoryListState;
226 using MemoryListStatePtr = SymbolicSemantics::MemoryListStatePtr;
227 
228 using MemoryMapState = SymbolicSemantics::MemoryMapState;
229 using MemoryMapStatePtr = SymbolicSemantics::MemoryMapStatePtr;
230 
231 using MemoryState = MemoryListState;
232 using MemoryStatePtr = MemoryListStatePtr;
233 
234 
236 // Complete state
238 
239 using State = SymbolicSemantics::State;
240 using StatePtr = SymbolicSemantics::StatePtr;
241 
242 
244 // RISC operators
246 
248 using RiscOperatorsPtr = boost::shared_ptr<class RiscOperators>;
249 
267 public:
270 
273 
275  // Serialization
276 #ifdef ROSE_HAVE_BOOST_SERIALIZATION_LIB
277 private:
278  friend class boost::serialization::access;
279 
280  template<class S>
281  void serialize(S &s, const unsigned /*version*/) {
282  s & BOOST_SERIALIZATION_BASE_OBJECT_NVP(Super);
283  }
284 #endif
285 
287  // Real constructors
288 protected:
289  RiscOperators(); // for serialization
290 
292 
293  explicit RiscOperators(const BaseSemantics::StatePtr&, const SmtSolverPtr&);
294 
296  // Static allocating constructors
297 public:
298  ~RiscOperators();
299 
303 
308  const SmtSolverPtr &solver = SmtSolverPtr());
309 
313 
315  // Virtual constructors
316 public:
318  const SmtSolverPtr &solver = SmtSolverPtr()) const override;
319 
321  const SmtSolverPtr &solver = SmtSolverPtr()) const override;
322 
324  // Dynamic pointer casts
325 public:
329 
331  // Override methods from base class. These are the RISC operators that are invoked by a Dispatcher.
332 public:
334  const BaseSemantics::SValuePtr &b_) override;
336  const BaseSemantics::SValuePtr &b_) override;
338  const BaseSemantics::SValuePtr &b_) override;
339  virtual BaseSemantics::SValuePtr invert(const BaseSemantics::SValuePtr &a_) override;
341  size_t begin_bit, size_t end_bit) override;
343  const BaseSemantics::SValuePtr &b_) override;
347  const BaseSemantics::SValuePtr &sa_) override;
349  const BaseSemantics::SValuePtr &sa_) override;
351  const BaseSemantics::SValuePtr &sa_) override;
353  const BaseSemantics::SValuePtr &sa_) override;
355  const BaseSemantics::SValuePtr &sa_) override;
358  const BaseSemantics::SValuePtr &a_,
359  const BaseSemantics::SValuePtr &b_,
360  IteStatus&) override;
361  virtual BaseSemantics::SValuePtr unsignedExtend(const BaseSemantics::SValuePtr &a_, size_t new_width) override;
362  virtual BaseSemantics::SValuePtr signExtend(const BaseSemantics::SValuePtr &a_, size_t new_width) override;
364  const BaseSemantics::SValuePtr &b_) override;
366  const BaseSemantics::SValuePtr &b_,
367  const BaseSemantics::SValuePtr &c_,
368  BaseSemantics::SValuePtr &carry_out/*out*/) override;
369  virtual BaseSemantics::SValuePtr negate(const BaseSemantics::SValuePtr &a_) override;
371  const BaseSemantics::SValuePtr &b_) override;
373  const BaseSemantics::SValuePtr &b_) override;
375  const BaseSemantics::SValuePtr &b_) override;
377  const BaseSemantics::SValuePtr &b_) override;
379  const BaseSemantics::SValuePtr &b_) override;
381  const BaseSemantics::SValuePtr &b_) override;
383  SgAsmFloatType *retType) override;
385 
386 private:
387  static Taintedness mergeTaintedness(const BaseSemantics::SValuePtr&, const BaseSemantics::SValue::Ptr&);
388 };
389 
390 } // namespace
391 } // namespace
392 } // namespace
393 } // namespace
394 
395 #ifdef ROSE_HAVE_BOOST_SERIALIZATION_LIB
398 #endif
399 
400 #endif
401 #endif
virtual BaseSemantics::SValuePtr unsignedMultiply(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) override
Multiply two unsigned values.
virtual BaseSemantics::SValuePtr signedDivide(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) override
Divides two signed values.
static const unsigned UNSPECIFIED
Value is somehow unspecified.
virtual BaseSemantics::SValuePtr unsignedModulo(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) override
Calculates modulo with unsigned values.
virtual BaseSemantics::SValuePtr unspecified_(size_t nbits) const override
Create a new unspecified semantic value.
static SValuePtr instance()
Instantiate a new prototypical value.
virtual BaseSemantics::SValuePtr leastSignificantSetBit(const BaseSemantics::SValuePtr &a_) override
Returns position of least significant set bit; zero when no bits are set.
virtual BaseSemantics::SValuePtr signExtend(const BaseSemantics::SValuePtr &a_, size_t new_width) override
Sign extends a value.
virtual BaseSemantics::SValuePtr rotateRight(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &sa_) override
Rotate bits to the right.
virtual BaseSemantics::SValuePtr addWithCarries(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_, const BaseSemantics::SValuePtr &c_, BaseSemantics::SValuePtr &carry_out) override
Add two values of equal size and a carry bit.
boost::shared_ptr< RiscOperators > RiscOperatorsPtr
Shared-ownership pointer to a RISC operators object.
static SValuePtr instance_unspecified(size_t nbits)
Instantiate a new unspecified value of specified width.
virtual BaseSemantics::SValuePtr number_(size_t nbits, uint64_t value) const override
Create a new concrete semantic value.
static const unsigned BOTTOM
Value represents bottom in dataflow analysis.
virtual BaseSemantics::SValuePtr equalToZero(const BaseSemantics::SValuePtr &a_) override
Determines whether a value is equal to zero.
virtual BaseSemantics::SValuePtr xor_(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) override
Computes bit-wise XOR of two values.
virtual BaseSemantics::SValuePtr reinterpret(const BaseSemantics::SValuePtr &, SgAsmType *) override
Reinterpret an expression as a different type.
static SValuePtr instance_symbolic(const SymbolicExpression::Ptr &value)
Instantiate a new symbolic value.
Sawyer::SharedPointer< class SValue > SValuePtr
Shared-ownership pointer for symbolic semantic value.
Base class for symbolic expression nodes.
Holds a value or nothing.
Definition: Optional.h:49
static RiscOperatorsPtr promote(const BaseSemantics::RiscOperatorsPtr &)
Run-time promotion of a base RiscOperators pointer to symbolic operators.
Main namespace for the ROSE library.
Defines RISC operators for the TaintSemantics domain.
virtual BaseSemantics::SValuePtr add(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) override
Adds two integers of equal size.
static SValuePtr promote(const BaseSemantics::SValuePtr &v)
Promote a base value to a TaintSemantics value.
virtual BaseSemantics::SValuePtr signedModulo(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) override
Calculates modulo with signed values.
boost::shared_ptr< State > StatePtr
Shared-ownership pointer to a semantic state.
boost::shared_ptr< class MemoryMapState > MemoryMapStatePtr
Shared-ownership pointer to symbolic memory state.
static RiscOperatorsPtr instanceFromState(const BaseSemantics::StatePtr &, const SmtSolverPtr &solver=SmtSolverPtr())
Instantiates a new RiscOperators object with specified state.
Taintedness taintedness() const
Property: Taintedness.
virtual BaseSemantics::SValuePtr and_(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) override
Computes bit-wise AND of two values.
static RiscOperatorsPtr instanceFromRegisters(const RegisterDictionaryPtr &, const SmtSolverPtr &solver=SmtSolverPtr())
Instantiates a new RiscOperators object and configures it to use semantic values and states that are ...
virtual BaseSemantics::SValuePtr signedMultiply(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) override
Multiplies two signed values.
virtual BaseSemantics::SValuePtr unsignedDivide(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) override
Divides two unsigned values.
virtual BaseSemantics::SValuePtr or_(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) override
Computes bit-wise OR of two values.
virtual BaseSemantics::SValuePtr unsignedExtend(const BaseSemantics::SValuePtr &a_, size_t new_width) override
Extend (or shrink) operand a so it is nbits wide by adding or removing high-order bits...
virtual BaseSemantics::SValuePtr concat(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) override
Concatenates the bits of two values.
virtual BaseSemantics::SValuePtr shiftLeft(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &sa_) override
Returns arg shifted left.
virtual BaseSemantics::SValuePtr iteWithStatus(const BaseSemantics::SValuePtr &sel_, const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_, IteStatus &) override
If-then-else with status.
static SValuePtr instance_integer(size_t nbits, uint64_t value)
Instantiate a new concrete value.
LeafPtr makeIntegerVariable(size_t nBits, const std::string &comment="", unsigned flags=0)
Leaf constructor.
Type of values manipulated by the SymbolicSemantics domain.
virtual void print(std::ostream &, BaseSemantics::Formatter &) const override
Print a value to a stream using default format.
boost::shared_ptr< class MemoryListState > MemoryListStatePtr
Shared-ownership pointer for symbolic list-based memory state.
virtual BaseSemantics::SValuePtr bottom_(size_t nbits) const override
Data-flow bottom value.
SharedPointer< U > dynamicCast() const
Dynamic cast.
Defines RISC operators for the SymbolicSemantics domain.
virtual BaseSemantics::SValuePtr mostSignificantSetBit(const BaseSemantics::SValuePtr &a_) override
Returns position of most significant set bit; zero when no bits are set.
static RiscOperatorsPtr instanceFromProtoval(const BaseSemantics::SValuePtr &protoval, const SmtSolverPtr &solver=SmtSolverPtr())
Instantiates a new RiscOperators object with specified prototypical values.
static SValuePtr instance_undefined(size_t nbits)
Instantiate a new undefined value of specified width.
boost::shared_ptr< class RiscOperators > RiscOperatorsPtr
Shared-ownership pointer to symbolic RISC operations.
LeafPtr makeIntegerConstant(size_t nBits, uint64_t value, const std::string &comment="", unsigned flags=0)
Leaf constructor.
Base class for binary types.
virtual BaseSemantics::SValuePtr shiftRightArithmetic(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &sa_) override
Returns arg shifted right arithmetically (with sign bit).
virtual BaseSemantics::SValuePtr rotateLeft(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &sa_) override
Rotate bits to the left.
virtual SmtSolverPtr solver() const
Property: Satisfiability module theory (SMT) solver.
virtual BaseSemantics::SValuePtr undefined_(size_t nbits) const override
Create a new undefined semantic value.
std::shared_ptr< SmtSolver > SmtSolverPtr
Reference counting pointer.
virtual bool must_equal(const BaseSemantics::SValuePtr &other, const SmtSolverPtr &solver=SmtSolverPtr()) const override
Virtual API.
virtual BaseSemantics::SValuePtr negate(const BaseSemantics::SValuePtr &a_) override
Two's complement.
virtual BaseSemantics::SValuePtr fpConvert(const BaseSemantics::SValuePtr &a, SgAsmFloatType *aType, SgAsmFloatType *retType) override
Convert from one floating-point type to another.
virtual BaseSemantics::SValuePtr extract(const BaseSemantics::SValuePtr &a_, size_t begin_bit, size_t end_bit) override
Extracts bits from a value.
virtual BaseSemantics::SValuePtr copy(size_t new_width=0) const override
Create a new value from an existing value, changing the width if new_width is non-zero.
virtual BaseSemantics::RiscOperatorsPtr create(const BaseSemantics::SValuePtr &protoval, const SmtSolverPtr &solver=SmtSolverPtr()) const override
Virtual allocating constructor.
virtual SValuePtr protoval() const
Property: Prototypical semantic value.
Base class for most instruction semantics RISC operators.
Definition: RiscOperators.h:49
static SValuePtr instance_bottom(size_t nbits)
Instantiate a new data-flow bottom value of specified width.
virtual BaseSemantics::SValuePtr boolean_(bool value) const override
Create a new, Boolean value.
Base class for semantics machine states.
Definition: State.h:39
virtual Sawyer::Optional< BaseSemantics::SValuePtr > createOptionalMerge(const BaseSemantics::SValuePtr &other, const BaseSemantics::MergerPtr &, const SmtSolverPtr &) const override
Possibly create a new value by merging two existing values.
virtual void hash(Combinatorics::Hasher &) const override
Hash this semantic value.
Floating point types.
virtual BaseSemantics::SValuePtr shiftRight(const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &sa_) override
Returns arg shifted right logically (no sign bit).
virtual BaseSemantics::SValuePtr invert(const BaseSemantics::SValuePtr &a_) override
One's complement.
Type of values manipulated by the SymbolicSemantics domain.
virtual bool may_equal(const BaseSemantics::SValuePtr &other, const SmtSolverPtr &solver=SmtSolverPtr()) const override
Virtual API.