Module Analyze.Create

Parameters

Signature

module Dba2CodexC : sig ... end
val initialize_codex : unit -> unit
val results_tbl : (string, string) Stdlib.Hashtbl.t
module Arch : sig ... end
module Dba2CState : sig ... end
module Record_cfg : sig ... end
module type SETTINGS = Analysis_settings.S with module Record_cfg = Record_cfg with module State := Dba2CState.State
val type_of_name : string -> Ctypes.typ
val m_settings : (module SETTINGS)
module Cfg = Cfg_analysis.Cfg
module Dhunk_regex = Dhunk_analysis.Dhunk_regex
val exploration_result : Dba2CState.State.t option Stdlib.ref

Utility functions. *

val unoption : 'a option -> 'b
val find_opt : (unit -> 'a) -> 'b option
module Dhunk_regex_hash : sig ... end
module Dhunk_regex_tbl : sig ... end
val do_regex : Binsec.Dhunk.t -> Dba2CState.State.t Dhunk_regex_tbl.t -> Dhunk_regex_tbl.key -> Dba2CState.State.t option
val filter_map : ('a -> 'b option) -> 'c list -> 'd list
val transfer_dhunk : Binsec.Dhunk.t -> Dba2CState.State.t -> (Binsec.Virtual_address.t * Dba2CState.State.t) list
val instr_cache : Binsec.Instruction.t Binsec_codex_lib.Analysis_settings.Addr_tbl.t
val decode_instr : Binsec_codex_lib.Analysis_settings.Addr_tbl.key -> Binsec.Instruction.t
module Addr_map : sig ... end
val transfer_instruction_nostub : Binsec_codex_lib.Analysis_settings.Addr_tbl.key -> Dba2CState.State.t -> Dba2CState.State.t Addr_map.t
val transfer_instruction : Binsec_codex_lib.Analysis_settings.Addr_tbl.key -> Settings.Record_cfg.t -> Dba2CState.State.t -> Settings.Record_cfg.t * Dba2CState.State.t Addr_map.t
val transfer_from_to_generic : transfer_instruction: ('a -> 'b -> 'c -> Settings.Record_cfg.t * 'd Addr_map.t) -> self: (stop_pred:'e -> Addr_map.key -> Settings.Record_cfg.t -> 'f -> Settings.Record_cfg.t * Dba2CState.State.t Addr_map.t) -> stop_pred:'g -> 'h -> 'i -> 'j -> Settings.Record_cfg.t * Dba2CState.State.t Addr_map.t
val transfer_from_to : Binsec_codex_lib.Analysis_settings.Addr_tbl.key -> stop_pred: (Binsec.Virtual_address.t -> Settings.Record_cfg.context_change -> bool) -> Settings.Record_cfg.t -> Dba2CState.State.t -> Settings.Record_cfg.t * Dba2CState.State.t Addr_map.t
val analyze_block : Dba2CState.State.t -> Settings.Record_cfg.t -> Binsec.Dhunk.t -> unit
val previous_func : string Stdlib.ref
val analyze_address_nocheck : Dba2CState.State.t -> Settings.Record_cfg.t -> Binsec.Virtual_address.t -> unit

Like analyze_address but does not call next on the first, and thus will not stop if address was already visited.

val analyze_address : Dba2CState.State.t -> Settings.Record_cfg.t -> Binsec.Virtual_address.t -> unit
val analyze_address' : Dba2CState.State.t -> Settings.Record_cfg.t -> Binsec.Virtual_address.t -> unit
val destination : ('a * 'b) Fixpoint.Regex.tagged_regex -> 'c
module Regex_tbl_0 : sig ... end
module Regex_tbl : sig ... end
val handle_successors : (Binsec.Virtual_address.t * Dba2CState.State.t) list -> Dba2CState.State.t Regex_tbl.t -> Dba2CState.State.t -> Settings.Record_cfg.t -> Cfg_analysis.CfgRegex.t -> Cfg_analysis.Cfg.V.t -> unit

Analyze a set of paths in the CFG (described by a regex) to possibly discover new edges. When that happens, the new path set is explored immediately, enriching the instruction graph by a depth-first search without merge (analyze_address). If that happens, it means that the fixpoint was not reached, and analyze_regex returns false. Otherwise, if no new instruction is discovered, a fixpoint was reached and analyze_regex returns true. Please note: The instruction at the end of the path is not analyzed by this function.

  • parameter state_table

    A table associating a path expression of an instruction to the entry state of that expression. When analyzing a regex, all intermediary regexes (i.e. expressions of subpaths) are updated in this table.

val find_end_nodes : Cfg.t -> Cfg.vertex -> Cfg.vertex list
val catch_exc : string -> (unit -> 'a) -> (unit -> 'b) -> 'c
module Wto_cfg = Cfg_analysis.Wto
module Reduce_cfg = Cfg_analysis.Reduce
module G' : sig ... end
module OutputCfg : sig ... end
val analyze : Binsec.Loader.Img.t -> int -> Dba2CState.State.t -> string -> Binsec_codex_lib.Analysis_settings.Addr_tbl.key option -> string option -> (string, string) Stdlib.Hashtbl.t -> (Binsec.Virtual_address.Set.t * Binsec.Virtual_address.Set.t) * Dba2CState.State.t option * Binsec.Virtual_address.Set.t
val interprete_concrete : Binsec.Loader.Img.t -> int -> Dba2CState.State.t -> string -> string option -> (string, string) Stdlib.Hashtbl.t -> (Binsec.Virtual_address.Set.t * Binsec.Virtual_address.Set.t) * Dba2CState.State.t option * Binsec.Virtual_address.Set.t
val list_init : int -> (int -> 'a) -> 'b list
val cpu_sp : Binsec.Virtual_address.t Stdlib.ref list

Return the same state but as if it was on a different CPU, i.e. with that CPU's stack pointer and the MPIDR register set accordingly.

    and new must be between 0 and 3 included.

    module Heap_typechecker : sig ... end
    val forget_memory_contents : 'a Binsec.Virtual_address.Htbl.t -> Dba2CState.State.t -> Dba2CState.State.t
    val blur_stack : Binsec.Loader.Img.t -> Dba2CState.State.t -> Dba2CState.State.t
    val add_stack_arg : int -> Types.Ctypes.typ -> Dba2CState.State.t -> Dba2CState.State.t
    val add_stack_arg_value : int -> Dba2CodexC.Domain.binary -> Dba2CState.State.t -> Dba2CState.State.t
    val populate_stack_with_args : Types.Ctypes.typ list -> Dba2CState.State.t -> Dba2CState.State.t
    val populate_globals_with_types : (Z.t * Types.Ctypes.typ) list -> Dba2CState.State.t -> Dba2CState.State.t
    val populate_globals_with_symbols : (string * Ctypes.typ) list -> Dba2CodexC.Domain.Context.t -> unit
    val populate_hook : (Binsec.Virtual_address.t * [> `nop | `return_unknown of Types.Ctypes.typ | `skip_to of Binsec.Virtual_address.t | `stop ]) list -> unit
    val get_args : string -> Ctypes.typ list
    val explore_function : string -> msg:string -> unit