CBMC
Loading...
Searching...
No Matches
analyze_symbol.h
Go to the documentation of this file.
1/*******************************************************************\
2
3Module: Symbol Analyzer
4
5Author: Malte Mues <mail.mues@gmail.com>
6 Daniel Poetzl
7
8\*******************************************************************/
9
12
13#ifndef CPROVER_MEMORY_ANALYZER_ANALYZE_SYMBOL_H
14#define CPROVER_MEMORY_ANALYZER_ANALYZE_SYMBOL_H
15
16#include <ansi-c/expr2c_class.h>
17
18#include <util/namespace.h>
19#include <util/symbol_table.h>
20
22
23#include "gdb_api.h"
24
25#include <map>
26#include <string>
27
28class pointer_typet;
30
33{
34public:
37 const std::vector<std::string> &args);
38
43 void analyze_symbols(const std::list<std::string> &symbols);
44
47 std::string get_snapshot_as_c_code();
48
56
59
64 bool run_gdb_to_breakpoint(const std::string &breakpoint)
65 {
67 }
68 void run_gdb_from_core(const std::string &corefile)
69 {
71 }
72
73private:
75
82
84 std::map<exprt, exprt> assignments;
85
88 std::map<exprt, memory_addresst> outstanding_assignments;
89
92 std::map<memory_addresst, exprt> values;
93
95 {
96 private:
97 size_t begin_int;
100
104 size_t address2size_t(const memory_addresst &point) const;
105
109 bool check_containment(const size_t &point_int) const
110 {
112 }
113
114 public:
116 const memory_addresst &begin,
117 const mp_integer &byte_size,
118 const irep_idt &name);
119
123 bool contains(const memory_addresst &point) const
124 {
126 }
127
134
137 irep_idt id() const
138 {
139 return name;
140 }
141
145 {
146 return byte_size;
147 }
148 };
149
151 std::vector<memory_scopet> dynamically_allocated;
152
154 std::map<irep_idt, pointer_valuet> memory_map;
155
157 {
158 return memory_map.count(id) != 0;
159 }
160
164 std::vector<memory_scopet>::iterator find_dynamic_allocation(irep_idt name);
165
169 std::vector<memory_scopet>::iterator
171
176
188 std::optional<std::string>
190
194 mp_integer get_type_size(const typet &type) const;
195
201
206 void add_assignment(const exprt &lhs, const exprt &value);
207
215 const exprt &expr,
216 const exprt &array,
217 const source_locationt &location);
218
229 const exprt &expr,
230 const exprt &zero_expr,
231 const source_locationt &location);
232
239 const exprt &expr,
240 const exprt &zero_expr,
241 const source_locationt &location);
242
249 const exprt &expr,
250 const exprt &zero_expr,
251 const source_locationt &location);
252
261 const exprt &expr,
262 const exprt &zero_expr,
263 const source_locationt &location);
264
273 const exprt &expr,
275 const source_locationt &location);
276
285 const exprt &expr,
286 const pointer_valuet &value,
287 const source_locationt &location);
288
297 const exprt &expr,
299 const source_locationt &location);
300
312 const exprt &expr,
314 const source_locationt &location);
315
318
322 std::string get_gdb_value(const exprt &expr);
323
329 bool points_to_member(
332};
333
334#endif // CPROVER_MEMORY_ANALYZER_ANALYZE_SYMBOL_H
ait supplies three of the four components needed: an abstract interpreter (in this case handling func...
Definition ai.h:562
dstringt has one field, an unsigned integer no which is an index into a static table of strings.
Definition dstring.h:38
Base class for all expressions.
Definition expr.h:56
Interface for running and querying GDB.
Definition gdb_api.h:30
bool run_gdb_to_breakpoint(const std::string &breakpoint)
Run gdb to the given breakpoint.
Definition gdb_api.cpp:345
void create_gdb_process()
Create a new gdb process for analysing the binary indicated by the first element in args
Definition gdb_api.cpp:67
void run_gdb_from_core(const std::string &corefile)
Run gdb with the given core file.
Definition gdb_api.cpp:275
Interface for extracting values from GDB (building on gdb_apit)
std::string get_gdb_value(const exprt &expr)
Extract a stringified value from and c-converted expr.
exprt get_pointer_to_member_value(const exprt &expr, const pointer_valuet &pointer_value, const source_locationt &location)
Call get_subexpression_at_offset to get the correct member expression.
allocate_objectst allocate_objects
bool run_gdb_to_breakpoint(const std::string &breakpoint)
std::map< irep_idt, pointer_valuet > memory_map
Keep track of the memory location for the analyzed symbols.
std::map< exprt, memory_addresst > outstanding_assignments
Mapping pointer expression for which get_non_char_pointer_value returned nil expression to memory loc...
gdb_apit::pointer_valuet pointer_valuet
void analyze_symbol(const irep_idt &symbol_name)
Assign the gdb-extracted value for symbol_name to its symbol expression and then process outstanding ...
bool has_known_memory_location(const irep_idt &id) const
exprt get_char_pointer_value(const exprt &expr, const memory_addresst &memory_location, const source_locationt &location)
If memory_location is found among values then return the symbol expression associated with it.
exprt get_pointer_to_function_value(const exprt &expr, const pointer_valuet &pointer_value, const source_locationt &location)
Extract the function name from pointer_value, check it has a symbol and return the associated symbol ...
void process_outstanding_assignments()
Call add_assignment for each pair in outstanding_assignments.
exprt get_array_value(const exprt &expr, const exprt &array, const source_locationt &location)
Iterate over array and fill its operands with the results of calling get_expr_value on index expressi...
void add_assignment(const exprt &lhs, const exprt &value)
Create assignment lhs := value (see analyze_symbol)
std::vector< memory_scopet > dynamically_allocated
Keep track of the dynamically allocated memory.
void run_gdb_from_core(const std::string &corefile)
std::map< exprt, exprt > assignments
Sequence of assignments collected during analyze_symbols.
std::string get_snapshot_as_c_code()
Get memory snapshot as C code.
std::map< memory_addresst, exprt > values
Storing pairs <address, symbol> such that at address is stored the value of symbol.
exprt get_expr_value(const exprt &expr, const exprt &zero_expr, const source_locationt &location)
Case analysis on the typet of expr 1) For integers, booleans, and enums: call gdb_apit::get_value dir...
mp_integer get_type_size(const typet &type) const
Wrapper for call get_offset_pointer_bits.
void analyze_symbols(const std::list< std::string > &symbols)
For each input symbol in symbols: map its value address to its symbol_exprt (via the values map) and ...
bool points_to_member(pointer_valuet &pointer_value, const pointer_typet &expected_type)
Analyzes the pointer_value to decide if it point to a struct or a union (or array)
mp_integer get_malloc_size(irep_idt name)
Search for the size of the allocated memory for name.
std::optional< std::string > get_malloc_pointee(const memory_addresst &point, mp_integer member_size)
Build the pointee string for address point assuming it points to a dynamic allocation of ā€˜nā€™ elements...
exprt get_pointer_value(const exprt &expr, const exprt &zero_expr, const source_locationt &location)
Call gdb_apit::get_memory on expr then split based on the points-to type being char type or not.
symbol_tablet symbol_table
External symbol table ā€“ extracted from read_goto_binary We only expect to analyse symbols located the...
exprt get_struct_value(const exprt &expr, const exprt &zero_expr, const source_locationt &location)
For each of the members of the struct: call get_expr_value.
std::vector< memory_scopet >::iterator find_dynamic_allocation(irep_idt name)
Search for a memory scope allocated under name.
exprt get_union_value(const exprt &expr, const exprt &zero_expr, const source_locationt &location)
For each of the members of the struct: call get_expr_value.
symbol_tablet get_snapshot_as_symbol_table()
Get memory snapshot as symbol table Build a new symbol_tablet and for each lhs symbol from collected ...
exprt get_non_char_pointer_value(const exprt &expr, const pointer_valuet &value, const source_locationt &location)
Similar to get_char_pointer_value.
gdb_apit::memory_addresst memory_addresst
const namespacet ns
A namespacet is essentially one or two symbol tables bound together, to allow for symbol lookups in t...
Definition namespace.h:94
The pointer type These are both 'bitvector_typet' (they have a width) and 'type_with_subtypet' (they ...
The symbol table base class interface.
The symbol table.
The type of an expression, extends irept.
Definition type.h:29
Low-level interface to gdb.
BigInt mp_integer
Definition smt_terms.h:17
Memory address imbued with the explicit boolean data indicating if the address is null or not.
Definition gdb_api.h:37
Data associated with the value of a pointer, i.e.
Definition gdb_api.h:77
mp_integer distance(const memory_addresst &point, mp_integer member_size) const
Compute the distance of point from the beginning of this scope.
bool check_containment(const size_t &point_int) const
Helper function that check if a point in memory points inside this scope.
mp_integer size() const
Getter for the allocation size of this memory scope.
bool contains(const memory_addresst &point) const
Check if point points somewhere in this memory scope.
size_t address2size_t(const memory_addresst &point) const
Convert base-16 memory address to a natural number.
irep_idt id() const
Getter for the name of this memory scope.
Author: Diffblue Ltd.