libTriton  version 1.0 build 1549
symbolicEngine.hpp
Go to the documentation of this file.
1
2/*
3** Copyright (C) - Triton
4**
5** This program is under the terms of the Apache License 2.0.
6*/
7
8#ifndef TRITON_SYMBOLICENGINE_H
9#define TRITON_SYMBOLICENGINE_H
10
11#include <map>
12#include <memory>
13#include <string>
14#include <unordered_map>
15#include <vector>
16
19#include <triton/ast.hpp>
20#include <triton/astContext.hpp>
21#include <triton/callbacks.hpp>
22#include <triton/dllexport.hpp>
24#include <triton/modes.hpp>
26#include <triton/register.hpp>
32
33
34
36namespace triton {
43 namespace engines {
51 namespace symbolic {
59
63
64 protected:
67
70
73
80 mutable std::unordered_map<triton::usize, WeakSymbolicVariable> symbolicVariables;
81
88 mutable std::unordered_map<triton::usize, WeakSymbolicExpression> symbolicExpressions;
89
96 std::map<std::pair<triton::uint64, triton::uint32>, SharedSymbolicExpression> alignedMemoryReference;
97
104 std::unordered_map<triton::uint64, SharedSymbolicExpression> memoryReference;
105
107 std::vector<SharedSymbolicExpression> symbolicReg;
108
109 private:
112
114 triton::arch::Architecture* architecture;
115
118
121
123 triton::usize getUniqueSymExprId(void);
124
126 triton::usize getUniqueSymVarId(void);
127
129 const SharedSymbolicExpression& getAlignedMemory(triton::uint64 address, triton::uint32 size);
130
132 void addAlignedMemory(triton::uint64 address, triton::uint32 size, const SharedSymbolicExpression& expr);
133
135 bool isAlignedMemory(triton::uint64 address, triton::uint32 size);
136
138 void removeAlignedMemory(triton::uint64 address, triton::uint32 size);
139
141 inline void addMemoryReference(triton::uint64 mem, const SharedSymbolicExpression& expr);
142
145
147 triton::ast::SharedAbstractNode insertSubRegisterInParent(const triton::arch::Register& reg, const triton::ast::SharedAbstractNode& node, bool zxForAssign=true);
148
150 void setImplicitReadRegisterFromEffectiveAddress(triton::arch::Instruction& inst, const triton::arch::MemoryAccess& mem);
151
153 const SharedSymbolicExpression& addSymbolicExpressions(triton::arch::Instruction& inst, triton::usize id) const;
154
155 public:
157 TRITON_EXPORT SymbolicEngine(triton::arch::Architecture* architecture,
158 const triton::modes::SharedModes& modes,
159 const triton::ast::SharedAstContext& astCtxt,
160 triton::callbacks::Callbacks* callbacks=nullptr);
161
163 TRITON_EXPORT SymbolicEngine(const SymbolicEngine& other);
164
166 TRITON_EXPORT ~SymbolicEngine();
167
169 TRITON_EXPORT SymbolicEngine& operator=(const SymbolicEngine& other);
170
173
175 TRITON_EXPORT void removeSymbolicExpression(const SharedSymbolicExpression& expr);
176
178 TRITON_EXPORT SharedSymbolicVariable newSymbolicVariable(triton::engines::symbolic::variable_e type, triton::uint64 source, triton::uint32 size, const std::string& alias="");
179
181 TRITON_EXPORT SharedSymbolicVariable getSymbolicVariable(triton::usize symVarId) const;
182
184 TRITON_EXPORT SharedSymbolicVariable getSymbolicVariable(const std::string& name) const;
185
187 TRITON_EXPORT SharedSymbolicExpression getSymbolicExpression(triton::usize symExprId) const;
188
191
193 TRITON_EXPORT const std::unordered_map<triton::uint64, SharedSymbolicExpression>& getSymbolicMemory(void) const;
194
196 TRITON_EXPORT const SharedSymbolicExpression& getSymbolicRegister(const triton::arch::Register& reg) const;
197
199 TRITON_EXPORT std::unordered_map<triton::arch::register_e, SharedSymbolicExpression> getSymbolicRegisters(void) const;
200
203
206
208 TRITON_EXPORT std::vector<triton::uint8> getSymbolicMemoryAreaValue(triton::uint64 baseAddr, triton::usize size);
209
212
215
218
221
224
227
230
233
236
239
241 TRITON_EXPORT const SharedSymbolicExpression& createSymbolicExpression(triton::arch::Instruction& inst, const triton::ast::SharedAbstractNode& node, const triton::arch::OperandWrapper& dst, const std::string& comment="");
242
244 TRITON_EXPORT const SharedSymbolicExpression& createSymbolicMemoryExpression(triton::arch::Instruction& inst, const triton::ast::SharedAbstractNode& node, const triton::arch::MemoryAccess& mem, const std::string& comment="");
245
247 TRITON_EXPORT const SharedSymbolicExpression& createSymbolicRegisterExpression(triton::arch::Instruction& inst, const triton::ast::SharedAbstractNode& node, const triton::arch::Register& reg, const std::string& comment="");
248
250 TRITON_EXPORT const SharedSymbolicExpression& createSymbolicVolatileExpression(triton::arch::Instruction& inst, const triton::ast::SharedAbstractNode& node, const std::string& comment="");
251
254
257
259 TRITON_EXPORT std::unordered_map<triton::usize, SharedSymbolicExpression> sliceExpressions(const SharedSymbolicExpression& expr);
260
262 TRITON_EXPORT std::vector<SharedSymbolicExpression> getTaintedSymbolicExpressions(void) const;
263
265 TRITON_EXPORT std::unordered_map<triton::usize, SharedSymbolicExpression> getSymbolicExpressions(void) const;
266
268 TRITON_EXPORT std::map<triton::usize, SharedSymbolicVariable> getSymbolicVariables(void) const;
269
271 TRITON_EXPORT SharedSymbolicVariable symbolizeExpression(triton::usize exprId, triton::uint32 symVarSize, const std::string& symVarAlias="");
272
274 TRITON_EXPORT SharedSymbolicVariable symbolizeMemory(const triton::arch::MemoryAccess& mem, const std::string& symVarAlias="");
275
277 TRITON_EXPORT void symbolizeMemory(triton::uint64 addr, triton::usize size);
278
280 TRITON_EXPORT SharedSymbolicVariable symbolizeRegister(const triton::arch::Register& reg, const std::string& symVarAlias="");
281
283 TRITON_EXPORT void concretizeAllMemory(void);
284
286 TRITON_EXPORT void concretizeAllRegister(void);
287
289 TRITON_EXPORT void concretizeMemory(const triton::arch::MemoryAccess& mem);
290
292 TRITON_EXPORT void concretizeMemory(triton::uint64 addr);
293
295 TRITON_EXPORT void concretizeRegister(const triton::arch::Register& reg);
296
298 TRITON_EXPORT bool isSymbolicExpressionExists(triton::usize symExprId) const;
299
301 TRITON_EXPORT bool isMemorySymbolized(const triton::arch::MemoryAccess& mem) const;
302
304 TRITON_EXPORT bool isMemorySymbolized(triton::uint64 addr, triton::uint32 size=1) const;
305
307 TRITON_EXPORT bool isRegisterSymbolized(const triton::arch::Register& reg) const;
308
310 TRITON_EXPORT void initLeaAst(triton::arch::MemoryAccess& mem, bool force=true);
311
313 TRITON_EXPORT triton::uint512 getConcreteVariableValue(const SharedSymbolicVariable& symVar) const;
314
316 TRITON_EXPORT void setConcreteVariableValue(const SharedSymbolicVariable& symVar, const triton::uint512& value);
317 };
318
320 };
322 };
324};
325
326#endif /* TRITON_SYMBOLICENGINE_H */
The abstract architecture class.
This class is used to represent an immediate.
Definition: immediate.hpp:37
This class is used to represent an instruction.
Definition: instruction.hpp:48
This class is used to represent a memory access.
This class is used as operand wrapper.
This class is used when an instruction has a register operand.
Definition: register.hpp:44
This class is used to represent specific properties of an Arm operand.
The callbacks class.
Definition: callbacks.hpp:79
std::unordered_map< triton::usize, WeakSymbolicExpression > symbolicExpressions
The map of symbolic expressions.
TRITON_EXPORT const SharedSymbolicExpression & createSymbolicMemoryExpression(triton::arch::Instruction &inst, const triton::ast::SharedAbstractNode &node, const triton::arch::MemoryAccess &mem, const std::string &comment="")
Returns the new shared symbolic memory expression expression and links this expression to the instruc...
triton::usize uniqueSymExprId
Symbolic expressions id.
std::unordered_map< triton::uint64, SharedSymbolicExpression > memoryReference
map of address -> symbolic expression
TRITON_EXPORT const SharedSymbolicExpression & createSymbolicRegisterExpression(triton::arch::Instruction &inst, const triton::ast::SharedAbstractNode &node, const triton::arch::Register &reg, const std::string &comment="")
Returns the new shared symbolic register expression expression and links this expression to the instr...
TRITON_EXPORT SharedSymbolicVariable symbolizeExpression(triton::usize exprId, triton::uint32 symVarSize, const std::string &symVarAlias="")
Converts a symbolic expression to a symbolic variable. symVarSize must be in bits.
triton::usize uniqueSymVarId
Symbolic variables id.
TRITON_EXPORT bool isMemorySymbolized(const triton::arch::MemoryAccess &mem) const
Returns true if memory cell expressions contain symbolic variables.
TRITON_EXPORT std::unordered_map< triton::usize, SharedSymbolicExpression > getSymbolicExpressions(void) const
Returns all symbolic expressions.
TRITON_EXPORT bool isSymbolicExpressionExists(triton::usize symExprId) const
Returns true if the symbolic expression ID exists.
TRITON_EXPORT SymbolicEngine & operator=(const SymbolicEngine &other)
Copies a SymbolicEngine.
TRITON_EXPORT SharedSymbolicVariable symbolizeRegister(const triton::arch::Register &reg, const std::string &symVarAlias="")
Converts a symbolic register expression to a symbolic variable.
triton::ast::SharedAbstractNode getShiftAst(const triton::arch::arm::ArmOperandProperties &shift, const triton::ast::SharedAbstractNode &node)
Returns the AST corresponding to the shift operation. Mainly used for Arm32 operands.
TRITON_EXPORT SharedSymbolicExpression getSymbolicExpression(triton::usize symExprId) const
Returns the symbolic expression corresponding to an id.
TRITON_EXPORT SharedSymbolicVariable getSymbolicVariable(triton::usize symVarId) const
Returns the symbolic variable corresponding to the symbolic variable id.
TRITON_EXPORT const SharedSymbolicExpression & createSymbolicVolatileExpression(triton::arch::Instruction &inst, const triton::ast::SharedAbstractNode &node, const std::string &comment="")
Returns the new shared symbolic volatile expression expression and links this expression to the instr...
TRITON_EXPORT void assignSymbolicExpressionToMemory(const SharedSymbolicExpression &se, const triton::arch::MemoryAccess &mem)
Assigns a symbolic expression to a memory.
TRITON_EXPORT void setConcreteVariableValue(const SharedSymbolicVariable &symVar, const triton::uint512 &value)
Sets the concrete value of a symbolic variable.
TRITON_EXPORT const std::unordered_map< triton::uint64, SharedSymbolicExpression > & getSymbolicMemory(void) const
Returns the map (addr:expr) of all symbolic memory defined.
TRITON_EXPORT void assignSymbolicExpressionToRegister(const SharedSymbolicExpression &se, const triton::arch::Register &reg)
Assigns a symbolic expression to a register.
TRITON_EXPORT void initLeaAst(triton::arch::MemoryAccess &mem, bool force=true)
Initializes the memory access AST (LOAD and STORE).
TRITON_EXPORT std::vector< triton::uint8 > getSymbolicMemoryAreaValue(triton::uint64 baseAddr, triton::usize size)
Returns the symbolic values of a memory area.
TRITON_EXPORT std::unordered_map< triton::arch::register_e, SharedSymbolicExpression > getSymbolicRegisters(void) const
Returns the map of symbolic registers defined.
std::map< std::pair< triton::uint64, triton::uint32 >, SharedSymbolicExpression > alignedMemoryReference
map of <address:size> -> symbolic expression.
TRITON_EXPORT SymbolicEngine(triton::arch::Architecture *architecture, const triton::modes::SharedModes &modes, const triton::ast::SharedAstContext &astCtxt, triton::callbacks::Callbacks *callbacks=nullptr)
Constructor.
TRITON_EXPORT triton::ast::SharedAbstractNode getMemoryAst(const triton::arch::MemoryAccess &mem)
Returns the AST corresponding to the memory.
TRITON_EXPORT SharedSymbolicVariable symbolizeMemory(const triton::arch::MemoryAccess &mem, const std::string &symVarAlias="")
Converts a symbolic memory expression to a symbolic variable.
TRITON_EXPORT triton::uint512 getSymbolicRegisterValue(const triton::arch::Register &reg)
Returns the symbolic register value.
TRITON_EXPORT std::vector< SharedSymbolicExpression > getTaintedSymbolicExpressions(void) const
Returns the vector of the tainted symbolic expressions.
TRITON_EXPORT triton::ast::SharedAbstractNode getRegisterAst(const triton::arch::Register &reg)
Returns the AST corresponding to the register.
TRITON_EXPORT triton::uint512 getConcreteVariableValue(const SharedSymbolicVariable &symVar) const
Gets the concrete value of a symbolic variable.
TRITON_EXPORT SharedSymbolicVariable newSymbolicVariable(triton::engines::symbolic::variable_e type, triton::uint64 source, triton::uint32 size, const std::string &alias="")
Adds a symbolic variable.
TRITON_EXPORT const SharedSymbolicExpression & createSymbolicExpression(triton::arch::Instruction &inst, const triton::ast::SharedAbstractNode &node, const triton::arch::OperandWrapper &dst, const std::string &comment="")
Returns the new shared symbolic abstract expression and links this expression to the instruction.
TRITON_EXPORT SharedSymbolicExpression newSymbolicExpression(const triton::ast::SharedAbstractNode &node, triton::engines::symbolic::expression_e type, const std::string &comment="")
Creates a new shared symbolic expression.
TRITON_EXPORT const SharedSymbolicExpression & getSymbolicRegister(const triton::arch::Register &reg) const
Returns the shared symbolic expression corresponding to the parent register.
TRITON_EXPORT void removeSymbolicExpression(const SharedSymbolicExpression &expr)
Removes the symbolic expression corresponding to the id.
TRITON_EXPORT std::unordered_map< triton::usize, SharedSymbolicExpression > sliceExpressions(const SharedSymbolicExpression &expr)
Slices all expressions from a given one.
triton::uint32 numberOfRegisters
Number of registers.
TRITON_EXPORT triton::uint8 getSymbolicMemoryValue(triton::uint64 address)
Returns the symbolic memory value.
TRITON_EXPORT void concretizeAllMemory(void)
Concretizes all symbolic memory references.
std::unordered_map< triton::usize, WeakSymbolicVariable > symbolicVariables
The map of symbolic variables.
TRITON_EXPORT ~SymbolicEngine()
Destructor.
TRITON_EXPORT triton::ast::SharedAbstractNode getImmediateAst(const triton::arch::Immediate &imm)
Returns the AST corresponding to the immediate.
std::vector< SharedSymbolicExpression > symbolicReg
Symbolic register state.
TRITON_EXPORT void concretizeAllRegister(void)
Concretizes all symbolic register references.
TRITON_EXPORT std::map< triton::usize, SharedSymbolicVariable > getSymbolicVariables(void) const
Returns all symbolic variables.
TRITON_EXPORT void concretizeRegister(const triton::arch::Register &reg)
Concretizes a specific symbolic register reference.
TRITON_EXPORT triton::ast::SharedAbstractNode getOperandAst(const triton::arch::OperandWrapper &op)
Returns the AST corresponding to the operand.
TRITON_EXPORT bool isRegisterSymbolized(const triton::arch::Register &reg) const
Returns true if the register expression contains a symbolic variable.
TRITON_EXPORT void concretizeMemory(const triton::arch::MemoryAccess &mem)
Concretizes a specific symbolic memory reference.
std::shared_ptr< triton::ast::AbstractNode > SharedAbstractNode
Shared Abstract Node.
Definition: ast.hpp:59
std::shared_ptr< triton::ast::AstContext > SharedAstContext
Shared AST context.
Definition: ast.hpp:65
std::shared_ptr< triton::modes::Modes > SharedModes
Shared Modes.
Definition: modes.hpp:66
std::shared_ptr< triton::engines::symbolic::SymbolicVariable > SharedSymbolicVariable
Shared Symbolic variable.
Definition: ast.hpp:43
expression_e
Type of symbolic expressions.
std::shared_ptr< triton::engines::symbolic::SymbolicExpression > SharedSymbolicExpression
Shared Symbolic Expression.
Definition: ast.hpp:40
variable_e
Type of symbolic variable.
std::size_t usize
unsigned MAX_INT 32 or 64 bits according to the CPU.
std::uint64_t uint64
unisgned 64-bits
Definition: tritonTypes.hpp:42
std::uint32_t uint32
unisgned 32-bits
Definition: tritonTypes.hpp:39
std::uint8_t uint8
unisgned 8-bits
Definition: tritonTypes.hpp:33
The Triton namespace.