New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Final 1.3 update #688
Final 1.3 update #688
Commits on Jul 5, 2017
-
makes main state global and few bug fixes
The main change is that now there is only one main state in the machine (aka project), not a separate copy per machine. This commit also fixes leave-{blk,sub} events and adds several new observations, such as exn-raised, that occurs every time a machine switches to an exceptional control flow. The commit also adds few common method to the monad interface.
Commits on Jul 7, 2017
-
Now it is possible to attach arbitrary values to a bitvector.
-
Commits on Aug 3, 2017
Commits on Aug 4, 2017
-
This bug leads to a type error, as a result of a byte load and a half word load is stored in a 32 bit variable.
-
-
fixes a bug in type checker and exp normalizer
a type checker didn't held correctly shifts and the normalizer didn't properly recurse
-
allow a backend to choose whether to propagate consts or not.
-
BIR becomes unreadable. We will apply normalization when needed. Later, we may add a memoization or stuff like that.
Commits on Aug 7, 2017
-
this enables better diagnostics of compilation and configuration errors on travis.
-
adds primus mark visted plugin
the plugin will mark all terms that were visited by Primus with the visited attribute.
-
a precedence sensitive exp pretty printer
Should do this long ago, but finally found some time. No more unnecessary parentheses! Note: operator precedences follow the C language, not OCaml. +-------------------------------------------+----+ | x[y], <cast>:<N>[x], extract:<N>:<M>[x] | 10 | +-------------------------------------------+----+ | ~x, -x | 9 | +-------------------------------------------+----+ | *,/,/$, %, %$ | 8 | +-------------------------------------------+----+ | +,- | 7 | +-------------------------------------------+----+ | <<,>>,~>> | 6 | +-------------------------------------------+----+ | <,>,<=,>= | 5 | +-------------------------------------------+----+ | =, <> | 4 | +-------------------------------------------+----+ | & | 3 | +-------------------------------------------+----+ | ^ | 2 | +-------------------------------------------+----+ | | | 1 | +-------------------------------------------+----+ | let.., x with y <- z, if.., . (dot) | 0 | +-------------------------------------------+----+ 1) Higher precedence means that operators binds tighter. 2) Any bil statement has precedence lower than an expression.
-
fixes simplifier, adds cast simplification
1. at some branches the simplified didn't recurce 2. if a cast casts to the same type it is removed
-
-
-
-
adds ssa and dead-code-elimination plugins
The ssa just translates a program into the SSA form The dead-code-elimination is a conservative deadcode elimination plugin, that helps alot with x86 binaries by removing tons of unused flags calcualations.
Commits on Aug 8, 2017
-
makes string_of_value more consistent
The string_of_value function now emits the `0x` prefix for hexnumbers, unless instructed explicitly with the `prefix:false` flag. The reason for this change is to enable a consitent handling of signed and unsinged, negative and positive values.
-
publishes Exp.substitute function
long time ago we forgot to make it public.
-
enhances dead-code elimination plugin
1. Now it will run until a fix point is reached 2. A simple constant propagation is added, so that more virtuals are removed
-
renames mem32 and mem64 in x86 lifter to mem
there is no need to have two different names for memory.
-
fixes and enhances lifted representation of shifts
1. The original implementation emited the following code ``` flag := flag ``` to denote an unchanged flag. The code was problematic for both static and dynamic analysis. Static analysis treated this as a used before defined variable and treated flag as a free variable in the eclosing definition. The dynamic analysis treated `flag` as an undefined variable with all the consequences. The new implementation uses the `if` statement and changes flag only if it is necessary. Moreover, instead of using multiple if/then/else expressions, all assignment are gathered under one big if statement, that leads to a more simple CFG representation. 2. The original implementation emited a temporary variable that holds a number of bits to which the destination should be shifted. There is no need for such variable (it is never changed). Moreover, the value of this variable is usually (if not always) a constant, so it is better to inline it directly in expressions. It looks like that this is the case of a common error - delegating OCaml computation to BIL. In our case this problem is solved by constant propagation.
Commits on Aug 9, 2017
-
applies simplification to assoc operations
If in operator is associative and expression is left recursive, then recurse to the right in hope to meet constants there. In particular, this will simplify `x + 1 + 1 + 1` to `x + 3`.
-
few optimizations and refactoring in old tainter
1. do not store values with just empty sets of values 2. special handling for the one byte storage 3. remove a key from the taint set if it is set to empty
-
-
-
-
calls exit if bap is interupted by Ctrl-C
so that profiler will work, as well as other at exit handlers.
Commits on Aug 10, 2017
-
implements new Bitvector pretty printer
and rolls back the [Word.string_of_value] behavior. The pretty printing function was totally rewritten from scratch, as Z.format and other Z printing functions are broken. Now we have a generic printer that suits all tastes, as well as 9 preinstantiated pretty printers. We also changed the bitvector default string representation. The new representation doesn't used [true] or [false] for the [1] and [0] (this is binary analysis anyway), and doesn't loose the signedness information.
Commits on Aug 11, 2017
Commits on Aug 16, 2017
-
Updated bap.mli with a documentation for new functions. Also, renamed Image.Scheme.reference to Image.Scheme.relocation.
-
-
-
automates documentation generation
Now it is enough just to type `make doc` and everything will work out of box, if a correct version of OCaml is used, i.e., 4.03. The Makefile recipe will pull the latest version of argot (git is required) and use it to build the documentation. BAP should be installed either from the source tree, or from opam, doesn't matter.
Commits on Aug 17, 2017
Commits on Aug 18, 2017
Commits on Aug 21, 2017
Commits on Aug 22, 2017
-
cleans and documents the monads library
I've removed few unnecessary funciton, e.g., `State.modify` and also fixed the type of the call/cc function.
-
-
also fixes few bugs that were found as a result 1) a zero width word was created (should be a one bit width) 2) a bug in the typechecker that led to a stackoverflow So far no more type errors
-
-
-
Commits on Aug 23, 2017
-
gone crazy and rewrote the taint propagation plugin
because my last update to primus broke it(((
-
Commits on Aug 24, 2017
-
dispatches linker unresolved calls to a lisp stub
The __primus_linker_unresolved_call function is called in case if a linker can resolved a call. Also adds the `pc` method to the interpreter interface and publish it as a primitive `get-current-program-counter`.
-
fixes a bug in random number generation
not actually in the random number generator, but rather in a casting it to a word.
-
don't fail the whole program on a division by zero
just fail the machine.
-
enhances the run plugin with the multi-entry mode
Now we can specify a list of entry points, or a magic `all-subroutines` to start execution in parallel from all specified entry points. If no specified, then all subroutine terms marked with the `entry_point` attribute are entered.
-
-
adds a Primus component that ensures termination
The primus-limit plugin will terminate a machine after a certain amount of computations has happened.