docs/beta/notebooks/GrammarMiner.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {
    "button": false,
    "new_sheet": false,
    "run_control": {
     "read_only": false
    },
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# Mining Input Grammars\n",
    "\n",
    "So far, the grammars we have seen have been mostly specified manually – that is, you (or the person knowing the input format) had to design and write a grammar in the first place.  While the grammars we have seen so far have been rather simple, creating a grammar for complex inputs can involve quite some effort.  In this chapter, we therefore introduce techniques that _automatically mine grammars from programs_ – by executing the programs and observing how they process which parts of the input.  In conjunction with a grammar fuzzer, this allows us to \n",
    "1. take a program, \n",
    "2. extract its input grammar, and \n",
    "3. fuzz it with high efficiency and effectiveness, using the concepts in this book."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "button": false,
    "new_sheet": false,
    "run_control": {
     "read_only": false
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "**Prerequisites**\n",
    "\n",
    "* You should have read the [chapter on grammars](Grammars.ipynb).\n",
    "* The [chapter on configuration fuzzing](ConfigurationFuzzer.ipynb) introduces grammar mining for configuration options, as well as observing variables and values during execution.\n",
    "* We use the tracer from the [chapter on coverage](Coverage.ipynb).\n",
    "* The concept of parsing from the [chapter on parsers](Parser.ipynb) is also useful."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## A Grammar Challenge\n",
    "\n",
    "Consider the `process_inventory()`  method from the [chapter on parsers](Parser.ipynb):"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "import fuzzingbook_utils"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from Parser import process_inventory, process_vehicle, process_car, process_van, lr_graph  # minor dependency"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "It takes inputs of the following form."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "INVENTORY = \"\"\"\\\n",
    "1997,van,Ford,E350\n",
    "2000,car,Mercury,Cougar\n",
    "1999,car,Chevy,Venture\\\n",
    "\"\"\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "print(process_inventory(INVENTORY))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We found from the [chapter on parsers](Parser.ipynb) that coarse grammars do not work well for fuzzing when the input format includes details expressed only in code. That is, even though we have the formal specification of CSV files ([RFC 4180](https://tools.ietf.org/html/rfc4180)), the inventory system includes further rules as to what is expected at each index of the CSV file. The solution of simply recombining existing inputs, while practical, is incomplete. In particular, it relies on a formal input specification being available in the first place. However, we have no assurance that the program obeys the input specification given."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "One of the ways out of this predicament is to interrogate the program under test as to what its input specification is. That is, if the program under test is written in a style such that specific methods are responsible for handling specific parts of the input, one can recover the parse tree by observing the process of parsing. Further, one can recover a reasonable approximation of the grammar by abstraction from multiple input trees."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    " _We start with the assumption (1) that the program is written in such a fashion that specific methods are responsible for parsing specific fragments of the program -- This includes almost all ad hoc parsers._\n",
    "\n",
    "The idea is as follows:\n",
    "\n",
    "* Hook into the Python execution and observe the fragments of input string as they are produced and named in different methods.\n",
    "* Stitch the input fragments together in a tree structure to retrieve the **Parse Tree**.\n",
    "* Abstract common elements from multiple parse trees to produce the **Context Free Grammar** of the input."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "button": false,
    "new_sheet": true,
    "run_control": {
     "read_only": false
    },
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## A Simple Grammar Miner"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Say we want to obtain the input grammar for the function `process_vehicle()`. We first collect the sample inputs for this function."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "VEHICLES = INVENTORY.split('\\n')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The set of methods responsible for processing inventory are the following."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "INVENTORY_METHODS = {\n",
    "    'process_inventory',\n",
    "    'process_vehicle',\n",
    "    'process_van',\n",
    "    'process_car'}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We have seen from the chapter on [configuration fuzzing](ConfigurationFuzzer.ipynb) that one can hook into the Python runtime to observe the arguments to a function and any local variables created. We have also seen that one can obtain the context of execution by inspecting the `frame` argument. Here is a simple tracer that can return the local variables and other contextual information in a traced function. We reuse the `Coverage` tracing class."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    },
    "toc-hr-collapsed": false
   },
   "source": [
    "### Tracer"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from Coverage import Coverage"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "import inspect"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class Tracer(Coverage):\n",
    "    def traceit(self, frame, event, arg):\n",
    "        method_name = inspect.getframeinfo(frame).function\n",
    "        if method_name not in INVENTORY_METHODS:\n",
    "            return\n",
    "        file_name = inspect.getframeinfo(frame).filename\n",
    "\n",
    "        param_names = inspect.getargvalues(frame).args\n",
    "        lineno = inspect.getframeinfo(frame).lineno\n",
    "        local_vars = inspect.getargvalues(frame).locals\n",
    "        print(event, file_name, lineno, method_name, param_names, local_vars)\n",
    "        return self.traceit"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We run the code under trace context."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "with Tracer() as tracer:\n",
    "    process_vehicle(VEHICLES[0])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The main thing that we want out of tracing is a list of assignments of input fragments to different variables. We can use the tracing facility `settrace()` to get that as we showed above.\n",
    "\n",
    "However, the `settrace()` function hooks into the Python debugging facility. When it is in operation, no debugger can hook into the program. That is, if there is a problem with our grammar miner, we will not be able to attach a debugger to it to understand what is happening. This is not ideal. Hence, we limit the tracer to the simplest implementation possible, and implement the core of grammar mining in later stages."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `traceit()` function relies on information from the `frame` variable which exposes Python internals. We define a `context` class that encapsulates the information that we need from the `frame`."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Context\n",
    "\n",
    "The `Context` class provides easy access to the information such as the current module, and parameter names."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class Context:\n",
    "    def __init__(self, frame, track_caller=True):\n",
    "        self.method = inspect.getframeinfo(frame).function\n",
    "        self.parameter_names = inspect.getargvalues(frame).args\n",
    "        self.file_name = inspect.getframeinfo(frame).filename\n",
    "        self.line_no = inspect.getframeinfo(frame).lineno\n",
    "\n",
    "    def _t(self):\n",
    "        return (self.file_name, self.line_no, self.method,\n",
    "                ','.join(self.parameter_names))\n",
    "\n",
    "    def __repr__(self):\n",
    "        return \"%s:%d:%s(%s)\" % self._t()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Here are a few convenience method that operate on the `frame` to `Context`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class Context(Context):\n",
    "    def extract_vars(self, frame):\n",
    "        return inspect.getargvalues(frame).locals\n",
    "\n",
    "    def parameters(self, all_vars):\n",
    "        return {k: v for k, v in all_vars.items() if k in self.parameter_names}\n",
    "\n",
    "    def qualified(self, all_vars):\n",
    "        return {\"%s:%s\" % (self.method, k): v for k, v in all_vars.items()}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We hook printing the context to our `traceit()` to see it in action. First we define an `log_event()` for displaying events."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def log_event(event, var):\n",
    "    print({'call': '->', 'return': '<-'}.get(event, '  '), var)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "And use the `log_event()` in the `traceit()` function."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class Tracer(Tracer):\n",
    "    def traceit(self, frame, event, arg):\n",
    "        log_event(event, Context(frame))\n",
    "        return self.traceit"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Running `process_vehicle()` under trace prints the contexts encountered."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "with Tracer() as tracer:\n",
    "    process_vehicle(VEHICLES[0])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The trace produced by executing any function can get overwhelmingly large. Hence, we need restrict our attention to specific modules. Further, we also restrict our attention exclusively to `str` variables since these variables are more likely to contain input fragments. (We will show how to deal with complex objects later in exercises.)\n",
    "\n",
    "The `Context` class we developed earlier is used to decide which modules to monitor, and which variables to trace.\n",
    "\n",
    "We store the current *input string* so that it can be used to determine if any particular string fragments came from the current input string. Any optional arguments are processed separately."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class Tracer(Tracer):\n",
    "    def __init__(self, my_input, **kwargs):\n",
    "        self.options(kwargs)\n",
    "        self.my_input, self.trace = my_input, []"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We use an optional argument `files` to indicate the specific source files we are interested in, and `methods` to indicate which specific methods that are of interest. Further, we also use `log` to specify whether verbose logging should be enabled during trace. We use the `log_event()` method we defined earlier for logging."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The options processing is as below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class Tracer(Tracer):\n",
    "    def options(self, kwargs):\n",
    "        self.files = kwargs.get('files', [])\n",
    "        self.methods = kwargs.get('methods', [])\n",
    "        self.log = log_event if kwargs.get('log') else lambda _evt, _var: None"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The `files` and `methods` are checked to determine if a particular event should be traced or not"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class Tracer(Tracer):\n",
    "    def tracing_context(self, cxt, event, arg):\n",
    "        fres = not self.files or any(\n",
    "            cxt.file_name.endswith(f) for f in self.files)\n",
    "        mres = not self.methods or any(cxt.method == m for m in self.methods)\n",
    "        return fres and mres"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Similar to the context of events, we also want to restrict our attention to specific variables. For now, we want to focus only on strings. (See the Exercises at the end of the chapter on how to extend it to other kinds of objects)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class Tracer(Tracer):\n",
    "    def tracing_var(self, k, v):\n",
    "        return isinstance(v, str)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We modify the `traceit()` to call an `on_event()` function with the context information only on the specific events we are interested in."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class Tracer(Tracer):\n",
    "    def on_event(self, event, arg, cxt, my_vars):\n",
    "        self.trace.append((event, arg, cxt, my_vars))\n",
    "\n",
    "    def traceit(self, frame, event, arg):\n",
    "        cxt = Context(frame)\n",
    "        if not self.tracing_context(cxt, event, arg):\n",
    "            return self.traceit\n",
    "        self.log(event, cxt)\n",
    "\n",
    "        my_vars = {\n",
    "            k: v\n",
    "            for k, v in cxt.extract_vars(frame).items()\n",
    "            if self.tracing_var(k, v)\n",
    "        }\n",
    "        self.on_event(event, arg, cxt, my_vars)\n",
    "        return self.traceit"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The `Tracer` class can now focus on specific kinds of events on specific files. Further, it provides a first level filter for variables that we find interesting. For example, we want to focus specifically on variables from `process_*` methods that contain input fragments. Here is how our updated `Tracer` can be used"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "with Tracer(VEHICLES[0], methods=INVENTORY_METHODS, log=True) as tracer:\n",
    "    process_vehicle(VEHICLES[0])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The execution produced the following trace."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "for t in tracer.trace:\n",
    "    print(t[0], t[2].method, dict(t[3]))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Since we are saving the input already in Tracer, it is redundant to specify it separately again as an argument."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "with Tracer(VEHICLES[0], methods=INVENTORY_METHODS, log=True) as tracer:\n",
    "    process_vehicle(tracer.my_input)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### DefineTracker"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We define a `DefineTracker` class that processes the trace from the `Tracer`. The idea is to store different variable definitions which are input fragments.\n",
    "\n",
    "The tracker identifies string fragments that are part of the input string, and stores them in a dictionary `my_assignments`. It saves the trace, and the corresponding input for processing. Finally it calls `process()` to process the `trace` it was given. We will start with a simple tracker that relies on certain assumptions, and later see how these assumptions can be relaxed."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class DefineTracker:\n",
    "    def __init__(self, my_input, trace, **kwargs):\n",
    "        self.options(kwargs)\n",
    "        self.my_input = my_input\n",
    "        self.trace = trace\n",
    "        self.my_assignments = {}\n",
    "        self.process()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "One of the problems of using substring search is that short string sequences tend to be included in other string sequences even though they may not have come from the original string. That is, say the input fragment is `v`. It could have equally come from either `van` or `chevy`. We rely on being able to predict the exact place input where a given fragment occurred. Hence, we define a constant `FRAGMENT_LEN` such that we ignore strings up to that length. We also incorporate a logging facility as before."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "FRAGMENT_LEN = 3"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class DefineTracker(DefineTracker):\n",
    "    def options(self, kwargs):\n",
    "        self.log = log_event if kwargs.get('log') else lambda _evt, _var: None\n",
    "        self.fragment_len = kwargs.get('fragment_len', FRAGMENT_LEN)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Our tracer simply records the variable values as they occur. We next need to check if the variables contain values from the **input string**. Common ways to do this is to rely on symbolic execution or at least dynamic tainting, which are powerful, but also complex. However, one can obtain a reasonable approximation by simply relying on substring search. That is, we consider any value produced that is a substring of the original input string to have come from the original input."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We define `is_input_fragment()` method that relies on string inclusion to detect if the string came from the input."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class DefineTracker(DefineTracker):\n",
    "    def is_input_fragment(self, var, value):\n",
    "        return len(value) >= self.fragment_len and value in self.my_input"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can use `is_input_fragment()` to select only a subset of variables defined, as implemented below in `fragments()`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class DefineTracker(DefineTracker):\n",
    "    def fragments(self, variables):\n",
    "        return {k: v for k, v in variables.items(\n",
    "        ) if self.is_input_fragment(k, v)}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The tracker processes each event, and at each event, it updates the dictionary `my_assignments` with the current local variables that contain strings that are part of the input. Note that there is a choice here with respect to what happens during reassignment. We can either discard all the reassignments, or keep only the last assignment. Here, we choose the later. If you want the former behavior, check whether the value exists in `my_assignments` before storing a fragment."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class DefineTracker(DefineTracker):\n",
    "    def track_event(self, event, arg, cxt, my_vars):\n",
    "        self.log(event, (cxt.method, my_vars))\n",
    "        self.my_assignments.update(self.fragments(my_vars))\n",
    "\n",
    "    def process(self):\n",
    "        for event, arg, cxt, my_vars in self.trace:\n",
    "            self.track_event(event, arg, cxt, my_vars)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Using the tracker, we can obtain the input fragments. For example, say we are only interested in strings that are at least `5` characters long."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "tracker = DefineTracker(tracer.my_input, tracer.trace, fragment_len=5)\n",
    "for k, v in tracker.my_assignments.items():\n",
    "    print(k, '=', repr(v))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Or strings that are `2` characters long (the default)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "tracker = DefineTracker(tracer.my_input, tracer.trace)\n",
    "for k, v in tracker.my_assignments.items():\n",
    "    print(k, '=', repr(v))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class DefineTracker(DefineTracker):\n",
    "    def assignments(self):\n",
    "        return self.my_assignments.items()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Assembling a Derivation Tree"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from Grammars import START_SYMBOL, syntax_diagram, is_nonterminal"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from GrammarFuzzer import GrammarFuzzer, FasterGrammarFuzzer, display_tree, tree_to_string"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The input fragments from the `DefineTracker` only tell half the story. The fragments may be created at different stages of parsing. Hence, we need to assemble the fragments to a  derivation tree of the input. The basic idea is as follows:\n",
    "\n",
    "Our input from the previous step was:\n",
    "\n",
    "```python\n",
    "\"1997,van,Ford,E350\"\n",
    "```\n",
    "\n",
    "We start a derivation tree, and associate it with the start symbol in the grammar."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "derivation_tree = (START_SYMBOL, [(\"1997,van,Ford,E350\", [])])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "display_tree(derivation_tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The next input was:\n",
    "```python\n",
    "vehicle = \"1997,van,Ford,E350\"\n",
    "```\n",
    "Since vehicle covers the `<start>` node's value completely, we replace the value with the vehicle node."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "derivation_tree = (START_SYMBOL, [('<vehicle>', [(\"1997,van,Ford,E350\", [])],\n",
    "                                   [])])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "display_tree(derivation_tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The next input was:\n",
    "```python\n",
    "model = 'E350'\n",
    "```\n",
    "Traversing the derivation tree from `<start>`, we see that it replaces a portion of the `<vehicle>` node's value. Hence we split the `<vehicle>` node's value to two children, where one corresponds to the value `\"1997\"` and the other to `\",van,Ford,E350\"`, and replace the first one with the node `<model>`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "derivation_tree = (START_SYMBOL, [('<vehicle>', [('<model>', [('1997', [])]),\n",
    "                                                 (\",van,Ford,E350\", [])], [])])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "display_tree(derivation_tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We perform similar operations for \n",
    "```python\n",
    "company = 'Ford'\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "derivation_tree = (START_SYMBOL, [('<vehicle>', [('<model>', [('1997', [])]),\n",
    "                                                 (\",van,\", []),\n",
    "                                                 ('<company>', [('Ford', [])]),\n",
    "                                                 (\",E350\", [])], [])])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "display_tree(derivation_tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Similarly for\n",
    "```python\n",
    "kind = 'van'\n",
    "```\n",
    "and\n",
    "```python\n",
    "model = 'E350'\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "derivation_tree = (START_SYMBOL, [('<vehicle>', [('<model>', [('1997', [])]),\n",
    "                                                 (\",\", []),\n",
    "                                                 (\"<kind>\", [('van', [])]),\n",
    "                                                 (\",\", []),\n",
    "                                                 ('<company>', [('Ford', [])]),\n",
    "                                                 (\",\", []),\n",
    "                                                 (\"<model>\", [('E350', [])])\n",
    "                                                 ], [])])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "display_tree(derivation_tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We now develop the complete algorithm with the above described steps.\n",
    "The derivation tree `TreeMiner` is initialized with the input string, and the variable assignments, and it converts the assignments to the corresponding derivation tree."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class TreeMiner:\n",
    "    def __init__(self, my_input, my_assignments, **kwargs):\n",
    "        self.options(kwargs)\n",
    "        self.my_input = my_input\n",
    "        self.my_assignments = my_assignments\n",
    "        self.tree = self.get_derivation_tree()\n",
    "\n",
    "    def options(self, kwargs):\n",
    "        self.log = log_call if kwargs.get('log') else lambda _i, _v: None\n",
    "\n",
    "    def get_derivation_tree(self):\n",
    "        return (START_SYMBOL, [])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "the `log_call()` is as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def log_call(indent, var):\n",
    "    print('\\t' * indent, var)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The basic idea is as follows:\n",
    "* **For now, we assume that the value assigned to a variable is stable. That is, it is never reassigned. In particular, there are no recursive calls, or multiple calls to the same function from different parts.** (We will show how to overcome this limitation later).\n",
    "* For each pair _var_, _value_ found in `my_assignments`:\n",
    "    1. We search for occurrences of _value_ `val` in the derivation tree recursively.\n",
    "    2. If an occurrence was found as a value `V1` of a node `P1`, we partition the value of the node `P1` into three parts, with the central part matching the _value_ `val`, and the first and last part, the corresponding prefix and suffix in `V1`.\n",
    "    3. Reconstitute the node `P1` with three children, where prefix and suffix mentioned earlier are string values, and the matching value `val` is replaced by a node `var` with a single value `val`."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "First, we define a wrapper to generate a nonterminal from a variable name."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def to_nonterminal(var):\n",
    "    return \"<\" + var.lower() + \">\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `insert_into_tree` method accepts a given tree `tree` and a `(k,v)` pair.  It recursively checks whether the given pair can be applied. If the pair can be applied, it applies the pair and returns `True`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class TreeMiner(TreeMiner):\n",
    "    def insert_into_tree(self, my_tree, pair):\n",
    "        var, values = my_tree\n",
    "        k, v = pair\n",
    "        self.log(1, \"- Node: %s\\t\\t? (%s:%s)\" % (var, k, repr(v)))\n",
    "        applied = False\n",
    "        for i, value_ in enumerate(values):\n",
    "            value, arr = value_\n",
    "            self.log(2, \"-> [%d] %s\" % (i, repr(value)))\n",
    "            if is_nonterminal(value):\n",
    "                applied = self.insert_into_tree(value_, pair)\n",
    "                if applied:\n",
    "                    break\n",
    "            elif v in value:\n",
    "                prefix_k_suffix = [\n",
    "                    (k, [[v, []]]) if i == 1 else (e, [])\n",
    "                    for i, e in enumerate(value.partition(v))\n",
    "                    if e\n",
    "                ]\n",
    "                del values[i]\n",
    "                for j, rep in enumerate(prefix_k_suffix):\n",
    "                    values.insert(j + i, rep)\n",
    "                applied = True\n",
    "\n",
    "                self.log(2, \" > %s\" % (repr([i[0] for i in prefix_k_suffix])))\n",
    "                break\n",
    "            else:\n",
    "                continue\n",
    "        return applied"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Here is how `insert_into_tree()` is used."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "tree = (START_SYMBOL, [(\"1997,van,Ford,E350\", [])])\n",
    "m = TreeMiner('', {}, log=True)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "First, we have our input string as the only node."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "display_tree(tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Inserting the `<vehicle>` node."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "v = m.insert_into_tree(tree, ('<vehicle>', \"1997,van,Ford,E350\"))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "display_tree(tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Inserting `<model>` node."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "v = m.insert_into_tree(tree, ('<model>', 'E350'))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "display_tree((tree))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Inserting `<company>`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "v = m.insert_into_tree(tree, ('<company>', 'Ford'))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "display_tree(tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Inserting `<kind>`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "v = m.insert_into_tree(tree, ('<kind>', 'van'))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "display_tree(tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Inserting `<year>`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "v = m.insert_into_tree(tree, ('<year>', '1997'))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "display_tree(tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "To make life simple, we define a wrapper function `nt_var()` that will convert a token to its corresponding nonterminal symbol."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class TreeMiner(TreeMiner):\n",
    "    def nt_var(self, var):\n",
    "        return var if is_nonterminal(var) else to_nonterminal(var)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Now, we need to apply a new definition to an entire grammar."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class TreeMiner(TreeMiner):\n",
    "    def apply_new_definition(self, tree, var, value):\n",
    "        nt_var = self.nt_var(var)\n",
    "        return self.insert_into_tree(tree, (nt_var, value))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "This algorithm is implemented as `get_derivation_tree()`. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class TreeMiner(TreeMiner):\n",
    "    def get_derivation_tree(self):\n",
    "        tree = (START_SYMBOL, [(self.my_input, [])])\n",
    "\n",
    "        for var, value in self.my_assignments:\n",
    "            self.log(0, \"%s=%s\" % (var, repr(value)))\n",
    "            self.apply_new_definition(tree, var, value)\n",
    "        return tree"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `TreeMiner` is used as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "with Tracer(VEHICLES[0]) as tracer:\n",
    "    process_vehicle(tracer.my_input)\n",
    "assignments = DefineTracker(tracer.my_input, tracer.trace).assignments()\n",
    "dt = TreeMiner(tracer.my_input, assignments, log=True)\n",
    "dt.tree"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The obtained derivation tree is as below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "display_tree(TreeMiner(tracer.my_input, assignments).tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Combining all the pieces:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "trees = []\n",
    "for vehicle in VEHICLES:\n",
    "    print(vehicle)\n",
    "    with Tracer(vehicle) as tracer:\n",
    "        process_vehicle(tracer.my_input)\n",
    "    assignments = DefineTracker(tracer.my_input, tracer.trace).assignments()\n",
    "    trees.append((tracer.my_input, assignments))\n",
    "    for var, val in assignments:\n",
    "        print(var + \" = \" + repr(val))\n",
    "    print()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The corresponding derivation trees are below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "csv_dt = []\n",
    "for inputstr, assignments in trees:\n",
    "    print(inputstr)\n",
    "    dt = TreeMiner(inputstr, assignments)\n",
    "    csv_dt.append(dt)\n",
    "    display_tree(dt.tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Recovering Grammars from Derivation Trees\n",
    "\n",
    "We define a class `Miner` that can combine multiple derivation trees to produce the grammar. The initial grammar is empty."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class GrammarMiner:\n",
    "    def __init__(self):\n",
    "        self.grammar = {}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `tree_to_grammar()` method converts our derivation tree to a grammar by picking one node at a time, and adding it to a grammar. The node name becomes the key, and any list of children it has becomes another alternative for that key."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class GrammarMiner(GrammarMiner):\n",
    "    def tree_to_grammar(self, tree):\n",
    "        node, children = tree\n",
    "        one_alt = [ck for ck, gc in children]\n",
    "        hsh = {node: [one_alt] if one_alt else []}\n",
    "        for child in children:\n",
    "            if not is_nonterminal(child[0]):\n",
    "                continue\n",
    "            chsh = self.tree_to_grammar(child)\n",
    "            for k in chsh:\n",
    "                if k not in hsh:\n",
    "                    hsh[k] = chsh[k]\n",
    "                else:\n",
    "                    hsh[k].extend(chsh[k])\n",
    "        return hsh"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "gm = GrammarMiner()\n",
    "gm.tree_to_grammar(csv_dt[0].tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The grammar being generated here is `canonical`. We define a function `readable()` that takes in a canonical grammar and returns it in a readable form."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def readable(grammar):\n",
    "    def readable_rule(rule):\n",
    "        return ''.join(rule)\n",
    "\n",
    "    return {k: list(set(readable_rule(a) for a in grammar[k]))\n",
    "            for k in grammar}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "syntax_diagram(readable(gm.tree_to_grammar(csv_dt[0].tree)))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The `add_tree()` method gets a combined list of non-terminals from current grammar, and the tree to be added to the grammar, and updates the definitions of each non-terminal."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "import itertools"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class GrammarMiner(GrammarMiner):\n",
    "    def add_tree(self, t):\n",
    "        t_grammar = self.tree_to_grammar(t.tree)\n",
    "        self.grammar = {\n",
    "            key: self.grammar.get(key, []) + t_grammar.get(key, [])\n",
    "            for key in itertools.chain(self.grammar.keys(), t_grammar.keys())\n",
    "        }"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `add_tree()` is used as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "inventory_grammar = GrammarMiner()\n",
    "for dt in csv_dt:\n",
    "    inventory_grammar.add_tree(dt)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "syntax_diagram(readable(inventory_grammar.grammar))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Given execution traces from various inputs, one can define `update_grammar()` to obtain the complete grammar from the traces."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class GrammarMiner(GrammarMiner):\n",
    "    def update_grammar(self, inputstr, trace):\n",
    "        dt = TreeMiner(inputstr, DefineTracker(inputstr, trace).assignments())\n",
    "        self.add_tree(dt)\n",
    "        return self.grammar"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The complete grammar recovery is implemented in `recover_grammar()`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def recover_grammar(fn, inputs, **kwargs):\n",
    "    miner = GrammarMiner()\n",
    "    for inputstr in inputs:\n",
    "        with Tracer(inputstr, **kwargs) as tracer:\n",
    "            fn(tracer.my_input)\n",
    "        miner.update_grammar(tracer.my_input, tracer.trace)\n",
    "    return readable(miner.grammar)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Note that the grammar could have been retrieved directly from the tracker, without the intermediate derivation tree stage. However, going through the derivation tree allows one to inspect the inputs being fragmented and verify that it happens correctly."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "#### Example 1. Recovering the Inventory Grammar"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "inventory_grammar = recover_grammar(process_vehicle, VEHICLES)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "inventory_grammar"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "#### Example 2. Recovering URL Grammar"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Our algorithm is robust enough to recover grammar from real world programs. For example, the `urlparse` function in the Python `urlib` module accepts the following sample URLs."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "URLS = [\n",
    "    'http://user:pass@www.google.com:80/?q=path#ref',\n",
    "    'https://www.cispa.saarland:80/',\n",
    "    'http://www.fuzzingbook.org/#News',\n",
    "]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The urllib caches its intermediate results for faster access. Hence, we need to disable it using `clear_cache()` after every invocation."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from urllib.parse import urlparse, clear_cache"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We use the sample URLs to recover grammar as follows. The `urlparse` function tends to cache its previous parsing results. Hence, we define a new method `url_parse()` that clears the cache before each call."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def url_parse(url):\n",
    "    clear_cache()\n",
    "    urlparse(url)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "trees = []\n",
    "for url in URLS:\n",
    "    print(url)\n",
    "    with Tracer(url) as tracer:\n",
    "        url_parse(tracer.my_input)\n",
    "    assignments = DefineTracker(tracer.my_input, tracer.trace).assignments()\n",
    "    trees.append((tracer.my_input, assignments))\n",
    "    for var, val in assignments:\n",
    "        print(var + \" = \" + repr(val))\n",
    "    print()\n",
    "\n",
    "\n",
    "url_dt = []\n",
    "for inputstr, assignments in trees:\n",
    "    print(inputstr)\n",
    "    dt = TreeMiner(inputstr, assignments)\n",
    "    url_dt.append(dt)\n",
    "    display_tree(dt.tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Using `url_parse()` to recover grammar."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "url_grammar = recover_grammar(url_parse, URLS, files=['urllib/parse.py'])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "syntax_diagram(url_grammar)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The recovered grammar describes the URL format reasonably well."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Fuzzing"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can now use our recovered grammar for fuzzing as follows.\n",
    "\n",
    "First, the inventory grammar."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "f = GrammarFuzzer(inventory_grammar)\n",
    "for _ in range(10):\n",
    "    print(f.fuzz())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Next, the URL grammar."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "f = GrammarFuzzer(url_grammar)\n",
    "for _ in range(10):\n",
    "    print(f.fuzz())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "What this means is that we can now take a program and a few samples, extract its grammar, and then use this very grammar for fuzzing.  Now that's quite an opportunity!"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Problems with the Simple Miner"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "One of the problems with our simple grammar miner is the assumption that the values assigned to variables are stable. Unfortunately, that may not hold true in all cases. For example, here is a URL with a slightly different format."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "URLS_X = URLS + ['ftp://freebsd.org/releases/5.8']"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The grammar generated from this set of samples is not as nice as what we got earlier"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "url_grammar = recover_grammar(url_parse, URLS_X, files=['urllib/parse.py'])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "syntax_diagram(url_grammar)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Clearly, something has gone wrong.\n",
    "\n",
    "To investigate why the `url` definition has gone wrong, let us inspect the trace for the URL."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "clear_cache()\n",
    "with Tracer(URLS_X[0]) as tracer:\n",
    "    urlparse(tracer.my_input)\n",
    "for i, t in enumerate(tracer.trace):\n",
    "    if t[0] in {'call', 'line'} and 'parse.py' in str(t[2]) and t[3]:\n",
    "        print(i, t[2]._t()[1], t[3:])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Notice how the value of `url` changes as the parsing progresses? This violates our assumption that the value assigned to a variable is stable. We next look at how this limitation can be removed."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Grammar Miner with Reassignment"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "One way to uniquely identify different variables is to annotate them with *line numbers* both when they are defined and also when their value changes. Consider the code fragment below"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Tracking variable assignment locations"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def C(cp_1):\n",
    "    c_2 = cp_1 + '@2'\n",
    "    c_3 = c_2 + '@3'\n",
    "    return c_3\n",
    "\n",
    "\n",
    "def B(bp_7):\n",
    "    b_8 = bp_7 + '@8'\n",
    "    return C(b_8)\n",
    "\n",
    "\n",
    "def A(ap_12):\n",
    "    a_13 = ap_12 + '@13'\n",
    "    a_14 = B(a_13) + '@14'\n",
    "    a_14 = a_14 + '@15'\n",
    "    a_13 = a_14 + '@16'\n",
    "    a_14 = B(a_13) + '@17'\n",
    "    a_14 = B(a_13) + '@18'"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Notice how all variables are either named corresponding to either where they are defined, or the value is annotated to indicate that it was changed.\n",
    "\n",
    "Let us run this under the trace."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "with Tracer('____') as tracer:\n",
    "    A(tracer.my_input)\n",
    "\n",
    "for t in tracer.trace:\n",
    "    print(t[0], \"%d:%s\" % (t[2].line_no, t[2].method), t[3])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Each variables were referenced first as follows:\n",
    "\n",
    "* `cp_1` -- *call* `1:C`\n",
    "* `c_2` -- *line* `3:C` (but the previous event was *line* `2:C`)\n",
    "* `c_3` -- *line* `4:C` (but the previous event was *line* `3:C`)\n",
    "* `bp_7` -- *call* `7:B`\n",
    "* `b_8` -- *line* `9:B` (but the previous event was *line* `8:B`)\n",
    "* `ap_12` -- *call* `12:A`\n",
    "* `a_13` -- *line* `14:A` (but the previous event was *line* `13:A`)\n",
    "* `a_14` -- *line* `15:A` (the previous event was *return* `9:B`. However, the previous event in A was *line* `14:A`)\n",
    "* reassign `a_14` at *15* -- *line* `16:A` (the previous event was *line* `15:A`)\n",
    "* reassign `a_13` at *16* -- *line* `17:A` (the previous event was *line* `16:A`)\n",
    "* reassign `a_14` at *17* -- *return* `17:A` (the previous event in A was *line* `17:A`)\n",
    "* reassign `a_14` at *18* -- *return* `18:A` (the previous event in A was *line* `18:A`)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "So, our observations are that, if it is a call, the current location is the right one for any new variables being defined. On the other hand, if the variable being referenced for the first time (or reassigned a new value), then the  right location to consider is the previous location *in the same method invocation*. Next, let us see how we can incorporate this information into variable naming."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Next, we need a way to track the individual method calls as they are being made. For this we define the class `CallStack`. Each method invocation gets a separate identifier, and when the method call is over, the identifier is reset."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### CallStack"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class CallStack:\n",
    "    def __init__(self, **kwargs):\n",
    "        self.options(kwargs)\n",
    "        self.method_id = (START_SYMBOL, 0)\n",
    "        self.method_register = 0\n",
    "        self.mstack = [self.method_id]\n",
    "\n",
    "    def enter(self, method):\n",
    "        self.method_register += 1\n",
    "        self.method_id = (method, self.method_register)\n",
    "        self.log('call', \"%s%s\" % (self.indent(), str(self)))\n",
    "        self.mstack.append(self.method_id)\n",
    "\n",
    "    def leave(self):\n",
    "        self.mstack.pop()\n",
    "        self.log('return', \"%s%s\" % (self.indent(), str(self)))\n",
    "        self.method_id = self.mstack[-1]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "A few extra functions to make life simpler."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class CallStack(CallStack):\n",
    "    def options(self, kwargs):\n",
    "        self.log = log_event if kwargs.get('log') else lambda _evt, _var: None\n",
    "\n",
    "    def indent(self):\n",
    "        return len(self.mstack) * \"\\t\"\n",
    "\n",
    "    def at(self, n):\n",
    "        return self.mstack[n]\n",
    "\n",
    "    def __len__(self):\n",
    "        return len(mstack) - 1\n",
    "\n",
    "    def __str__(self):\n",
    "        return \"%s:%d\" % self.method_id\n",
    "\n",
    "    def __repr__(self):\n",
    "        return repr(self.method_id)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We also define a convenience method to display a given stack."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def display_stack(istack):\n",
    "    def stack_to_tree(stack):\n",
    "        current, *rest = stack\n",
    "        if not rest:\n",
    "            return (repr(current), [])\n",
    "        return (repr(current), [stack_to_tree(rest)])\n",
    "    display_tree(stack_to_tree(istack.mstack), graph_attr=lr_graph)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Here is how we can use the `CallStack`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "cs = CallStack()\n",
    "display_stack(cs)\n",
    "cs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "cs.enter('hello')\n",
    "display_stack(cs)\n",
    "cs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "cs.enter('world')\n",
    "display_stack(cs)\n",
    "cs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "cs.leave()\n",
    "display_stack(cs)\n",
    "cs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "cs.enter('world')\n",
    "display_stack(cs)\n",
    "cs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "cs.leave()\n",
    "display_stack(cs)\n",
    "cs"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "In order to account for variable reassignments, we need to have a more intelligent data structure than a dictionary for storing variables. We first define a simple interface `Vars`. It acts as a container for variables, and is instantiated at `my_assignments`."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "lines_to_next_cell": 0,
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Vars"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `Vars` stores references to variables as they occur during parsing in its internal dictionary `defs`. We initialize the dictionary with the original string."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class Vars:\n",
    "    def __init__(self, original):\n",
    "        self.defs = {}\n",
    "        self.my_input = original"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The dictionary needs two methods: `update()` that takes a set of key-value pairs to update itself, and `_set_kv()` that updates a particular key-value pair."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class Vars(Vars):\n",
    "    def _set_kv(self, k, v):\n",
    "        self.defs[k] = v\n",
    "\n",
    "    def __setitem__(self, k, v):\n",
    "        self._set_kv(k, v)\n",
    "\n",
    "    def update(self, v):\n",
    "        for k, v in v.items():\n",
    "            self._set_kv(k, v)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The vars is a proxy for the internal dictionary. For example, here is how one can use it."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "v = Vars('')\n",
    "v.defs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "v['x'] = 'X'\n",
    "v.defs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "v.update({'x': 'x', 'y': 'y'})\n",
    "v.defs"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### AssignmentVars"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We now extend the simple `Vars` to account for variable reassignments. For this, we define `AssignmentVars`.\n",
    "\n",
    "The idea for detecting reassignments and renaming variables is as follows: We keep track of the previous reassignments to particular variables using `accessed_seq_var`. It contains the last rename of any particular variable as its corresponding value. The `new_vars` contains a list of all new variables that were added on this iteration."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentVars(Vars):\n",
    "    def __init__(self, original):\n",
    "        super().__init__(original)\n",
    "        self.accessed_seq_var = {}\n",
    "        self.var_def_lines = {}\n",
    "        self.current_event = None\n",
    "        self.new_vars = set()\n",
    "        self.method_init()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `method_init()` method takes care of keeping track of method invocations using records saved in the `call_stack`. `event_locations` is for keeping track of the locations accessed *within this method*. This is used for line number tracking of variable definitions."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentVars(AssignmentVars):\n",
    "    def method_init(self):\n",
    "        self.call_stack = CallStack()\n",
    "        self.event_locations = {self.call_stack.method_id: []}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `update()` is now modified to track the changed line numbers if any, using `var_location_register()`. We reinitialize the `new_vars` after use for the next event."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentVars(AssignmentVars):\n",
    "    def update(self, v):\n",
    "        for k, v in v.items():\n",
    "            self._set_kv(k, v)\n",
    "        self.var_location_register(self.new_vars)\n",
    "        self.new_vars = set()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The variable name now incorporates an index of how many reassignments it has gone through, effectively making each reassignment a unique variable."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentVars(AssignmentVars):\n",
    "    def var_name(self, var):\n",
    "        return (var, self.accessed_seq_var[var])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "While storing variables, we need to first check whether it was previously known. If it is not, we need to initialize the rename count. This is accomplished by `var_access`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentVars(AssignmentVars):\n",
    "    def var_access(self, var):\n",
    "        if var not in self.accessed_seq_var:\n",
    "            self.accessed_seq_var[var] = 0\n",
    "        return self.var_name(var)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "During a variable reassignment, we update the `accessed_seq_var` to reflect the new count."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentVars(AssignmentVars):\n",
    "    def var_assign(self, var):\n",
    "        self.accessed_seq_var[var] += 1\n",
    "        self.new_vars.add(self.var_name(var))\n",
    "        return self.var_name(var)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "These methods can be used as follows"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "sav = AssignmentVars('')\n",
    "sav.defs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "sav.var_access('v1')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "sav.var_assign('v1')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Assigning to it again increments the counter."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "sav.var_assign('v1')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The core of the logic is in `_set_kv()`. When a variable is being assigned, we get the sequenced variable name `s_var`. If the sequenced variable name was previously unknown in `defs`, then we have no further concerns. We add the sequenced variable to `defs`.\n",
    "\n",
    "If the variable is previously known, then it is an indication of a possible reassignment. In this case, we look at the value the variable is holding. We check if the value changed. If it has not, then it is not.\n",
    "\n",
    "If the value has changed, it is a reassignment. We first increment the variable usage sequence using `var_assign`, retrieve the new name, update the new name in `defs`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentVars(AssignmentVars):\n",
    "    def _set_kv(self, var, val):\n",
    "        s_var = self.var_access(var)\n",
    "        if s_var in self.defs and self.defs[s_var] == val:\n",
    "            return\n",
    "        self.defs[self.var_assign(var)] = val"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Here is how it can be used. Assigning a variable the first time initializes its counter."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "sav = AssignmentVars('')\n",
    "sav['x'] = 'X'\n",
    "sav.defs"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "If the variable is assigned again with the same value, it is probably not a reassignment."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "sav['x'] = 'X'\n",
    "sav.defs"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "However, if the value changed, it is a reassignment."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "sav['x'] = 'Y'\n",
    "sav.defs"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "There is a subtlety here. It is possible for a child method to be called from the middle of a parent method, and for both to use the same variable name with different values. In this case, when the child returns, parent will have the old variable with old value in context. With our implementation, we consider this as a reassignment. However, this is OK because adding a new reassignment is harmless, but missing one is not. Further, we will discuss later how this can be avoided."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We also define book keeping codes for `register_event()` `method_enter()` and `method_exit()` which are the methods responsible for keeping track of the method stack. The basic idea is that, each `method_enter()` represents a new method invocation. Hence it merits a new method id, which is generated from the `method_register`, and saved in the `method_id`. Since this is a new method, the method stack is extended by one element with this id. In the case of `method_exit()`, we pop the method stack, and reset the current `method_id` to what was below the current one."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentVars(AssignmentVars):\n",
    "    def method_enter(self, cxt, my_vars):\n",
    "        self.current_event = 'call'\n",
    "        self.call_stack.enter(cxt.method)\n",
    "        self.event_locations[self.call_stack.method_id] = []\n",
    "        self.register_event(cxt)\n",
    "        self.update(my_vars)\n",
    "\n",
    "    def method_exit(self, cxt, my_vars):\n",
    "        self.current_event = 'return'\n",
    "        self.register_event(cxt)\n",
    "        self.update(my_vars)\n",
    "        self.call_stack.leave()\n",
    "\n",
    "    def method_statement(self, cxt, my_vars):\n",
    "        self.current_event = 'line'\n",
    "        self.register_event(cxt)\n",
    "        self.update(my_vars)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "For each of the method events, we also register the event using `register_event()` which keeps track of the line numbers that were referenced in *this* method."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentVars(AssignmentVars):\n",
    "    def register_event(self, cxt):\n",
    "        self.event_locations[self.call_stack.method_id].append(cxt.line_no)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `var_location_register()` keeps the locations of newly added variables. The definition location of variables in a `call` is the *current*  location. However, for a `line`, it would be the previous event in the current method."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentVars(AssignmentVars):\n",
    "    def var_location_register(self, my_vars):\n",
    "        def loc(mid):\n",
    "            if self.current_event == 'call':\n",
    "                return self.event_locations[mid][-1]\n",
    "            elif self.current_event == 'line':\n",
    "                return self.event_locations[mid][-2]\n",
    "            elif self.current_event == 'return':\n",
    "                return self.event_locations[mid][-2]\n",
    "            else:\n",
    "                assert False\n",
    "\n",
    "        my_loc = loc(self.call_stack.method_id)\n",
    "        for var in my_vars:\n",
    "            self.var_def_lines[var] = my_loc"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We define `defined_vars()` which returns the names of variables annotated with the line numbers as below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentVars(AssignmentVars):\n",
    "    def defined_vars(self, formatted=True):\n",
    "        def fmt(k):\n",
    "            v = (k[0], self.var_def_lines[k])\n",
    "            return \"%s@%s\" % v if formatted else v\n",
    "\n",
    "        return [(fmt(k), v) for k, v in self.defs.items()]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Similar to `defined_vars()` we define `seq_vars()` which annotates different variables with the number of times it was used."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentVars(AssignmentVars):\n",
    "    def seq_vars(self, formatted=True):\n",
    "        def fmt(k):\n",
    "            v = (k[0], self.var_def_lines[k], k[1])\n",
    "            return \"%s@%s:%s\" % v if formatted else v\n",
    "\n",
    "        return {fmt(k): v for k, v in self.defs.items()}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### AssignmentTracker"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `AssignmentTracker` keeps the assignment definitions using the `AssignmentVars` we defined previously."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentTracker(DefineTracker):\n",
    "    def __init__(self, my_input, trace, **kwargs):\n",
    "        self.options(kwargs)\n",
    "        self.my_input = my_input\n",
    "\n",
    "        self.my_assignments = AssignmentVars(my_input)\n",
    "\n",
    "        self.trace = trace\n",
    "        self.process()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "To fine-tune the process, we define an optional parameter called `track_return`. During tracing a method return, Python produces a virtual variable that contains the result of the returned value. If the `track_return` is set, we capture this value as a variable.\n",
    "\n",
    "* `track_return` -- if true, add a *virtual variable* to the Vars representing the return value"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentTracker(AssignmentTracker):\n",
    "    def options(self, kwargs):\n",
    "        self.track_return = kwargs.get('track_return', False)\n",
    "        super().options(kwargs)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "There can be different kinds of events during a trace, which includes `call` when a function is entered, `return` when the function returns, `exception` when an exception is thrown and `line` when a statement is executed.\n",
    "\n",
    "The previous `Tracker` was too simplistic in that it did not distinguish between the different events. We rectify that and define `on_call()`, `on_return()`, and `on_line()` respectively that gets called on their corresponding events.\n",
    "\n",
    "Note that `on_line()` is called also for `on_return()`. The reason is that, Python invokes the trace function *before* the corresponding line is executed. Hence, effectively, the `on_return()` is called with the binding produced by the execution of the previous statement in the environment. Our processing in effect is done on values that were bound by the previous statement. Hence, calling `on_line()` here is appropriate as it provides the event handler a chance to work on the previous binding."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class AssignmentTracker(AssignmentTracker):\n",
    "    def on_call(self, arg, cxt, my_vars):\n",
    "        my_vars = cxt.parameters(my_vars)\n",
    "        self.my_assignments.method_enter(cxt, self.fragments(my_vars))\n",
    "\n",
    "    def on_line(self, arg, cxt, my_vars):\n",
    "        self.my_assignments.method_statement(cxt, self.fragments(my_vars))\n",
    "\n",
    "    def on_return(self, arg, cxt, my_vars):\n",
    "        self.on_line(arg, cxt, my_vars)\n",
    "        my_vars = {'<-%s' % cxt.method: arg} if self.track_return else {}\n",
    "        self.my_assignments.method_exit(cxt, my_vars)\n",
    "\n",
    "    def on_exception(self, arg, cxt, my_vara):\n",
    "        return\n",
    "\n",
    "    def track_event(self, event, arg, cxt, my_vars):\n",
    "        self.current_event = event\n",
    "        dispatch = {\n",
    "            'call': self.on_call,\n",
    "            'return': self.on_return,\n",
    "            'line': self.on_line,\n",
    "            'exception': self.on_exception\n",
    "        }\n",
    "        dispatch[event](arg, cxt, my_vars)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We can now use `AssignmentTracker` to track the different variables. To verify that our variable line number inference works, we recover definitions from the functions A, B and C (with data annotations removed so that the input fragments are correctly identified). "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def C(cp_1):\n",
    "    c_2 = cp_1\n",
    "    c_3 = c_2\n",
    "    return c_3\n",
    "\n",
    "\n",
    "def B(bp_7):\n",
    "    b_8 = bp_7\n",
    "    return C(b_8)\n",
    "\n",
    "\n",
    "def A(ap_12):\n",
    "    a_13 = ap_12\n",
    "    a_14 = B(a_13)\n",
    "    a_14 = a_14\n",
    "    a_13 = a_14\n",
    "    a_14 = B(a_13)\n",
    "    a_14 = B(a_14)[3:]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Running `A()` with sufficient input."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "with Tracer('---xxx') as tracer:\n",
    "    A(tracer.my_input)\n",
    "tracker = AssignmentTracker(tracer.my_input, tracer.trace, log=True)\n",
    "for k, v in tracker.my_assignments.seq_vars().items():\n",
    "    print(k, '=', repr(v))\n",
    "print()\n",
    "for k, v in tracker.my_assignments.defined_vars(formatted=True):\n",
    "    print(k, '=', repr(v))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "As can be seen, the line numbers are now correctly identified for each variables."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    " Let us try retrieving the assignments for a real world example."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "traces = []\n",
    "for inputstr in URLS_X:\n",
    "    clear_cache()\n",
    "    with Tracer(inputstr, files=['urllib/parse.py']) as tracer:\n",
    "        urlparse(tracer.my_input)\n",
    "    traces.append((tracer.my_input, tracer.trace))\n",
    "\n",
    "    tracker = AssignmentTracker(tracer.my_input, tracer.trace, log=True)\n",
    "    for k, v in tracker.my_assignments.defined_vars():\n",
    "        print(k, '=', repr(v))\n",
    "    print()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The line numbers of variables can be verified from the source code of [urllib/parse.py](https://github.com/python/cpython/blob/3.6/Lib/urllib/parse.py)."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Recovering a Derivation Tree"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Does handling variable reassignments help with our URL examples? We look at these next."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class TreeMiner(TreeMiner):\n",
    "    def get_derivation_tree(self):\n",
    "        tree = (START_SYMBOL, [(self.my_input, [])])\n",
    "        for var, value in self.my_assignments:\n",
    "            self.log(0, \"%s=%s\" % (var, repr(value)))\n",
    "            self.apply_new_definition(tree, var, value)\n",
    "        return tree"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "#### Example 1: Recovering URL Derivation Tree"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "First we obtain the derivation tree of the URL 1"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### URL 1 derivation tree"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "clear_cache()\n",
    "with Tracer(URLS_X[0], files=['urllib/parse.py']) as tracer:\n",
    "    urlparse(tracer.my_input)\n",
    "sm = AssignmentTracker(tracer.my_input, tracer.trace)\n",
    "dt = TreeMiner(tracer.my_input, sm.my_assignments.defined_vars())\n",
    "display_tree(dt.tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Next, we obtain the derivation tree of URL 4"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### URL 4 derivation tree"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "clear_cache()\n",
    "with Tracer(URLS_X[-1], files=['urllib/parse.py']) as tracer:\n",
    "    urlparse(tracer.my_input)\n",
    "sm = AssignmentTracker(tracer.my_input, tracer.trace)\n",
    "dt = TreeMiner(tracer.my_input, sm.my_assignments.defined_vars())\n",
    "display_tree(dt.tree)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The derivation trees seem to belong to the same grammar. Hence, we obtain the grammar for the complete set. First, we update the `recover_grammar()` to use `AssignTracker`."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Recover Grammar"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class GrammarMiner(GrammarMiner):\n",
    "    def update_grammar(self, inputstr, trace):\n",
    "        at = AssignmentTracker(inputstr, trace)\n",
    "        dt = TreeMiner(inputstr, at.my_assignments.defined_vars())\n",
    "        self.add_tree(dt)\n",
    "        return self.grammar"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Next, we use the modified `recover_grammar()` on derivation trees obtained from URLs."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "url_grammar = recover_grammar(url_parse, URLS_X, files=['urllib/parse.py'])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The recovered grammar is below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "syntax_diagram(url_grammar)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Let us fuzz a little to see if the produced values are sane."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "f = GrammarFuzzer(url_grammar)\n",
    "for _ in range(10):\n",
    "    print(f.fuzz())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Our modifications does seem to help. Next, we check whether we can still retrieve the grammar for inventory."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "#### Example 2: Recovering Inventory Grammar"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "inventory_grammar = recover_grammar(process_vehicle, VEHICLES)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "syntax_diagram(inventory_grammar)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Using fuzzing to produce values from the grammar."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "f = GrammarFuzzer(inventory_grammar)\n",
    "for _ in range(10):\n",
    "    print(f.fuzz())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Problems with the Grammar Miner with Reassignment"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "One of the problems with our grammar miner is that it doesn't yet account for the current context. That is, when replacing, a variable can replace tokens that it does not have access to (and hence, it is not a fragment of). Consider this example."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with Tracer(INVENTORY) as tracer:\n",
    "    process_inventory(tracer.my_input)\n",
    "sm = AssignmentTracker(tracer.my_input, tracer.trace)\n",
    "dt = TreeMiner(tracer.my_input, sm.my_assignments.defined_vars())\n",
    "display_tree(dt.tree, graph_attr=lr_graph)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "As can be seen, the derivation tree obtained is not quite what we expected. The issue is easily seen if we enable logging in the `TreeMiner`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "dt = TreeMiner(tracer.my_input, sm.my_assignments.defined_vars(), log=True)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Look at the last statement. We have a value `1999,car,` where only the `year` got replaced. We no longer have a `'car'` variable to continue the replacement here. This happens because the `'car'` value in `'1999,car,Chevy,Venture'` is not treated as a new value because the value `'car'` had occurred for `'vehicle'` variable in the exact same location for a *different* method call (for `'2000,car,Mercury,Cougar'`)."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## A Grammar Miner with Scope\n",
    "\n",
    "We need to incorporate inspection of the variables in the current context. We already have a stack of method calls so that we can obtain the current method at any point. We need to do the same for variables.\n",
    "\n",
    "For that, we extend the `CallStack` to a new class `InputStack` which holds the method invoked as well as the parameters observed. It is essentially the record of activation of the method. We start with the original input at the base of the stack, and for each new method-call, we push the parameters of that call into the stack as a new record."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Input Stack"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "code_folding": [],
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class InputStack(CallStack):\n",
    "    def __init__(self, i, fragment_len=FRAGMENT_LEN):\n",
    "        self.inputs = [{START_SYMBOL: i}]\n",
    "        self.fragment_len = fragment_len\n",
    "        super().__init__()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "In order to check if a particular variable be saved, we define `in_current_record()` which checks only the variables in the current scope for inclusion (rather than the original input string)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class InputStack(InputStack):\n",
    "    def in_current_record(self, val):\n",
    "        return any(val in var for var in self.inputs[-1].values())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "my_istack = InputStack('hello my world')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "my_istack.in_current_record('hello')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "my_istack.in_current_record('bye')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "my_istack.inputs.append({'greeting': 'hello', 'location': 'world'})"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "my_istack.in_current_record('hello')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "my_istack.in_current_record('my')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We define the method `ignored()` that returns true if either the variable is not a string, or the variable length is less than the defined `fragment_len`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class InputStack(InputStack):\n",
    "    def ignored(self, val):\n",
    "        return not (isinstance(val, str) and len(val) >= self.fragment_len)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "my_istack = InputStack('hello world')\n",
    "my_istack.ignored(1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "my_istack.ignored('a')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "my_istack.ignored('help')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can now define the `in_scope()` method that checks whether the variable needs to be ignored, and if it is not to be ignored, whether the variable value is present in the current scope."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class InputStack(InputStack):\n",
    "    def in_scope(self, k, val):\n",
    "        if self.ignored(val):\n",
    "            return False\n",
    "        return self.in_current_record(val)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Finally, we update `enter()` that pushes relevant variables in the current context to the stack."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class InputStack(InputStack):\n",
    "    def enter(self, method, inputs):\n",
    "        my_inputs = {k: v for k, v in inputs.items() if self.in_scope(k, v)}\n",
    "        self.inputs.append(my_inputs)\n",
    "        super().enter(method)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "When a method returns, we also need a corresponding `leave()` to pop out the inputs and unwind the stack."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class InputStack(InputStack):\n",
    "    def leave(self):\n",
    "        self.inputs.pop()\n",
    "        super().leave()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### ScopedVars"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We need to update our `AssignmentVars` to include information about which scope the variable was defined. We start by updating `method_init()`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class ScopedVars(AssignmentVars):\n",
    "    def method_init(self):\n",
    "        self.call_stack = InputStack(self.my_input)\n",
    "        self.event_locations = {self.call_stack.method_id: []}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Similarly, the `method_enter()` now initializes the `accessed_seq_var` for the current method call."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ScopedVars(ScopedVars):\n",
    "    def method_enter(self, cxt, my_vars):\n",
    "        self.current_event = 'call'\n",
    "        self.call_stack.enter(cxt.method, my_vars)\n",
    "        self.accessed_seq_var[self.call_stack.method_id] = {}\n",
    "        self.event_locations[self.call_stack.method_id] = []\n",
    "        self.register_event(cxt)\n",
    "        self.update(my_vars)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The `update()` method now saves the context in which the value is defined. In the case of a parameter to a function, the context should be the context in which the function was called. On the other hand, a value defined during a statement execution would have the current context.\n",
    "\n",
    "Further, we annotate on value rather than key because we do not want to duplicate variables when parameters are in context in the next line. They will have same value, but different context because they are present in a statement execution.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ScopedVars(ScopedVars):\n",
    "    def update(self, v):\n",
    "        if self.current_event == 'call':\n",
    "            context = -2\n",
    "        elif self.current_event == 'line':\n",
    "            context = -1\n",
    "        else:\n",
    "            context = -1\n",
    "        for k, v in v.items():\n",
    "            self._set_kv(k, (v, self.call_stack.at(context)))\n",
    "        self.var_location_register(self.new_vars)\n",
    "        self.new_vars = set()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We also need to save the current method invocation so as to determine which variables are in scope. This information is now incorporated in the variable name as `accessed_seq_var[method_id][var]`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ScopedVars(ScopedVars):\n",
    "    def var_name(self, var):\n",
    "        return (var, self.call_stack.method_id,\n",
    "                self.accessed_seq_var[self.call_stack.method_id][var])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "As before, `var_access` simply initializes the corresponding counter, this time in the context of `method_id`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class ScopedVars(ScopedVars):\n",
    "    def var_access(self, var):\n",
    "        if var not in self.accessed_seq_var[self.call_stack.method_id]:\n",
    "            self.accessed_seq_var[self.call_stack.method_id][var] = 0\n",
    "        return self.var_name(var)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "During a variable reassignment, we update the `accessed_seq_var` to reflect the new count."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ScopedVars(ScopedVars):\n",
    "    def var_assign(self, var):\n",
    "        self.accessed_seq_var[self.call_stack.method_id][var] += 1\n",
    "        self.new_vars.add(self.var_name(var))\n",
    "        return self.var_name(var)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We now update `defined_vars()` to account for the new information."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class ScopedVars(ScopedVars):\n",
    "    def defined_vars(self, formatted=True):\n",
    "        def fmt(k):\n",
    "            method, i = k[1]\n",
    "            v = (method, i, k[0], self.var_def_lines[k])\n",
    "            return \"%s[%d]:%s@%s\" % v if formatted else v\n",
    "\n",
    "        return [(fmt(k), v) for k, v in self.defs.items()]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Updating `seq_vars()` to account for new information."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ScopedVars(ScopedVars):\n",
    "    def seq_vars(self, formatted=True):\n",
    "        def fmt(k):\n",
    "            method, i = k[1]\n",
    "            v = (method, i, k[0], self.var_def_lines[k], k[2])\n",
    "            return \"%s[%d]:%s@%s:%s\" % v if formatted else v\n",
    "\n",
    "        return {fmt(k): v for k, v in self.defs.items()}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Scope Tracker"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "With the `InputStack` and `Vars` defined, we can now define the `ScopeTracker`. The `ScopeTracker` only saves variables if the value is present in the current scope."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class ScopeTracker(AssignmentTracker):\n",
    "    def __init__(self, my_input, trace, **kwargs):\n",
    "        self.options(kwargs)\n",
    "\n",
    "        self.current_event = None\n",
    "        self.my_assignments = ScopedVars(my_input)\n",
    "\n",
    "        self.trace = trace\n",
    "        self.process()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We define a wrapper for checking whether a variable is present in the scope."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ScopeTracker(ScopeTracker):\n",
    "    def is_input_fragment(self, var, value):\n",
    "        return self.my_assignments.call_stack.in_scope(var, value)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can use the `ScopeTracker` as follows"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "vehicle_traces = []\n",
    "with Tracer(INVENTORY) as tracer:\n",
    "    process_inventory(tracer.my_input)\n",
    "sm = ScopeTracker(tracer.my_input, tracer.trace)\n",
    "vehicle_traces.append((tracer.my_input, sm))\n",
    "for k, v in sm.my_assignments.seq_vars().items():\n",
    "    print(k, '=', repr(v))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Recovering a Derivation Tree"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The main difference in `apply_new_definition()` is that we add a second condition that checks for scope. In particular, variables are only allowed to replace portions of string fragments that were in scope.\n",
    "The variable scope is indicated by `scope`. However, merely accounting for scope is not sufficient. For example, consider the fragment below."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "```python\n",
    "def my_fn(stringval):\n",
    "    partA, partB = stringval.split('/')\n",
    "    return partA, partB\n",
    "\n",
    "svalue = ...\n",
    "v1, v2 = my_fn(svalue)\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Here, `v1` and `v2` get their values from a previous function call. Not from their current context. That is, we have to provide an exception for cases where an internal child method call may have generated a large fragment as we showed above. To account for that, we define `mseq()` that retrieves the method call sequence. In the above case, the `mseq()` of the internal child method call would be larger than the current `mseq()`. If so, we allow the replacement to proceed."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class ScopeTreeMiner(TreeMiner):\n",
    "    def mseq(self, key):\n",
    "        method, seq, var, lno = key\n",
    "        return seq"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `nt_var()` method needs to take the tuple and generate a non-terminal symbol out of it. We skip the method sequence because it is not relevant for the grammar."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ScopeTreeMiner(ScopeTreeMiner):\n",
    "    def nt_var(self, key):\n",
    "        method, seq, var, lno = key\n",
    "        return to_nonterminal(\"%s@%d:%s\" % (method, lno, var))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We now redefine the `apply_new_definition()` to account for context and scope. In particular, a variable is allowed to replace a part of a value only if the variable is in *scope* -- that is, it's scope (method sequence number of either its calling context in case it is a parameter or the current context in case it is a statement) is same as that of the value's method sequence number. An exception is made when the value's method sequence number is greater than the variable's method sequence number. In that case, the value may have come from an internal call. We allow the replacement to proceed in that case."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ScopeTreeMiner(ScopeTreeMiner):\n",
    "    def insert_into_tree(self, my_tree, pair):\n",
    "        var, values, my_scope = my_tree\n",
    "        (nt_var, nt_seq), (v, v_scope) = pair\n",
    "        applied = False\n",
    "        for i, value_ in enumerate(values):\n",
    "            key, arr, scope = value_\n",
    "            self.log(2, \"-> [%d] %s\" % (i, repr(value_)))\n",
    "            if is_nonterminal(key):\n",
    "                applied = self.insert_into_tree(value_, pair)\n",
    "                if applied:\n",
    "                    break\n",
    "            else:\n",
    "                if v_scope != scope:\n",
    "                    if nt_seq > scope:\n",
    "                        continue\n",
    "                if v not in key:\n",
    "                    continue\n",
    "                prefix_k_suffix = [\n",
    "                    (nt_var, [(v, [], nt_seq)],\n",
    "                     scope) if i == 1 else (e, [], scope)\n",
    "                    for i, e in enumerate(key.partition(v))\n",
    "                    if e\n",
    "                ]\n",
    "                del values[i]\n",
    "                for j, rep in enumerate(prefix_k_suffix):\n",
    "                    values.insert(j + i, rep)\n",
    "\n",
    "                applied = True\n",
    "                self.log(2, \" > %s\" % (repr([i[0] for i in prefix_k_suffix])))\n",
    "                break\n",
    "        return applied"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The `apply_new_definition()` is now modified to carry additional contextual information `mseq`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class ScopeTreeMiner(ScopeTreeMiner):\n",
    "    def apply_new_definition(self, tree, var, value_):\n",
    "        nt_var = self.nt_var(var)\n",
    "        seq = self.mseq(var)\n",
    "        val, (smethod, mseq) = value_\n",
    "        return self.insert_into_tree(tree, ((nt_var, seq), (val, mseq)))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We also modify `get_derivation_tree()` so that the initial node carries the context."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ScopeTreeMiner(ScopeTreeMiner):\n",
    "    def get_derivation_tree(self):\n",
    "        tree = (START_SYMBOL, [(self.my_input, [], 0)], 0)\n",
    "        for var, value in self.my_assignments:\n",
    "            self.log(0, \"%s=%s\" % (var, repr(value)))\n",
    "            self.apply_new_definition(tree, var, value)\n",
    "        return tree"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "#### Example 1: Recovering URL Parse Tree"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We verify that our URL parse tree recovery still works as expected."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "url_dts = []\n",
    "for inputstr in URLS_X:\n",
    "    clear_cache()\n",
    "    with Tracer(inputstr, files=['urllib/parse.py']) as tracer:\n",
    "        urlparse(tracer.my_input)\n",
    "    sm = ScopeTracker(tracer.my_input, tracer.trace)\n",
    "    for k, v in sm.my_assignments.defined_vars(formatted=False):\n",
    "        print(k, '=', repr(v))\n",
    "    dt = ScopeTreeMiner(\n",
    "        tracer.my_input,\n",
    "        sm.my_assignments.defined_vars(\n",
    "            formatted=False))\n",
    "    display_tree(dt.tree, graph_attr=lr_graph)\n",
    "    url_dts.append(dt)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "#### Example 2: Recovering Inventory Parse Tree"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Next, we look at recovering the parse tree from `process_inventory()` which failed last time."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "with Tracer(INVENTORY) as tracer:\n",
    "    process_inventory(tracer.my_input)\n",
    "\n",
    "sm = ScopeTracker(tracer.my_input, tracer.trace)\n",
    "for k, v in sm.my_assignments.defined_vars():\n",
    "    print(k, '=', repr(v))\n",
    "inventory_dt = ScopeTreeMiner(\n",
    "    tracer.my_input,\n",
    "    sm.my_assignments.defined_vars(\n",
    "        formatted=False))\n",
    "display_tree(inventory_dt.tree, graph_attr=lr_graph)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The recovered parse tree seems reasonable.\n",
    "\n",
    "One of the things that one might notice from our Example (2) is that the three subtrees -- `vehicle[2:1]`, `vehicle[4:1]` and `vehicle[6:1]` are quite alike. We will examine how this can be exploited to generate a grammar directly, next."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Grammar Mining"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `tree_to_grammar()` is now redefined as follows, to account for the extra scope in nodes."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ScopedGrammarMiner(GrammarMiner):\n",
    "    def tree_to_grammar(self, tree):\n",
    "        key, children, scope = tree\n",
    "        one_alt = [ckey for ckey, gchildren, cscope in children if ckey != key]\n",
    "        hsh = {key: [one_alt] if one_alt else []}\n",
    "        for child in children:\n",
    "            (ckey, _gc, _cscope) = child\n",
    "            if not is_nonterminal(ckey):\n",
    "                continue\n",
    "            chsh = self.tree_to_grammar(child)\n",
    "            for k in chsh:\n",
    "                if k not in hsh:\n",
    "                    hsh[k] = chsh[k]\n",
    "                else:\n",
    "                    hsh[k].extend(chsh[k])\n",
    "        return hsh"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The grammar is in canonical form, which needs to be massaged to display. First, the recovered grammar for inventory."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "si = ScopedGrammarMiner()\n",
    "si.add_tree(inventory_dt)\n",
    "syntax_diagram(readable(si.grammar))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The recovered grammar for URLs."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "su = ScopedGrammarMiner()\n",
    "for url_dt in url_dts:\n",
    "    su.add_tree(url_dt)\n",
    "syntax_diagram(readable(su.grammar))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "One might notice that the grammar is not entirely human readable, with a number of single token definitions."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Hence, the last piece of the puzzle is the cleanup method `clean_grammar()`, which cleans up such definitions. The idea is to look for single token definitions such that a key is defined exactly by another key (single alternative, single token, nonterminal)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ScopedGrammarMiner(ScopedGrammarMiner):\n",
    "    def get_replacements(self, grammar):\n",
    "        replacements = {}\n",
    "        for k in grammar:\n",
    "            if k == START_SYMBOL:\n",
    "                continue\n",
    "            alts = grammar[k]\n",
    "            if len(set([str(i) for i in alts])) != 1:\n",
    "                continue\n",
    "            rule = alts[0]\n",
    "            if len(rule) != 1:\n",
    "                continue\n",
    "            tok = rule[0]\n",
    "            if not is_nonterminal(tok):\n",
    "                continue\n",
    "            replacements[k] = tok\n",
    "        return replacements"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Once we have such a list, iteratively replace the original key where ever it is used with the token we found earlier. Repeat until none is left."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ScopedGrammarMiner(ScopedGrammarMiner):\n",
    "    def clean_grammar(self):\n",
    "        replacements = self.get_replacements(self.grammar)\n",
    "\n",
    "        while True:\n",
    "            changed = set()\n",
    "            for k in self.grammar:\n",
    "                if k in replacements:\n",
    "                    continue\n",
    "                new_alts = []\n",
    "                for alt in self.grammar[k]:\n",
    "                    new_alt = []\n",
    "                    for t in alt:\n",
    "                        if t in replacements:\n",
    "                            new_alt.append(replacements[t])\n",
    "                            changed.add(t)\n",
    "                        else:\n",
    "                            new_alt.append(t)\n",
    "                    new_alts.append(new_alt)\n",
    "                self.grammar[k] = new_alts\n",
    "            if not changed:\n",
    "                break\n",
    "            for k in changed:\n",
    "                self.grammar.pop(k, None)\n",
    "        return readable(self.grammar)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The `clean_grammar()` is used as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "si = ScopedGrammarMiner()\n",
    "si.add_tree(inventory_dt)\n",
    "syntax_diagram(readable(si.clean_grammar()))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We update the `update_grammar()` to use the right tracker and miner."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class ScopedGrammarMiner(ScopedGrammarMiner):\n",
    "    def update_grammar(self, inputstr, trace):\n",
    "        at = ScopeTracker(inputstr, trace)\n",
    "        dt = ScopeTreeMiner(\n",
    "            inputstr,\n",
    "            at.my_assignments.defined_vars(\n",
    "                formatted=False))\n",
    "        self.add_tree(dt)\n",
    "        return self.grammar"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `recover_grammar()` uses the right miner, and returns a cleaned grammar."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def recover_grammar(fn, inputs, **kwargs):\n",
    "    miner = ScopedGrammarMiner()\n",
    "    for inputstr in inputs:\n",
    "        with Tracer(inputstr, **kwargs) as tracer:\n",
    "            fn(tracer.my_input)\n",
    "        miner.update_grammar(tracer.my_input, tracer.trace)\n",
    "    return readable(miner.clean_grammar())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "url_grammar = recover_grammar(url_parse, URLS_X, files=['urllib/parse.py'])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "syntax_diagram(url_grammar)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "f = GrammarFuzzer(url_grammar)\n",
    "for _ in range(10):\n",
    "    print(f.fuzz())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "inventory_grammar = recover_grammar(process_inventory, [INVENTORY])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "syntax_diagram(inventory_grammar)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "f = GrammarFuzzer(inventory_grammar)\n",
    "for _ in range(10):\n",
    "    print(f.fuzz())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We see how tracking scope helps us to extract an even more precise grammar."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Notice that we use *String* inclusion testing as a way of determining whether a particular string fragment  came from the original input string. While this may seem rather error-prone compared to dynamic tainting, we note that numerous tracing tools such as `dtrace()` and `ptrace()` allow one to obtain the information we seek from execution of binaries directly in different platforms. However, methods for obtaining dynamic taints almost always involve instrumenting the binaries before they can be used. Hence, this method of string inclusion can be more generally applied than dynamic tainting approaches. Further, dynamic taints are often lost due to implicit transmission, or at the boundary between *Python* and *C* code. String inclusion has not such problems. Hence, our approach can often obtain better results than relying on dynamic tainting."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "button": false,
    "new_sheet": true,
    "run_control": {
     "read_only": false
    },
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Lessons Learned\n",
    "\n",
    "* Given a set of sample inputs for program, we can learn an input grammar by examining variable values during execution if the program relies on handwritten parsers.\n",
    "* Simple string inclusion checks are sufficient to obtain reasonably accurate grammars from real world programs.\n",
    "* The resulting grammars can be directly used for fuzzing, and can have a multiplier effect on any samples you have."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "button": false,
    "new_sheet": false,
    "run_control": {
     "read_only": false
    },
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Next Steps\n",
    "\n",
    "* Learn how to use [information flow](InformationFlow.ipynb) to further improve mapping inputs to states."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Background\n",
    "\n",
    "Recovering the language from a _set of samples_ (i.e., not taking into account a possible program that might process them) is a well researched topic.  The excellent reference by Higuera \\cite{higuera2010grammatical} covers all the classical approaches. The current state of the art in black box grammar mining is described by Clark \\cite{clark2013learning}.\n",
    "\n",
    "Learning an input language from a _program_, with or without samples, is yet a emerging topic, despite its potential for fuzzing.  The pioneering work in this area was done by Lin et al. \\cite{Lin2008} who invented a way to retrieve the parse trees from top down and bottom up parsers. The approach described in this chapter is based directly on the AUTOGRAM work of Hoschele et al. \\cite{Hoschele2017}."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "button": false,
    "new_sheet": true,
    "run_control": {
     "read_only": false
    },
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Exercises"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "button": false,
    "new_sheet": false,
    "run_control": {
     "read_only": false
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Exercise 1: Flattening complex objects\n",
    "\n",
    "Our grammar miners only check for string fragments. However, programs may often pass containers or custom objects containing input fragments. For example, consider the plausible modification for our inventory processor, where we use a custom object `Vehicle` to carry fragments."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class Vehicle:\n",
    "    def __init__(self, vehicle):\n",
    "        year, kind, company, model, *_ = vehicle.split(',')\n",
    "        self.year, self.kind, self.company, self.model = year, kind, company, model"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def process_inventory(inventory):\n",
    "    res = []\n",
    "    for vehicle in inventory.split('\\n'):\n",
    "        ret = process_vehicle(vehicle)\n",
    "        res.extend(ret)\n",
    "    return '\\n'.join(res)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def process_vehicle(vehicle):\n",
    "    v = Vehicle(vehicle)\n",
    "    if v.kind == 'van':\n",
    "        return process_van(v)\n",
    "\n",
    "    elif v.kind == 'car':\n",
    "        return process_car(v)\n",
    "\n",
    "    else:\n",
    "        raise Exception('Invalid entry')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def process_van(vehicle):\n",
    "    res = [\n",
    "        \"We have a %s %s van from %s vintage.\" % (vehicle.company,\n",
    "                                                  vehicle.model, vehicle.year)\n",
    "    ]\n",
    "    iyear = int(vehicle.year)\n",
    "    if iyear > 2010:\n",
    "        res.append(\"It is a recent model!\")\n",
    "    else:\n",
    "        res.append(\"It is an old but reliable model!\")\n",
    "    return res"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def process_car(vehicle):\n",
    "    res = [\n",
    "        \"We have a %s %s car from %s vintage.\" % (vehicle.company,\n",
    "                                                  vehicle.model, vehicle.year)\n",
    "    ]\n",
    "    iyear = int(vehicle.year)\n",
    "    if iyear > 2016:\n",
    "        res.append(\"It is a recent model!\")\n",
    "    else:\n",
    "        res.append(\"It is an old but reliable model!\")\n",
    "    return res"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We recover the grammar as before."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "vehicle_grammar = recover_grammar(\n",
    "    process_inventory,\n",
    "    [INVENTORY],\n",
    "    methods=INVENTORY_METHODS)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The new vehicle grammar is missing in details, especially as to the different models and company for a van and car."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "syntax_diagram(vehicle_grammar)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    },
    "solution2": "hidden",
    "solution2_first": true
   },
   "source": [
    "The problem is that, we are looking specifically for string objects that contain fragments of the input string during tracing. Can you modify our grammar miner to correctly account for the complex objects too?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden",
    "solution2_first": true
   },
   "source": [
    "**Solution.**"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden"
   },
   "source": [
    "The problem can be understood if we execute the tracer under verbose logging."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden"
   },
   "outputs": [],
   "source": [
    "with Tracer(INVENTORY, methods=INVENTORY_METHODS, log=True) as tracer:\n",
    "    process_inventory(tracer.my_input)\n",
    "print()\n",
    "print('Traced values:')\n",
    "for t in tracer.trace:\n",
    "    print(t)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden"
   },
   "source": [
    "You can see that we lose track of string fragments as soon as they are incorporated into the `Vehicle` object. The way out is to trace these variables separately."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden"
   },
   "source": [
    "For that, we develop the `flatten()` method that given any custom complex object and its key, returns a list of flattened *key*,*value* pairs that correspond to the object passed in."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "cell_style": "split",
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden"
   },
   "outputs": [],
   "source": [
    "def flatten(key, val):\n",
    "    tv = type(val)\n",
    "    if isinstance(val, (int, float, complex, str, bytes, bytearray)):\n",
    "        return [(key, val)]\n",
    "    elif isinstance(val, (set, frozenset, list, tuple, range)):\n",
    "        values = [(i, e) for i, elt in enumerate(val) for e in flatten(i, elt)]\n",
    "        return [(\"%s.%d\" % (key, i), v) for i, v in values]\n",
    "    elif isinstance(val, dict):\n",
    "        values = [e for k, elt in val.items() for e in flatten(k, elt)]\n",
    "        return [(\"%s.%s\" % (key, k), v) for k, v in values]\n",
    "    elif isinstance(val, str):\n",
    "        return [(key, val)]\n",
    "    elif hasattr(val, '__dict__'):\n",
    "        values = [e for k, elt in val.__dict__.items()\n",
    "                  for e in flatten(k, elt)]\n",
    "        return [(\"%s.%s\" % (key, k), v) for k, v in values]\n",
    "    else:\n",
    "        return [(key, str(v))]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden"
   },
   "source": [
    "Next, we hook the `flatten()` into the `Context` class so that the parameters we obtain are flattened."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden"
   },
   "outputs": [],
   "source": [
    "class Context(Context):\n",
    "    def extract_vars(self, frame):\n",
    "        vals = inspect.getargvalues(frame).locals\n",
    "        return {k1: v1 for k, v in vals.items() for k1, v1 in flatten(k, v)}\n",
    "\n",
    "    def parameters(self, all_vars):\n",
    "        def check_param(k):\n",
    "            return any(k.startswith(p) for p in self.parameter_names)\n",
    "        return {k: v for k, v in all_vars.items() if check_param(k)}\n",
    "\n",
    "    def qualified(self, all_vars):\n",
    "        return {\"%s:%s\" % (self.method, k): v for k, v in all_vars.items()}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden"
   },
   "source": [
    "With this change, we have the following trace output."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden"
   },
   "outputs": [],
   "source": [
    "with Tracer(INVENTORY, methods=INVENTORY_METHODS, log=True) as tracer:\n",
    "    process_inventory(tracer.my_input)\n",
    "print()\n",
    "print('Traced values:')\n",
    "for t in tracer.trace:\n",
    "    print(t)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden"
   },
   "source": [
    "Our change seems to have worked. Let us derive the grammar."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden"
   },
   "outputs": [],
   "source": [
    "vehicle_grammar = recover_grammar(\n",
    "    process_inventory,\n",
    "    [INVENTORY],\n",
    "    methods=INVENTORY_METHODS)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden"
   },
   "outputs": [],
   "source": [
    "syntax_diagram(vehicle_grammar)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    },
    "solution2": "hidden"
   },
   "source": [
    "The recovered grammar contains all the details that we were able to recover before."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Exercise 2: Incorporating Taints from InformationFlow"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We have been using *string inclusion* to check whether a particular fragment came from the input string. This is unsatisfactory as it required us to compromise on the size of the strings tracked, which was limited to those greater than `FRAGMENT_LEN`. Further, it is possible that a single method could process a string where a fragment repeats, but is part of different tokens. For example, an embedded comma in the CSV file would cause our parser to fail. One way to avoid this is to rely on *dynamic taints*, and check for taint inclusion rather than string inclusion.\n",
    "\n",
    "The chapter on [information flow](InformationFlow.ipynb) details how to incorporate dynamic taints. Can you update our grammar miner based on scope to use *dynamic taints* instead?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "<!-- **Advanced.** The *dynamic taint* approach is limited in that it can not observe implicit flows. For example, consider the fragment below.\n",
    "\n",
    "```python\n",
    "if my_fragment == 'begin':\n",
    "    return 'begin'\n",
    "```\n",
    "\n",
    "In this case, we lose track of the string `begin` that is returned even though it is dependent on the value of `my_fragment`. For such cases, a better (but costly) alternative is to rely on concolic execution and capture the constraints as it relates to input characters on each variable.\n",
    "\n",
    "The chapter on [symbolic execution](SymbolicExecution.ipynb) details how to incorporate concolic symbolic execution to program execution. Can you update our grammar miner to use *concolic exeuction* to track taints instead?\n",
    "-->"
   ]
  }
 ],
 "metadata": {
  "ipub": {
   "bibliography": "fuzzingbook.bib"
  },
  "jupytext": {
   "text_representation": {
    "extension": ".py",
    "format_name": "percent",
    "format_version": "1.2",
    "jupytext_version": "0.8.6"
   }
  },
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.8"
  },
  "toc": {
   "base_numbering": 1,
   "nav_menu": {},
   "number_sections": true,
   "sideBar": true,
   "skip_h1_title": true,
   "title_cell": "",
   "title_sidebar": "Contents",
   "toc_cell": false,
   "toc_position": {},
   "toc_section_display": true,
   "toc_window_display": true
  },
  "toc-autonumbering": false,
  "varInspector": {
   "cols": {
    "lenName": 16,
    "lenType": 16,
    "lenVar": 40
   },
   "kernels_config": {
    "python": {
     "delete_cmd_postfix": "",
     "delete_cmd_prefix": "del ",
     "library": "var_list.py",
     "varRefreshCmd": "print(var_dic_list())"
    },
    "r": {
     "delete_cmd_postfix": ") ",
     "delete_cmd_prefix": "rm(",
     "library": "var_list.r",
     "varRefreshCmd": "cat(var_dic_list()) "
    }
   },
   "types_to_exclude": [
    "module",
    "function",
    "builtin_function_or_method",
    "instance",
    "_Feature"
   ],
   "window_display": false
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}