Пример #1
0
        /// <summary>
        /// Convert values to string representation and concatenate them.
        /// </summary>
        /// <param name="leftOperand">The left operand of concatenation.</param>
        /// <param name="rightOperand">The right operand of concatenation.</param>
        /// <returns>Concatenated string of both operands.</returns>
        public Value EvaluateConcatenation(Value leftOperand, Value rightOperand)
        {
            // Gets type of left operand and convert to string
            leftOperand.Accept(this);

            var leftString = result;

            // Gets type of right operand and convert to string
            rightOperand.Accept(this);

            // Get all flags from both operands if they are tainted
            var flags    = FlagsHandler.GetFlagsFromValues(leftOperand, rightOperand);
            var flagInfo = new Flags(flags);

            // Check whether it is concrete or abstract value
            Value taintedResult;

            if ((leftString != null) && (result != null))
            {
                taintedResult = OutSet.CreateString(string.Concat(leftString.Value, result.Value));
            }
            else
            {
                taintedResult = OutSet.AnyStringValue;
            }

            return(taintedResult.SetInfo(flagInfo));
        }
Пример #2
0
        /// <summary>
        /// Convert all possible values to string representation and concatenate every combination of them.
        /// </summary>
        /// <param name="leftOperand">The left operand of concatenation.</param>
        /// <param name="rightOperand">The right operand of concatenation.</param>
        /// <returns>All string ​​resulting from the combination of left and right operand values.</returns>
        public MemoryEntry EvaluateConcatenation(MemoryEntry leftOperand, MemoryEntry rightOperand)
        {
            var values = new HashSet <Value>();

            AnyStringValue leftAnyString;
            var            leftStrings = Evaluate(leftOperand, out leftAnyString);

            AnyStringValue rightAnyString;
            var            rightStrings = Evaluate(rightOperand, out rightAnyString);

            if ((leftAnyString != null) || (rightAnyString != null))
            {
                // Get all flags from both abstract operands if they are tainted
                Dictionary <FlagType, bool> flags;
                if (leftAnyString != null)
                {
                    if (rightAnyString != null)
                    {
                        flags = FlagsHandler.GetFlagsFromValues(leftAnyString, rightAnyString);
                    }
                    else
                    {
                        flags = FlagsHandler.GetFlagsFromValues(leftAnyString);
                    }
                }
                else
                {
                    flags = FlagsHandler.GetFlagsFromValues(rightAnyString);
                }

                var flagInfo = new Flags(flags);
                values.Add(OutSet.AnyStringValue.SetInfo(flagInfo));
            }

            foreach (var leftValue in leftStrings)
            {
                foreach (var rightValue in rightStrings)
                {
                    // Get all flags from all combinations of both operands if they are tainted
                    var taintedResult = OutSet.CreateString(string.Concat(leftValue.Value,
                                                                          rightValue.Value));

                    if ((leftValue.GetInfo <Flags>() != null) || (rightValue.GetInfo <Flags>() != null))
                    {
                        var flags    = FlagsHandler.GetFlagsFromValues(leftValue, rightValue);
                        var flagInfo = new Flags(flags);
                        values.Add(taintedResult.SetInfo(flagInfo));
                    }
                    else
                    {
                        values.Add(taintedResult);
                    }
                }
            }

            return(new MemoryEntry(values));
        }
Пример #3
0
        /// <inheritdoc />
        public override void VisitAnyValue(AnyValue value)
        {
            // TODO: This is possible fatal error
            result = null;

            if (value.GetInfo <Flags>() != null)
            {
                var flags    = FlagsHandler.GetFlagsFromValues(value);
                var flagInfo = new Flags(flags);
                abstractResult = (AnyStringValue)OutSet.AnyStringValue.SetInfo(flagInfo);
            }
            else
            {
                abstractResult = OutSet.AnyStringValue;
            }
        }
Пример #4
0
        /// <summary>
        /// Converts all possible values in memory entry to string representation.
        /// </summary>
        /// <param name="entry">Memory entry with all possible values to convert.</param>
        /// <param name="abstractString">Abstract string value if any conversion fails.</param>
        /// <returns>List of strings after conversion of all possible values.</returns>
        public IEnumerable <StringValue> Evaluate(MemoryEntry entry, out AnyStringValue abstractString)
        {
            var values          = new HashSet <StringValue>();
            var abstractStrings = new HashSet <AnyStringValue>();

            foreach (var value in entry.PossibleValues)
            {
                // Gets type of value and convert to string
                value.Accept(this);

                Debug.Assert((result != null) != (abstractResult != null),
                             "Result can be either concrete or abstract string value");

                if (result != null)
                {
                    values.Add(result);
                }
                else
                {
                    abstractStrings.Add(abstractResult);
                }
            }

            if (abstractStrings.Count > 0)
            {
                var flags    = FlagsHandler.GetFlagsFromValues(abstractStrings);
                var flagInfo = new Flags(flags);
                abstractString = (AnyStringValue)OutSet.AnyStringValue.SetInfo(flagInfo);
            }
            else
            {
                abstractString = null;
            }

            return(values);
        }