22 inline bool is_target_pc(
const std::unordered_set<int> &target_pcs,
int pc) {
23 return ((target_pcs.size() == 0) ||
24 (target_pcs.find(-1) != target_pcs.end()) ||
25 (target_pcs.find(pc) != target_pcs.end()));
41 return maxDepth > 0 && maxSAT > 0 && maxUNSAT > 0;
59 std::unordered_map<int, float> ¶ms,
61 bool ignore_memory,
bool use_dpll) {
88 bool is_unknown_path_constraint,
bool is_target,
90 std::string constraints_str,
92 const std::unordered_map<int, float> ¶ms) {
93 if ((verbose_level >= 1 && is_unknown_path_constraint && is_target) ||
94 (verbose_level >= 2)) {
100 printf(
"pc=%d, IS_SAT - %d\x1b[39m, %s, params = {", pc, is_sat,
101 constraints_str.c_str());
102 for (
auto &p : params) {
104 if (state.
mem.find(p.first) != state.
mem.end()) {
109 printf(
"%d: %d, ", p.first, (
int)p.second);
111 printf(
"%d: %f, ", p.first, p.second);
130 if (verbose_level > -1) {
131 printf(
"pc: %d, ", pc);
133 if (verbose_level >= 2) {
147 if (verbose_level >= 2) {
165 std::vector<SymState *> &result) {
168 switch (instr.
instr) {
174 result.emplace_back(state);
184 result.emplace_back(state);
194 result.emplace_back(state);
204 result.emplace_back(state);
214 result.emplace_back(state);
224 result.emplace_back(state);
234 result.emplace_back(state);
244 result.emplace_back(state);
254 result.emplace_back(state);
265 result.emplace_back(state);
312 result.emplace_back(state);
324 result.emplace_back(state);
331 result.emplace_back(state);
337 result.emplace_back(state);
346 result.emplace_back(state);
352 result.emplace_back(state);
368 result.emplace_back(true_state);
369 result.emplace_back(false_state);
377 result.emplace_back(state);
382 result.emplace_back(state);
389 fprintf(stderr,
"Detect unsupported instruction\n");
471 std::string constraints_str = state.
toString(
false);
473 std::unordered_map<int, float> params = {};
476 bool is_unknown_path_constraint =
true;
482 is_unknown_path_constraint =
false;
492 std::make_pair(is_sat, params));
497 is_target, is_sat, pc, constraints_str, state,
520 int maxDepth = 256) {
528 is_sat =
solve(is_target, pc, state);
533 return Trace(state, {});
535 Instr instr = prog[pc];
536 std::vector<SymState *> newStates;
537 symStep(&state, instr, newStates);
538 std::vector<Trace> children;
539 for (
SymState *newState : newStates) {
540 Trace child =
run(prog, target_pcs, *newState, maxDepth - 1);
542 children.push_back(child);
545 return Trace(state, children);
547 return Trace(state, {});
Class representing an instruction.
Definition: type.h:53
Word32 word
Definition: type.h:56
InstrType instr
Definition: type.h:55
Definition: compiler.h:11
bool explore_further(int maxDepth, int maxSAT, int maxUNSAT)
Checks if further exploration is allowed based on maximum depth and satisfiability conditions.
Definition: symbolic.h:40
int wordToInt(uint32_t word)
Converts a 32-bit word representation to an integer value.
Definition: utils.h:66
void call_smt_solver(bool &is_sat, SymState &state, std::unordered_map< int, float > ¶ms, GDOptimizer &optimizer, int max_num_trials, bool ignore_memory, bool use_dpll)
Calls the SMT solver based on the specified options.
Definition: symbolic.h:58
bool is_integer(float x)
Checks if a float is an integer.
Definition: utils.h:25
void verbose_constraints(int verbose_level, bool is_unknown_path_constraint, bool is_target, bool is_sat, int pc, std::string constraints_str, const SymState &state, const std::unordered_map< int, float > ¶ms)
Prints a verbose for conflicts solving if conditions are met.
Definition: symbolic.h:87
void initialize_params(std::unordered_map< int, float > ¶ms, SymState &state, bool ignore_memory)
Initialize Parameter Values from Memory.
Definition: smt.h:23
void smt_union_solver(bool &is_sat, SymState &state, std::unordered_map< int, float > ¶ms, GDOptimizer &optimizer, int max_num_trials, bool ignore_memory)
SMT Solver with Unified Loss Function.
Definition: smt.h:44
bool is_target_pc(const std::unordered_set< int > &target_pcs, int pc)
Checks if the given program counter (pc) is a target program counter.
Definition: symbolic.h:22
void verbose_pre(int verbose_level, int pc, Prog &prog, SymState &state)
Prints a verbose representation before solving constraints.
Definition: symbolic.h:128
void symStep(SymState *state, Instr &instr, std::vector< SymState * > &result)
Symbolically Execute a Single Instruction of a Program.
Definition: symbolic.h:164
std::vector< Instr > Prog
Alias for a program, represented as a vector of instructions.
Definition: type.h:143
void verbose_post(int verbose_level)
Prints a verbose representation after solving constraints.
Definition: symbolic.h:146
void smt_dpll_solver(bool &is_sat, SymState &state, std::unordered_map< int, float > ¶ms, GDOptimizer &optimizer, int max_num_trials, bool ignore_memory)
SMT Solver using DPLL as its backend.
Definition: smt.h:74
std::unordered_map< std::string, std::pair< bool, std::unordered_map< int, float > >> PathConstraintsTable
Alias for a table of path constraints.
Definition: type.h:1189
Core implementation of gradient-based smt solver.
Represents the base class for symbolic execution engine.
Definition: symbolic.h:397
int max_num_trials
Definition: symbolic.h:402
bool return_trace
Definition: symbolic.h:409
bool ignore_memory
Definition: symbolic.h:405
int maxUNSAT
The maximum number of UNSAT constraints to collect.
Definition: symbolic.h:401
GDOptimizer optimizer
Definition: symbolic.h:398
virtual Trace run(Prog &prog, std::unordered_set< int > &target_pcs, SymState &state, int maxDepth)=0
int maxSAT
The maximum number of SAT constraints to collect.
Definition: symbolic.h:400
int verbose_level
The level of verbosity.
Definition: symbolic.h:404
virtual bool solve(bool is_target, int pc, SymState &state)=0
BaseExecutor(GDOptimizer optimizer, int maxSAT=256, int maxUNSAT=256, int max_num_trials=10, bool ignore_memory=false, bool use_dpll=false, int verbose_level=0, bool return_trace=false)
Constructor for BaseExecutor.
Definition: symbolic.h:429
bool use_dpll
Definition: symbolic.h:407
Gradient Descent Optimizer for Symbolic Path Constraints.
Definition: gd.h:28
Represents a derived class for symbolic execution engine for deterministic programs.
Definition: symbolic.h:452
Trace run(Prog &prog, std::unordered_set< int > &target_pcs, SymState &state, int maxDepth=256)
Symbolically Execute a Program with Gradient Descent Optimization.
Definition: symbolic.h:519
bool solve(bool is_target, int pc, SymState &state)
Solves path constraints and updates the cache.
Definition: symbolic.h:469
PathConstraintsTable constraints_cache
Cache for storing and reusing path constraints.
Definition: symbolic.h:454
Struct representing the symbolic state of the symbolic execution.
Definition: type.h:1042
std::vector< Sym > path_constraints
Definition: type.h:1049
int var_cnt
Definition: type.h:1044
SymState * copy()
Create a copy object.
Definition: type.h:1098
void print() const
Prints a human-readable representation of the symbolic state.
Definition: type.h:1162
Linkedlist< Sym > symbolic_stack
Definition: type.h:1047
int pc
Definition: type.h:1043
SMem smem
Definition: type.h:1046
std::string toString(bool include_memory=true) const
Returns the human-redable string representation of concrete memory, symbolic memory and path constrai...
Definition: type.h:1119
Mem mem
Definition: type.h:1045
Struct representing a symbolic expression.
Definition: type.h:265
SymType symtype
Definition: type.h:266
int var_idx
Definition: type.h:270
Word32 word
Definition: type.h:269
Struct representing a trace in symbolic execution.
Definition: type.h:1210