ROSE  0.9.11.56
Public Types | Public Member Functions | List of all members
Rose::BinaryAnalysis::FeasiblePath::PathProcessor Class Reference

Description

Path searching functor.

This is the base class for user-defined functors called when searching for feasible paths.

Definition at line 144 of file BinaryFeasiblePath.h.

#include <BinaryFeasiblePath.h>

Public Types

enum  Action {
  BREAK,
  CONTINUE
}
 

Public Member Functions

virtual Action found (const FeasiblePath &analyzer, const Partitioner2::CfgPath &path, const InstructionSemantics2::BaseSemantics::DispatcherPtr &cpu, const SmtSolverPtr &solver)
 Function invoked whenever a complete path is found. More...
 
virtual void nullDeref (const FeasiblePath &analyzer, const Partitioner2::CfgPath &path, IoMode ioMode, const InstructionSemantics2::BaseSemantics::SValuePtr &addr, SgAsmInstruction *)
 Function invoked whenever a null pointer dereference is detected. More...
 
virtual void memoryIo (const FeasiblePath &analyzer, IoMode ioMode, const InstructionSemantics2::BaseSemantics::SValuePtr &addr, const InstructionSemantics2::BaseSemantics::SValuePtr &value, const InstructionSemantics2::BaseSemantics::RiscOperatorsPtr &ops)
 Function invoked every time a memory reference occurs. More...
 

Member Enumeration Documentation

Enumerator
BREAK 

Do not look for more paths.

CONTINUE 

Look for more paths.

Definition at line 146 of file BinaryFeasiblePath.h.

Member Function Documentation

virtual Action Rose::BinaryAnalysis::FeasiblePath::PathProcessor::found ( const FeasiblePath analyzer,
const Partitioner2::CfgPath path,
const InstructionSemantics2::BaseSemantics::DispatcherPtr cpu,
const SmtSolverPtr solver 
)
inlinevirtual

Function invoked whenever a complete path is found.

The analyzer is a reference to the analyzer that's invoking this callback.

The path enumerates the CFG vertices and edges that compose the path.

The cpu represents the machine state at the start of the final vertex of the path. Modifications to the state have undefined behavior; the state may be re-used by the analysis when testing subsequent paths.

The solver contains the assertions that are satisfied to prove that this path is feasible. The solver contains multiple levels: an initial level that's probably empty (trivially satisfiable), followed by an additional level pushed for each edge of the path.

The return value from this callback determines whether the analysis will search for additional paths.

Definition at line 167 of file BinaryFeasiblePath.h.

References CONTINUE.

virtual void Rose::BinaryAnalysis::FeasiblePath::PathProcessor::nullDeref ( const FeasiblePath analyzer,
const Partitioner2::CfgPath path,
IoMode  ioMode,
const InstructionSemantics2::BaseSemantics::SValuePtr addr,
SgAsmInstruction  
)
inlinevirtual

Function invoked whenever a null pointer dereference is detected.

The ioMode indicates whether the null address was read or written, and the addr is the address that was accessed. The address might not be the constant zero depending on other settings (for example, it could be an unknown value represented as a variable if "may" analysis is used and the comparison is not limited to only constant expressions).

The instruction during which the null dereference occurred is also passed as an argument, but it may be a null pointer in some situations. For instance, the instruction will be null if the dereference occurs when popping the return address from the stack for a function that was called but whose implementation is not present (such as when the inter-procedural depth was too great, the function is a non-linked import, etc.)

Definition at line 182 of file BinaryFeasiblePath.h.

virtual void Rose::BinaryAnalysis::FeasiblePath::PathProcessor::memoryIo ( const FeasiblePath analyzer,
IoMode  ioMode,
const InstructionSemantics2::BaseSemantics::SValuePtr addr,
const InstructionSemantics2::BaseSemantics::SValuePtr value,
const InstructionSemantics2::BaseSemantics::RiscOperatorsPtr ops 
)
inlinevirtual

Function invoked every time a memory reference occurs.

The ioMode indicates whether the memory location was read or written, and the value is the value read or written.

Definition at line 189 of file BinaryFeasiblePath.h.


The documentation for this class was generated from the following file: