Пример #1
0
        /// <summary>
        /// Traces the definition of the input memory operand (for a source-level dereference)
        /// and returns its symbolic Expression at the source level.
        /// </summary>
        ///
        /// <param name="memoryOperand">Memory operand whose definition needs to be traced.</param>
        /// <param name="varOperand">Current variable operand whose definition is being traced,
        /// which may be different from <paramref name="memoryOperand"/>.</param>
        /// <param name="path">Path along which to trace the definition.</param>
        ///
        /// <returns>Symbolic Expression that corresponds to the input memory operand.</returns>
        /// <remarks>Precondition: <paramref name="memoryOperand"/> and
        /// <paramref name="varOperand"/> are not null.</remarks>
        /// <remarks>Postcondition: The resulting Expression is not null.</remarks>
        private static Expression TraceMemoryOperandBackward(Operand memoryOperand,
                                                             Operand varOperand, Path path)
        {
            Operand    baseOperand     = memoryOperand.BaseOperand;
            Expression basePointerExpr = TraceOperandBackward(baseOperand, varOperand, path);

            int offset = memoryOperand.Field.BitOffset;

            if (offset != 0)
            {
                /* If the bit offset of the field from the start of the memory location
                 * is not zero, add this to any existing offsets. */
                basePointerExpr = ExpressionHelper.AddOffsetToPointer(basePointerExpr,
                                                                      new Constant(offset, path.Config.WORD_BITSIZE), path);
            }

            /* Do not dereference the aggregate access if the memory operand and the variable
             * operand, whose definition is being traced, are both aggregates and have the same
             * aggregate type. This case arises when an aggregate is aliased by another. */
            bool derefAggAccess = !(ExpressionHelper.IsAggregateExpressionType(varOperand.Type) &&
                                    ExpressionHelper.IsAggregateExpressionType(memoryOperand.Type) &&
                                    (PhoenixHelper.GetAggregateName(varOperand.Type.AsAggregateType) ==
                                     PhoenixHelper.GetAggregateName(memoryOperand.Type.AsAggregateType)));

            return(ExpressionHelper.DereferencePointer(basePointerExpr, memoryOperand.Type,
                                                       derefAggAccess, path));
        }
Пример #2
0
        /// <summary>
        /// Traces the definition of the operands occurring in the input value instruction
        /// backward and returns the source-level symbolic Expression that corresponds
        /// to the instruction.
        /// </summary>
        ///
        /// <param name="valueInstruction">Value instruction.</param>
        /// <param name="varOperand">Current variable operand whose definition
        /// is being traced.</param>
        /// <param name="completeTrace">True, if non-temporary variables should be traced
        /// all the way back; false, otherwise. This flag is set to false when generating
        /// conditions, but true when collecting assignments; in the former, we only need
        /// the variable names being assigned to, whereas in the latter, we need the actual
        /// assignment on the right-hand side traced back completely.</param>
        /// <param name="path">Path along which to trace the definition.</param>
        /// <returns>Symbolic Expression that corresponds to the input instruction.</returns>
        public static Expression ExecuteValueInstructionBackward(ValueInstruction valueInstruction,
                                                                 Operand varOperand, bool completeTrace, Path path)
        {
            Expression result      = null;
            Operand    destOperand = valueInstruction.DestinationOperand;

            /* IR instructions that assign to temporary variables should be completely executed
             * backward. Other assignments are actual assignments in the source code. */
            if (!completeTrace && !destOperand.IsTemporary)
            {
                return((destOperand.IsMemoryOperand) ?
                       TraceMemoryOperandBackward(destOperand, varOperand, path) :
                       PhoenixHelper.MakeVariableExpression(destOperand,
                                                            PhoenixHelper.GetOperandName(destOperand), path));
            }

            /* We will be using the first and second operands considerably. We determine what
             * they are before entering the switch-case statement, to keep the code efficient
             * and clean. */
            List <Operand>    srcOperands = new List <Operand>();
            List <Expression> srcExprs    = new List <Expression>();

            foreach (Operand srcOperand in valueInstruction.SourceOperands)
            {
                srcOperands.Add(srcOperand);
                srcExprs.Add(TraceOperandBackward(srcOperand, varOperand, path));
            }

            switch (valueInstruction.Opcode.Id)
            {
            case Phx.Common.Opcode.Index.Parenthesis:
                result = srcExprs[0];
                break;

            case Phx.Common.Opcode.Index.Add:
                result = new Expression(OperatorStore.AddOp,
                                        srcExprs[0], srcExprs[1], destOperand.BitSize);
                break;

            case Phx.Common.Opcode.Index.Subtract:
                result = new Expression(OperatorStore.SubOp,
                                        srcExprs[0], srcExprs[1], destOperand.BitSize);
                break;

            case Phx.Common.Opcode.Index.Multiply:
                result = new Expression(OperatorStore.MultOp,
                                        srcExprs[0], srcExprs[1], destOperand.BitSize);
                break;

            case Phx.Common.Opcode.Index.Divide:
                /* Perform signed division only if the two operands are signed integers. */
                Operator divOpToUse = (srcExprs[0].Type.IsSignedInt &&
                                       srcExprs[1].Type.IsSignedInt) ?
                                      OperatorStore.SDivOp : OperatorStore.UDivOp;
                result = new Expression(divOpToUse,
                                        srcExprs[0], srcExprs[1], destOperand.BitSize);
                break;

            case Phx.Common.Opcode.Index.Remainder:
                result = new Expression(OperatorStore.RemOp,
                                        srcExprs[0], srcExprs[1], destOperand.BitSize);
                break;

            case Phx.Common.Opcode.Index.Assign:
                result = srcExprs[0];
                break;

            case Phx.Common.Opcode.Index.Convert:
                /* This case implies a source-level cast. */
                if (destOperand.IsPointer && srcOperands[0].IsPointer)
                {
                    /* If a pointer to one type is cast to a pointer of another type, the size
                     * of the pointer does not change. In this case, do not change the size
                     * or the type of the source operand. */
                    result = srcExprs[0];

                    /* Return the result now so that its type does not get modified later in
                     * this function to be that of the destination operand. */
                    return(result);
                }
                else
                {
                    result = ExpressionHelper.AdjustBitSize(srcExprs[0],
                                                            destOperand.BitSize, srcOperands[0].IsUnsignedInt, path);
                }
                break;

            case Phx.Common.Opcode.Index.Subscript:
                /* Dereference the first source Expression, which is a pointer Expression
                 * that refers to the array whose element is being accessed. */
                Expression arrayExpr = ExpressionHelper.DereferencePointer(srcExprs[0],
                                                                           ExpressionHelper.GetPointerReferentType(srcExprs[0]), true, path);
                /* Check if the dereferenced source Expression aliases another Expression. */
                arrayExpr = path.FindAliasedExpression(arrayExpr);

                /* Determine the indices that are needed to access the array element
                 * that the subscription Expression represents. */
                List <Expression> accessIndexExprs =
                    ExpressionHelper.GetArrayAccessIndices(arrayExpr,
                                                           srcExprs.GetRange(1, srcExprs.Count - 1), path);

                /* Construct an Expression that refers to the array element that is
                 * being accessed. This Expression will be dereferenced later. */
                result = ExpressionHelper.GetArrayElementReference(arrayExpr,
                                                                   accessIndexExprs, path);

                /* Add conditions that enforce lower and upper bounds on the indices. */
                List <int> upperBounds =
                    ExpressionHelper.GetArrayIndicesUpperBounds(arrayExpr.Type, path);
                int currentBoundIndex = 0;
                foreach (Expression accessIndexExpr in accessIndexExprs)
                {
                    Expression boundCondition =
                        ExpressionHelper.AddBoundsOnIndex(accessIndexExpr,
                                                          upperBounds[currentBoundIndex], path);
                    path.AddCondition(boundCondition, valueInstruction.BasicBlock.Id);
                    currentBoundIndex++;
                }
                break;

            case Phx.Common.Opcode.Index.ShiftLeft:
                result = new Expression(OperatorStore.ShiftLeftOp,
                                        srcExprs[0], srcExprs[1], destOperand.BitSize);
                break;

            case Phx.Common.Opcode.Index.ShiftRight:
                /* (From K&R): If the first Expression is an unsigned
                 * integer, a logical right-shift is performed;
                 * otherwise, an arithmetic right-shift is performed. */
                Operator srOpToUse = srcExprs[0].Type.IsUnsignedInt ?
                                     OperatorStore.LShiftRightOp : OperatorStore.AShiftRightOp;
                result = new Expression(srOpToUse,
                                        srcExprs[0], srcExprs[1], destOperand.BitSize);
                break;

            case Phx.Common.Opcode.Index.BitAnd:
                result = new Expression(OperatorStore.BitAndOp,
                                        srcExprs[0], srcExprs[1], destOperand.BitSize);
                break;

            case Phx.Common.Opcode.Index.BitOr:
                result = new Expression(OperatorStore.BitOrOp,
                                        srcExprs[0], srcExprs[1], destOperand.BitSize);
                break;

            case Phx.Common.Opcode.Index.BitXor:
                result = new Expression(OperatorStore.BitXorOp,
                                        srcExprs[0], srcExprs[1], destOperand.BitSize);
                break;

            case Phx.Common.Opcode.Index.BitComplement:
                result = new Expression(OperatorStore.BitComplementOp,
                                        srcExprs[0], destOperand.BitSize);
                break;

            case Phx.Common.Opcode.Index.Not:
                List <Expression> paramList = new List <Expression>();

                uint destBitSize = destOperand.BitSize;
                paramList.Add(new Expression(OperatorStore.EqualOp, srcExprs[0],
                                             new Constant(0, srcExprs[0].BitSize), path.Config.WORD_BITSIZE));
                paramList.Add(new Constant(1, destBitSize));
                paramList.Add(new Constant(0, destBitSize));

                result = new Expression(OperatorStore.IteOp, paramList, destBitSize);
                break;

            case Phx.Common.Opcode.Index.Negate:
                result = new Expression(OperatorStore.NegateOp,
                                        srcExprs[0], destOperand.BitSize);
                break;

            case Phx.Common.Opcode.Index.Acquire:
                // TODO: We have not implemented complete support for this type of instruction.
                result = new Expression(OperatorStore.AcquireOp);
                break;

            case Phx.Common.Opcode.Index.Release:
                result = srcExprs[0];
                break;

            case Phx.Common.Opcode.Index.Chi:
            default:
                throw new NotImplementedException("PHOENIX: " +
                                                  "Value Instruction Opcode not implemented in symbolic tracer: " +
                                                  valueInstruction.OpcodeToString());
            }

            if (destOperand.IsPointer)
            {
                /* The operand that is being traced is a pointer. This implies that the result
                 * is at least a pointer Expression (or equivalently, a "dereferencing function"
                 * Expression), perhaps offset by a byte offset Expression. Add this offset to
                 * the pointer Expression. */
                Pair <Expression, Expression> baseAndOffset =
                    ExpressionHelper.GetAugendAndAddend(result, path);
                Expression baseExpr = baseAndOffset.First, offsetExpr = baseAndOffset.Second;

                if (!srcOperands[0].IsTemporary)
                {
                    /* Check if the base Expression is an alias for another Expression, but only
                     * if the base Expression results from tracing back a non-temporary operand.
                     * We do not need to check if an Expression that results from tracing
                     * a temporary operand back is an alias: this check would have already
                     * happened, since the process of tracing back a temporary operand should
                     * eventually find (and trace back) a non-temporary operand.
                     *
                     * Also, checking if an Expression is an alias for another Expression
                     * is not an idempotent operation, so it should be done sparingly. */
                    baseExpr = path.FindAliasedExpression(baseExpr);
                }

                Phx.Types.Type referentType = ExpressionHelper.GetPointerReferentType(destOperand.Type);
                if (referentType.IsUnmanagedArrayType)
                {
                    Expression modifiedOffsetExpr = new Expression(OperatorStore.MultOp,
                                                                   offsetExpr, new Constant(referentType.BitSize, offsetExpr.BitSize),
                                                                   offsetExpr.BitSize);
                    modifiedOffsetExpr.Type = offsetExpr.Type;
                    offsetExpr = ExpressionHelper.SimplifyExpression(modifiedOffsetExpr, path);
                }

                Expression offsetBitsExpr = ExpressionHelper.ConvertToBits(offsetExpr, path);
                result = ExpressionHelper.AddOffsetToPointer(baseExpr, offsetBitsExpr, path);
            }

            result.Type = destOperand.Type;
            return(result);
        }