Static Value-Flow Analysis
|
AbstractInterpretation is same as Abstract Execution. More...
#include <AbstractInterpretation.h>
Public Types | |
typedef SCCDetection< PTACallGraph * > | CallGraphSCC |
Public Member Functions | |
AbstractInterpretation () | |
Constructor. More... | |
virtual void | runOnModule (ICFG *icfg) |
virtual | ~AbstractInterpretation () |
Destructor. More... | |
void | analyse () |
Program entry. More... | |
void | addDetector (std::unique_ptr< AEDetector > detector) |
Static Public Member Functions | |
static AbstractInterpretation & | getAEInstance () |
Public Attributes | |
Set< const CallICFGNode * > | checkpoints |
Private Member Functions | |
virtual void | handleGlobalNode () |
Global ICFGNode is handled at the entry of the program,. More... | |
void | initWTO () |
Mark recursive functions in the call graph. More... | |
bool | mergeStatesFromPredecessors (const ICFGNode *icfgNode) |
bool | isBranchFeasible (const IntraCFGEdge *intraEdge, AbstractState &as) |
virtual void | handleSingletonWTO (const ICFGSingletonWTO *icfgSingletonWto) |
handle instructions in svf basic blocks More... | |
virtual void | handleCallSite (const ICFGNode *node) |
virtual void | handleCycleWTO (const ICFGCycleWTO *cycle) |
handle wto cycle (loop) More... | |
void | handleWTOComponents (const std::list< const ICFGWTOComp * > &wtoComps) |
Hanlde two types of WTO components (singleton and cycle) More... | |
void | handleWTOComponent (const ICFGWTOComp *wtoComp) |
virtual void | handleSVFStatement (const SVFStmt *stmt) |
virtual void | SkipRecursiveCall (const CallICFGNode *callnode) |
bool | isCmpBranchFeasible (const CmpStmt *cmpStmt, s64_t succ, AbstractState &as) |
bool | isSwitchBranchFeasible (const SVFVar *var, s64_t succ, AbstractState &as) |
void | collectCheckPoint () |
void | checkPointAllSet () |
void | updateStateOnAddr (const AddrStmt *addr) |
void | updateStateOnBinary (const BinaryOPStmt *binary) |
void | updateStateOnCmp (const CmpStmt *cmp) |
void | updateStateOnLoad (const LoadStmt *load) |
void | updateStateOnStore (const StoreStmt *store) |
void | updateStateOnCopy (const CopyStmt *copy) |
void | updateStateOnCall (const CallPE *callPE) |
void | updateStateOnRet (const RetPE *retPE) |
void | updateStateOnGep (const GepStmt *gep) |
void | updateStateOnSelect (const SelectStmt *select) |
void | updateStateOnPhi (const PhiStmt *phi) |
AbstractState & | getAbsStateFromTrace (const ICFGNode *node) |
bool | hasAbsStateFromTrace (const ICFGNode *node) |
AbsExtAPI * | getUtils () |
virtual bool | isExtCall (const CallICFGNode *callNode) |
virtual void | extCallPass (const CallICFGNode *callNode) |
virtual bool | isRecursiveCall (const CallICFGNode *callNode) |
virtual void | recursiveCallPass (const CallICFGNode *callNode) |
virtual bool | isDirectCall (const CallICFGNode *callNode) |
virtual void | directCallFunPass (const CallICFGNode *callNode) |
virtual bool | isIndirectCall (const CallICFGNode *callNode) |
virtual void | indirectCallFunPass (const CallICFGNode *callNode) |
Private Attributes | |
SVFIR * | svfir |
protected data members, also used in subclasses More... | |
AEAPI * | api {nullptr} |
Execution State, used to store the Interval Value of every SVF variable. More... | |
ICFG * | icfg |
AEStat * | stat |
std::vector< const CallICFGNode * > | callSiteStack |
Map< const SVFFunction *, ICFGWTO * > | funcToWTO |
Set< const SVFFunction * > | recursiveFuns |
Map< std::string, std::function< void(const CallICFGNode *)> > | func_map |
Map< const ICFGNode *, AbstractState > | abstractTrace |
std::string | moduleName |
std::vector< std::unique_ptr< AEDetector > > | detectors |
AbsExtAPI * | utils |
Map< s32_t, s32_t > | _reverse_predicate |
Map< s32_t, s32_t > | _switch_lhsrhs_predicate |
Friends | |
class | AEStat |
class | AEAPI |
class | BufOverflowDetector |
AbstractInterpretation is same as Abstract Execution.
Definition at line 102 of file AbstractInterpretation.h.
Definition at line 109 of file AbstractInterpretation.h.
AbstractInterpretation::AbstractInterpretation | ( | ) |
|
virtual |
Destructor.
Definition at line 65 of file AbstractInterpretation.cpp.
|
inline |
Definition at line 127 of file AbstractInterpretation.h.
void AbstractInterpretation::analyse | ( | ) |
Program entry.
Definition at line 107 of file AbstractInterpretation.cpp.
|
private |
Definition at line 946 of file AbstractInterpretation.cpp.
|
private |
Definition at line 915 of file AbstractInterpretation.cpp.
|
privatevirtual |
Definition at line 614 of file AbstractInterpretation.cpp.
|
privatevirtual |
Definition at line 575 of file AbstractInterpretation.cpp.
|
inlineprivate |
Definition at line 258 of file AbstractInterpretation.h.
|
inlinestatic |
Definition at line 121 of file AbstractInterpretation.h.
|
inlineprivate |
Definition at line 277 of file AbstractInterpretation.h.
|
privatevirtual |
handle call node in ICFGNode
node | ICFGNode which has a single CallICFGNode |
Definition at line 539 of file AbstractInterpretation.cpp.
|
privatevirtual |
handle wto cycle (loop)
handle wto cycle (loop)
cycle | WTOCycle which has weak topo order of basic blocks and nested cycles |
Definition at line 667 of file AbstractInterpretation.cpp.
|
privatevirtual |
Global ICFGNode is handled at the entry of the program,.
handle global node
Definition at line 122 of file AbstractInterpretation.cpp.
|
privatevirtual |
handle instructions in svf basic blocks
handle instructions in ICFGSingletonWTO
block | basic block that has one instruction or a series of instructions |
Definition at line 480 of file AbstractInterpretation.cpp.
|
privatevirtual |
handle SVF Statement like CmpStmt, CallStmt, GepStmt, LoadStmt, StoreStmt, etc.
stmt | SVFStatement which is a value flow of instruction |
Definition at line 713 of file AbstractInterpretation.cpp.
|
private |
Definition at line 519 of file AbstractInterpretation.cpp.
|
private |
Hanlde two types of WTO components (singleton and cycle)
Definition at line 511 of file AbstractInterpretation.cpp.
|
inlineprivate |
Definition at line 271 of file AbstractInterpretation.h.
|
privatevirtual |
Definition at line 637 of file AbstractInterpretation.cpp.
|
private |
Mark recursive functions in the call graph.
This function identifies and marks recursive functions in the call graph. It does this by detecting cycles in the call graph's strongly connected components (SCC). Any function found to be part of a cycle is marked as recursive.
Definition at line 80 of file AbstractInterpretation.cpp.
|
private |
Check if execution state exist at the branch edge
intraEdge | the edge from CmpStmt to the next node |
Definition at line 452 of file AbstractInterpretation.cpp.
|
private |
Check if this cmpStmt and succ are satisfiable to the execution state.
cmpStmt | CmpStmt is a conditional branch statement |
succ | the value of cmpStmt (True or False) |
Definition at line 187 of file AbstractInterpretation.cpp.
|
privatevirtual |
Definition at line 610 of file AbstractInterpretation.cpp.
|
privatevirtual |
Definition at line 570 of file AbstractInterpretation.cpp.
|
privatevirtual |
Definition at line 631 of file AbstractInterpretation.cpp.
|
privatevirtual |
Definition at line 586 of file AbstractInterpretation.cpp.
|
private |
Check if this SwitchInst and succ are satisfiable to the execution state.
var | var in switch inst |
succ | the case value of switch inst |
Definition at line 408 of file AbstractInterpretation.cpp.
|
private |
Check if execution state exist by merging states of predecessor nodes
icfgNode | The icfg node to analyse |
get execution state by merging states of predecessor blocks Scenario 1: preblock --—(intraEdge)-—> block, join the preES of inEdges Scenario 2: preblock --—(callEdge)-—> block
Definition at line 137 of file AbstractInterpretation.cpp.
|
privatevirtual |
Definition at line 591 of file AbstractInterpretation.cpp.
|
virtual |
collect checkpoint
Definition at line 40 of file AbstractInterpretation.cpp.
|
privatevirtual |
Check if this callnode is recursive call and skip it.
callnode | CallICFGNode which calls a recursive function |
Definition at line 772 of file AbstractInterpretation.cpp.
|
private |
Definition at line 1052 of file AbstractInterpretation.cpp.
|
private |
Find the comparison predicates in "class BinaryOPStmt:OpCode" under SVF/svf/include/SVFIR/SVFStatements.h You are only required to handle integer predicates, including Add, FAdd, Sub, FSub, Mul, FMul, SDiv, FDiv, UDiv, SRem, FRem, URem, Xor, And, Or, AShr, Shl, LShr
Definition at line 1062 of file AbstractInterpretation.cpp.
|
private |
Definition at line 1035 of file AbstractInterpretation.cpp.
|
private |
Definition at line 1124 of file AbstractInterpretation.cpp.
|
private |
Definition at line 1352 of file AbstractInterpretation.cpp.
|
private |
Definition at line 962 of file AbstractInterpretation.cpp.
|
private |
Definition at line 1336 of file AbstractInterpretation.cpp.
|
private |
Definition at line 996 of file AbstractInterpretation.cpp.
|
private |
Definition at line 1043 of file AbstractInterpretation.cpp.
|
private |
Definition at line 978 of file AbstractInterpretation.cpp.
|
private |
Definition at line 1344 of file AbstractInterpretation.cpp.
|
friend |
Definition at line 105 of file AbstractInterpretation.h.
|
friend |
Definition at line 104 of file AbstractInterpretation.h.
|
friend |
Definition at line 106 of file AbstractInterpretation.h.
Definition at line 308 of file AbstractInterpretation.h.
Definition at line 329 of file AbstractInterpretation.h.
|
private |
Definition at line 295 of file AbstractInterpretation.h.
|
private |
Execution State, used to store the Interval Value of every SVF variable.
Definition at line 248 of file AbstractInterpretation.h.
|
private |
Definition at line 253 of file AbstractInterpretation.h.
Set<const CallICFGNode*> SVF::AbstractInterpretation::checkpoints |
Definition at line 132 of file AbstractInterpretation.h.
|
private |
Definition at line 298 of file AbstractInterpretation.h.
|
private |
Definition at line 293 of file AbstractInterpretation.h.
|
private |
Definition at line 254 of file AbstractInterpretation.h.
|
private |
Definition at line 250 of file AbstractInterpretation.h.
|
private |
Definition at line 296 of file AbstractInterpretation.h.
|
private |
Definition at line 255 of file AbstractInterpretation.h.
|
private |
Definition at line 251 of file AbstractInterpretation.h.
|
private |
protected data members, also used in subclasses
Definition at line 246 of file AbstractInterpretation.h.
|
private |
Definition at line 299 of file AbstractInterpretation.h.