ROSE
0.11.27.0
|
Basic semantic operations.
Each operation builds a new AST by creating a new node and attaching existing children to that node. The parent pointers of the children are not updated, and as described in SValue, therefore do not form proper ROSE abstract syntax trees.
The writeRegister, writeMemory, and a handful of other operators that represent instruction side effects are inserted into the instruction's list of static sematics. This is the point at which this semantic domain takes an improperly formed ROSE AST from an SValue and fixes it so it has proper parent pointers and does not share nodes with other subtrees.
Definition at line 247 of file StaticSemantics2.h.
#include <StaticSemantics2.h>
Public Member Functions | |
virtual BaseSemantics::RiscOperatorsPtr | create (const BaseSemantics::SValuePtr &protoval, const SmtSolverPtr &solver=SmtSolverPtr()) const ROSE_OVERRIDE |
Virtual allocating constructor. More... | |
virtual BaseSemantics::RiscOperatorsPtr | create (const BaseSemantics::StatePtr &state, const SmtSolverPtr &solver=SmtSolverPtr()) const ROSE_OVERRIDE |
Virtual allocating constructor. More... | |
virtual void | startInstruction (SgAsmInstruction *) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | filterCallTarget (const BaseSemantics::SValuePtr &a) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | filterReturnTarget (const BaseSemantics::SValuePtr &a) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | filterIndirectJumpTarget (const BaseSemantics::SValuePtr &a) ROSE_OVERRIDE |
virtual void | hlt () ROSE_OVERRIDE |
virtual void | cpuid () ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | rdtsc () ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | and_ (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | or_ (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | xor_ (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | invert (const BaseSemantics::SValuePtr &a_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | extract (const BaseSemantics::SValuePtr &a_, size_t begin_bit, size_t end_bit) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | concat (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | leastSignificantSetBit (const BaseSemantics::SValuePtr &a_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | mostSignificantSetBit (const BaseSemantics::SValuePtr &a_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | rotateLeft (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &sa_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | rotateRight (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &sa_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | shiftLeft (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &sa_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | shiftRight (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &sa_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | shiftRightArithmetic (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &sa_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | equalToZero (const BaseSemantics::SValuePtr &a_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | ite (const BaseSemantics::SValuePtr &sel_, const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | isEqual (const BaseSemantics::SValuePtr &, const BaseSemantics::SValuePtr &) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | isNotEqual (const BaseSemantics::SValuePtr &, const BaseSemantics::SValuePtr &) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | isUnsignedLessThan (const BaseSemantics::SValuePtr &, const BaseSemantics::SValuePtr &) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | isUnsignedLessThanOrEqual (const BaseSemantics::SValuePtr &, const BaseSemantics::SValuePtr &) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | isUnsignedGreaterThan (const BaseSemantics::SValuePtr &, const BaseSemantics::SValuePtr &) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | isUnsignedGreaterThanOrEqual (const BaseSemantics::SValuePtr &, const BaseSemantics::SValuePtr &) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | isSignedLessThan (const BaseSemantics::SValuePtr &, const BaseSemantics::SValuePtr &) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | isSignedLessThanOrEqual (const BaseSemantics::SValuePtr &, const BaseSemantics::SValuePtr &) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | isSignedGreaterThan (const BaseSemantics::SValuePtr &, const BaseSemantics::SValuePtr &) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | isSignedGreaterThanOrEqual (const BaseSemantics::SValuePtr &, const BaseSemantics::SValuePtr &) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | unsignedExtend (const BaseSemantics::SValuePtr &a_, size_t new_width) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | signExtend (const BaseSemantics::SValuePtr &a_, size_t new_width) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | add (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | subtract (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) ROSE_OVERRIDE |
virtual BaseSemantics::SValuePtr | addWithCarries (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_, const BaseSemantics::SValuePtr &c_, BaseSemantics::SValuePtr &carry_out) ROSE_OVERRIDE |
Used for printing RISC operators with formatting. More... | |
virtual BaseSemantics::SValuePtr | negate (const BaseSemantics::SValuePtr &a_) ROSE_OVERRIDE |
Two's complement. More... | |
virtual BaseSemantics::SValuePtr | signedDivide (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) ROSE_OVERRIDE |
Divides two signed values. More... | |
virtual BaseSemantics::SValuePtr | signedModulo (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) ROSE_OVERRIDE |
Calculates modulo with signed values. More... | |
virtual BaseSemantics::SValuePtr | signedMultiply (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) ROSE_OVERRIDE |
Multiplies two signed values. More... | |
virtual BaseSemantics::SValuePtr | unsignedDivide (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) ROSE_OVERRIDE |
Divides two unsigned values. More... | |
virtual BaseSemantics::SValuePtr | unsignedModulo (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) ROSE_OVERRIDE |
Calculates modulo with unsigned values. More... | |
virtual BaseSemantics::SValuePtr | unsignedMultiply (const BaseSemantics::SValuePtr &a_, const BaseSemantics::SValuePtr &b_) ROSE_OVERRIDE |
Multiply two unsigned values. More... | |
virtual void | interrupt (int majr, int minr) ROSE_OVERRIDE |
Invoked for instructions that cause an interrupt. More... | |
virtual BaseSemantics::SValuePtr | readRegister (RegisterDescriptor reg, const BaseSemantics::SValuePtr &dflt) ROSE_OVERRIDE |
Reads a value from a register. More... | |
virtual BaseSemantics::SValuePtr | peekRegister (RegisterDescriptor reg, const BaseSemantics::SValuePtr &dflt) ROSE_OVERRIDE |
Obtain a register value without side effects. More... | |
virtual void | writeRegister (RegisterDescriptor reg, const BaseSemantics::SValuePtr &a) ROSE_OVERRIDE |
Writes a value to a register. More... | |
virtual BaseSemantics::SValuePtr | readMemory (RegisterDescriptor segreg, const BaseSemantics::SValuePtr &addr, const BaseSemantics::SValuePtr &dflt, const BaseSemantics::SValuePtr &cond) ROSE_OVERRIDE |
Reads a value from memory. More... | |
virtual BaseSemantics::SValuePtr | peekMemory (RegisterDescriptor segreg, const BaseSemantics::SValuePtr &addr, const BaseSemantics::SValuePtr &dflt) ROSE_OVERRIDE |
Read memory without side effects. More... | |
virtual void | writeMemory (RegisterDescriptor segreg, const BaseSemantics::SValuePtr &addr, const BaseSemantics::SValuePtr &data, const BaseSemantics::SValuePtr &cond) ROSE_OVERRIDE |
Writes a value to memory. More... | |
![]() | |
virtual SValuePtr | protoval () const |
Property: Prototypical semantic value. More... | |
virtual void | interrupt (const SValuePtr &majr, const SValuePtr &minr, const SValuePtr &enabled) |
Invoked for instructions that cause an interrupt. More... | |
virtual SValuePtr | fpFromInteger (const SValuePtr &intValue, SgAsmFloatType *fpType) |
Construct a floating-point value from an integer value. More... | |
virtual SValuePtr | fpToInteger (const SValuePtr &fpValue, SgAsmFloatType *fpType, const SValuePtr &dflt) |
Construct an integer value from a floating-point value. More... | |
virtual SValuePtr | fpConvert (const SValuePtr &a, SgAsmFloatType *aType, SgAsmFloatType *retType) |
Convert from one floating-point type to another. More... | |
virtual SValuePtr | fpIsNan (const SValuePtr &fpValue, SgAsmFloatType *fpType) |
Whether a floating-point value is a special not-a-number bit pattern. More... | |
virtual SValuePtr | fpIsDenormalized (const SValuePtr &fpValue, SgAsmFloatType *fpType) |
Whether a floating-point value is denormalized. More... | |
virtual SValuePtr | fpIsZero (const SValuePtr &fpValue, SgAsmFloatType *fpType) |
Whether a floating-point value is equal to zero. More... | |
virtual SValuePtr | fpIsInfinity (const SValuePtr &fpValue, SgAsmFloatType *fpType) |
Whether a floating-point value is infinity. More... | |
virtual SValuePtr | fpSign (const SValuePtr &fpValue, SgAsmFloatType *fpType) |
Sign of floating-point value. More... | |
virtual SValuePtr | fpEffectiveExponent (const SValuePtr &fpValue, SgAsmFloatType *fpType) |
Exponent of floating-point value. More... | |
virtual SValuePtr | fpAdd (const SValuePtr &a, const SValuePtr &b, SgAsmFloatType *fpType) |
Add two floating-point values. More... | |
virtual SValuePtr | fpSubtract (const SValuePtr &a, const SValuePtr &b, SgAsmFloatType *fpType) |
Subtract one floating-point value from another. More... | |
virtual SValuePtr | fpMultiply (const SValuePtr &a, const SValuePtr &b, SgAsmFloatType *fpType) |
Multiply two floating-point values. More... | |
virtual SValuePtr | fpDivide (const SValuePtr &a, const SValuePtr &b, SgAsmFloatType *fpType) |
Divide one floating-point value by another. More... | |
virtual SValuePtr | fpSquareRoot (const SValuePtr &a, SgAsmFloatType *fpType) |
Square root. More... | |
virtual SValuePtr | fpRoundTowardZero (const SValuePtr &a, SgAsmFloatType *fpType) |
Round toward zero. More... | |
virtual SValuePtr | reinterpret (const SValuePtr &a, SgAsmType *retType) |
Reinterpret an expression as a different type. More... | |
virtual SValuePtr | convert (const SValuePtr &a, SgAsmType *srcType, SgAsmType *dstType) |
Convert value from one type to another. More... | |
virtual SmtSolverPtr | solver () const |
Property: Satisfiability module theory (SMT) solver. More... | |
virtual void | solver (const SmtSolverPtr &s) |
Property: Satisfiability module theory (SMT) solver. More... | |
const HotPatch & | hotPatch () const |
Property: Post-instruction hot patches. More... | |
HotPatch & | hotPatch () |
Property: Post-instruction hot patches. More... | |
void | hotPatch (const HotPatch &hp) |
Property: Post-instruction hot patches. More... | |
virtual StatePtr | currentState () const |
Property: Current semantic state. More... | |
virtual void | currentState (const StatePtr &s) |
Property: Current semantic state. More... | |
virtual StatePtr | initialState () const |
Property: Optional lazily updated initial state. More... | |
virtual void | initialState (const StatePtr &s) |
Property: Optional lazily updated initial state. More... | |
virtual const std::string & | name () const |
Property: Name used for debugging. More... | |
virtual void | name (const std::string &s) |
Property: Name used for debugging. More... | |
void | print (std::ostream &stream, const std::string prefix="") const |
Print multi-line output for this object. | |
virtual void | print (std::ostream &stream, Formatter &fmt) const |
Print multi-line output for this object. | |
virtual SValuePtr | readRegister (RegisterDescriptor reg) |
Reads a value from a register. More... | |
SValuePtr | peekRegister (RegisterDescriptor reg) |
Obtain a register value without side effects. More... | |
Static Public Member Functions | |
static RiscOperatorsPtr | instance (const RegisterDictionary *regdict, const SmtSolverPtr &solver=SmtSolverPtr()) |
Instantiates a new RiscOperators object and configures it to use semantic values and states that are defaults for StaticSemantics. More... | |
static RiscOperatorsPtr | instance (const BaseSemantics::SValuePtr &protoval, const SmtSolverPtr &solver=SmtSolverPtr()) |
Instantiates a new RiscOperators object with specified prototypical values. More... | |
static RiscOperatorsPtr | instance (const BaseSemantics::StatePtr &state, const SmtSolverPtr &solver=SmtSolverPtr()) |
Instantiates a new RiscOperators object with specified state. More... | |
static RiscOperatorsPtr | promote (const BaseSemantics::RiscOperatorsPtr &x) |
Run-time promotion of a base RiscOperators pointer to static operators. More... | |
![]() | |
static RiscOperatorsPtr | promote (const RiscOperatorsPtr &x) |
Additional Inherited Members | |
![]() | |
typedef RiscOperatorsPtr | Ptr |
Shared-ownership pointer for a RiscOperators object. More... | |
|
inlinestatic |
Instantiates a new RiscOperators object and configures it to use semantic values and states that are defaults for StaticSemantics.
Definition at line 264 of file StaticSemantics2.h.
References Rose::BinaryAnalysis::InstructionSemantics2::StaticSemantics::SValue::instance().
Referenced by create().
|
inlinestatic |
Instantiates a new RiscOperators object with specified prototypical values.
An SMT solver may be specified as the second argument because the base class expects one, but it is not used for static semantics. See solver for details.
Definition at line 275 of file StaticSemantics2.h.
|
inlinestatic |
Instantiates a new RiscOperators object with specified state.
An SMT solver may be specified as the second argument because the base class expects one, but it is not used for static semantics. See solver for details.
Definition at line 281 of file StaticSemantics2.h.
|
inlinevirtual |
Virtual allocating constructor.
The protoval
is a prototypical semantic value that is used as a factory to create additional values as necessary via its virtual constructors. The state upon which the RISC operations operate must be set by modifying the currentState property. An optional SMT solver may be specified (see solver).
Implements Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
Definition at line 288 of file StaticSemantics2.h.
References instance().
|
inlinevirtual |
Virtual allocating constructor.
The supplied state
is that upon which the RISC operations operate and is also used to define the prototypical semantic value. Other states can be supplied by setting currentState. The prototypical semantic value is used as a factory to create additional values as necessary via its virtual constructors. An optional SMT solver may be specified (see solver).
Implements Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
Definition at line 293 of file StaticSemantics2.h.
References instance().
|
inlinestatic |
Run-time promotion of a base RiscOperators pointer to static operators.
This is a checked conversion–it will fail if x
does not point to a StaticSemantics::RiscOperators object.
Definition at line 303 of file StaticSemantics2.h.
|
protected |
|
protected |
|
protected |
|
protected |
|
protected |
|
protected |
|
protected |
Save instruction side effect.
Any semantic value which is an ultimate side effect of an instruction must get saved as a subtree of the instruction node in the AST. This is the point at which the improperly formed SValue AST gets transformed into an AST that follows ROSE's rules for an AST, namely, a parent
property that points to the parent in the AST and thus no sharing of nodes between subtrees.
|
virtual |
Used for printing RISC operators with formatting.
The usual way to use this is:
Since specifying a line prefix string for indentation purposes is such a common use case, the indentation can be given instead of a format, as in the following code that indents the prefixes each line of the expression with four spaces.
The carry_out value is 11100100.
The width of a
and b
must be equal; c
must have a width of one bit; the return value and carry_out
will be the same width as a
and b
. The carry_out
value is allocated herein.
Implements Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Two's complement.
The return value will have the same width as the operand.
Implements Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Divides two signed values.
The width of the result will be the same as the width of the dividend
.
Implements Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Calculates modulo with signed values.
The width of the result will be the same as the width of operand b
.
Implements Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Multiplies two signed values.
The width of the result will be the sum of the widths of a
and b
.
Implements Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Divides two unsigned values.
The width of the result is the same as the width of the dividend
.
Implements Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Calculates modulo with unsigned values.
The width of the result is the same as the width of operand b
.
Implements Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Multiply two unsigned values.
The width of the result is the sum of the widths of a
and b
.
Implements Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Invoked for instructions that cause an interrupt.
The major and minor numbers are architecture specific. For instance, an x86 INT instruction uses major number zero and the minor number is the interrupt number (e.g., 0x80 for Linux system calls), while an x86 SYSENTER instruction uses major number one. The minr operand for INT3 is -3 to distinguish it from the one-argument "INT 3" instruction which has slightly different semantics.
Reimplemented from Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Reads a value from a register.
The base implementation simply delegates to the current semantic State, which probably delegates to a register state, but subclasses are welcome to override this behavior at any level.
A register state will typically implement storage for hardware registers, but higher layers (the State, RiscOperators, Dispatcher, ...) should not be concerned about the size of the register they're trying to read. For example, a register state for a 32-bit x86 architecture will likely have a storage location for the 32-bit EAX register, but it should be possible to ask readRegister to return the value of AX (the low-order 16-bits). In order to accomplish this, some level of the readRegister delegations needs to invoke extract to obtain the low 16 bits. The RiscOperators object is passed along the delegation path for this purpose. The inverse concat operation will be needed at some level when we ask readRegister to return a value that comes from multiple storage locations in the register state (such as can happen if an x86 register state holds individual status flags and we ask for the 32-bit EFLAGS register).
If the register state can distinguish between a register that has never been accessed and a register that has only been read, then the dflt
value is stored into the register the first time it's read. This ensures that reading the register a second time with no intervening write will return the same value as the first read. If a dflt
is not provided then one is constructed by invoking undefined_.
There needs to be a certain level of cooperation between the RiscOperators, State, and register state classes to decide which layer should invoke the extract or concat (or whatever other RISC operations might be necessary).
Reimplemented from Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Obtain a register value without side effects.
This is a lower-level operation than readRegister in that it doesn't cause the register to be marked as having been read. It is typically used in situations where the register is being accessed for analysis purposes rather than as part of an instruction emulation.
Reimplemented from Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Writes a value to a register.
The base implementation simply delegates to the current semantic State, which probably delegates to a register state, but subclasses are welcome to override this behavior at any level.
As with readRegister, writeRegister may need to perform various RISC operations in order to accomplish the task of writing a value to the specified register when the underlying register state doesn't actually store a value for that specific register. The RiscOperations object is passed along for that purpose. See readRegister for more details.
Reimplemented from Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Reads a value from memory.
The implementation (in subclasses) will typically delegate much of the work to the current state's readMemory method.
A MemoryState will implement storage for memory locations and might impose certain restrictions, such as "all memory values must be eight bits". However, the readMemory should not have these constraints so that it can be called from a variety of Dispatcher subclass (e.g., the DispatcherX86 class assumes that readMemory is capable of reading 32-bit values from little-endian memory). The designers of the MemoryState, State, and RiscOperators should collaborate to decide which layer (RiscOperators, State, or MemoryState) is reponsible for combining individual memory locations into larger values. A RiscOperators object is passed along the chain of delegations for this purpose. The RiscOperators might also contain other data that's important during the process, such as an SMT solver.
The segreg
argument is an optional segment register. Most architectures have a flat virtual address space and will pass a default-constructed register descriptor whose is_valid() method returns false.
The cond
argument is a Boolean value that indicates whether this is a true read operation. If cond
can be proven to be false then the read is a no-op and returns an arbitrary value.
The dflt
argument determines the size of the value to be read. This argument is also passed along to the lower layers so that they can, if they desire, use it to initialize memory that has never been read or written before.
Implements Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Read memory without side effects.
This is a lower-level operation than readMemory in that it doesn't cause any side effects in the memory state. In all other respects, it's similar to readMemory.
Implements Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.
|
virtual |
Writes a value to memory.
The implementation (in subclasses) will typically delegate much of the work to the current state's writeMemory method.
The segreg
argument is an optional segment register. Most architectures have a flat virtual address space and will pass a default-constructed register descriptor whose is_valid() method returns false.
The cond
argument is a Boolean value that indicates whether this is a true write operation. If cond
can be proved to be false then writeMemory is a no-op.
Implements Rose::BinaryAnalysis::InstructionSemantics2::BaseSemantics::RiscOperators.