Safe Haskell | None |
---|---|
Language | Haskell2010 |
Synopsis
- data VerificationCondition
- type VCS = Set VerificationCondition
- add_function_pointer :: Word64 -> Key -> (a, Set VerificationCondition) -> (a, Set VerificationCondition)
- data SymbolicOperation v
- data RegionSize
- = Nat Word64
- | UnknownSize
- class (Ord v, Eq v, Show v, Eq p, Ord p, Show p) => SymbolicExecutable ctxt v p | ctxt -> v p where
- sseparate :: ctxt -> String -> p -> RegionSize -> p -> RegionSize -> Bool
- senclosed :: ctxt -> p -> RegionSize -> p -> RegionSize -> Bool
- salias :: ctxt -> p -> RegionSize -> p -> RegionSize -> Bool
- ssensitive :: ctxt -> p -> RegionSize -> v -> Bool
- sread_from_ro_data :: ctxt -> p -> RegionSize -> Maybe v
- smk_mem_addresses :: ctxt -> String -> v -> Set p
- sjoin_values :: Foldable t => ctxt -> String -> t v -> v
- swiden_values :: ctxt -> String -> v -> v
- sjoin_pointers :: ctxt -> [p] -> [p]
- top :: ctxt -> String -> v
- ssemantics :: ctxt -> String -> SymbolicOperation v -> v
- sflg_semantics :: ctxt -> v -> Instruction -> FlagStatus -> FlagStatus
- simmediate :: Integral i => ctxt -> i -> v
- smk_init_reg_value :: ctxt -> Register -> v
- smk_init_mem_value :: ctxt -> String -> p -> RegionSize -> v
- scall :: ctxt -> Bool -> Instruction -> State (Sstate v p, VCS) ()
- sjump :: ctxt -> Instruction -> State (Sstate v p, VCS) ()
- stry_jump_targets :: ctxt -> v -> Maybe (Set ResolvedJumpTarget)
- stry_immediate :: ctxt -> v -> Maybe Word64
- stry_deterministic :: ctxt -> v -> Maybe SimpleExpr
- stry_relocation :: ctxt -> p -> RegionSize -> Maybe v
- saddress_has_instruction :: ctxt -> Word64 -> Bool
- data Sstate v p = Sstate {
- sregs :: Map Register v
- smem :: Map (p, RegionSize) v
- sflags :: FlagStatus
- execSstate :: State (Sstate v p, VCS) b -> Sstate v p -> Sstate v p
- evalSstate :: State (Sstate v p, VCS) a -> Sstate v p -> a
- sread_rreg :: SymbolicExecutable ctxt p1 p2 => ctxt -> Register -> (Sstate p1 p3, b) -> p1
- sread_reg :: SymbolicExecutable ctxt v p => ctxt -> Register -> State (Sstate v p, VCS) v
- swrite_rreg :: SymbolicExecutable ctxt v p => ctxt -> Register -> v -> State (Sstate v p, VCS) ()
- soverwrite_reg :: SymbolicExecutable ctxt v p => ctxt -> Bool -> Register -> v -> State (Sstate v p, VCS) ()
- swrite_reg :: SymbolicExecutable ctxt v p => ctxt -> Register -> v -> State (Sstate v p, VCS) ()
- sread_mem :: SymbolicExecutable ctxt v p => ctxt -> String -> v -> RegionSize -> State (Sstate v p, VCS) v
- sread_mem_from_ptr :: SymbolicExecutable ctxt v p => ctxt -> String -> p -> RegionSize -> State (Sstate v p, VCS) v
- swrite_mem :: SymbolicExecutable ctxt v p => ctxt -> Bool -> v -> RegionSize -> v -> State (Sstate v p, VCS) ()
- swrite_mem_to_ptr :: SymbolicExecutable ctxt v p => ctxt -> Bool -> p -> RegionSize -> v -> State (Sstate v p, VCS) ()
- sresolve_address :: SymbolicExecutable ctxt v p => ctxt -> Address -> State (Sstate v p, VCS) v
- sread_operand :: SymbolicExecutable ctxt v p => ctxt -> String -> Operand -> State (Sstate v p, VCS) v
- swrite_operand :: SymbolicExecutable ctxt v p => ctxt -> Bool -> Operand -> v -> State (Sstate v p, VCS) ()
- swrite_flags :: SymbolicExecutable ctxt v p => ctxt -> v -> Instruction -> State (Sstate v p, VCS) ()
- clean_flg :: StatePart -> FlagStatus -> FlagStatus
- add_jump_to_pred :: Instruction -> Instruction -> FlagStatus -> FlagStatus
- sreturn :: SymbolicExecutable ctxt v p => ctxt -> State (Sstate v p, VCS) ()
- slea :: SymbolicExecutable ctxt v p => ctxt -> AddressWord64 -> Operand -> Operand -> State (Sstate v p, VCS) ()
- smov :: SymbolicExecutable ctxt v p => ctxt -> a -> Instruction -> State (Sstate v p, VCS) ()
- sgeneric_cinstr :: SymbolicExecutable ctxt v p => ctxt -> Instruction -> State (Sstate v p, VCS) ()
- operand_size :: HasSize a => GenericOperand a -> Int
- maybe_operand_size :: HasSize storage => [GenericOperand storage] -> Maybe Int
- sexec_cinstr :: SymbolicExecutable ctxt v p => ctxt -> Instruction -> State (Sstate v p, VCS) ()
- sset_rip :: SymbolicExecutable ctxt v p => ctxt -> Instruction -> State (Sstate v p, VCS) ()
- sexec_instr :: SymbolicExecutable ctxt v p => ctxt -> Instruction -> State (Sstate v p, VCS) ()
- sexec_block :: SymbolicExecutable ctxt v p => ctxt -> [GenericInstruction AddressWord64 Register Prefix Opcode Int] -> Maybe [GenericInstruction AddressWord64 Register Prefix Opcode Int] -> Sstate v p -> (Sstate v p, Set VerificationCondition)
- sjoin_mem :: SymbolicExecutable ctxt v p => ctxt -> String -> Sstate v p -> Sstate v p -> Map (p, RegionSize) v
- sjoin_states :: forall v p1 ctxt p2. (SymbolicExecutable ctxt v p1, SymbolicExecutable ctxt v p2) => ctxt -> [Char] -> Sstate v p1 -> Sstate v p1 -> Sstate v p1
- supremum :: SymbolicExecutable ctxt v p => ctxt -> [Sstate v p] -> Sstate v p
- simplies :: SymbolicExecutable ctxt v p => ctxt -> Sstate v p -> Sstate v p -> Bool
Documentation
data VerificationCondition Source #
A verification condition is either: * A precondition of the form: > Precondition (a0,si0) (a1,si1) This formulates that at the initial state the two regions must be separate. * An assertion of the form: > Assertion a (a0,si0) (a1,si1) This formulates that dynamically, whenever address a is executed, the two regions are asserted to be separate. * A function constraint of the form: > FunctionConstraint foo [(RDI, v0), (RSI, v1), ...] { sp0,sp1,... } This formulates that a function call to function foo with values v0, v1, ... stored in the registers should not overwrite certain state parts.
Precondition SimpleExpr Int SimpleExpr Int | Precondition: lhs SEP rhs |
Assertion SimpleExpr SimpleExpr Int SimpleExpr Int | Assertion: @address, lhs SEP rhs |
FunctionConstraint String Word64 [(Register, SimpleExpr)] (Set StatePart) | Function name, address, of call, with param registers |
FunctionPointers Word64 IntSet | A set of function pointers passed to a function |
Instances
type VCS = Set VerificationCondition Source #
An acornym for a set of verification conditions
add_function_pointer :: Word64 -> Key -> (a, Set VerificationCondition) -> (a, Set VerificationCondition) Source #
Add a function_pointer_intro to the given symbolic predicate
data SymbolicOperation v Source #
data RegionSize Source #
Instances
class (Ord v, Eq v, Show v, Eq p, Ord p, Show p) => SymbolicExecutable ctxt v p | ctxt -> v p where Source #
sseparate :: ctxt -> String -> p -> RegionSize -> p -> RegionSize -> Bool Source #
senclosed :: ctxt -> p -> RegionSize -> p -> RegionSize -> Bool Source #
salias :: ctxt -> p -> RegionSize -> p -> RegionSize -> Bool Source #
ssensitive :: ctxt -> p -> RegionSize -> v -> Bool Source #
sread_from_ro_data :: ctxt -> p -> RegionSize -> Maybe v Source #
smk_mem_addresses :: ctxt -> String -> v -> Set p Source #
sjoin_values :: Foldable t => ctxt -> String -> t v -> v Source #
swiden_values :: ctxt -> String -> v -> v Source #
sjoin_pointers :: ctxt -> [p] -> [p] Source #
top :: ctxt -> String -> v Source #
ssemantics :: ctxt -> String -> SymbolicOperation v -> v Source #
sflg_semantics :: ctxt -> v -> Instruction -> FlagStatus -> FlagStatus Source #
simmediate :: Integral i => ctxt -> i -> v Source #
smk_init_reg_value :: ctxt -> Register -> v Source #
smk_init_mem_value :: ctxt -> String -> p -> RegionSize -> v Source #
scall :: ctxt -> Bool -> Instruction -> State (Sstate v p, VCS) () Source #
sjump :: ctxt -> Instruction -> State (Sstate v p, VCS) () Source #
stry_jump_targets :: ctxt -> v -> Maybe (Set ResolvedJumpTarget) Source #
stry_immediate :: ctxt -> v -> Maybe Word64 Source #
stry_deterministic :: ctxt -> v -> Maybe SimpleExpr Source #
stry_relocation :: ctxt -> p -> RegionSize -> Maybe v Source #
saddress_has_instruction :: ctxt -> Word64 -> Bool Source #
Instances
Sstate | |
|
Instances
sread_rreg :: SymbolicExecutable ctxt p1 p2 => ctxt -> Register -> (Sstate p1 p3, b) -> p1 Source #
Read from a register
swrite_rreg :: SymbolicExecutable ctxt v p => ctxt -> Register -> v -> State (Sstate v p, VCS) () Source #
Write to a register
soverwrite_reg :: SymbolicExecutable ctxt v p => ctxt -> Bool -> Register -> v -> State (Sstate v p, VCS) () Source #
swrite_reg :: SymbolicExecutable ctxt v p => ctxt -> Register -> v -> State (Sstate v p, VCS) () Source #
sread_mem :: SymbolicExecutable ctxt v p => ctxt -> String -> v -> RegionSize -> State (Sstate v p, VCS) v Source #
Read from memory
sread_mem_from_ptr :: SymbolicExecutable ctxt v p => ctxt -> String -> p -> RegionSize -> State (Sstate v p, VCS) v Source #
swrite_mem :: SymbolicExecutable ctxt v p => ctxt -> Bool -> v -> RegionSize -> v -> State (Sstate v p, VCS) () Source #
Write to memory
swrite_mem_to_ptr :: SymbolicExecutable ctxt v p => ctxt -> Bool -> p -> RegionSize -> v -> State (Sstate v p, VCS) () Source #
sresolve_address :: SymbolicExecutable ctxt v p => ctxt -> Address -> State (Sstate v p, VCS) v Source #
Given the address of an operand of an instruction, resolve it given the current state.
sread_operand :: SymbolicExecutable ctxt v p => ctxt -> String -> Operand -> State (Sstate v p, VCS) v Source #
swrite_operand :: SymbolicExecutable ctxt v p => ctxt -> Bool -> Operand -> v -> State (Sstate v p, VCS) () Source #
swrite_flags :: SymbolicExecutable ctxt v p => ctxt -> v -> Instruction -> State (Sstate v p, VCS) () Source #
clean_flg :: StatePart -> FlagStatus -> FlagStatus Source #
add_jump_to_pred :: Instruction -> Instruction -> FlagStatus -> FlagStatus Source #
slea :: SymbolicExecutable ctxt v p => ctxt -> AddressWord64 -> Operand -> Operand -> State (Sstate v p, VCS) () Source #
smov :: SymbolicExecutable ctxt v p => ctxt -> a -> Instruction -> State (Sstate v p, VCS) () Source #
sgeneric_cinstr :: SymbolicExecutable ctxt v p => ctxt -> Instruction -> State (Sstate v p, VCS) () Source #
operand_size :: HasSize a => GenericOperand a -> Int Source #
maybe_operand_size :: HasSize storage => [GenericOperand storage] -> Maybe Int Source #
sexec_cinstr :: SymbolicExecutable ctxt v p => ctxt -> Instruction -> State (Sstate v p, VCS) () Source #
sset_rip :: SymbolicExecutable ctxt v p => ctxt -> Instruction -> State (Sstate v p, VCS) () Source #
sexec_instr :: SymbolicExecutable ctxt v p => ctxt -> Instruction -> State (Sstate v p, VCS) () Source #
sexec_block :: SymbolicExecutable ctxt v p => ctxt -> [GenericInstruction AddressWord64 Register Prefix Opcode Int] -> Maybe [GenericInstruction AddressWord64 Register Prefix Opcode Int] -> Sstate v p -> (Sstate v p, Set VerificationCondition) Source #
sjoin_mem :: SymbolicExecutable ctxt v p => ctxt -> String -> Sstate v p -> Sstate v p -> Map (p, RegionSize) v Source #
sjoin_states :: forall v p1 ctxt p2. (SymbolicExecutable ctxt v p1, SymbolicExecutable ctxt v p2) => ctxt -> [Char] -> Sstate v p1 -> Sstate v p1 -> Sstate v p1 Source #