public void EnsureEvaluationContext(BlockFlow bf)
{
this.ctx = bf.SymbolicIn.Clone();
var tes = new TrashedExpressionSimplifier(this, ctx);
this.se = new SymbolicEvaluator(tes, ctx);
}
private void CreateSymbolicEvaluator(Frame frame)
{
ctx = new SymbolicEvaluationContext(arch, frame);
se = new SymbolicEvaluator(ctx);
if (esp == null)
esp = Tmp32("esp");
ctx.SetValue(esp, frame.FramePointer);
}
private void CreateSymbolicEvaluator(Frame frame)
{
ctx = new SymbolicEvaluationContext(arch, frame);
se = new SymbolicEvaluator(ctx);
if (esp == null)
{
esp = Tmp32("esp");
}
ctx.SetValue(esp, frame.FramePointer);
}
private void CreateEvaluationState(Block block)
{
this.ctx = new SymbolicEvaluationContext(
block.Procedure.Architecture,
block.Procedure.Frame);
var tes = new TrashedExpressionSimplifier(
this.program.SegmentMap, this, ctx);
this.se = new SymbolicEvaluator(tes, ctx);
}
private void CreateSymbolicEvaluator(Frame frame)
{
ctx = new SymbolicEvaluationContext(arch, frame);
se = new SymbolicEvaluator(
new ExpressionSimplifier(segmentMap, ctx, listener),
ctx);
if (esp == null)
{
esp = Tmp32("esp");
}
ctx.SetValue(esp, frame.FramePointer);
}
/// <summary>
/// Generate inputs that exercise different program paths.
/// </summary>
/// <param name="function">The function.</param>
/// <param name="precondition">A precondition.</param>
/// <param name="input">The symbolic input.</param>
/// <param name="backend">The backend to use.</param>
/// <returns>A collection of inputs.</returns>
public static IEnumerable <T1> GenerateInputs <T1, T2>(
Func <Zen <T1>, Zen <T2> > function,
Func <Zen <T1>, Zen <bool> > precondition,
Zen <T1> input,
Backend backend)
{
var expression = function(input).Simplify();
var assume = precondition(input).Simplify();
(T2, PathConstraint) interpretFunction(T1 e)
{
var assignment = ModelCheckerFactory.CreateModelChecker(backend, null).ModelCheck(input == e);
var evaluator = new ExpressionEvaluator(true);
var env = new ExpressionEvaluatorEnvironment(assignment);
return((T2)expression.Accept(evaluator, env), evaluator.PathConstraint);
}
Option <T1> findFunction(Zen <bool> e) => SymbolicEvaluator.Find(e, input, backend);
return(GenerateInputsSage(assume, findFunction, interpretFunction));
}
private Expression GetRegisterState(SymbolicEvaluator se, Identifier id)
{
return(ctx.RegisterState[(RegisterStorage)id.Storage]);
}
/// <summary>
/// Verify that if the function satisfies the precondition,
/// then it also satisfies the postcondition.
/// </summary>
/// <param name="invariant">The invariant.</param>
/// <param name="backend">The backend.</param>
/// <returns>An input if one exists satisfying the constraints.</returns>
public bool Assert(Func <Zen <T>, Zen <bool> > invariant = null, Backend backend = Backend.Z3)
{
var result = invariant(this.function());
return(SymbolicEvaluator.Find(result, backend));
}
private Expression GetRegisterState(SymbolicEvaluator se, Identifier id)
{
return ctx.RegisterState[(RegisterStorage)id.Storage];
}
/// <summary>
/// Verify that if the function satisfies the precondition,
/// then it also satisfies the postcondition.
/// </summary>
/// <param name="invariant">The invariant.</param>
/// <param name="backend">The backend.</param>
/// <returns>An input if one exists satisfying the constraints.</returns>
public bool Assert(Func <Zen <T>, Zen <bool> > invariant, Backend backend = Backend.Z3)
{
var result = invariant(this.function());
return(CommonUtilities.RunWithLargeStack(() => SymbolicEvaluator.Find(result, backend)));
}
