Classes

• namespace maat Main namespace for Maat's API.
  • namespace callother Namespace regrouping classes and handlers to deal with the pcode CALLOTHER instruction.
    • class HandlerMap A mapping between CALLOTHER occurences and their handler.
  • namespace env Simulation of the external environment in which a process is run.
    • namespace abi Util classes and methods to handle various calling conventions.
      • class ABI Abstract interface for different ABIs.
      • class X64_LINUX_SYSCALL X64 Linux SYSCALL ABI.
      • class X64_SYSTEM_V X64 SYSTEM V ABI.
      • class X86_CDECL X86 CDECL ABI.
      • class X86_LINUX_INT80 X86 Linux INT 0x80 ABI.
      • class X86_LINUX_SYSENTER X86 Linux SYSENTER ABI.
      • class X86_STDCALL X86 STDCALL ABI.
    • namespace emulated Namespace containing all emulated external functions, data, libraries, and syscalls.
    • class Data Emulated external data (in a library)
    • class EnvEmulator Main class emulating a process environment.
    • class FileAccessor
    • class Function Emulated function.
    • class FunctionCallback A C/C++ or Python callback emulating an imported function.
    • class Library Emulated external library.
    • class LinuxEmulator Specialisation of 'EnvEmulator' for the Linux operating system.
    • class PhysicalFile
  • namespace event Namespace regrouping event related classes and types.
    • class AddrFilter Filter addresses to monitor.
    • class EventCallback A callback to be executed on an event.
    • class EventHook Generic hook base.
    • class EventManager The event manager holds all hooks that have been set in the engine. It allows to add/remove/enable/disable hooks. It also serves as an interface to check whether hooks should be triggered or not given the current executed instruction.
  • namespace info Namespace regrouping classes and types used by the engine to provide various information to the user.
    • struct Branch Struct holding information about a regular or conditional branch operation.
    • class Info This class is used by the engine to make relevant information easily available to the user when it stops executing emulated code. The accessible information depends on the reason why the engine stopped. For instance if the engine encountered a breakpoint, the class will hold breakpoint related info, e.g register/memory that was read/written, path constraints that was encountered, etc.
    • struct MemAccess Struct holding information about a memory access.
    • struct RegAccess Struct holding information about a register access.
  • namespace ir Intermediate Representation of machine code in Maat.
    • class AsmInst A native instruction lifted into a sequence of IR/PCODE instructions.
    • class CPU
    • class CPUContext
    • class Inst Maat IR instructions.
      An IR instruction is made of an operation followed by one or several parameters.
    • class IRMap
      • struct InstLocation The location of a given IR instruction, it is made of an IR block and the id of the instruction within the block.
    • class Param Base class for parameters to be used in IR instructions.
    • class ProcessedInst
      • class Param A processed parameter, it can hold either an abstract value, a concrete value, or no value at all.
    • class TmpContext
  • namespace loader Functionalities to load executable files in Maat's engine.
    • class CmdlineArg A class representing a command line argument supplied when executing a binary.
    • class Loader Loader interface for loading executables into a MaatEngine
  • namespace X64 Namespace for X86-64 specific definitions and classes.
    • class ArchX64 Intel X86-64 architecture.
  • namespace X86 Namespace for X86-32 specific definitions and classes.
    • class ArchX86 Intel X86-32 architecture.
  • class Arch Base class representing an architecture.
  • class callother_exception
  • class constraint_exception
  • class ConstraintObject Constraint object representing constraints between symbolic expressions. This class should never be manipulated directly but used transparently through Constraint instances.
  • class env_exception
  • class event_exception
  • class ExprBinop Binary operation.
  • class ExprConcat Concatenation of two expressions.
  • class ExprCst Constant expression.
  • class expression_exception
  • class ExprExtract Bitfield extract.
  • class ExprITE If-Then-Else expression.
  • class ExprObject
  • class ExprSimplifier
  • class ExprUnop Unary operation.
  • class ExprVar Abstract variable.
  • class generic_exception
  • class illegal_instruction_exception
  • class IntervalTree Class used internally for symbolic memory management.
  • class ir_exception
  • class Lifter The lifter is responsible for translating binary assembly code into Maat's IR.
  • class lifter_exception
  • class loader_exception
  • class Logger Maat logger.
  • class MaatEngine The main engine class of the Maat framework. It is a wrapper around core components (lifter, memory engine, IR CPU, binary loader, environment simulation, etc) that enables to symbolically emulate a process.
  • class MaatStats
  • class mem_exception
  • class MemAbstractBuffer
  • class MemConcreteBuffer
  • class MemEngine
  • class MemMap A memory mapping.
  • class MemMapManager Basic manager for page permissions.
  • class MemPageManager Basic manager for page permissions.
  • class MemSegment
  • class MemStatusBitmap
  • class Number Represents a constant value on an arbitrary number of bits.
  • class PageSet A set of contiguous memory pages.
  • class PathManager A class recording the constraints associated with the current execution path.
    • struct iterator Custom iterator for path constraints.
    • class IteratorWrapper
  • class ProcessInfo This class contains information about a process.
  • class runtime_exception
  • struct SavedMemState Struct used by snapshots to record previous contents of an overwritten memory area.
  • class serialize_exception
  • class Settings Tweakable settings and options for the engine.
  • class SimpleInterval Class used internally for symbolic memory management.
  • class Snapshot Data container class used by the engine for snapshoting.
  • class snapshot_exception
  • class SnapshotManager Wrapper class to manage a list of snapshots.
  • class Symbol A class representing a symbol.
  • class symbol_exception
  • class symbolic_exception
  • class SymbolicMemEngine Dedicated memory engine handling the 'symbolic' memory state resulting from symbolic pointer writes.
  • class SymbolicMemWrite Represents a symbolic pointer memory write.
  • class SymbolManager Manager for all symbols in an engine.
  • class test_exception
  • class unsupported_instruction_exception
  • class Value
  • class ValueSet
  • class var_context_exception
  • class VarContext