ROSE  0.10.0.0
Public Types | Public Member Functions | List of all members
Rose::BinaryAnalysis::FeasiblePath::PathProcessor Class Reference

Description

Path searching functor.

This is the base class for user-defined functors called when searching for feasible paths.

Definition at line 156 of file BinaryFeasiblePath.h.

#include <BinaryFeasiblePath.h>

Public Types

enum  Action {
  BREAK,
  CONTINUE
}
 

Public Member Functions

virtual Action found (const FeasiblePath &analyzer, const Partitioner2::CfgPath &path, const InstructionSemantics2::BaseSemantics::DispatcherPtr &cpu, const SmtSolverPtr &solver)
 Function invoked whenever a complete path is found. More...
 
virtual void nullDeref (const FeasiblePath &analyzer, const Partitioner2::CfgPath &path, SgAsmInstruction *insn, const InstructionSemantics2::BaseSemantics::RiscOperatorsPtr &cpu, const SmtSolverPtr &solver, IoMode ioMode, const InstructionSemantics2::BaseSemantics::SValuePtr &addr)
 Function invoked whenever a null pointer dereference is detected. More...
 
virtual void memoryIo (const FeasiblePath &analyzer, const Partitioner2::CfgPath &path, SgAsmInstruction *insn, const InstructionSemantics2::BaseSemantics::RiscOperatorsPtr &cpu, const SmtSolverPtr &solver, IoMode ioMode, const InstructionSemantics2::BaseSemantics::SValuePtr &addr, const InstructionSemantics2::BaseSemantics::SValuePtr &value)
 Function invoked every time a memory reference occurs. More...
 

Member Enumeration Documentation

Enumerator
BREAK 

Do not look for more paths.

CONTINUE 

Look for more paths.

Definition at line 158 of file BinaryFeasiblePath.h.

Member Function Documentation

virtual Action Rose::BinaryAnalysis::FeasiblePath::PathProcessor::found ( const FeasiblePath analyzer,
const Partitioner2::CfgPath path,
const InstructionSemantics2::BaseSemantics::DispatcherPtr cpu,
const SmtSolverPtr solver 
)
inlinevirtual

Function invoked whenever a complete path is found.

The analyzer is a reference to the analyzer that's invoking this callback.

The path enumerates the CFG vertices and edges that compose the path.

The cpu represents the machine state at the start of the final vertex of the path. Modifications to the state have undefined behavior; the state may be re-used by the analysis when testing subsequent paths.

The solver contains the assertions that are satisfied to prove that this path is feasible. The solver contains multiple levels: an initial level that's probably empty (trivially satisfiable), followed by an additional level pushed for each edge of the path.

The return value from this callback determines whether the analysis will search for additional paths.

Definition at line 179 of file BinaryFeasiblePath.h.

References CONTINUE.

virtual void Rose::BinaryAnalysis::FeasiblePath::PathProcessor::nullDeref ( const FeasiblePath analyzer,
const Partitioner2::CfgPath path,
SgAsmInstruction insn,
const InstructionSemantics2::BaseSemantics::RiscOperatorsPtr cpu,
const SmtSolverPtr solver,
IoMode  ioMode,
const InstructionSemantics2::BaseSemantics::SValuePtr addr 
)
inlinevirtual

Function invoked whenever a null pointer dereference is detected.

The following parameters are passed to this callback:

The analyzer is the state of the analysis at the time that the null dereference is detected. Additional information such as the partitioner is available through this object.

The path is the execution path from a starting vertex to the vertex in which the null dereference occurs. Each vertex of the path is a basic block or function summary. All but the last vertex will have a corresponding symbolic state of the model checker as it existed at the end of processing the vertex. These states should not be modified by this callback.

The insn is the instruction during which the null dereference occurred and may be a null pointer in some situations. For instance, the instruction will be null if the dereference occurs when popping the return address from the stack for a function that was called but whose implementation is not present (such as when the inter-procedural depth was too great, the function is a non-linked import, etc.)

The cpu is the model checker's state immediately prior to the null dereference. This callback must not modify the state.

The solver is the optional SMT solver used to conclude that the execution path is feasible and that a null dereference occurs. This callback can query the SMT solver to obtain information about the evidence of satisfiability. This callback may use the solver for additional work either in its current transaction or by pushing additional transactions; this callback should not pop the current transaction.

The ioMode indicates whether the null address was read or written.

The addr is the address that was accessed. Depending on the model checker's settings, this is either a constant or a symbolic expression. In the latter case, the solver will have evidence that the expression can be zero.

Definition at line 212 of file BinaryFeasiblePath.h.

virtual void Rose::BinaryAnalysis::FeasiblePath::PathProcessor::memoryIo ( const FeasiblePath analyzer,
const Partitioner2::CfgPath path,
SgAsmInstruction insn,
const InstructionSemantics2::BaseSemantics::RiscOperatorsPtr cpu,
const SmtSolverPtr solver,
IoMode  ioMode,
const InstructionSemantics2::BaseSemantics::SValuePtr addr,
const InstructionSemantics2::BaseSemantics::SValuePtr value 
)
inlinevirtual

Function invoked every time a memory reference occurs.

The following parameters are passed to this callback:

The analyzer is the state of the analysis at the time that the memory I/O is detected. Additional information such as the partitioner is available through this object.

The path is the execution path from a starting vertex to the vertex in which the memory I/O occurs. Each vertex of the path is a basic block or function summary. All but the last vertex will have a corresponding symbolic state of the model checker as it existed at the end of processing the vertex. These states should not be modified by this callback.

The insn is the instruction during which the memoryIo occurred and may be a null pointer in some situations. For instance, the instruction will be null if the I/O occurs when popping the return address from the stack for a function that was called but whose implementation is not present (such as when the inter-procedural depth was too great, the function is a non-linked import, etc.)

The cpu is the model checker's state immediately prior to the memory I/O. This callback must not modify the state.

The solver is the optional SMT solver used to conclude that the execution path is feasible. This callback can query the SMT solver to obtain information about the evidence of satisfiability. This callback may use the solver for additional work either in its current transaction or by pushing additional transactions; this callback should not pop the current transaction.

The ioMode indicates whether the memory address was read or written.

The addr is the address that was accessed.

The value is the value read or written.

The insn is the instruction during which the null dereference occurred and may be a null pointer in some situations. For instance, the instruction will be null if the dereference occurs when popping the return address from the stack for a function that was called but whose implementation is not present (such as when the inter-procedural depth was too great, the function is a non-linked import, etc.)

Definition at line 251 of file BinaryFeasiblePath.h.


The documentation for this class was generated from the following file: