Maat C++ Documentation
expression.hpp
1 #ifndef EXPRESSION_H
2 #define EXPRESSION_H
3 
4 #include <cstdint>
5 #include <string>
6 #include <vector>
7 #include <memory>
8 #include <ostream>
9 #include <map>
10 #include <set>
11 #include <variant>
12 #include "exception.hpp"
13 #include "number.hpp"
14 #include "types.hpp"
15 
16 namespace maat
17 {
18 
35 enum class ExprType
37 {
38  VAR,
39  MEM,
40  EXTRACT,
41  CONCAT,
42  UNOP,
43  BINOP,
44  ITE,
45  CST,
46  NONE
47 };
48 
51 
53 enum class ITECond
54 {
55  EQ,
56  LT,
57  LE,
58  SLT,
59  SLE,
60  FEQ,
61  FLT,
62  FLE
63 };
64 
66 // TODO, remove THE MULH/SMULH ???
67 enum class Op
68 {
69  ADD=0,
70  MUL,
71  MULH,
72  SMULL,
73  SMULH,
74  DIV,
75  SDIV,
76  NEG,
77  AND,
78  OR,
79  XOR,
80  SHL,
81  SHR,
82  SAR,
83  MOD,
84  SMOD,
85  NOT,
86  NONE
87 };
88 
89 std::string op_to_str(Op op);
90 bool operator<(Op op1, Op op2);
91 bool op_is_symetric(Op op);
92 bool op_is_associative(Op op);
93 bool op_is_left_associative(Op op);
94 bool op_is_distributive_over(Op op1, Op op2);
95 bool op_is_multiplication(Op op);
96 
98 enum class ExprStatus: uint8_t
99 {
100  CONCRETE,
101  SYMBOLIC,
102  CONCOLIC,
103  NOT_COMPUTED
104 };
105 
106 ExprStatus operator|(ExprStatus s1, ExprStatus s2);
107 
109 enum class Taint: uint8_t
110 {
111  NOT_TAINTED = 0,
112  TAINTED = 1,
113  NOT_COMPUTED = 2
114 };
115 
117 static const uint64_t default_expr_taint_mask = 0xffffffffffffffff;
118 
122 class ValueSet
123 {
124  protected:
125  static const uint64_t vs_min = 0;
126  static const uint64_t vs_max = 0xffffffffffffffff;
127 
128  public:
131  int size;
135 
136  ValueSet();
137  ValueSet(size_t size);
139 
140  void set(ucst_t min, ucst_t max, ucst_t stride);
141  void set_cst(ucst_t val);
142  bool is_cst();
143  void set_all();
145 
146  bool contains(ucst_t val);
147 
148  void set_not(ValueSet& vs);
149  void set_neg(ValueSet& vs);
150  void set_add(ValueSet& vs1, ValueSet& vs2);
151  void set_or(ValueSet& vs1, ValueSet& vs2);
152  void set_and(ValueSet& vs1, ValueSet& vs2);
153  void set_xor(ValueSet& vs1, ValueSet& vs2);
154  void set_mod(ValueSet& vs1, ValueSet& vs2);
155  void set_smod(ValueSet& vs1, ValueSet& vs2);
156  void set_shl(ValueSet& vs1, ValueSet& vs2);
157  void set_shr(ValueSet& vs1, ValueSet& vs2);
158  void set_sar(ValueSet& vs1, ValueSet& vs2);
159  void set_mul(ValueSet& vs1, ValueSet& vs2);
160  void set_mulh(ValueSet& vs1, ValueSet& vs2);
161  void set_div(ValueSet& vs1, ValueSet& vs2);
162  void set_concat(ValueSet& high, ValueSet& low);
163  void set_union(ValueSet& vs1, ValueSet& vs2);
164 
165 };
166 
167 
168 class ExprObject;
169 class VarContext;
170 
178 typedef std::shared_ptr<ExprObject> Expr;
179 
186 {
187 friend class ExprSimplifier;
188 
189 protected:
190  // ValueSet
191  ValueSet _value_set;
192  bool _value_set_computed;
193  // Hash
194  bool _hashed;
195  hash_t _hash;
196  // Simplification
200  // Taint
201  Taint _taint;
204  // Concretization
206  int _concrete_ctx_id = -1;
207  // State
208  ExprStatus _status;
210 
211 public:
214  ExprType type, size_t size,
215  bool _is_simp=false,
218  );
219  virtual ~ExprObject() = default;
220 protected:
222  virtual const maat::Number& concretize(const VarContext* ctx = nullptr){throw runtime_exception("No implementation");};
223 
224 public:
225  const ExprType type;
226  const size_t size;
227  std::vector<Expr> args;
228 
229 public:
230  virtual void get_associative_args(Op op, std::vector<Expr>& vec){};
231  virtual void get_left_associative_args(Op op, std::vector<Expr>& vec, Expr& leftmost){};
232 
234  bool contains_vars(std::set<std::string>& var_names);
236  void get_vars(std::set<std::string>& var_names);
237 
239  virtual hash_t hash(){throw runtime_exception("No implementation");};
240 
243  bool is_type(ExprType t, Op op=Op::NONE);
244 
246  virtual bool is_tainted(ucst_t taint_mask=maat::default_expr_taint_mask){throw runtime_exception("No implementation");};
251 
252 public:
258  ucst_t as_uint(const VarContext& ctx);
264  cst_t as_int(const VarContext& ctx);
269  const maat::Number& as_number(const VarContext& ctx);
275 
276 public:
279  virtual ValueSet& value_set(){throw runtime_exception("No implementation");};
280 
282  virtual ExprStatus status(const VarContext& ctx){throw runtime_exception("No implementation");};
284  virtual bool is_symbolic(const VarContext& ctx);
286  bool is_concrete(const VarContext& ctx);
288  virtual bool is_concolic(const VarContext& ctx);
289 
290  /* Simplification */
291  bool already_simplified_by(int simplifier_id);
292 
296  bool eq(Expr other);
298  bool neq(Expr other);
299  bool inf(Expr other);
300 
301  /* Accessors for child classes functions */
302  virtual cst_t cst(){throw runtime_exception("No implementation");};
303  virtual const std::string& name(){throw runtime_exception("No implementation");};
304  virtual Op op(){throw runtime_exception("No implementation");};
305  virtual cst_t mode(){throw runtime_exception("No implementation");};
306  virtual unsigned int access_count(){throw runtime_exception("No implementation");};
307  virtual Expr cond_left(){throw runtime_exception("No implementation");};
308  virtual Expr cond_right(){throw runtime_exception("No implementation");};
309  virtual Expr if_true(){throw runtime_exception("No implementation");};
310  virtual Expr if_false(){throw runtime_exception("No implementation");};
311  virtual ITECond cond_op(){throw runtime_exception("No implementation");};
312  virtual Expr base_expr(){throw runtime_exception("No implementation");};
313 
314  // Printing
315  virtual void print(std::ostream& out){out << "???";};
316 };
317 
318 /* Child specialized classes */
320 class ExprCst: public ExprObject
321 {
322 protected:
323  virtual const Number& concretize(const VarContext* ctx=nullptr);
324 
325 public:
327  ExprCst(size_t size, cst_t cst);
329  ExprCst(size_t size, const std::string& value, int base=16);
331  ExprCst(const Number& value);
332  virtual ~ExprCst() = default;
333  cst_t cst();
334  virtual hash_t hash();
335  virtual void print(std::ostream& out);
337 
338  virtual ExprStatus status(const VarContext& ctx);
339  virtual ValueSet& value_set();
340 };
341 
343 class ExprVar: public ExprObject
344 {
345 private:
346  const std::string _name;
347  static const int max_name_length = 1024;
348 
349 protected:
350  virtual const Number& concretize(const VarContext* ctx=nullptr);
351 
352 public:
354  ExprVar(size_t size, std::string name, Taint tainted=Taint::NOT_TAINTED);
355  virtual ~ExprVar() = default;
357  const std::string& name();
358  virtual hash_t hash();
359  virtual void print(std::ostream& out);
361  virtual ExprStatus status(const VarContext& ctx);
362  virtual ValueSet& value_set();
363 };
364 
365 class ExprMem: public ExprObject
366 {
367 friend class SymbolicMemEngine;
368 
369 private:
370  unsigned int _access_count;
371  ValueSet _addr_value_set;
372  Expr _base_expr;
373  // Unfolding cache
374  Expr _unfolded;
375  bool _unfolded_with_forced_align;
376 
377 protected:
378  virtual const Number& concretize(const VarContext* ctx=nullptr);
379 
380 public:
381  ExprMem(size_t size, Expr addr, unsigned int access_count=0, Expr base=nullptr);
382  ExprMem(size_t size, Expr addr, unsigned int access_count, Expr base, ValueSet& vs);
383  virtual ~ExprMem() = default;
384  virtual hash_t hash();
385  virtual void print(std::ostream& out);
387  virtual ExprStatus status(const VarContext& ctx);
388  unsigned int access_count();
389  virtual ValueSet& value_set();
390  Expr base_expr();
391 };
392 
394 class ExprUnop: public ExprObject
395 {
396 private:
397  Op _op;
398 
399 protected:
400  virtual const Number& concretize(const VarContext* ctx=nullptr);
401 
402 public:
405  virtual ~ExprUnop() = default;
406  Op op();
407 
408  virtual hash_t hash();
409  virtual void print(std::ostream& out);
411  virtual ExprStatus status(const VarContext& ctx);
412  virtual ValueSet& value_set();
413 };
414 
416 class ExprBinop: public ExprObject
417 {
418 private:
419  Op _op;
420 
421 protected:
422  virtual const Number& concretize(const VarContext* ctx=nullptr);
423 
424 public:
426  ExprBinop(Op op, Expr left, Expr right);
427  virtual ~ExprBinop() = default;
428  Op op();
429 
430  virtual hash_t hash();
431  virtual void get_associative_args(Op op, std::vector<Expr>& vec);
432  virtual void get_left_associative_args(Op op, std::vector<Expr>& vec, Expr& leftmost);
433  virtual void print(std::ostream& out);
435  virtual ExprStatus status(const VarContext& ctx);
436  virtual ValueSet& value_set();
437 };
438 
440 class ExprExtract: public ExprObject{
441 
442 protected:
443  virtual const Number& concretize(const VarContext* ctx=nullptr);
444 
445 public:
447  ExprExtract(Expr arg, Expr higher, Expr lower);
448  virtual ~ExprExtract() = default;
449  virtual hash_t hash();
450  virtual void print(std::ostream& out);
452  virtual ExprStatus status(const VarContext& ctx);
453  virtual ValueSet& value_set();
454 };
455 
457 class ExprConcat: public ExprObject{
458 
459 protected:
460  virtual const Number& concretize(const VarContext* ctx=nullptr);
461 
462 public:
464  ExprConcat(Expr upper, Expr lower);
465  virtual ~ExprConcat() = default;
466  virtual hash_t hash();
467  virtual void print(std::ostream& out);
469  virtual ExprStatus status(const VarContext& ctx);
470  virtual ValueSet& value_set();
471 };
472 
474 class ExprITE: public ExprObject{
475 private:
476  ITECond _cond_op;
477 
478 protected:
479  virtual const Number& concretize(const VarContext* ctx=nullptr);
480 
481 public:
484  virtual ~ExprITE() = default;
490 
491  virtual hash_t hash();
492  virtual void print(std::ostream& out);
494  virtual ExprStatus status(const VarContext& ctx);
495  virtual ValueSet& value_set();
496 };
497 
498 
499 /* Helper functions to create new expressions */
500 Expr exprcst(size_t size, cst_t cst);
501 Expr exprcst(size_t size, std::string&& value, int base=16);
502 Expr exprcst(const Number& value);
503 Expr exprvar(size_t size, std::string name, Taint tainted = Taint::NOT_TAINTED);
504 Expr exprmem(size_t size, Expr addr, unsigned int access_count = 0xffffffff, Expr base=nullptr);
505 Expr exprmem(size_t size, Expr addr, unsigned int access_count, Expr base, ValueSet& addr_value_set);
506 Expr exprbinop(Op op, Expr left, Expr right);
507 Expr extract(Expr arg, unsigned long higher, unsigned long lower);
508 Expr extract(Expr arg, Expr higher, Expr lower);
509 Expr concat(Expr upper, Expr lower);
510 Expr ITE(Expr cond_left, ITECond cond_op, Expr cond_right, Expr if_true, Expr if_false);
511 
512 // Binary operations
513 Expr operator+(Expr left, Expr right);
514 Expr operator+(Expr left, cst_t right);
515 Expr operator+(cst_t left, Expr right);
516 
517 Expr operator-(Expr left, Expr right);
518 Expr operator-(Expr left, cst_t right);
519 Expr operator-(cst_t left, Expr right);
520 
521 Expr operator*(Expr left, Expr right);
522 Expr operator*(Expr left, cst_t right);
523 Expr operator*(cst_t left, Expr right);
524 
525 Expr operator/(Expr left, Expr right);
526 Expr operator/(Expr left, cst_t right);
527 Expr operator/(cst_t left, Expr right);
528 
529 Expr operator&(Expr left, Expr right);
530 Expr operator&(Expr left, cst_t right);
531 Expr operator&(cst_t left, Expr right);
532 
533 Expr operator|(Expr left, Expr right);
534 Expr operator|(Expr left, cst_t right);
535 Expr operator|(cst_t left, Expr right);
536 
537 Expr operator^(Expr left, Expr right);
538 Expr operator^(Expr left, cst_t right);
539 Expr operator^(cst_t left, Expr right);
540 
541 Expr operator%(Expr val, Expr mod);
544 
545 Expr operator<<(Expr val, Expr shift);
546 Expr operator<<(Expr val, cst_t shift);
547 Expr operator<<(cst_t val, Expr shift);
548 
549 Expr operator>>(Expr val, Expr shift);
550 Expr operator>>(Expr val, cst_t shift);
551 Expr operator>>(cst_t val, Expr shift);
552 
553 Expr shl(Expr arg, Expr shift);
554 Expr shl(Expr arg, cst_t shift);
555 Expr shl(cst_t arg, Expr shift);
556 
557 Expr shr(Expr arg, Expr shift);
558 Expr shr(Expr arg, cst_t shift);
559 Expr shr(cst_t arg, Expr shift);
560 
561 Expr sar(Expr arg, Expr shift);
562 Expr sar(Expr arg, cst_t shift);
563 Expr sar(cst_t arg, Expr shift);
564 
565 Expr sdiv(Expr left, Expr right);
566 Expr sdiv(Expr left, cst_t right);
567 Expr sdiv(cst_t left, Expr right);
568 
569 Expr smod(Expr val, Expr mod);
570 Expr smod(Expr val, cst_t mod);
571 Expr smod(cst_t val, Expr mod);
572 
573 Expr mulh(Expr left, Expr right);
574 Expr mulh(Expr left, cst_t right);
575 Expr mulh(cst_t left, Expr right);
576 
577 Expr smull(Expr left, Expr right);
578 Expr smull(Expr left, cst_t right);
579 Expr smull(cst_t left, Expr right);
580 
581 Expr smulh(Expr left, Expr right);
582 Expr smulh(Expr left, cst_t right);
583 Expr smulh(cst_t left, Expr right);
584 
587 
588 std::ostream& operator<< (std::ostream& os, Expr e);
589 
590 /* Canonizing expressions */
591 Expr expr_canonize(Expr e);
592 cst_t cst_sign_trunc(size_t size, cst_t val);
593 cst_t cst_mask(size_t size);
594 cst_t cst_sign_extend(size_t size, cst_t val);
595 ucst_t cst_unsign_trunc(size_t size, cst_t val);
596 ucst_t cst_gcd( ucst_t c1, ucst_t c2);
597 ucst_t cst_lcm( ucst_t c1, ucst_t c2);
598 ucst_t cst_extract(ucst_t c, int high, int low);
599 ucst_t cst_concat(ucst_t c_1, int size_c1, ucst_t c2, int size_c2);
600 cst_t fcst_to_cst(size_t size, fcst_t f);
601 
604 {
605 private:
606  static unsigned int _id_cnt;
607 
608 private:
610  std::map<std::string, maat::Number> varmap;
611 
612 public:
613  VarContext(unsigned int id=0);
614  VarContext(const VarContext&) = default;
615  VarContext& operator=(const VarContext&) = default;
616  ~VarContext() = default;
617 
618 public:
619  unsigned int id;
620  void set(const std::string& var, cst_t value);
621  void set(const std::string& var, const Number& number);
622  cst_t get(const std::string& var) const;
623  const maat::Number& get_as_number(const std::string& var) const;
624  std::vector<uint8_t> get_as_buffer(std::string var, unsigned int elem_size=1) const;
625  std::string get_as_string(std::string var) const;
626  void remove(const std::string& var);
627  bool contains(const std::string& var) const;
628  std::string new_name_from(const std::string& hint) const;
636  std::vector<Expr> new_symbolic_buffer(
637  const std::string& name,
638  int nb_elems,
639  int elem_size=1,
640  bool null_terminated=false
641  );
650  std::vector<Expr> new_concolic_buffer(
651  const std::string& name,
652  const std::vector<cst_t>& concrete_buffer,
653  int nb_elems,
654  int elem_size=1,
655  bool null_terminated=false
656  );
663  void update_from(VarContext& other);
664  void print(std::ostream& os) const;
665 };
666 
668 std::ostream& operator<<(std::ostream& os, const VarContext& c);
669 
672 // Utils functions
673 std::string ite_cond_to_string(ITECond c);
674 bool ite_evaluate(Expr left, ITECond cond, Expr right, const VarContext* ctx = nullptr);
675 
680 inline Expr __attribute__((always_inline)) overwrite_expr_bits(Expr old_expr, Expr new_expr, size_t higher_bit)
681 {
682  if (new_expr->size >= old_expr->size)
683  return new_expr;
684  else if(higher_bit == new_expr->size-1)
685  {
686  return concat(extract(old_expr, old_expr->size-1, higher_bit+1), new_expr);
687  }
688  else if(higher_bit == old_expr->size-1)
689  {
690  return concat(new_expr, extract(old_expr, higher_bit-new_expr->size, 0));
691  }
692  else
693  {
694  return concat(extract(old_expr, old_expr->size-1, higher_bit+1),
695  concat(new_expr, extract(old_expr, higher_bit-new_expr->size, 0)));
696  }
697 }
698 
699 } // namespace maat
700 
701 #endif
maat::extract
Expr extract(Expr arg, unsigned long higher, unsigned long lower)
Create new ExprExtract instance.
maat::ExprConcat::status
virtual ExprStatus status(const VarContext &ctx)
Return the expression symbolic status.
maat::ExprMem::is_tainted
virtual bool is_tainted(ucst_t taint_mask=maat::default_expr_taint_mask)
Return true if at least one bit set in 'taint_mask' is tainted in the epression.
maat::ExprCst::hash
virtual hash_t hash()
Return the expression hash. Every expression has a unique hash.
maat::smulh
Expr smulh(Expr left, Expr right)
Signed multiply two expressions (higher bits of result)
maat::ExprConcat::is_tainted
virtual bool is_tainted(ucst_t taint_mask=maat::default_expr_taint_mask)
Return true if at least one bit set in 'taint_mask' is tainted in the epression.
maat::ValueSet::max
ucst_t max
Upper bound.
Definition: expression.hpp:133
maat::ExprObject::as_int
cst_t as_int(const VarContext &ctx)
Return the concrete value of the expression evaluated in the context 'ctx' as a signed value....
maat::operator&
Expr operator&(Expr left, Expr right)
Logical and between two expressions.
maat::ExprBinop::value_set
virtual ValueSet & value_set()
Return the value set of the expression, which is the set of possible numerical values it can take exp...
maat::operator^
Expr operator^(Expr left, Expr right)
Logical xor between two expressions.
maat::VarContext::set
void set(const std::string &var, cst_t value)
Give a concrete value to a symbolic variable.
maat::ExprCst::ExprCst
ExprCst(size_t size, cst_t cst)
Constructor for constants on 64 bits or less.
maat::ExprObject::_simplifier_id
int _simplifier_id
ID of the simplifier that has simplified the expression.
Definition: expression.hpp:199
maat::ExprExtract::is_tainted
virtual bool is_tainted(ucst_t taint_mask=maat::default_expr_taint_mask)
Return true if at least one bit set in 'taint_mask' is tainted in the epression.
maat::ExprITE::cond_op
ITECond cond_op()
Condition comparison operator (==, !=, <, <=, ...)
maat::ExprObject::make_tainted
void make_tainted(ucst_t taint_mask=maat::default_expr_taint_mask)
Make the bits specified by 'taint_mask' tainted in the expression.
maat::runtime_exception
Definition: exception.hpp:64
maat::ExprVar::concretize
virtual const Number & concretize(const VarContext *ctx=nullptr)
Return the concrete value of the expression evaluated in the context 'ctx'.
maat::ExprConcat
Concatenation of two expressions.
Definition: expression.hpp:457
maat::ValueSet::set_cst
void set_cst(ucst_t val)
Set value set as just one constant value.
maat::ExprUnop::is_tainted
virtual bool is_tainted(ucst_t taint_mask=maat::default_expr_taint_mask)
Return true if at least one bit set in 'taint_mask' is tainted in the epression.
maat::ValueSet::range
ucst_t range()
Return the difference between max and min.
maat::ExprBinop
Binary operation.
Definition: expression.hpp:417
maat::ExprObject::contains_vars
bool contains_vars(std::set< std::string > &var_names)
Return true if the expression contains at least one of the given symbolic variable names.
maat::ValueSet::size
int size
Definition: expression.hpp:131
maat::cst_t
int64_t cst_t
Signed constant integer value.
Definition: types.hpp:14
maat::ExprObject::as_float
fcst_t as_float()
Return the concrete value of the expression as a floating point value. If the expression is concolic,...
maat::ExprObject::_taint_mask
ucst_t _taint_mask
The bits that are tainted in the expression (if _taint == TAINTED)
Definition: expression.hpp:203
maat::operator+
Expr operator+(Expr left, Expr right)
Add two expressions.
maat::ExprMem
Definition: expression.hpp:366
maat::ExprObject::ExprObject
ExprObject(ExprType type, size_t size, bool _is_simp=false, Taint _t=Taint::NOT_COMPUTED, ucst_t _taint_mask=maat::default_expr_taint_mask)
Constructor.
maat::ExprUnop::ExprUnop
ExprUnop(Op op, Expr arg)
Constructor.
maat::ExprConcat::ExprConcat
ExprConcat(Expr upper, Expr lower)
Constructor.
maat::ExprExtract::value_set
virtual ValueSet & value_set()
Return the value set of the expression, which is the set of possible numerical values it can take exp...
maat::ExprObject::_taint_ctx_id
int _taint_ctx_id
The ID of the VarContext that was used to compute the taint.
Definition: expression.hpp:202
maat::ValueSet::min
ucst_t min
Lower bound.
Definition: expression.hpp:132
maat::mulh
Expr mulh(Expr left, Expr right)
Unsigned multiply two expressions (higher bits of result)
maat::fcst_t
double fcst_t
Float constant value (double precision / 64 bits)
Definition: types.hpp:16
maat::ExprITE::status
virtual ExprStatus status(const VarContext &ctx)
Return the expression symbolic status.
maat::ExprBinop::hash
virtual hash_t hash()
Return the expression hash. Every expression has a unique hash.
maat::ExprUnop::hash
virtual hash_t hash()
Return the expression hash. Every expression has a unique hash.
maat::ucst_t
uint64_t ucst_t
Unsigned constant integer value.
Definition: types.hpp:15
maat::concat
Expr concat(Expr upper, Expr lower)
Create new ExprConcat instance.
maat::Expr
std::shared_ptr< ExprObject > Expr
Definition: expression.hpp:178
maat::ExprStatus
ExprStatus
Definition: expression.hpp:99
maat::VarContext::VarContext
VarContext(unsigned int id=0)
Constructor.
maat::ExprITE::hash
virtual hash_t hash()
Return the expression hash. Every expression has a unique hash.
maat::ExprObject::eq
bool eq(Expr other)
Checks equality between two expressions. The method returns true if the expressions are syntactically...
maat::SymbolicMemEngine
Dedicated memory engine handling the 'symbolic' memory state resulting from symbolic pointer writes.
Definition: memory.hpp:310
maat::ExprITE::cond_left
Expr cond_left()
Left member of condition.
maat::ExprVar::name
const std::string & name()
Get the variable name.
maat::ExprExtract::hash
virtual hash_t hash()
Return the expression hash. Every expression has a unique hash.
maat::ExprCst::status
virtual ExprStatus status(const VarContext &ctx)
Return the expression symbolic status.
maat::ExprITE::cond_right
Expr cond_right()
Right member of condition.
maat::ExprObject::as_number
const maat::Number & as_number(const VarContext &ctx)
Return the concrete value of the expression as a *maat::Number instance. If the expression is concoli...
maat::ExprVar::hash
virtual hash_t hash()
Return the expression hash. Every expression has a unique hash.
maat::ExprObject::type
const ExprType type
Expression type.
Definition: expression.hpp:222
maat::ITECond::EQ
@ EQ
Equal.
maat::ExprSimplifier
Definition: simplification.hpp:29
maat::ExprConcat::concretize
virtual const Number & concretize(const VarContext *ctx=nullptr)
Return the concrete value of the expression evaluated in the context 'ctx'.
maat::ExprObject::is_tainted
virtual bool is_tainted(ucst_t taint_mask=maat::default_expr_taint_mask)
Return true if at least one bit set in 'taint_mask' is tainted in the epression.
Definition: expression.hpp:246
maat::ExprITE
If-Then-Else expression.
Definition: expression.hpp:474
maat::exprmem
Expr exprmem(size_t size, Expr addr, unsigned int access_count=0xffffffff, Expr base=nullptr)
Create new ExprMem instance.
maat::ExprObject::as_uint
ucst_t as_uint(const VarContext &ctx)
Return the concrete value of the expression evaluated in the context 'ctx' as an unsigned value....
maat::ExprObject::value_set
virtual ValueSet & value_set()
Return the value set of the expression, which is the set of possible numerical values it can take exp...
Definition: expression.hpp:279
maat::VarContext::contains
bool contains(const std::string &var) const
Return true if a concrete value is associated to the symbolic variable.
maat::ExprExtract::ExprExtract
ExprExtract(Expr arg, Expr higher, Expr lower)
Constructor.
maat::ExprObject::args
std::vector< Expr > args
Expression arguments (sub-expressions)
Definition: expression.hpp:227
maat::exprcst
Expr exprcst(size_t size, cst_t cst)
Create new ExprCst instance.
maat::ExprBinop::status
virtual ExprStatus status(const VarContext &ctx)
Return the expression symbolic status.
maat::sdiv
Expr sdiv(Expr left, Expr right)
Signed divide two expressions.
maat::ExprMem::hash
virtual hash_t hash()
Return the expression hash. Every expression has a unique hash.
maat::ExprVar::value_set
virtual ValueSet & value_set()
Return the value set of the expression, which is the set of possible numerical values it can take exp...
maat::ExprUnop
Unary operation.
Definition: expression.hpp:395
maat::ExprBinop::is_tainted
virtual bool is_tainted(ucst_t taint_mask=maat::default_expr_taint_mask)
Return true if at least one bit set in 'taint_mask' is tainted in the epression.
maat::ExprObject::neq
bool neq(Expr other)
Opposite of the eq() method.
maat::operator>>
Expr operator>>(Expr val, Expr shift)
Shift an expression to the right.
maat::sar
Expr sar(Expr arg, Expr shift)
Arithmetic shift an expression to the right.
maat::VarContext::print
void print(std::ostream &os) const
Print the context to a stream.
maat::ValueSet::set_all
void set_all()
Make value set as big as possible (min = vs_min, max = vs_max)
maat::ExprCst::value_set
virtual ValueSet & value_set()
Return the value set of the expression, which is the set of possible numerical values it can take exp...
maat::ExprExtract::concretize
virtual const Number & concretize(const VarContext *ctx=nullptr)
Return the concrete value of the expression evaluated in the context 'ctx'.
maat::operator*
Expr operator*(Expr left, Expr right)
Unsigned multiply two expressions (lower bits of result)
maat::ExprVar::is_tainted
virtual bool is_tainted(ucst_t taint_mask=maat::default_expr_taint_mask)
Return true if at least one bit set in 'taint_mask' is tainted in the epression.
maat::operator%
Expr operator%(Expr val, Expr mod)
Unsigned modulo of two expressions.
maat::__attribute__
Expr __attribute__((always_inline)) overwrite_expr_bits(Expr old_expr
Returns the expression resulting from overwriting the bits higher_bit to higher_bit-new_expr....
maat::ExprObject::is_concrete
bool is_concrete(const VarContext &ctx)
Return true if expression is concrete.
maat::ExprConcat::hash
virtual hash_t hash()
Return the expression hash. Every expression has a unique hash.
maat::ExprExtract
Bitfield extract.
Definition: expression.hpp:440
maat::operator/
Expr operator/(Expr left, Expr right)
Unsigned divide two expressions.
maat::ExprBinop::op
Op op()
Return the operation of the expression.
maat::smod
Expr smod(Expr val, Expr mod)
Signed modulo between two expressions.
maat::ExprObject::taint_mask
ucst_t taint_mask()
Return the bit mask of tainted bits in the expression.
maat::ValueSet::stride
ucst_t stride
Stride.
Definition: expression.hpp:134
maat::ITE
Expr ITE(Expr cond_left, ITECond cond_op, Expr cond_right, Expr if_true, Expr if_false)
Create new ExprITE instance.
maat::ExprITE::value_set
virtual ValueSet & value_set()
Return the value set of the expression, which is the set of possible numerical values it can take exp...
maat::ExprITE::concretize
virtual const Number & concretize(const VarContext *ctx=nullptr)
Return the concrete value of the expression evaluated in the context 'ctx'.
maat::VarContext::get
cst_t get(const std::string &var) const
Get the concrete value given to a symbolic variable.
maat::ExprConcat::value_set
virtual ValueSet & value_set()
Return the value set of the expression, which is the set of possible numerical values it can take exp...
maat::ExprStatus::CONCRETE
@ CONCRETE
Concrete expression (no symbolic variables)
maat::Taint::NOT_TAINTED
@ NOT_TAINTED
No bit is tainted.
maat::VarContext::update_from
void update_from(VarContext &other)
Copy the mapping between concrete values and symbolic variables from 'other'.
maat::ExprITE::ExprITE
ExprITE(Expr cond1, ITECond cond_op, Expr cond2, Expr if_true, Expr if_false)
Constructor.
maat::ExprCst::concretize
virtual const Number & concretize(const VarContext *ctx=nullptr)
Return the concrete value of the expression evaluated in the context 'ctx'.
maat::exprvar
Expr exprvar(size_t size, std::string name, Taint tainted=Taint::NOT_TAINTED)
Create new ExprVar instance.
maat::VarContext
Definition: expression.hpp:604
maat::ExprObject::as_int
cst_t as_int()
Return the concrete value of the expression as an signed value. If the expression is concolic,...
maat::ExprMem::value_set
virtual ValueSet & value_set()
Return the value set of the expression, which is the set of possible numerical values it can take exp...
maat::operator<<
std::ostream & operator<<(std::ostream &os, const Constraint &constr)
Print a constraint to an out stream.
maat::ValueSet::is_cst
bool is_cst()
Return true if the value set represents a constant (min==max)
maat::ExprObject::_concrete_ctx_id
int _concrete_ctx_id
The ID of the VarContext that was used to concretize the expression.
Definition: expression.hpp:206
maat::ExprObject::_simplified_expr
Expr _simplified_expr
Pointer to the simplified version of this expression if it has already been simplified.
Definition: expression.hpp:197
maat::ExprCst::is_tainted
virtual bool is_tainted(ucst_t taint_mask=maat::default_expr_taint_mask)
Return true if at least one bit set in 'taint_mask' is tainted in the epression.
maat::ExprVar::status
virtual ExprStatus status(const VarContext &ctx)
Return the expression symbolic status.
maat::ExprITE::if_false
Expr if_false()
Value of the expression if the condition is false.
maat::VarContext::remove
void remove(const std::string &var)
Remove concrete value for symbolic variable.
maat::ExprVar
Abstract variable.
Definition: expression.hpp:344
maat::ValueSet
Definition: expression.hpp:123
maat::ExprCst::ExprCst
ExprCst(size_t size, const std::string &value, int base=16)
Constructor for constants on more than 64 bits.
maat::ExprITE::if_true
Expr if_true()
Value of the expression if the condition is true.
maat::ExprType::CST
@ CST
Constant value.
maat::ExprType
ExprType
Different types of abstract expressions.
Definition: expression.hpp:37
maat::ExprObject::get_vars
void get_vars(std::set< std::string > &var_names)
Fill 'var_names' with the names of symbolic variables contained in the expression.
maat::ExprObject::_is_simplified
bool _is_simplified
True if this expression is the result of a simplification.
Definition: expression.hpp:198
maat::VarContext::set
void set(const std::string &var, const Number &number)
Give a concrete value to a symbolic variable as a maat::Number instance.
maat::ExprMem::status
virtual ExprStatus status(const VarContext &ctx)
Return the expression symbolic status.
maat
Main namespace for Maat's API.
Definition: arch.hpp:11
maat::ExprObject::status
virtual ExprStatus status(const VarContext &ctx)
Return the expression symbolic status.
Definition: expression.hpp:282
maat::Op
Op
Definition: expression.hpp:68
maat::ExprObject::size
const size_t size
Expression size in bits.
Definition: expression.hpp:226
maat::ExprUnop::op
Op op()
Return the operation of the expression.
maat::default_expr_taint_mask
static const uint64_t default_expr_taint_mask
Definition: expression.hpp:117
maat::ValueSet::vs_min
static const uint64_t vs_min
Minimal lower bound.
Definition: expression.hpp:125
maat::ExprUnop::value_set
virtual ValueSet & value_set()
Return the value set of the expression, which is the set of possible numerical values it can take exp...
maat::ExprObject::hash
virtual hash_t hash()
Return the expression hash. Every expression has a unique hash.
Definition: expression.hpp:239
maat::ExprUnop::status
virtual ExprStatus status(const VarContext &ctx)
Return the expression symbolic status.
maat::ExprCst
Constant expression.
Definition: expression.hpp:321
maat::ITECond
ITECond
Definition: expression.hpp:54
maat::Taint
Taint
Definition: expression.hpp:110
maat::VarContext::id
unsigned int id
Unique identifier for the VarContext instance.
Definition: expression.hpp:619
maat::ExprMem::concretize
virtual const Number & concretize(const VarContext *ctx=nullptr)
Return the concrete value of the expression evaluated in the context 'ctx'.
maat::ExprITE::is_tainted
virtual bool is_tainted(ucst_t taint_mask=maat::default_expr_taint_mask)
Return true if at least one bit set in 'taint_mask' is tainted in the epression.
maat::ExprObject::as_float
fcst_t as_float(const VarContext &ctx)
Return the concrete value of the expression evaluated in the context 'ctx' as a floating point value.
maat::ExprObject::is_type
bool is_type(ExprType t, Op op=Op::NONE)
Return true if the expression is of type 't'. If type is UNOP or BINOP, also check if the operation i...
maat::Number
Represents a constant value on an arbitrary number of bits.
Definition: number.hpp:23
maat::ExprObject::is_symbolic
virtual bool is_symbolic(const VarContext &ctx)
Return true if expression is symbolic.
maat::smull
Expr smull(Expr left, Expr right)
Signed multiply two expressions (lower bits of result)
maat::ExprCst::ExprCst
ExprCst(const Number &value)
Constructor for constants directly from number.
maat::ExprBinop::ExprBinop
ExprBinop(Op op, Expr left, Expr right)
Constructor.
maat::VarContext::new_concolic_buffer
std::vector< Expr > new_concolic_buffer(const std::string &name, const std::vector< cst_t > &concrete_buffer, int nb_elems, int elem_size=1, bool null_terminated=false)
Create a new buffer of concolic variables. Returns a pair <buffer_name, buffer>.
maat::ValueSet::vs_max
static const uint64_t vs_max
Maximal upper bound.
Definition: expression.hpp:126
maat::ExprObject::_concrete
maat::Number _concrete
The concrete value of the expression.
Definition: expression.hpp:205
maat::VarContext::new_symbolic_buffer
std::vector< Expr > new_symbolic_buffer(const std::string &name, int nb_elems, int elem_size=1, bool null_terminated=false)
Create a new buffer of symbolic variables. Returns a pair <buffer_name, buffer>.
maat::ExprObject::concretize
virtual const maat::Number & concretize(const VarContext *ctx=nullptr)
Return the concrete value of the expression evaluated in the context 'ctx'.
Definition: expression.hpp:222
maat::ExprUnop::concretize
virtual const Number & concretize(const VarContext *ctx=nullptr)
Return the concrete value of the expression evaluated in the context 'ctx'.
maat::operator<
Constraint operator<(Expr left, Expr right)
Create a signed less-than constraint.
maat::ExprObject::as_number
const maat::Number & as_number()
Return the concrete value of the expression as a maat::Number instance.
maat::hash_t
uint32_t hash_t
Unique hash identifying an abstract expression object.
Definition: types.hpp:13
maat::ExprObject::is_concolic
virtual bool is_concolic(const VarContext &ctx)
Return true if expression is concolic.
maat::ExprExtract::status
virtual ExprStatus status(const VarContext &ctx)
Return the expression symbolic status.
maat::ExprObject::_status_ctx_id
int _status_ctx_id
The ID of the VarContext that was used to compute the epression status.
Definition: expression.hpp:209
maat::ExprObject::as_uint
ucst_t as_uint()
Return the concrete value of the expression as an unsigned value. If the expression is concolic,...
maat::CPUMode::X86
@ X86
Intel X86.
maat::ExprBinop::concretize
virtual const Number & concretize(const VarContext *ctx=nullptr)
Return the concrete value of the expression evaluated in the context 'ctx'.
maat::operator-
Expr operator-(Expr left, Expr right)
Subtract two expressions.
maat::operator~
Expr operator~(Expr arg)
Negate an expression.
maat::ExprObject
Definition: expression.hpp:186
maat::ExprVar::ExprVar
ExprVar(size_t size, std::string name, Taint tainted=Taint::NOT_TAINTED)
Constructor.