maat::ExprObject class

Expressions are represented in a generic way with the base class ExprObject.

The different types are implemented in separate classes inheriting from ExprObject: ExprCst, ExprVar, ExprMem, etc. They have specific fields and methods

❱   Base classes

class Serializable
Virtual interface that serializable classes must implement.

❱   Derived classes

class ExprBinop
Binary operation.

class ExprConcat
Concatenation of two expressions.

class ExprCst
Constant expression.

class ExprExtract
Bitfield extract.

class ExprITE
If-Then-Else expression.

class ExprUnop
Unary operation.

class ExprVar
Abstract variable.

❱   Constructors, destructors, conversion operators

ExprObject(ExprType type, size_t size, bool _is_simp = false, Taint _t = Taint::NOT_COMPUTED, ucst_t _taint_mask = maat::default_expr_taint_mask)
Constructor.

❱   Public functions

auto contains_vars(std::set<std::string>& var_names) -> bool
Return true if the expression contains at least one of the given symbolic variable names.

void get_vars(std::set<std::string>& var_names)
Fill 'var_names' with the names of symbolic variables contained in the expression.

auto hash() -> hash_t virtual
Return the expression hash. Every expression has a unique hash.

auto is_type(ExprType t, Op op = Op::NONE) -> bool
Return true if the expression is of type 't'. If type is UNOP or BINOP, also check if the operation is the one specified in 'op'.

auto is_tainted(ucst_t taint_mask = maat::default_expr_taint_mask) -> bool virtual
Return true if at least one bit set in 'taint_mask' is tainted in the epression.

void make_tainted(ucst_t taint_mask = maat::default_expr_taint_mask)
Make the bits specified by 'taint_mask' tainted in the expression.

auto taint_mask() -> ucst_t
Return the bit mask of tainted bits in the expression.

auto as_uint() -> ucst_t
Return the concrete value of the expression as an unsigned value. If the expression is concolic, or is on more than 64 bits, this function will throw an 'expression_exception'.

auto as_uint(const VarContext& ctx) -> ucst_t
Return the concrete value of the expression evaluated in the context 'ctx' as an unsigned value. If the expression is on more than 64 bits this function will throw an 'expression_exception'.

auto as_int() -> cst_t
Return the concrete value of the expression as an signed value. If the expression is concolic, or is on more than 64 bits, this function will throw an 'expression_exception'.

auto as_int(const VarContext& ctx) -> cst_t
Return the concrete value of the expression evaluated in the context 'ctx' as a signed value. If the expression is on more than 64 bits this function will throw an 'expression_exception'.

auto as_number() -> const maat::Number&
Return the concrete value of the expression as a maat::Number instance.

auto as_number(const VarContext& ctx) -> const maat::Number&
Return the concrete value of the expression as a *maat::Number instance. If the expression is concolic this function will throw an 'expression_exception'.

auto as_float() -> fcst_t
Return the concrete value of the expression as a floating point value. If the expression is concolic, this function will throw an 'expression_exception'.

auto as_float(const VarContext& ctx) -> fcst_t
Return the concrete value of the expression evaluated in the context 'ctx' as a floating point value.

auto value_set() -> ValueSet& virtual
Return the value set of the expression, which is the set of possible numerical values it can take expressed as a strided interval.

auto status(const VarContext& ctx) -> ExprStatus virtual
Return the expression symbolic status.

auto is_symbolic(const VarContext& ctx) -> bool virtual
Return true if expression is symbolic.

auto is_concrete(const VarContext& ctx) -> bool
Return true if expression is concrete.

auto is_concolic(const VarContext& ctx) -> bool virtual
Return true if expression is concolic.

auto eq(Expr other) -> bool
Checks equality between two expressions. The method returns true if the expressions are syntactically equivalent, but doesn't test semantic equivalence.

auto neq(Expr other) -> bool
Opposite of the eq() method.

auto class_uid() const -> uid_t virtual
Return the class uid (see ClassId enum)

void dump(Serializer&) const virtual
Dump the object contents in a serializer stream.

void load(Deserializer&) virtual
Restore an object from a deserializer stream.

❱   Public variables

ExprType type
Expression type.

size_t size
Expression size in bits.

std::vector<Expr> args
Expression arguments (sub-expressions)

❱   Protected functions

auto concretize(const VarContext* ctx = nullptr) -> const maat::Number& virtual
Return the concrete value of the expression evaluated in the context 'ctx'.

❱   Protected variables

Expr _simplified_expr
Pointer to the simplified version of this expression if it has already been simplified.

bool _is_simplified
True if this expression is the result of a simplification.

int _simplifier_id
ID of the simplifier that has simplified the expression.

int _taint_ctx_id
The ID of the VarContext that was used to compute the taint.

ucst_t _taint_mask
The bits that are tainted in the expression (if _taint == TAINTED)

maat::Number _concrete
The concrete value of the expression.

int _concrete_ctx_id
The ID of the VarContext that was used to concretize the expression.

int _status_ctx_id
The ID of the VarContext that was used to compute the epression status.