Description

Type of values manipulated by the SymbolicSemantics domain.

Values of type type are used whenever a value needs to be stored, such as memory addresses, the values stored at those addresses, the values stored in registers, the operands for RISC operations, and the results of those operations.

An SValue points to an expression composed of the ExprNode types defined in Rose/BinaryAnalysis/SymbolicExpression.h, and also stores the set of instructions that were used to define the value. This provides a framework for some simple forms of value-based def-use analysis. See get_defining_instructions() for details.

Unknown versus Uninitialized Values

One sometimes needs to distinguish between registers (or other named storage locations) that contain an "unknown" value versus registers that have not been initialized. By "unknown" we mean a value that has no constraints except for its size (e.g., a register that contains "any 32-bit value"). By "uninitialized" we mean a register that still contains the value that was placed there before we started symbolically evaluating instructions (i.e., a register to which symbolic evaluation hasn't written a new value).

An "unknown" value might be produced by a RISC operation that is unable/unwilling to express its result symbolically. For instance, the RISC "add(A,B)" operation could return an unknown/unconstrained result if either A or B are unknown/unconstrained (in other words, add(A,B) returns C). An unconstrained value is represented by a free variable. ROSE's SymbolicSemantics RISC operations never return unconstrained values, but rather always return a new expression (add(A,B) returns the symbolic expression A+B). However, user-defined subclasses of ROSE's SymbolicSemantics classes might return unconstrained values, and in fact it is quite common for a programmer to first stub out all the RISC operations to return unconstrained values and then gradually implement them as they're required. When a RISC operation returns an unconstrained value, it should set the returned value's defining instructions to the CPU instruction that caused the RISC operation to be called (and possibly the union of the sets of instructions that defined the RISC operation's operands).

An "uninitialized" register (or other storage location) is a register that hasn't ever had a value written to it as a side effect of a machine instruction, and thus still contains the value that was initialially stored there before analysis started (perhaps by a default constructor). Such values will generally be unconstrained (i.e., "unknown" as defined above) but will have an empty defining instruction set. The defining instruction set is empty because the register contains a value that was not generated as the result of simulating some machine instruction.

Therefore, it is possible to destinguish between an uninitialized register and an unconstrained register by looking at its value. If the value is a variable with an empty set of defining instructions, then it must be an initial value. If the value is a variable but has a non-empty set of defining instructions, then it must be a value that came from some RISC operation invoked on behalf of a machine instruction.

One should note that a register that contains a variable is not necessarily unconstrained: another register might contain the same variable, in which case the two registers are constrained to have the same value, although that value could be anything. Consider the following example:

Step 1: Initialize registers. At this point EAX contains v1[32]{}, EBX contains v2[32]{}, and ECX contains v3[32]{}. The notation "vN" is a variable, "[32]" means the variable is 32-bits wide, and "{}" indicates that the set of defining instructions is empty. Since the defining sets are empty, the registers can be considered to be "uninitialized" (more specifically, they contain initial values that were created by the symbolic machine state constructor, or by the user explicitly initializing the registers; they don't contain values that were put there as a side effect of executing some machine instruction).

Step 2: Execute an x86 "I1: MOV EAX, EBX" instruction that moves the value stored in EBX into the EAX register. After this instruction executes, EAX contains v2[32]{I1}, EBX contains v2[32]{}, and ECX contains v3[32]{}. Registers EBX and ECX continue to have empty sets of defining instructions and thus contain their initial values. Reigister EAX refers to the same variable (v2) as EBX and therefore must have the same value as EBX, although that value can be any 32-bit value. We can also tell that EAX no longer contains its initial value because the set of defining instructions is non-empty ({I1}).

Step 3: Execute the imaginary "I2: FOO ECX, EAX" instruction and presume that it performs an operation using ECX and EAX and stores the result in ECX. The operation is implemented by a new user-defined RISC operation called "doFoo(A,B)". Furthermore, presume that the operation encoded by doFoo(A,B) cannot be represented by ROSE's expression trees either directly or indirectly via other expression tree operations. Therefore, the implementation of doFoo(A,B) is such that it always returns an unconstrained value (i.e., a new variable): doFoo(A,B) returns C. After this instruction executes, EAX and EBX continue to contain the results they had after step 2, and ECX now contains v4[32]{I2}. We can tell that ECX contains an unknown value (because its value is a variable) that is 32-bits wide. We can also tell that ECX no longer contains its initial value because its set of defining instructions is non-empty ({I2}).

Definition at line 193 of file SymbolicSemantics.h.

#include <Rose/BinaryAnalysis/InstructionSemantics/SymbolicSemantics.h>

Inheritance diagram for Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue:

[legend]

Collaboration diagram for Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue:

[legend]

Public Types
using	Super = BaseSemantics::SValue
	Base type.

using	Ptr = SValuePtr
	Shared-ownership pointer.

Public Types inherited from Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue
using	Ptr = SValuePtr
	Shared-ownership pointer.

Public Member Functions
virtual BaseSemantics::SValuePtr	bottom_ (size_t nbits) const override
	Data-flow bottom value.

virtual BaseSemantics::SValuePtr	undefined_ (size_t nbits) const override
	Create a new undefined semantic value.

virtual BaseSemantics::SValuePtr	unspecified_ (size_t nbits) const override
	Create a new unspecified semantic value.

virtual BaseSemantics::SValuePtr	number_ (size_t nbits, uint64_t value) const override
	Create a new concrete semantic value.

virtual BaseSemantics::SValuePtr	boolean_ (bool value) const override
	Create a new, Boolean value.

virtual BaseSemantics::SValuePtr	copy (size_t new_width=0) const override
	Create a new value from an existing value, changing the width if `new_width` is non-zero.

virtual Sawyer::Optional< BaseSemantics::SValuePtr >	createOptionalMerge (const BaseSemantics::SValuePtr &other, const BaseSemantics::MergerPtr &, const SmtSolverPtr &) const override
	Possibly create a new value by merging two existing values.

virtual bool	isBottom () const override
	Determines whether a value is a data-flow bottom.

virtual void	print (std::ostream &, BaseSemantics::Formatter &) const override
	Print a value to a stream using default format.

virtual void	hash (Combinatorics::Hasher &) const override
	Hash this semantic value.

virtual SValuePtr	substitute (const SValuePtr &from, const SValuePtr &to, const SmtSolverPtr &solver) const
	Substitute one value for another throughout a value.

virtual const ExprPtr &	get_expression () const
	Returns the expression stored in this value.

virtual const InsnSet &	get_defining_instructions () const
	Returns the set of instructions that defined this value.


virtual void	defined_by (SgAsmInstruction *insn, const InsnSet &set1, const InsnSet &set2, const InsnSet &set3)
	Adds instructions to the list of defining instructions.

virtual void	defined_by (SgAsmInstruction *insn, const InsnSet &set1, const InsnSet &set2)
	Adds instructions to the list of defining instructions.

virtual void	defined_by (SgAsmInstruction *insn, const InsnSet &set1)
	Adds instructions to the list of defining instructions.

virtual void	defined_by (SgAsmInstruction *insn)
	Adds instructions to the list of defining instructions.


virtual void	set_expression (const ExprPtr &new_expr)
	Changes the expression stored in the value.

virtual void	set_expression (const SValuePtr &source)
	Changes the expression stored in the value.


virtual size_t	add_defining_instructions (const InsnSet &to_add)
	Adds definitions to the list of defining instructions.

virtual size_t	add_defining_instructions (const SValuePtr &source)
	Adds definitions to the list of defining instructions.

virtual size_t	add_defining_instructions (SgAsmInstruction *insn)
	Adds definitions to the list of defining instructions.


virtual void	set_defining_instructions (const InsnSet &new_defs)
	Set defining instructions.

virtual void	set_defining_instructions (const SValuePtr &source)
	Set defining instructions.

virtual void	set_defining_instructions (SgAsmInstruction *insn)
	Set defining instructions.

Public Member Functions inherited from Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue
SValuePtr	createMerged (const SValuePtr &other, const MergerPtr &merger, const SmtSolverPtr &solver) const
	Create a new value by merging two existing values.

size_t	nBits () const
	Property: value width.

bool	isConcrete () const
	Determines if the value is a concrete number.

Sawyer::Optional< uint64_t >	toUnsigned () const
	Converts a concrete value to a native unsigned integer.

Sawyer::Optional< int64_t >	toSigned () const
	Converts a concrete value to a native signed integer.

bool	mustEqual (const SValuePtr &other, const SmtSolverPtr &solver=SmtSolverPtr()) const
	Tests two values for equality.

bool	mayEqual (const SValuePtr &other, const SmtSolverPtr &solver=SmtSolverPtr()) const
	Tests two values for possible equality.

bool	isTrue () const
	Returns true if concrete non-zero.

bool	isFalse () const
	Returns true if concrete zero.

std::string	toString () const
	Render this symbolic expression as a string.

std::string	comment () const
	Property: Comment.

void	comment (const std::string &) const
	Property: Comment.

void	print (std::ostream &) const
	Print a value to a stream using default format.

WithFormatter	with_format (Formatter &fmt)
	Used for printing values with formatting.

WithFormatter	operator+ (Formatter &fmt)
	Used for printing values with formatting.

WithFormatter	operator+ (const std::string &linePrefix)
	Used for printing values with formatting.

virtual size_t	get_width () const
	Virtual API.

Public Member Functions inherited from Sawyer::SharedObject
	SharedObject ()
	Default constructor.

	SharedObject (const SharedObject &)
	Copy constructor.

virtual	~SharedObject ()
	Virtual destructor.

SharedObject &	operator= (const SharedObject &)
	Assignment.

Public Member Functions inherited from Sawyer::SharedFromThis< SValue >
SharedPointer< SValue >	sharedFromThis ()
	Create a shared pointer from `this`.

SharedPointer< const SValue >	sharedFromThis () const
	Create a shared pointer from `this`.

Static Public Member Functions
static SValuePtr	instance ()
	Instantiate a new prototypical value.

static SValuePtr	instance_bottom (size_t nbits)
	Instantiate a new data-flow bottom value of specified width.

static SValuePtr	instance_undefined (size_t nbits)
	Instantiate a new undefined value of specified width.

static SValuePtr	instance_unspecified (size_t nbits)
	Instantiate a new unspecified value of specified width.

static SValuePtr	instance_integer (size_t nbits, uint64_t value)
	Instantiate a new concrete value.

static SValuePtr	instance_symbolic (const SymbolicExpression::Ptr &value)
	Instantiate a new symbolic value.

static SValuePtr	promote (const BaseSemantics::SValuePtr &)
	Promote a base value to a SymbolicSemantics value.

Static Public Member Functions inherited from Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue
static SValuePtr	promote (const SValuePtr &x)

Static Public Member Functions inherited from Sawyer::SmallObject
static SynchronizedPoolAllocator &	poolAllocator ()
	Return the pool allocator for this class.

static void *	operator new (size_t size)

static void	operator delete (void *ptr, size_t size)

Protected Member Functions
	SValue (size_t nbits)

	SValue (size_t nbits, uint64_t number)

	SValue (ExprPtr expr)

virtual bool	may_equal (const BaseSemantics::SValuePtr &other, const SmtSolverPtr &solver=SmtSolverPtr()) const override
	Virtual API.

virtual bool	must_equal (const BaseSemantics::SValuePtr &other, const SmtSolverPtr &solver=SmtSolverPtr()) const override
	Virtual API.

virtual void	set_width (size_t nbits) override
	Virtual API.

virtual bool	is_number () const override
	Virtual API.

virtual uint64_t	get_number () const override
	Virtual API.

virtual std::string	get_comment () const override
	Some subclasses support the ability to add comments to values.

virtual void	set_comment (const std::string &) const override
	Some subclasses support the ability to add comments to values.

Protected Member Functions inherited from Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue
	SValue (size_t nbits)

	SValue (const SValue &other)

Protected Attributes
ExprPtr	expr
	The symbolic expression for this value.

InsnSet	defs
	Instructions defining this value.

Protected Attributes inherited from Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue
size_t	width

Member Typedef Documentation

◆ Super

using Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::Super = BaseSemantics::SValue

Base type.

Definition at line 196 of file SymbolicSemantics.h.

◆ Ptr

using Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::Ptr = SValuePtr

Shared-ownership pointer.

Definition at line 199 of file SymbolicSemantics.h.

Member Function Documentation

◆ instance()

static SValuePtr Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::instance ( )

static

Instantiate a new prototypical value.

Prototypical values are only used for their virtual constructors.

◆ bottom_()

virtual BaseSemantics::SValuePtr Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::bottom_ ( size_t nBits ) const

overridevirtual

Data-flow bottom value.

Returns a new value that represents bottom in a data-flow analysis. If a semantic domain can represent a bottom value then the isBottom predicate is true when invoked on this method's return value. If a semantic domain cannot support a bottom value, then it may return some other value.

Implements Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

Reimplemented in Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue.

◆ undefined_()

virtual BaseSemantics::SValuePtr Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::undefined_ ( size_t nbits ) const

overridevirtual

Create a new undefined semantic value.

The new semantic value will have the same dynamic type as the value on which this virtual method is called. This is the most common way that a new value is created. The unspecified_ method is closely related.

See also: unspecified_

Implements Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

Reimplemented in Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue.

◆ unspecified_()

virtual BaseSemantics::SValuePtr Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::unspecified_ ( size_t nbits ) const

overridevirtual

Create a new unspecified semantic value.

The new semantic value will have the same dynamic type as the value on which this virtual method is called. Undefined (undefined_) and unspecified are closely related. Unspecified values are the same as undefined values except they're instantiated as the result of some machine instruction where the ISA documentation indicates that the value is unspecified (e.g., status flags for x86 shift and rotate instructions).

Most semantic domains make no distinction between undefined and unspecified.

See also: undefined_

Implements Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

Reimplemented in Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue.

◆ number_()

virtual BaseSemantics::SValuePtr Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::number_	(	size_t	nbits,
		uint64_t	number
	)		const

overridevirtual

Create a new concrete semantic value.

The new value will represent the specified concrete value and have the same dynamic type as the value on which this virtual method is called. This is the most common way that a new constant is created. The number is truncated to contain nbits bits (higher order bits are cleared).

Implements Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

Reimplemented in Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue.

◆ boolean_()

virtual BaseSemantics::SValuePtr Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::boolean_ ( bool value ) const

overridevirtual

Create a new, Boolean value.

The new semantic value will have the same dynamic type as the value on which this virtual method is called. This is how 1-bit flag register values (among others) are created. The base implementation uses number_() to construct a 1-bit value whose bit is zero (false) or one (true).

Reimplemented from Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

Reimplemented in Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue.

◆ copy()

virtual BaseSemantics::SValuePtr Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::copy ( size_t new_width = 0 ) const

overridevirtual

Create a new value from an existing value, changing the width if new_width is non-zero.

Increasing the width logically adds zero bits to the most significant side of the value; decreasing the width logically removes bits from the most significant side of the value.

Implements Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

Reimplemented in Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue.

◆ createOptionalMerge()

virtual Sawyer::Optional< BaseSemantics::SValuePtr > Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::createOptionalMerge	(	const BaseSemantics::SValuePtr &	other,
		const BaseSemantics::MergerPtr &	merger,
		const SmtSolverPtr &	solver
	)		const

overridevirtual

Possibly create a new value by merging two existing values.

This method optionally returns a new semantic value as the data-flow merge of this and other. If the two inputs are "equal" in some sense of the dataflow implementation then nothing is returned, otherwise a new value is returned. Typical usage is like this:

 if (SValuePtr merged = v1->createOptionalMerge(v2).orDefault()) {
     std::cout <<"v1 and v2 were merged to " <<*merged <<"\n";
 } else {
     std::cout <<"no merge is necessary\n";
 }
 
 or
 
@code
 SValuePtr merge;
 if (v1->createOptionalMerge(v2).assignTo(merged)) {
     std::cout <<"v1 and v2 were merged to " <<*merged <<"\n";
 } else {
     std::cout <<"v1 and v2 are equal in some sense (no merge necessary)\n";
 }

If you always want a copy regardless of whether the merge is necessary, then use the createMerged convenience function instead.

Implements Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

Reimplemented in Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue.

◆ promote()

static SValuePtr Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::promote ( const BaseSemantics::SValuePtr & )

static

Promote a base value to a SymbolicSemantics value.

The value v must have a SymbolicSemantics::SValue dynamic type.

◆ isBottom()

virtual bool Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::isBottom ( ) const

overridevirtual

Determines whether a value is a data-flow bottom.

Returns true if this value represents a bottom value for data-flow analysis. Any RiscOperation performed on an operand whose isBottom predicate returns true will itself return a bottom value. This includes operations like "xor x x" which would normally return zero.

Implements Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

◆ print()

virtual void Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::print	(	std::ostream &	,
		BaseSemantics::Formatter &
	)		const

overridevirtual

Print a value to a stream using default format.

The value will normally occupy a single line and not contain leading space or line termination. See also, with_format().

Implements Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

Reimplemented in Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue.

◆ hash()

virtual void Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::hash ( Combinatorics::Hasher & ) const

overridevirtual

Hash this semantic value.

Hashes the value by appending it to the specified hasher.

Implements Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

Reimplemented in Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue.

◆ may_equal()

virtual bool Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::may_equal	(	const BaseSemantics::SValuePtr &	other,
		const SmtSolverPtr &	solver = `SmtSolverPtr()`
	)		const

overrideprotectedvirtual

Virtual API.

See mayEqual.

Implements Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

Reimplemented in Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue.

◆ must_equal()

virtual bool Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::must_equal	(	const BaseSemantics::SValuePtr &	other,
		const SmtSolverPtr &	solver = `SmtSolverPtr()`
	)		const

overrideprotectedvirtual

Virtual API.

See mustEqual.

Implements Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

Reimplemented in Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue.

◆ set_width()

virtual void Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::set_width ( size_t nbits )

overrideprotectedvirtual

Virtual API.

See nBits.

Reimplemented from Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

◆ is_number()

virtual bool Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::is_number ( ) const

overrideprotectedvirtual

Virtual API.

See isConcrete.

Implements Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

◆ get_number()

virtual uint64_t Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::get_number ( ) const

overrideprotectedvirtual

Virtual API.

See toUnsigned and toSigned.

Implements Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

◆ get_comment()

virtual std::string Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::get_comment ( ) const

overrideprotectedvirtual

Some subclasses support the ability to add comments to values.

We define no-op versions of these methods here because it makes things easier. The base class tries to be as small as possible by not storing comments at all. Comments should not affect any computation (comparisons, hash values, etc), and therefore are allowed to be modified even for const objects.

Reimplemented from Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

◆ set_comment()

virtual void Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::set_comment ( const std::string & ) const

overrideprotectedvirtual

Some subclasses support the ability to add comments to values.

We define no-op versions of these methods here because it makes things easier. The base class tries to be as small as possible by not storing comments at all. Comments should not affect any computation (comparisons, hash values, etc), and therefore are allowed to be modified even for const objects.

Reimplemented from Rose::BinaryAnalysis::InstructionSemantics::BaseSemantics::SValue.

◆ substitute()

virtual SValuePtr Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::substitute	(	const SValuePtr &	from,
		const SValuePtr &	to,
		const SmtSolverPtr &	solver
	)		const

virtual

Substitute one value for another throughout a value.

For example, if this value is "(add esp_0, -12)" and we substitute "esp_0" with "(add stack_frame 4)", this method would return "(add stack_frame -8)". It is also possible for the from value to be a more complicated expression. This method attempts to match from at all nodes of this expression and substitutes at eac node that matches. The from and to must have the same width. The solver is optional and used during simplification of the result.

◆ defined_by() [1/4]

virtual void Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::defined_by	(	SgAsmInstruction *	insn,
		const InsnSet &	set1,
		const InsnSet &	set2,
		const InsnSet &	set3
	)

virtual

Adds instructions to the list of defining instructions.

Adds the specified instruction and defining sets into this value and returns a reference to this value. See also add_defining_instructions().

◆ defined_by() [2/4]

virtual void Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::defined_by	(	SgAsmInstruction *	insn,
		const InsnSet &	set1,
		const InsnSet &	set2
	)

virtual

Adds instructions to the list of defining instructions.

Adds the specified instruction and defining sets into this value and returns a reference to this value. See also add_defining_instructions().

◆ defined_by() [3/4]

virtual void Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::defined_by	(	SgAsmInstruction *	insn,
		const InsnSet &	set1
	)

virtual

Adds instructions to the list of defining instructions.

Adds the specified instruction and defining sets into this value and returns a reference to this value. See also add_defining_instructions().

◆ defined_by() [4/4]

virtual void Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::defined_by ( SgAsmInstruction * insn )

virtual

Adds instructions to the list of defining instructions.

Adds the specified instruction and defining sets into this value and returns a reference to this value. See also add_defining_instructions().

◆ get_expression()

virtual const ExprPtr & Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::get_expression ( ) const

virtual

Returns the expression stored in this value.

Expressions are reference counted; the reference count of the returned expression is not incremented.

◆ get_defining_instructions()

virtual const InsnSet & Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::get_defining_instructions ( ) const

virtual

Returns the set of instructions that defined this value.

The return value is a flattened lattice represented as a set. When analyzing this basic block starting with an initial default state:

mov eax, 2
add eax, 1
mov ebx, eax;
mov ebx, 3

the defining set for the value stored in EAX will be instructions {1, 2} and the defining set for the value stored in EBX will be {4}. Defining sets for values stored in other registers are the empty set.

◆ add_defining_instructions() [1/3]

virtual size_t Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::add_defining_instructions ( const InsnSet & to_add )

virtual

Adds definitions to the list of defining instructions.

Returns the number of items added that weren't already in the list of defining instructions.

◆ add_defining_instructions() [2/3]

virtual size_t Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::add_defining_instructions ( const SValuePtr & source )

virtual

Adds definitions to the list of defining instructions.

Returns the number of items added that weren't already in the list of defining instructions.

◆ add_defining_instructions() [3/3]

virtual size_t Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::add_defining_instructions ( SgAsmInstruction * insn )

virtual

Adds definitions to the list of defining instructions.

Returns the number of items added that weren't already in the list of defining instructions.

◆ set_defining_instructions() [1/3]

virtual void Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::set_defining_instructions ( const InsnSet & new_defs )

virtual

Set defining instructions.

This discards the old set of defining instructions and replaces it with the specified set.

◆ set_defining_instructions() [2/3]

virtual void Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::set_defining_instructions ( const SValuePtr & source )

virtual

Set defining instructions.

This discards the old set of defining instructions and replaces it with the specified set.

◆ set_defining_instructions() [3/3]

virtual void Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::set_defining_instructions ( SgAsmInstruction * insn )

virtual

Set defining instructions.

This discards the old set of defining instructions and replaces it with the specified set.

Member Data Documentation

◆ expr

ExprPtr Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::expr

protected

The symbolic expression for this value.

Symbolic expressions are reference counted.

Definition at line 203 of file SymbolicSemantics.h.

◆ defs

InsnSet Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::defs

protected

Instructions defining this value.

Any instruction that saves the value to a register or memory location adds itself to the saved value.

Definition at line 207 of file SymbolicSemantics.h.

The documentation for this class was generated from the following file:

SymbolicSemantics.h

Description

Unknown versus Uninitialized Values

Public Types

Public Member Functions

Static Public Member Functions

Protected Member Functions

Protected Attributes

Member Typedef Documentation

◆ Super

◆ Ptr

Member Function Documentation

◆ instance()

◆ bottom_()

◆ undefined_()

◆ unspecified_()

◆ number_()

◆ boolean_()

◆ copy()

◆ createOptionalMerge()

◆ promote()

◆ isBottom()

◆ print()

◆ hash()

◆ may_equal()

◆ must_equal()

◆ set_width()

◆ is_number()

◆ get_number()

◆ get_comment()

◆ set_comment()

◆ substitute()

◆ defined_by() [1/4]

◆ defined_by() [2/4]

◆ defined_by() [3/4]

◆ defined_by() [4/4]

◆ get_expression()

◆ get_defining_instructions()

◆ add_defining_instructions() [1/3]

◆ add_defining_instructions() [2/3]

◆ add_defining_instructions() [3/3]

◆ set_defining_instructions() [1/3]

◆ set_defining_instructions() [2/3]

◆ set_defining_instructions() [3/3]

Member Data Documentation

◆ expr

◆ defs