Analyze.Create
module Dba2CodexC : sig ... end
module Arch : sig ... end
module Dba2CState : sig ... end
module Record_cfg : sig ... end
module type SETTINGS =
Analysis_settings.S
with module Record_cfg = Record_cfg
with module State := Dba2CState.State
val type_of_name : string -> Ctypes.typ
val bunknown :
size:int ->
Dba2CodexC.Domain.Context.t ->
Dba2CodexC.Domain.binary
val m_settings : (module SETTINGS)
module Cfg = Cfg_analysis.Cfg
module Dhunk_regex = Dhunk_analysis.Dhunk_regex
val exploration_result : Dba2CState.State.t option Stdlib.ref
Utility functions. *
module Dhunk_regex_hash : sig ... end
module Dhunk_regex_tbl : sig ... end
val do_regex :
Binsec.Dhunk.t ->
Dba2CState.State.t Dhunk_regex_tbl.t ->
Dhunk_regex_tbl.key ->
Dba2CState.State.t option
val transfer_dhunk :
Binsec.Dhunk.t ->
Dba2CState.State.t ->
(Binsec.Virtual_address.t * Dba2CState.State.t) list
module Addr_map : sig ... end
val transfer_instruction_nostub :
Binsec_codex_lib.Analysis_settings.Addr_tbl.key ->
Dba2CState.State.t ->
Dba2CState.State.t Addr_map.t
val transfer_instruction :
Binsec_codex_lib.Analysis_settings.Addr_tbl.key ->
Settings.Record_cfg.t ->
Dba2CState.State.t ->
Settings.Record_cfg.t * Dba2CState.State.t Addr_map.t
val transfer_from_to_generic :
transfer_instruction:
('a -> 'b -> 'c -> Settings.Record_cfg.t * 'd Addr_map.t) ->
self:
(stop_pred:'e ->
Addr_map.key ->
Settings.Record_cfg.t ->
'f ->
Settings.Record_cfg.t * Dba2CState.State.t Addr_map.t) ->
stop_pred:'g ->
'h ->
'i ->
'j ->
Settings.Record_cfg.t * Dba2CState.State.t Addr_map.t
val transfer_from_to :
Binsec_codex_lib.Analysis_settings.Addr_tbl.key ->
stop_pred:
(Binsec.Virtual_address.t -> Settings.Record_cfg.context_change -> bool) ->
Settings.Record_cfg.t ->
Dba2CState.State.t ->
Settings.Record_cfg.t * Dba2CState.State.t Addr_map.t
val analyze_block :
Dba2CState.State.t ->
Settings.Record_cfg.t ->
Binsec.Dhunk.t ->
unit
val analyze_address_nocheck :
Dba2CState.State.t ->
Settings.Record_cfg.t ->
Binsec.Virtual_address.t ->
unit
Like analyze_address
but does not call next
on the first, and thus will not stop if address
was already visited.
val analyze_address :
Dba2CState.State.t ->
Settings.Record_cfg.t ->
Binsec.Virtual_address.t ->
unit
val analyze_address' :
Dba2CState.State.t ->
Settings.Record_cfg.t ->
Binsec.Virtual_address.t ->
unit
val destination : ('a * 'b) Fixpoint.Regex.tagged_regex -> 'c
module Regex_tbl_0 : sig ... end
module Regex_tbl : sig ... end
val handle_successors :
(Binsec.Virtual_address.t * Dba2CState.State.t) list ->
Dba2CState.State.t Regex_tbl.t ->
Dba2CState.State.t ->
Settings.Record_cfg.t ->
Cfg_analysis.CfgRegex.t ->
Cfg_analysis.Cfg.V.t ->
unit
val analyze_regex :
Dba2CState.State.t Regex_tbl.t ->
Dba2CState.State.Domain.Context.t ->
Settings.Record_cfg.t ->
Regex_tbl.key ->
unit
Analyze a set of paths in the CFG (described by a regex) to possibly discover new edges. When that happens, the new path set is explored immediately, enriching the instruction graph by a depth-first search without merge (analyze_address
). If that happens, it means that the fixpoint was not reached, and analyze_regex
returns false
. Otherwise, if no new instruction is discovered, a fixpoint was reached and analyze_regex
returns true
. Please note: The instruction at the end of the path is not analyzed by this function.
val find_end_nodes : Cfg.t -> Cfg.vertex -> Cfg.vertex list
module Wto_cfg = Cfg_analysis.Wto
module Reduce_cfg = Cfg_analysis.Reduce
module G' : sig ... end
module OutputCfg : sig ... end
val analyze :
Binsec.Loader.Img.t ->
int ->
Dba2CState.State.t ->
string ->
Binsec_codex_lib.Analysis_settings.Addr_tbl.key option ->
string option ->
(string, string) Stdlib.Hashtbl.t ->
(Binsec.Virtual_address.Set.t * Binsec.Virtual_address.Set.t)
* Dba2CState.State.t option
* Binsec.Virtual_address.Set.t
val interprete_concrete :
Binsec.Loader.Img.t ->
int ->
Dba2CState.State.t ->
string ->
string option ->
(string, string) Stdlib.Hashtbl.t ->
(Binsec.Virtual_address.Set.t * Binsec.Virtual_address.Set.t)
* Dba2CState.State.t option
* Binsec.Virtual_address.Set.t
val switch_cpu :
Dba2CodexC.Domain.Context.t ->
int ->
int ->
Dba2CState.State.t ->
Dba2CState.State.t
Return the same state but as if it was on a different CPU, i.e. with that CPU's stack pointer and the MPIDR register set accordingly.
and new
must be between 0 and 3 included.
module ReadMem :
Heap_typing.MEMORY
with type t = Dba2CodexC.Domain.Context.t * Dba2CState.State.t
module Heap_typechecker : sig ... end
val forget_memory_contents :
'a Binsec.Virtual_address.Htbl.t ->
Dba2CState.State.t ->
Dba2CState.State.t
val blur_stack :
Binsec.Loader.Img.t ->
Dba2CState.State.t ->
Dba2CState.State.t
val add_stack_arg :
int ->
Types.Ctypes.typ ->
Dba2CState.State.t ->
Dba2CState.State.t
val add_stack_arg_value :
int ->
Dba2CodexC.Domain.binary ->
Dba2CState.State.t ->
Dba2CState.State.t
val populate_stack_with_args :
Types.Ctypes.typ list ->
Dba2CState.State.t ->
Dba2CState.State.t
val populate_globals_with_types :
(Z.t * Types.Ctypes.typ) list ->
Dba2CState.State.t ->
Dba2CState.State.t
val populate_globals_with_symbols :
(string * Ctypes.typ) list ->
Dba2CodexC.Domain.Context.t ->
unit
val populate_hook :
(Binsec.Virtual_address.t
* [> `nop
| `return_unknown of Types.Ctypes.typ
| `skip_to of Binsec.Virtual_address.t
| `stop ])
list ->
unit
val get_args : string -> Ctypes.typ list