e024646860
This commit updates macaw-refinement to work with the latest macaw/crucible and makes a few improvements along the way. The major changes involved in this are: * Block labels were removed from macaw, so we had to come up with an alternative approach to making synthetic blocks to represent dispatch resolved by macaw-refinement that is not really a jump table. We considered adding a new terminator that encoded "computed IP-based dispatch", but there was concern about the impact on client code. Instead, we added a field to the `DiscoveryFunInfo` that records "external" resolutions to indirect control flow (e.g., as by an SMT solver in macaw-refinement). The hook by which we feed SMT-based resolutions back into macaw was modified accordingly (`addDiscoveredFunctionBlockTargets`). * Solver invocation changed to allow solver selection and parallel solver application. * Logging is now done via the `lumberjack` library. * macaw-symbolic now uses the "external" resolutions in `DiscoveryFunInfo` while building crucible CFGs. * The path creation code in macaw-refinement was simplified significantly and the approach to path creation has been documented. * The run-refinement tool is now more featureful. * The test suite is a bit more structured and no longer depends on the printed output of the discovery process. |
||
|---|---|---|
| .. | ||
| examples | ||
| src/Data/Macaw | ||
| test | ||
| LICENSE | ||
| macaw-symbolic.cabal | ||
| README.org | ||
Overview
The macaw-symbolic library provides a mechanism for translating machine code functions discovered by macaw into Crucible CFGs that can then be symbolically simulated.
The core macaw-symbolic library supports translating generic macaw into crucible, but is not a standalone library. To translate actual machine code, an architecture-specific backend is required. For example, macaw-x86-symbolic can be used to translate x86_64 binaries into crucible. Examples for using macaw-symbolic (and architecture-specific backends) are available in Data.Macaw.Symbolic.
In order to avoid API bloat, the definitions required to implement a new architecture-specific backend are exported through the Data.Macaw.Symbolic.Backend module.
An additional module, Data.Macaw.Symbolic.Memory, provides an example of how to handle memory address translation in the simulator for machine code programs. There are other possible ways to translate memory addresses, but this module provides a versatile example that can serve many common use cases.