docs/beta/notebooks/ConcolicFuzzer.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "# Concolic Fuzzing\n",
    "\n",
    "In the [chapter on information flow](InformationFlow.ipynb), we have seen how one can use dynamic taints to produce more intelligent test cases than simply looking for program crashes. We have also seen how one can use the taints to update the grammar, and hence focus more on the dangerous methods. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "While taints are helpful, uninterpreted strings is only one of the attack vectors. Can we say anything more about the properties of variables at any point in the execution? For example, can we say for sure that a function will always receive the buffers with the correct length?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    " _Concolic execution_ offers a solution here. The idea of _concolic execution_ over a function is as follows: We start with a sample input for the function, and execute the function under trace. At each point the execution passes through a conditional, we _save the conditional encountered_ in the form of _relations between symbolic variables._ Here, a _symbolic variable_ can be thought of as a sort of placeholder for the real variable, sort of like the x in solving for x in Algebra. The symbolic variables can be used to specify relations without actually solving them."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "With concolic execution, one can collect the constraints that an execution path encounters, and use it to answer questions about the program behavior at any point we prefer along the program execution path. We can further use concolic execution to enhance fuzzing."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "In this chapter, we explore in depth how to execute a Python function concolically, and how concolic execution can be used to enhance fuzzing."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:07.083919Z",
     "iopub.status.busy": "2024-04-27T13:49:07.083463Z",
     "iopub.status.idle": "2024-04-27T13:49:07.128282Z",
     "shell.execute_reply": "2024-04-27T13:49:07.127888Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "        <iframe\n",
       "            width=\"640\"\n",
       "            height=\"360\"\n",
       "            src=\"https://www.youtube-nocookie.com/embed/KDcMjWX5ulU\"\n",
       "            frameborder=\"0\"\n",
       "            allowfullscreen\n",
       "            \n",
       "        ></iframe>\n",
       "        "
      ],
      "text/plain": [
       "<IPython.lib.display.IFrame at 0x106053a30>"
      ]
     },
     "execution_count": 1,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from bookutils import YouTubeVideo\n",
    "YouTubeVideo('KDcMjWX5ulU')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "button": false,
    "new_sheet": false,
    "run_control": {
     "read_only": false
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "**Prerequisites**\n",
    "\n",
    "* You should have read the [chapter on coverage](Coverage.ipynb).\n",
    "* You should have read the [chapter on information flow](InformationFlow.ipynb).\n",
    "* A familiarity with the basic idea of [SMT solvers](https://en.wikipedia.org/wiki/Satisfiability_modulo_theories) would be useful."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:07.150063Z",
     "iopub.status.busy": "2024-04-27T13:49:07.149847Z",
     "iopub.status.idle": "2024-04-27T13:49:07.152338Z",
     "shell.execute_reply": "2024-04-27T13:49:07.152041Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "import bookutils.setup"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:07.154283Z",
     "iopub.status.busy": "2024-04-27T13:49:07.154156Z",
     "iopub.status.idle": "2024-04-27T13:49:07.155875Z",
     "shell.execute_reply": "2024-04-27T13:49:07.155433Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from typing import List, Callable, Dict, Tuple"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "source": [
    "## Synopsis\n",
    "<!-- Automatically generated. Do not edit. -->\n",
    "\n",
    "To [use the code provided in this chapter](Importing.ipynb), write\n",
    "\n",
    "```python\n",
    ">>> from fuzzingbook.ConcolicFuzzer import <identifier>\n",
    "```\n",
    "\n",
    "and then make use of the following features.\n",
    "\n",
    "\n",
    "This chapter defines two main classes: `SimpleConcolicFuzzer` and `ConcolicGrammarFuzzer`. The `SimpleConcolicFuzzer` first uses a sample input to collect predicates encountered. The fuzzer then negates random predicates to generate new input constraints. These, when solved, produce inputs that explore paths that are close to the original path.\n",
    "\n",
    "### ConcolicTracer\n",
    "\n",
    "At the heart of both fuzzers lies the concept of a _concolic tracer_, capturing symbolic variables and path conditions as a program gets executed.\n",
    "\n",
    "`ConcolicTracer` is used in a `with` block; the syntax `tracer[function]` executes `function` within the `tracer` while capturing conditions. Here is an example for the `cgi_decode()` function:\n",
    "\n",
    "```python\n",
    ">>> with ConcolicTracer() as _:\n",
    ">>>     _[cgi_decode]('a%20d')\n",
    "```\n",
    "Once executed, we can retrieve the symbolic variables in the `decls` attribute. This is a mapping of symbolic variables to types.\n",
    "\n",
    "```python\n",
    ">>> _.decls\n",
    "{'cgi_decode_s_str_1': 'String'}\n",
    "```\n",
    "The extracted path conditions can be found in the `path` attribute:\n",
    "\n",
    "```python\n",
    ">>> _.path\n",
    "[0 < Length(cgi_decode_s_str_1),\n",
    " Not(str.substr(cgi_decode_s_str_1, 0, 1) == \"+\"),\n",
    " Not(str.substr(cgi_decode_s_str_1, 0, 1) == \"%\"),\n",
    " 1 < Length(cgi_decode_s_str_1),\n",
    " Not(str.substr(cgi_decode_s_str_1, 1, 1) == \"+\"),\n",
    " str.substr(cgi_decode_s_str_1, 1, 1) == \"%\",\n",
    " Not(str.substr(cgi_decode_s_str_1, 2, 1) == \"0\"),\n",
    " Not(str.substr(cgi_decode_s_str_1, 2, 1) == \"1\"),\n",
    " str.substr(cgi_decode_s_str_1, 2, 1) == \"2\",\n",
    " str.substr(cgi_decode_s_str_1, 3, 1) == \"0\",\n",
    " 4 < Length(cgi_decode_s_str_1),\n",
    " Not(str.substr(cgi_decode_s_str_1, 4, 1) == \"+\"),\n",
    " Not(str.substr(cgi_decode_s_str_1, 4, 1) == \"%\"),\n",
    " Not(5 < Length(cgi_decode_s_str_1))]\n",
    "```\n",
    "The `context` attribute holds a pair of `decls` and `path` attributes; this is useful for passing it into the `ConcolicTracer` constructor.\n",
    "\n",
    "```python\n",
    ">>> assert _.context == (_.decls, _.path)\n",
    "```\n",
    "We can solve these constraints to obtain a value for the function parameters that follow the same path as the original (traced) invocation:\n",
    "\n",
    "```python\n",
    ">>> _.zeval()\n",
    "('sat', {'s': ('A%20B', 'String')})\n",
    "```\n",
    "The `zeval()` function also allows passing _alternate_ or _negated_ constraints. See the chapter for examples.\n",
    "\n",
    "![](PICS/ConcolicFuzzer-synopsis-1.svg)\n",
    "\n",
    "### SimpleConcolicFuzzer\n",
    "\n",
    "The constraints obtained from `ConcolicTracer` are added to the concolic fuzzer as follows:\n",
    "\n",
    "```python\n",
    ">>> scf = SimpleConcolicFuzzer()\n",
    ">>> scf.add_trace(_, 'a%20d')\n",
    "```\n",
    "The concolic fuzzer then uses the constraints added to guide its fuzzing as follows:\n",
    "\n",
    "```python\n",
    ">>> scf = SimpleConcolicFuzzer()\n",
    ">>> for i in range(20):\n",
    ">>>     v = scf.fuzz()\n",
    ">>>     if v is None:\n",
    ">>>         break\n",
    ">>>     print(repr(v))\n",
    ">>>     with ExpectError(print_traceback=False):\n",
    ">>>         with ConcolicTracer() as _:\n",
    ">>>             _[cgi_decode](v)\n",
    ">>>     scf.add_trace(_, v)\n",
    "' '\n",
    "'%'\n",
    "'AB'\n",
    "''\n",
    "'ABC'\n",
    "'A'\n",
    "'AB+'\n",
    "'AB'\n",
    "'ABCD'\n",
    "\n",
    "IndexError: string index out of range (expected)\n",
    "\n",
    "'ABC+'\n",
    "'A'\n",
    "'ABC'\n",
    "'ABC%'\n",
    "'A%'\n",
    "'ABC+DE'\n",
    "'AB'\n",
    "'AB+'\n",
    "'A'\n",
    "'ABCD'\n",
    "'A'\n",
    "\n",
    "IndexError: string index out of range (expected)\n",
    "IndexError: string index out of range (expected)\n",
    "\n",
    "```\n",
    "We see how the additional inputs generated explore additional paths.\n",
    "\n",
    "![](PICS/ConcolicFuzzer-synopsis-2.svg)\n",
    "\n",
    "### ConcolicGrammarFuzzer\n",
    "\n",
    "The `SimpleConcolicFuzzer` simply explores all paths near the original path traversed by the sample input. It uses a simple mechanism to explore the paths that are near the paths that it knows about, and other than code paths, knows nothing about the input.\n",
    "\n",
    "The `ConcolicGrammarFuzzer` on the other hand, knows about the input grammar, and can collect feedback from the subject under fuzzing. It can lift some constraints encountered to the grammar, enabling deeper fuzzing. It is used as follows:\n",
    "\n",
    "```python\n",
    ">>> from InformationFlow import INVENTORY_GRAMMAR, SQLException\n",
    ">>> cgf = ConcolicGrammarFuzzer(INVENTORY_GRAMMAR)\n",
    ">>> cgf.prune_tokens(prune_tokens)\n",
    ">>> for i in range(10):\n",
    ">>>     query = cgf.fuzz()\n",
    ">>>     print(query)\n",
    ">>>     with ConcolicTracer() as _:\n",
    ">>>         with ExpectError(print_traceback=False):\n",
    ">>>             try:\n",
    ">>>                 res = _[db_select](query)\n",
    ">>>                 print(repr(res))\n",
    ">>>             except SQLException as e:\n",
    ">>>                 print(e)\n",
    ">>>         cgf.update_grammar(_)\n",
    ">>>         print()\n",
    "insert into W (Ru_2,.Wj186518W8) values ('@','}','h')\n",
    "Table ('W') was not found\n",
    "\n",
    "select S>R(j),A from C3 where U4==9249\n",
    "Table ('C3') was not found\n",
    "\n",
    "select I/I*U/n1(M),T/E*d(S) from months\n",
    "Invalid WHERE ('(I/I*U/n1(M),T/E*d(S))')\n",
    "\n",
    "select (v==X),t,h,E from vehicles where r8(w)<D-e\n",
    "\n",
    "select e!=K,X from a25i where G/S-y<h/P\n",
    "Table ('a25i') was not found\n",
    "\n",
    "select C,: from vehicles where s*u!=W(Y)>B/P(g)\n",
    "\n",
    "select x/z+.(L)-h from vehicles where -9!=Y>G(A)\n",
    "\n",
    "delete from h4OB60J where K-w/M<t*N/A*S\n",
    "Table ('h4OB60J') was not found\n",
    "\n",
    "delete from vehicles where r/v+z*Y+A-k<(q<h)+y\n",
    "Invalid WHERE ('r/v+z*Y+A-k<(q<h)+y')\n",
    "\n",
    "select (V==b),(C>A) from months where B(e,R)>D\n",
    "\n",
    "\n",
    "TypeError: 'NotImplementedType' object is not callable (expected)\n",
    "TypeError: 'NotImplementedType' object is not callable (expected)\n",
    "TypeError: 'NotImplementedType' object is not callable (expected)\n",
    "TypeError: 'NotImplementedType' object is not callable (expected)\n",
    "\n",
    "```\n",
    "![](PICS/ConcolicFuzzer-synopsis-3.svg)\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    },
    "toc-hr-collapsed": false
   },
   "source": [
    "## Tracking Constraints"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "In the chapter on [information flow](InformationFlow), we have seen how dynamic taints can be used to direct fuzzing by indicating which part of input reached interesting places. However, dynamic taint tracking is limited in the information that it can propagate. For example, we might want to explore what happens when certain properties of the input changes."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "For example, say we have a function `factorial()` that returns the *factorial value* of its input."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:07.157788Z",
     "iopub.status.busy": "2024-04-27T13:49:07.157633Z",
     "iopub.status.idle": "2024-04-27T13:49:07.160001Z",
     "shell.execute_reply": "2024-04-27T13:49:07.159694Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def factorial(n):\n",
    "    if n < 0:\n",
    "        return None\n",
    "\n",
    "    if n == 0:\n",
    "        return 1\n",
    "\n",
    "    if n == 1:\n",
    "        return 1\n",
    "\n",
    "    v = 1\n",
    "    while n != 0:\n",
    "        v = v * n\n",
    "        n = n - 1\n",
    "\n",
    "    return v"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We exercise the function with a value of `5`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:07.161664Z",
     "iopub.status.busy": "2024-04-27T13:49:07.161552Z",
     "iopub.status.idle": "2024-04-27T13:49:07.163992Z",
     "shell.execute_reply": "2024-04-27T13:49:07.163570Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "120"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "factorial(5)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Is this sufficient to explore all the features of the function? How do we know? One way to verify that we have explored all features is to look at the _coverage obtained_. First we need to extend the `Coverage` class from the [chapter on coverage](Coverage.ipynb) to provide us with coverage arcs."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:07.165904Z",
     "iopub.status.busy": "2024-04-27T13:49:07.165787Z",
     "iopub.status.idle": "2024-04-27T13:49:07.602938Z",
     "shell.execute_reply": "2024-04-27T13:49:07.602622Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from Coverage import Coverage"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:07.604813Z",
     "iopub.status.busy": "2024-04-27T13:49:07.604656Z",
     "iopub.status.idle": "2024-04-27T13:49:07.606436Z",
     "shell.execute_reply": "2024-04-27T13:49:07.606171Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "import inspect"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:07.607882Z",
     "iopub.status.busy": "2024-04-27T13:49:07.607782Z",
     "iopub.status.idle": "2024-04-27T13:49:07.609972Z",
     "shell.execute_reply": "2024-04-27T13:49:07.609689Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ArcCoverage(Coverage):\n",
    "    def traceit(self, frame, event, args):\n",
    "        if event != 'return':\n",
    "            f = inspect.getframeinfo(frame)\n",
    "            self._trace.append((f.function, f.lineno))\n",
    "        return self.traceit\n",
    "\n",
    "    def arcs(self):\n",
    "        t = [i for f, i in self._trace]\n",
    "        return list(zip(t, t[1:]))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Next, we use the `Tracer` to obtain the coverage arcs."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:07.611411Z",
     "iopub.status.busy": "2024-04-27T13:49:07.611295Z",
     "iopub.status.idle": "2024-04-27T13:49:07.681679Z",
     "shell.execute_reply": "2024-04-27T13:49:07.681379Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ArcCoverage() as cov:\n",
    "    factorial(5)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can now use the coverage arcs to visualize the coverage obtained."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:07.683503Z",
     "iopub.status.busy": "2024-04-27T13:49:07.683412Z",
     "iopub.status.idle": "2024-04-27T13:49:07.795943Z",
     "shell.execute_reply": "2024-04-27T13:49:07.795628Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from ControlFlow import to_graph, gen_cfg"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:07.797947Z",
     "iopub.status.busy": "2024-04-27T13:49:07.797821Z",
     "iopub.status.idle": "2024-04-27T13:49:08.270159Z",
     "shell.execute_reply": "2024-04-27T13:49:08.269724Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "image/svg+xml": [
       "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\n",
       "<!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\"\n",
       " \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n",
       "<!-- Generated by graphviz version 9.0.0 (20230911.1827)\n",
       " -->\n",
       "<!-- Pages: 1 -->\n",
       "<svg width=\"418pt\" height=\"564pt\"\n",
       " viewBox=\"0.00 0.00 418.25 564.00\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n",
       "<g id=\"graph0\" class=\"graph\" transform=\"scale(1 1) rotate(0) translate(4 560)\">\n",
       "<polygon fill=\"white\" stroke=\"none\" points=\"-4,4 -4,-560 414.25,-560 414.25,4 -4,4\"/>\n",
       "<!-- 1 -->\n",
       "<g id=\"node1\" class=\"node\">\n",
       "<title>1</title>\n",
       "<ellipse fill=\"none\" stroke=\"black\" cx=\"98.75\" cy=\"-534\" rx=\"79.82\" ry=\"18\"/>\n",
       "<ellipse fill=\"none\" stroke=\"black\" cx=\"98.75\" cy=\"-534\" rx=\"83.82\" ry=\"22\"/>\n",
       "<text text-anchor=\"middle\" x=\"98.75\" y=\"-527.83\" font-family=\"Times,serif\" font-size=\"14.00\">1: enter: factorial(n)</text>\n",
       "</g>\n",
       "<!-- 3 -->\n",
       "<g id=\"node7\" class=\"node\">\n",
       "<title>3</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"98.75,-476 31.06,-458 98.75,-440 166.44,-458 98.75,-476\"/>\n",
       "<text text-anchor=\"middle\" x=\"98.75\" y=\"-451.82\" font-family=\"Times,serif\" font-size=\"14.00\">2: if: n &lt; 0</text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;3 -->\n",
       "<g id=\"edge5\" class=\"edge\">\n",
       "<title>1&#45;&gt;3</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M98.75,-511.6C98.75,-504.11 98.75,-495.59 98.75,-487.61\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"102.25,-487.65 98.75,-477.65 95.25,-487.65 102.25,-487.65\"/>\n",
       "</g>\n",
       "<!-- 2 -->\n",
       "<g id=\"node2\" class=\"node\">\n",
       "<title>2</title>\n",
       "<ellipse fill=\"none\" stroke=\"black\" cx=\"142.75\" cy=\"-22\" rx=\"75.53\" ry=\"18\"/>\n",
       "<ellipse fill=\"none\" stroke=\"black\" cx=\"142.75\" cy=\"-22\" rx=\"79.53\" ry=\"22\"/>\n",
       "<text text-anchor=\"middle\" x=\"142.75\" y=\"-15.82\" font-family=\"Times,serif\" font-size=\"14.00\">1: exit: factorial(n)</text>\n",
       "</g>\n",
       "<!-- 4 -->\n",
       "<g id=\"node3\" class=\"node\">\n",
       "<title>4</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"95.5,-188 0,-188 0,-152 95.5,-152 95.5,-188\"/>\n",
       "<text text-anchor=\"middle\" x=\"47.75\" y=\"-163.82\" font-family=\"Times,serif\" font-size=\"14.00\">3: return None</text>\n",
       "</g>\n",
       "<!-- 4&#45;&gt;2 -->\n",
       "<g id=\"edge1\" class=\"edge\">\n",
       "<title>4&#45;&gt;2</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M59.02,-151.68C74.74,-127.52 103.5,-83.33 122.86,-53.56\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"125.7,-55.63 128.22,-45.34 119.83,-51.81 125.7,-55.63\"/>\n",
       "</g>\n",
       "<!-- 6 -->\n",
       "<g id=\"node4\" class=\"node\">\n",
       "<title>6</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"160.25,-332 87.25,-332 87.25,-296 160.25,-296 160.25,-332\"/>\n",
       "<text text-anchor=\"middle\" x=\"123.75\" y=\"-307.82\" font-family=\"Times,serif\" font-size=\"14.00\">6: return 1</text>\n",
       "</g>\n",
       "<!-- 6&#45;&gt;2 -->\n",
       "<g id=\"edge2\" class=\"edge\">\n",
       "<title>6&#45;&gt;2</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M124.88,-295.73C127.97,-248.63 136.57,-117.38 140.6,-55.75\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"144.09,-56.12 141.25,-45.91 137.1,-55.66 144.09,-56.12\"/>\n",
       "</g>\n",
       "<!-- 8 -->\n",
       "<g id=\"node5\" class=\"node\">\n",
       "<title>8</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"230.25,-260 157.25,-260 157.25,-224 230.25,-224 230.25,-260\"/>\n",
       "<text text-anchor=\"middle\" x=\"193.75\" y=\"-235.82\" font-family=\"Times,serif\" font-size=\"14.00\">9: return 1</text>\n",
       "</g>\n",
       "<!-- 8&#45;&gt;2 -->\n",
       "<g id=\"edge3\" class=\"edge\">\n",
       "<title>8&#45;&gt;2</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M189.66,-223.53C181.12,-187.02 161.27,-102.15 150.32,-55.37\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"153.78,-54.77 148.09,-45.83 146.96,-56.36 153.78,-54.77\"/>\n",
       "</g>\n",
       "<!-- 13 -->\n",
       "<g id=\"node6\" class=\"node\">\n",
       "<title>13</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"269.62,-116 189.88,-116 189.88,-80 269.62,-80 269.62,-116\"/>\n",
       "<text text-anchor=\"middle\" x=\"229.75\" y=\"-91.83\" font-family=\"Times,serif\" font-size=\"14.00\">16: return v</text>\n",
       "</g>\n",
       "<!-- 13&#45;&gt;2 -->\n",
       "<g id=\"edge4\" class=\"edge\">\n",
       "<title>13&#45;&gt;2</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M209.57,-79.84C199.33,-71.13 186.64,-60.33 175.08,-50.5\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"177.56,-48.01 167.68,-44.2 173.03,-53.35 177.56,-48.01\"/>\n",
       "</g>\n",
       "<!-- 3&#45;&gt;4 -->\n",
       "<g id=\"edge6\" class=\"edge\">\n",
       "<title>3&#45;&gt;4</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M87.53,-442.6C80.25,-432.41 71.31,-418.12 66.75,-404 43.96,-333.39 44.03,-244.81 45.93,-199.93\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"49.42,-200.15 46.42,-189.99 42.43,-199.81 49.42,-200.15\"/>\n",
       "</g>\n",
       "<!-- 5 -->\n",
       "<g id=\"node8\" class=\"node\">\n",
       "<title>5</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"150.75,-404 75.64,-386 150.75,-368 225.86,-386 150.75,-404\"/>\n",
       "<text text-anchor=\"middle\" x=\"150.75\" y=\"-379.82\" font-family=\"Times,serif\" font-size=\"14.00\">5: if: n == 0</text>\n",
       "</g>\n",
       "<!-- 3&#45;&gt;5 -->\n",
       "<g id=\"edge7\" class=\"edge\">\n",
       "<title>3&#45;&gt;5</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M109.52,-442.5C116.36,-433.3 125.36,-421.18 133.2,-410.62\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"135.93,-412.82 139.09,-402.7 130.31,-408.64 135.93,-412.82\"/>\n",
       "</g>\n",
       "<!-- 5&#45;&gt;6 -->\n",
       "<g id=\"edge8\" class=\"edge\">\n",
       "<title>5&#45;&gt;6</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M144.62,-369.12C141.65,-361.4 137.98,-351.9 134.56,-343.02\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"137.83,-341.77 130.96,-333.7 131.3,-344.29 137.83,-341.77\"/>\n",
       "</g>\n",
       "<!-- 7 -->\n",
       "<g id=\"node9\" class=\"node\">\n",
       "<title>7</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"253.75,-332 178.64,-314 253.75,-296 328.86,-314 253.75,-332\"/>\n",
       "<text text-anchor=\"middle\" x=\"253.75\" y=\"-307.82\" font-family=\"Times,serif\" font-size=\"14.00\">8: if: n == 1</text>\n",
       "</g>\n",
       "<!-- 5&#45;&gt;7 -->\n",
       "<g id=\"edge9\" class=\"edge\">\n",
       "<title>5&#45;&gt;7</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M169.64,-372.16C185.32,-361.5 207.85,-346.19 225.65,-334.1\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"227.42,-337.12 233.73,-328.61 223.49,-331.33 227.42,-337.12\"/>\n",
       "</g>\n",
       "<!-- 7&#45;&gt;8 -->\n",
       "<g id=\"edge10\" class=\"edge\">\n",
       "<title>7&#45;&gt;8</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M241.32,-298.5C234.06,-290.03 224.7,-279.1 216.19,-269.18\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"218.86,-266.92 209.7,-261.61 213.55,-271.48 218.86,-266.92\"/>\n",
       "</g>\n",
       "<!-- 9 -->\n",
       "<g id=\"node10\" class=\"node\">\n",
       "<title>9</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"316.88,-260 250.62,-260 250.62,-224 316.88,-224 316.88,-260\"/>\n",
       "<text text-anchor=\"middle\" x=\"283.75\" y=\"-235.82\" font-family=\"Times,serif\" font-size=\"14.00\">11: v = 1</text>\n",
       "</g>\n",
       "<!-- 7&#45;&gt;9 -->\n",
       "<g id=\"edge11\" class=\"edge\">\n",
       "<title>7&#45;&gt;9</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M260.41,-297.46C263.75,-289.68 267.89,-280 271.76,-270.98\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"274.95,-272.42 275.67,-261.85 268.51,-269.66 274.95,-272.42\"/>\n",
       "</g>\n",
       "<!-- 10 -->\n",
       "<g id=\"node11\" class=\"node\">\n",
       "<title>10</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"308.75,-188 211.38,-170 308.75,-152 406.12,-170 308.75,-188\"/>\n",
       "<text text-anchor=\"middle\" x=\"308.75\" y=\"-163.82\" font-family=\"Times,serif\" font-size=\"14.00\">12: while: n != 0</text>\n",
       "</g>\n",
       "<!-- 9&#45;&gt;10 -->\n",
       "<g id=\"edge12\" class=\"edge\">\n",
       "<title>9&#45;&gt;10</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M289.93,-223.7C292.7,-215.93 296.04,-206.58 299.13,-197.93\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"302.41,-199.16 302.48,-188.57 295.82,-196.81 302.41,-199.16\"/>\n",
       "</g>\n",
       "<!-- 10&#45;&gt;13 -->\n",
       "<g id=\"edge16\" class=\"edge\">\n",
       "<title>10&#45;&gt;13</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M292.76,-154.83C282.78,-145.98 269.63,-134.34 257.94,-123.98\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"260.29,-121.38 250.48,-117.37 255.65,-126.62 260.29,-121.38\"/>\n",
       "</g>\n",
       "<!-- 11 -->\n",
       "<g id=\"node13\" class=\"node\">\n",
       "<title>11</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"375.38,-116 288.12,-116 288.12,-80 375.38,-80 375.38,-116\"/>\n",
       "<text text-anchor=\"middle\" x=\"331.75\" y=\"-91.83\" font-family=\"Times,serif\" font-size=\"14.00\">13: v = v * n</text>\n",
       "</g>\n",
       "<!-- 10&#45;&gt;11 -->\n",
       "<g id=\"edge14\" class=\"edge\">\n",
       "<title>10&#45;&gt;11</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M314.08,-152.76C316.62,-145.04 319.73,-135.59 322.63,-126.77\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"325.85,-128.15 325.65,-117.56 319.2,-125.97 325.85,-128.15\"/>\n",
       "</g>\n",
       "<!-- 12 -->\n",
       "<g id=\"node12\" class=\"node\">\n",
       "<title>12</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"410.25,-40 325.25,-40 325.25,-4 410.25,-4 410.25,-40\"/>\n",
       "<text text-anchor=\"middle\" x=\"367.75\" y=\"-15.82\" font-family=\"Times,serif\" font-size=\"14.00\">14: n = n &#45; 1</text>\n",
       "</g>\n",
       "<!-- 12&#45;&gt;10 -->\n",
       "<g id=\"edge13\" class=\"edge\">\n",
       "<title>12&#45;&gt;10</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M377.25,-40.44C386.46,-59.91 397.35,-91.84 384.75,-116 376.77,-131.3 362.14,-143.08 347.83,-151.6\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"346.45,-148.37 339.38,-156.26 349.83,-154.5 346.45,-148.37\"/>\n",
       "</g>\n",
       "<!-- 11&#45;&gt;12 -->\n",
       "<g id=\"edge15\" class=\"edge\">\n",
       "<title>11&#45;&gt;12</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M340.1,-79.84C344.34,-71.12 349.6,-60.32 354.38,-50.48\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"357.43,-52.21 358.66,-41.69 351.14,-49.15 357.43,-52.21\"/>\n",
       "</g>\n",
       "</g>\n",
       "</svg>\n"
      ],
      "text/plain": [
       "<graphviz.graphs.Digraph at 0x1055ad8d0>"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "to_graph(gen_cfg(inspect.getsource(factorial)), arcs=cov.arcs())"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We see that the path `[1, 2, 5, 8, 11, 12, 13, 14]` is covered (green) but sub-paths such as `[2, 3]`, `[5, 6]` and `[8, 9]` are unexplored (red). What we need is the ability to generate inputs such that the `True` branch is taken at `2`. How do we do that?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    },
    "toc-hr-collapsed": false
   },
   "source": [
    "## Concolic Execution\n",
    "\n",
    "One way to cover additional branches is to look at the execution path being taken, and collect the _conditional constraints_ that the path encounters. Then we can try to produce inputs that lead us to taking the non-traversed path."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "First, let us step through the function."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.272062Z",
     "iopub.status.busy": "2024-04-27T13:49:08.271928Z",
     "iopub.status.idle": "2024-04-27T13:49:08.274611Z",
     "shell.execute_reply": "2024-04-27T13:49:08.274369Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "lines = [i[1] for i in cov._trace if i[0] == 'factorial']\n",
    "src = {i + 1: s for i, s in enumerate(\n",
    "    inspect.getsource(factorial).split('\\n'))}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "* The line (1) is simply the entry point of the function. We know that the input is `n`, which is an integer."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.276115Z",
     "iopub.status.busy": "2024-04-27T13:49:08.275998Z",
     "iopub.status.idle": "2024-04-27T13:49:08.278521Z",
     "shell.execute_reply": "2024-04-27T13:49:08.278140Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'def factorial(n):'"
      ]
     },
     "execution_count": 13,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "src[1]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "* The line (2) is a predicate `n < 0`. Since the next line taken is line (5), we know that at this point in the execution path, the predicate was `false`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.280038Z",
     "iopub.status.busy": "2024-04-27T13:49:08.279916Z",
     "iopub.status.idle": "2024-04-27T13:49:08.282568Z",
     "shell.execute_reply": "2024-04-27T13:49:08.282232Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('    if n < 0:', '        return None', '', '    if n == 0:')"
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "src[2], src[3], src[4], src[5]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We notice that this is one of the predicates where the `true` branch was not taken. How do we generate a value that takes the `true` branch here? One way is to use symbolic variables to represent the input, encode the constraint, and use an *SMT Solver* to solve the negation of the constraint."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "As we mentioned in the introduction to the chapter, a symbolic variable can be thought of as a sort of placeholder for the real variable, sort of like the `x` in solving for `x` in Algebra. These variables can be used to encode constraints placed on the variables in the program. We identify what constraints the variable is supposed to obey, and finally produce a value that obeys all constraints imposed."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Solving Constraints"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "To solve these constraints, one can use a _Satisfiability Modulo Theories_ (SMT) solver. An SMT solver is built on top of a _SATISFIABILITY_ (SAT) solver. A SAT solver is being used to check whether boolean formulas in first order logic (e.g. `(a | b ) & (~a | ~b)`) can be satisfied using any assignments for the variables (e.g `a = true, b = false`). An SMT solver extends these SAT solvers to specific background theories -- for example, _theory of integers_, or _theory of strings_. That is, given a string constraint expressed as a formula with string variables (e.g. `h + t == 'hello,world'`), an SMT solver that understands _theory of strings_ can be used to check if that constraint can be satisfied, and if satisfiable, provide an instantiation of concrete values for the variables used in the formula (e.g `h = 'hello,', t = 'world'`)."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We use the SMT solver Z3 in this chapter."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.284371Z",
     "iopub.status.busy": "2024-04-27T13:49:08.284262Z",
     "iopub.status.idle": "2024-04-27T13:49:08.302231Z",
     "shell.execute_reply": "2024-04-27T13:49:08.301877Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "import z3  # type: ignore"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.303892Z",
     "iopub.status.busy": "2024-04-27T13:49:08.303771Z",
     "iopub.status.idle": "2024-04-27T13:49:08.305661Z",
     "shell.execute_reply": "2024-04-27T13:49:08.305370Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "z3_ver = z3.get_version()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.307171Z",
     "iopub.status.busy": "2024-04-27T13:49:08.307058Z",
     "iopub.status.idle": "2024-04-27T13:49:08.308914Z",
     "shell.execute_reply": "2024-04-27T13:49:08.308658Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(4, 11, 2, 0)\n"
     ]
    }
   ],
   "source": [
    "print(z3_ver)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.310396Z",
     "iopub.status.busy": "2024-04-27T13:49:08.310281Z",
     "iopub.status.idle": "2024-04-27T13:49:08.312014Z",
     "shell.execute_reply": "2024-04-27T13:49:08.311758Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "assert z3_ver >= (4, 8, 13, 0), \\\n",
    "    f\"Please install z3-solver 4.8.13.0 or later - you have {z3_ver}\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Let us set up Z3 first. To ensure that the string constraints we use in this chapter are successfully evaluated, we need to specify the `z3str3` solver. Further, we set the timeout for Z3 computations to 30 seconds."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.313595Z",
     "iopub.status.busy": "2024-04-27T13:49:08.313485Z",
     "iopub.status.idle": "2024-04-27T13:49:08.316888Z",
     "shell.execute_reply": "2024-04-27T13:49:08.316615Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "# z3.set_option('smt.string_solver', 'z3str3')\n",
    "z3.set_option('timeout', 30 * 1000)  # milliseconds"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "To encode constraints, we need symbolic variables. Here, we make `zn` a placeholder for the Z3 symbolic integer variable `n`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.318347Z",
     "iopub.status.busy": "2024-04-27T13:49:08.318233Z",
     "iopub.status.idle": "2024-04-27T13:49:08.326281Z",
     "shell.execute_reply": "2024-04-27T13:49:08.325998Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "zn = z3.Int('n')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Remember the constraint `(n < 0)` from line 2 in `factorial()`? We can now encode the constraint as follows. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.327968Z",
     "iopub.status.busy": "2024-04-27T13:49:08.327852Z",
     "iopub.status.idle": "2024-04-27T13:49:08.330929Z",
     "shell.execute_reply": "2024-04-27T13:49:08.330683Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "n &lt; 0"
      ],
      "text/plain": [
       "n < 0"
      ]
     },
     "execution_count": 21,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "zn < 0"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We previously traced `factorial(5)`. We saw that with input `5`, the execution took the `else` branch on the predicate `n < 0`. We can express this observation as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.332522Z",
     "iopub.status.busy": "2024-04-27T13:49:08.332391Z",
     "iopub.status.idle": "2024-04-27T13:49:08.335760Z",
     "shell.execute_reply": "2024-04-27T13:49:08.335413Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "&not;(n &lt; 0)"
      ],
      "text/plain": [
       "Not(n < 0)"
      ]
     },
     "execution_count": 22,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "z3.Not(zn < 0)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Let us now solve constraints. The `z3.solve()` method checks if the constraints are satisfiable; if they are, it also provides values for variables such that the constraints are satisfied. For example, we can ask Z3 for an input that will take the `else` branch as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.337170Z",
     "iopub.status.busy": "2024-04-27T13:49:08.337080Z",
     "iopub.status.idle": "2024-04-27T13:49:08.365748Z",
     "shell.execute_reply": "2024-04-27T13:49:08.365440Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[n = 0]\n"
     ]
    }
   ],
   "source": [
    "z3.solve(z3.Not(zn < 0))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "This is *a solution* (albeit a trivial one). SMT solvers can be used to solve much harder problems. For example, here is how one can solve a quadratic equation."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.367321Z",
     "iopub.status.busy": "2024-04-27T13:49:08.367207Z",
     "iopub.status.idle": "2024-04-27T13:49:08.378398Z",
     "shell.execute_reply": "2024-04-27T13:49:08.378156Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[x = 5]\n"
     ]
    }
   ],
   "source": [
    "x = z3.Real('x')\n",
    "eqn = (2 * x**2 - 11 * x + 5 == 0)\n",
    "z3.solve(eqn)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Again, this is _one solution_. We can ask z3 to give us another solution as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.379912Z",
     "iopub.status.busy": "2024-04-27T13:49:08.379808Z",
     "iopub.status.idle": "2024-04-27T13:49:08.388191Z",
     "shell.execute_reply": "2024-04-27T13:49:08.387933Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[x = 1/2]\n"
     ]
    }
   ],
   "source": [
    "z3.solve(x != 5, eqn)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Indeed, both `x = 5` and `x = 1/2` are solutions to the quadratic equation $2x^2 -11x + 5 = 0$"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Similarly, we can ask *Z3* for an input that satisfies the constraint encoded in line 2 of `factorial()` so that we take the `if` branch."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.389793Z",
     "iopub.status.busy": "2024-04-27T13:49:08.389692Z",
     "iopub.status.idle": "2024-04-27T13:49:08.397509Z",
     "shell.execute_reply": "2024-04-27T13:49:08.397145Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[n = -1]\n"
     ]
    }
   ],
   "source": [
    "z3.solve(zn < 0)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "That is, if one uses `-1` as an input to `factorial()`, it is guaranteed to take the `if` branch in line 2 during execution."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Let us try using that with our coverage. Here, the `-1` is the solution from above."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.399206Z",
     "iopub.status.busy": "2024-04-27T13:49:08.399077Z",
     "iopub.status.idle": "2024-04-27T13:49:08.418385Z",
     "shell.execute_reply": "2024-04-27T13:49:08.417992Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "with cov as cov:\n",
    "    factorial(-1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.420504Z",
     "iopub.status.busy": "2024-04-27T13:49:08.420348Z",
     "iopub.status.idle": "2024-04-27T13:49:08.843083Z",
     "shell.execute_reply": "2024-04-27T13:49:08.842579Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "image/svg+xml": [
       "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\n",
       "<!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\"\n",
       " \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n",
       "<!-- Generated by graphviz version 9.0.0 (20230911.1827)\n",
       " -->\n",
       "<!-- Pages: 1 -->\n",
       "<svg width=\"418pt\" height=\"564pt\"\n",
       " viewBox=\"0.00 0.00 418.25 564.00\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n",
       "<g id=\"graph0\" class=\"graph\" transform=\"scale(1 1) rotate(0) translate(4 560)\">\n",
       "<polygon fill=\"white\" stroke=\"none\" points=\"-4,4 -4,-560 414.25,-560 414.25,4 -4,4\"/>\n",
       "<!-- 1 -->\n",
       "<g id=\"node1\" class=\"node\">\n",
       "<title>1</title>\n",
       "<ellipse fill=\"none\" stroke=\"black\" cx=\"98.75\" cy=\"-534\" rx=\"79.82\" ry=\"18\"/>\n",
       "<ellipse fill=\"none\" stroke=\"black\" cx=\"98.75\" cy=\"-534\" rx=\"83.82\" ry=\"22\"/>\n",
       "<text text-anchor=\"middle\" x=\"98.75\" y=\"-527.83\" font-family=\"Times,serif\" font-size=\"14.00\">1: enter: factorial(n)</text>\n",
       "</g>\n",
       "<!-- 3 -->\n",
       "<g id=\"node7\" class=\"node\">\n",
       "<title>3</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"98.75,-476 31.06,-458 98.75,-440 166.44,-458 98.75,-476\"/>\n",
       "<text text-anchor=\"middle\" x=\"98.75\" y=\"-451.82\" font-family=\"Times,serif\" font-size=\"14.00\">2: if: n &lt; 0</text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;3 -->\n",
       "<g id=\"edge5\" class=\"edge\">\n",
       "<title>1&#45;&gt;3</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M98.75,-511.6C98.75,-504.11 98.75,-495.59 98.75,-487.61\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"102.25,-487.65 98.75,-477.65 95.25,-487.65 102.25,-487.65\"/>\n",
       "</g>\n",
       "<!-- 2 -->\n",
       "<g id=\"node2\" class=\"node\">\n",
       "<title>2</title>\n",
       "<ellipse fill=\"none\" stroke=\"black\" cx=\"142.75\" cy=\"-22\" rx=\"75.53\" ry=\"18\"/>\n",
       "<ellipse fill=\"none\" stroke=\"black\" cx=\"142.75\" cy=\"-22\" rx=\"79.53\" ry=\"22\"/>\n",
       "<text text-anchor=\"middle\" x=\"142.75\" y=\"-15.82\" font-family=\"Times,serif\" font-size=\"14.00\">1: exit: factorial(n)</text>\n",
       "</g>\n",
       "<!-- 4 -->\n",
       "<g id=\"node3\" class=\"node\">\n",
       "<title>4</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"95.5,-188 0,-188 0,-152 95.5,-152 95.5,-188\"/>\n",
       "<text text-anchor=\"middle\" x=\"47.75\" y=\"-163.82\" font-family=\"Times,serif\" font-size=\"14.00\">3: return None</text>\n",
       "</g>\n",
       "<!-- 4&#45;&gt;2 -->\n",
       "<g id=\"edge1\" class=\"edge\">\n",
       "<title>4&#45;&gt;2</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M59.02,-151.68C74.74,-127.52 103.5,-83.33 122.86,-53.56\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"125.7,-55.63 128.22,-45.34 119.83,-51.81 125.7,-55.63\"/>\n",
       "</g>\n",
       "<!-- 6 -->\n",
       "<g id=\"node4\" class=\"node\">\n",
       "<title>6</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"160.25,-332 87.25,-332 87.25,-296 160.25,-296 160.25,-332\"/>\n",
       "<text text-anchor=\"middle\" x=\"123.75\" y=\"-307.82\" font-family=\"Times,serif\" font-size=\"14.00\">6: return 1</text>\n",
       "</g>\n",
       "<!-- 6&#45;&gt;2 -->\n",
       "<g id=\"edge2\" class=\"edge\">\n",
       "<title>6&#45;&gt;2</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M124.88,-295.73C127.97,-248.63 136.57,-117.38 140.6,-55.75\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"144.09,-56.12 141.25,-45.91 137.1,-55.66 144.09,-56.12\"/>\n",
       "</g>\n",
       "<!-- 8 -->\n",
       "<g id=\"node5\" class=\"node\">\n",
       "<title>8</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"230.25,-260 157.25,-260 157.25,-224 230.25,-224 230.25,-260\"/>\n",
       "<text text-anchor=\"middle\" x=\"193.75\" y=\"-235.82\" font-family=\"Times,serif\" font-size=\"14.00\">9: return 1</text>\n",
       "</g>\n",
       "<!-- 8&#45;&gt;2 -->\n",
       "<g id=\"edge3\" class=\"edge\">\n",
       "<title>8&#45;&gt;2</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M189.66,-223.53C181.12,-187.02 161.27,-102.15 150.32,-55.37\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"153.78,-54.77 148.09,-45.83 146.96,-56.36 153.78,-54.77\"/>\n",
       "</g>\n",
       "<!-- 13 -->\n",
       "<g id=\"node6\" class=\"node\">\n",
       "<title>13</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"269.62,-116 189.88,-116 189.88,-80 269.62,-80 269.62,-116\"/>\n",
       "<text text-anchor=\"middle\" x=\"229.75\" y=\"-91.83\" font-family=\"Times,serif\" font-size=\"14.00\">16: return v</text>\n",
       "</g>\n",
       "<!-- 13&#45;&gt;2 -->\n",
       "<g id=\"edge4\" class=\"edge\">\n",
       "<title>13&#45;&gt;2</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M209.57,-79.84C199.33,-71.13 186.64,-60.33 175.08,-50.5\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"177.56,-48.01 167.68,-44.2 173.03,-53.35 177.56,-48.01\"/>\n",
       "</g>\n",
       "<!-- 3&#45;&gt;4 -->\n",
       "<g id=\"edge6\" class=\"edge\">\n",
       "<title>3&#45;&gt;4</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M87.53,-442.6C80.25,-432.41 71.31,-418.12 66.75,-404 43.96,-333.39 44.03,-244.81 45.93,-199.93\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"49.42,-200.15 46.42,-189.99 42.43,-199.81 49.42,-200.15\"/>\n",
       "</g>\n",
       "<!-- 5 -->\n",
       "<g id=\"node8\" class=\"node\">\n",
       "<title>5</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"150.75,-404 75.64,-386 150.75,-368 225.86,-386 150.75,-404\"/>\n",
       "<text text-anchor=\"middle\" x=\"150.75\" y=\"-379.82\" font-family=\"Times,serif\" font-size=\"14.00\">5: if: n == 0</text>\n",
       "</g>\n",
       "<!-- 3&#45;&gt;5 -->\n",
       "<g id=\"edge7\" class=\"edge\">\n",
       "<title>3&#45;&gt;5</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M109.52,-442.5C116.36,-433.3 125.36,-421.18 133.2,-410.62\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"135.93,-412.82 139.09,-402.7 130.31,-408.64 135.93,-412.82\"/>\n",
       "</g>\n",
       "<!-- 5&#45;&gt;6 -->\n",
       "<g id=\"edge8\" class=\"edge\">\n",
       "<title>5&#45;&gt;6</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M144.62,-369.12C141.65,-361.4 137.98,-351.9 134.56,-343.02\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"137.83,-341.77 130.96,-333.7 131.3,-344.29 137.83,-341.77\"/>\n",
       "</g>\n",
       "<!-- 7 -->\n",
       "<g id=\"node9\" class=\"node\">\n",
       "<title>7</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"253.75,-332 178.64,-314 253.75,-296 328.86,-314 253.75,-332\"/>\n",
       "<text text-anchor=\"middle\" x=\"253.75\" y=\"-307.82\" font-family=\"Times,serif\" font-size=\"14.00\">8: if: n == 1</text>\n",
       "</g>\n",
       "<!-- 5&#45;&gt;7 -->\n",
       "<g id=\"edge9\" class=\"edge\">\n",
       "<title>5&#45;&gt;7</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M169.64,-372.16C185.32,-361.5 207.85,-346.19 225.65,-334.1\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"227.42,-337.12 233.73,-328.61 223.49,-331.33 227.42,-337.12\"/>\n",
       "</g>\n",
       "<!-- 7&#45;&gt;8 -->\n",
       "<g id=\"edge10\" class=\"edge\">\n",
       "<title>7&#45;&gt;8</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M241.32,-298.5C234.06,-290.03 224.7,-279.1 216.19,-269.18\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"218.86,-266.92 209.7,-261.61 213.55,-271.48 218.86,-266.92\"/>\n",
       "</g>\n",
       "<!-- 9 -->\n",
       "<g id=\"node10\" class=\"node\">\n",
       "<title>9</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"316.88,-260 250.62,-260 250.62,-224 316.88,-224 316.88,-260\"/>\n",
       "<text text-anchor=\"middle\" x=\"283.75\" y=\"-235.82\" font-family=\"Times,serif\" font-size=\"14.00\">11: v = 1</text>\n",
       "</g>\n",
       "<!-- 7&#45;&gt;9 -->\n",
       "<g id=\"edge11\" class=\"edge\">\n",
       "<title>7&#45;&gt;9</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M260.41,-297.46C263.75,-289.68 267.89,-280 271.76,-270.98\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"274.95,-272.42 275.67,-261.85 268.51,-269.66 274.95,-272.42\"/>\n",
       "</g>\n",
       "<!-- 10 -->\n",
       "<g id=\"node11\" class=\"node\">\n",
       "<title>10</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"308.75,-188 211.38,-170 308.75,-152 406.12,-170 308.75,-188\"/>\n",
       "<text text-anchor=\"middle\" x=\"308.75\" y=\"-163.82\" font-family=\"Times,serif\" font-size=\"14.00\">12: while: n != 0</text>\n",
       "</g>\n",
       "<!-- 9&#45;&gt;10 -->\n",
       "<g id=\"edge12\" class=\"edge\">\n",
       "<title>9&#45;&gt;10</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M289.93,-223.7C292.7,-215.93 296.04,-206.58 299.13,-197.93\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"302.41,-199.16 302.48,-188.57 295.82,-196.81 302.41,-199.16\"/>\n",
       "</g>\n",
       "<!-- 10&#45;&gt;13 -->\n",
       "<g id=\"edge16\" class=\"edge\">\n",
       "<title>10&#45;&gt;13</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M292.76,-154.83C282.78,-145.98 269.63,-134.34 257.94,-123.98\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"260.29,-121.38 250.48,-117.37 255.65,-126.62 260.29,-121.38\"/>\n",
       "</g>\n",
       "<!-- 11 -->\n",
       "<g id=\"node13\" class=\"node\">\n",
       "<title>11</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"375.38,-116 288.12,-116 288.12,-80 375.38,-80 375.38,-116\"/>\n",
       "<text text-anchor=\"middle\" x=\"331.75\" y=\"-91.83\" font-family=\"Times,serif\" font-size=\"14.00\">13: v = v * n</text>\n",
       "</g>\n",
       "<!-- 10&#45;&gt;11 -->\n",
       "<g id=\"edge14\" class=\"edge\">\n",
       "<title>10&#45;&gt;11</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M314.08,-152.76C316.62,-145.04 319.73,-135.59 322.63,-126.77\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"325.85,-128.15 325.65,-117.56 319.2,-125.97 325.85,-128.15\"/>\n",
       "</g>\n",
       "<!-- 12 -->\n",
       "<g id=\"node12\" class=\"node\">\n",
       "<title>12</title>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"410.25,-40 325.25,-40 325.25,-4 410.25,-4 410.25,-40\"/>\n",
       "<text text-anchor=\"middle\" x=\"367.75\" y=\"-15.82\" font-family=\"Times,serif\" font-size=\"14.00\">14: n = n &#45; 1</text>\n",
       "</g>\n",
       "<!-- 12&#45;&gt;10 -->\n",
       "<g id=\"edge13\" class=\"edge\">\n",
       "<title>12&#45;&gt;10</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M377.25,-40.44C386.46,-59.91 397.35,-91.84 384.75,-116 376.77,-131.3 362.14,-143.08 347.83,-151.6\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"346.45,-148.37 339.38,-156.26 349.83,-154.5 346.45,-148.37\"/>\n",
       "</g>\n",
       "<!-- 11&#45;&gt;12 -->\n",
       "<g id=\"edge15\" class=\"edge\">\n",
       "<title>11&#45;&gt;12</title>\n",
       "<path fill=\"none\" stroke=\"green\" d=\"M340.1,-79.84C344.34,-71.12 349.6,-60.32 354.38,-50.48\"/>\n",
       "<polygon fill=\"green\" stroke=\"green\" points=\"357.43,-52.21 358.66,-41.69 351.14,-49.15 357.43,-52.21\"/>\n",
       "</g>\n",
       "</g>\n",
       "</svg>\n"
      ],
      "text/plain": [
       "<graphviz.graphs.Digraph at 0x12d5a2230>"
      ]
     },
     "execution_count": 28,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "to_graph(gen_cfg(inspect.getsource(factorial)), arcs=cov.arcs())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Ok, so we have managed to cover a little more of the graph. Let us continue with our original input of `factorial(5)`:\n",
    "* In line (5) we encounter a new predicate `n == 0`, for which we again took the false branch."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.845438Z",
     "iopub.status.busy": "2024-04-27T13:49:08.845064Z",
     "iopub.status.idle": "2024-04-27T13:49:08.848497Z",
     "shell.execute_reply": "2024-04-27T13:49:08.847907Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'    if n == 0:'"
      ]
     },
     "execution_count": 29,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "src[5]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The predicates required, to follow the path until this point are as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.850887Z",
     "iopub.status.busy": "2024-04-27T13:49:08.850776Z",
     "iopub.status.idle": "2024-04-27T13:49:08.853343Z",
     "shell.execute_reply": "2024-04-27T13:49:08.853012Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "predicates = [z3.Not(zn < 0), z3.Not(zn == 0)]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "* If we continue to line (8), we encounter another predicate, for which again, we took the `false` branch"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.855287Z",
     "iopub.status.busy": "2024-04-27T13:49:08.855140Z",
     "iopub.status.idle": "2024-04-27T13:49:08.857361Z",
     "shell.execute_reply": "2024-04-27T13:49:08.857104Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'    if n == 1:'"
      ]
     },
     "execution_count": 31,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "src[8]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The predicates encountered so far are as follows"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.859000Z",
     "iopub.status.busy": "2024-04-27T13:49:08.858884Z",
     "iopub.status.idle": "2024-04-27T13:49:08.861257Z",
     "shell.execute_reply": "2024-04-27T13:49:08.861006Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "predicates = [z3.Not(zn < 0), z3.Not(zn == 0), z3.Not(zn == 1)]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "To take the branch at (6), we essentially have to obey the predicates until that point, but invert the last predicate."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 33,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.862837Z",
     "iopub.status.busy": "2024-04-27T13:49:08.862709Z",
     "iopub.status.idle": "2024-04-27T13:49:08.871562Z",
     "shell.execute_reply": "2024-04-27T13:49:08.871281Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[n = 1]\n"
     ]
    }
   ],
   "source": [
    "last = len(predicates) - 1\n",
    "z3.solve(predicates[0:-1] + [z3.Not(predicates[-1])])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "What we are doing here is tracing the execution corresponding to a particular input `factorial(5)`, using concrete values, and along with it, keeping *symbolic shadow variables* that enable us to capture the constraints. As we mentioned in the introduction, this particular method of execution where one tracks concrete  execution using symbolic variables is called *Concolic Execution*.\n",
    "\n",
    "How do we automate this process? One method is to use a similar infrastructure as that of the chapter on [information flow](InformationFlow.ipynb), and use the Python inheritance to create _symbolic proxy objects_ that can track the concrete execution."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    },
    "tags": [],
    "toc-nb-collapsed": true
   },
   "source": [
    "## A Concolic Tracer\n",
    "\n",
    "Let us now define a class to _collect_ symbolic variables and path conditions during an execution. The idea is to have a `ConcolicTracer` class that is invoked in a `with` block. To execute a function while tracing its path conditions, we need to _transform_ its arguments, which we do by invoking functions through a `[]` item access.\n",
    "\n",
    "This is a typical usage of a `ConcolicTracer`:\n",
    "\n",
    "```python\n",
    "with ConcolicTracer as _:\n",
    "    _.[function](args, ...)\n",
    "```\n",
    "\n",
    "After execution, we can access the symbolic variables in the `decls` attribute:\n",
    "\n",
    "```python\n",
    "_.decls\n",
    "```\n",
    "\n",
    "whereas the `path` attribute lists the precondition paths encountered:\n",
    "\n",
    "```python\n",
    "_.path\n",
    "```\n",
    "\n",
    "The `context` attribute contains a pair of declarations and paths:\n",
    "\n",
    "```python\n",
    "_.context\n",
    "```\n",
    "\n",
    "If you read this for the first time, skip the implementation and head right to the examples."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    },
    "tags": []
   },
   "source": [
    "### Excursion: Implementing ConcolicTracer"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Let us now implement `ConcolicTracer`.\n",
    " Its constructor accepts a single `context` argument which contains the declarations for the symbolic variables seen so far, and path conditions seen so far. We only need this in case of nested contexts."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 34,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.873455Z",
     "iopub.status.busy": "2024-04-27T13:49:08.873321Z",
     "iopub.status.idle": "2024-04-27T13:49:08.875709Z",
     "shell.execute_reply": "2024-04-27T13:49:08.875305Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class ConcolicTracer:\n",
    "    \"\"\"Trace function execution, tracking variables and path conditions\"\"\"\n",
    "\n",
    "    def __init__(self, context=None):\n",
    "        \"\"\"Constructor.\"\"\"\n",
    "        self.context = context if context is not None else ({}, [])\n",
    "        self.decls, self.path = self.context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We add the enter and exit methods for the `with` block."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.877758Z",
     "iopub.status.busy": "2024-04-27T13:49:08.877608Z",
     "iopub.status.idle": "2024-04-27T13:49:08.879646Z",
     "shell.execute_reply": "2024-04-27T13:49:08.879394Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ConcolicTracer(ConcolicTracer):\n",
    "    def __enter__(self):\n",
    "        return self\n",
    "\n",
    "    def __exit__(self, exc_type, exc_value, tb):\n",
    "        return"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We use introspection to determine the arguments to the function, which is hooked into the `getitem()` method."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 36,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.881327Z",
     "iopub.status.busy": "2024-04-27T13:49:08.881177Z",
     "iopub.status.idle": "2024-04-27T13:49:08.883139Z",
     "shell.execute_reply": "2024-04-27T13:49:08.882899Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class ConcolicTracer(ConcolicTracer):\n",
    "    def __getitem__(self, fn):\n",
    "        self.fn = fn\n",
    "        self.fn_args = {i: None for i in inspect.signature(fn).parameters}\n",
    "        return self"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Finally, the function itself is invoked using the `call` method."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 37,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.884608Z",
     "iopub.status.busy": "2024-04-27T13:49:08.884484Z",
     "iopub.status.idle": "2024-04-27T13:49:08.886504Z",
     "shell.execute_reply": "2024-04-27T13:49:08.886235Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ConcolicTracer(ConcolicTracer):\n",
    "    def __call__(self, *args):\n",
    "        self.result = self.fn(*self.concolic(args))\n",
    "        return self.result"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "For now, we define `concolic()` as a transparent function. It will be modified to produce symbolic variables later."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.888037Z",
     "iopub.status.busy": "2024-04-27T13:49:08.887902Z",
     "iopub.status.idle": "2024-04-27T13:49:08.889656Z",
     "shell.execute_reply": "2024-04-27T13:49:08.889359Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class ConcolicTracer(ConcolicTracer):\n",
    "    def concolic(self, args):\n",
    "        return args"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We now have things in place for _tracing_ functions:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 39,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.891365Z",
     "iopub.status.busy": "2024-04-27T13:49:08.891210Z",
     "iopub.status.idle": "2024-04-27T13:49:08.893088Z",
     "shell.execute_reply": "2024-04-27T13:49:08.892799Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    _[factorial](1)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "And for retrieving results (but not actually _computing_ them):"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.894692Z",
     "iopub.status.busy": "2024-04-27T13:49:08.894585Z",
     "iopub.status.idle": "2024-04-27T13:49:08.896757Z",
     "shell.execute_reply": "2024-04-27T13:49:08.896521Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{}"
      ]
     },
     "execution_count": 40,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.decls"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.898521Z",
     "iopub.status.busy": "2024-04-27T13:49:08.898365Z",
     "iopub.status.idle": "2024-04-27T13:49:08.900634Z",
     "shell.execute_reply": "2024-04-27T13:49:08.900369Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[]"
      ]
     },
     "execution_count": 41,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.path"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Both `decls` and `path` attributes will be set by concolic proxy objects, which we define next."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    },
    "tags": [],
    "toc-hr-collapsed": true
   },
   "source": [
    "#### Concolic Proxy Objects\n",
    "\n",
    "We now define the concolic proxy objects that can be used for concolic tracing. First, we define the `zproxy_create()` method that given a class name, correctly creates an instance of that class, and the symbolic corresponding variable, and registers the symbolic variable in the context information `context`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.902195Z",
     "iopub.status.busy": "2024-04-27T13:49:08.902090Z",
     "iopub.status.idle": "2024-04-27T13:49:08.903911Z",
     "shell.execute_reply": "2024-04-27T13:49:08.903633Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def zproxy_create(cls, z_type, z3var, context, z_name, v=None):\n",
    "    z_value = cls(context, z3var(z_name), v)\n",
    "    context[0][z_name] = z_type  # add to decls\n",
    "    return z_value"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    },
    "toc-hr-collapsed": false
   },
   "source": [
    "#### A Proxy Class for Booleans\n",
    "\n",
    "First, we define the `zbool` class which is used to track the predicates encountered. It is a wrapper class that contains both symbolic (`z`) and concrete (`v`) values. The concrete value is used to determine which path to take, and the symbolic value is used to collect the predicates encountered.\n",
    "\n",
    "The initialization is done in two parts. The first one is using `zproxy_create()` to correctly initialize and register the shadow symbolic variable corresponding to the passed argument. This is used exclusively when the symbolic variable needs to be initialized first. In all other cases, the constructor is called with the preexisting symbolic value."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 43,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.905338Z",
     "iopub.status.busy": "2024-04-27T13:49:08.905238Z",
     "iopub.status.idle": "2024-04-27T13:49:08.908263Z",
     "shell.execute_reply": "2024-04-27T13:49:08.907862Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zbool:\n",
    "    @classmethod\n",
    "    def create(cls, context, z_name, v):\n",
    "        return zproxy_create(cls, 'Bool', z3.Bool, context, z_name, v)\n",
    "\n",
    "    def __init__(self, context, z, v=None):\n",
    "        self.context = context\n",
    "        self.z = z\n",
    "        self.v = v\n",
    "        self.decl, self.path = self.context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Here is how it is used. We create a symbolic variable `my_bool_arg` with a value of `True` in the current context of the concolic tracer:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 44,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.910043Z",
     "iopub.status.busy": "2024-04-27T13:49:08.909937Z",
     "iopub.status.idle": "2024-04-27T13:49:08.911918Z",
     "shell.execute_reply": "2024-04-27T13:49:08.911623Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    val = zbool.create(_.context, 'my_bool_arg', True)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can now access the symbolic name in the `z` attribute:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.913473Z",
     "iopub.status.busy": "2024-04-27T13:49:08.913376Z",
     "iopub.status.idle": "2024-04-27T13:49:08.916280Z",
     "shell.execute_reply": "2024-04-27T13:49:08.915904Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "my_bool_arg"
      ],
      "text/plain": [
       "my_bool_arg"
      ]
     },
     "execution_count": 45,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "val.z"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The value is in the `v` attribute:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 46,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.918217Z",
     "iopub.status.busy": "2024-04-27T13:49:08.918066Z",
     "iopub.status.idle": "2024-04-27T13:49:08.920408Z",
     "shell.execute_reply": "2024-04-27T13:49:08.920035Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "True"
      ]
     },
     "execution_count": 46,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "val.v"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Note that the context of the enclosing `ConcolicTracer()` is automatically updated (via `zproxy_create()`) to hold the variable declarations and types:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 47,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.922128Z",
     "iopub.status.busy": "2024-04-27T13:49:08.921845Z",
     "iopub.status.idle": "2024-04-27T13:49:08.924066Z",
     "shell.execute_reply": "2024-04-27T13:49:08.923760Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'my_bool_arg': 'Bool'}, [])"
      ]
     },
     "execution_count": 47,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The context can also be reached through the `context` attribute; both point to the same data structure."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 48,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.925514Z",
     "iopub.status.busy": "2024-04-27T13:49:08.925414Z",
     "iopub.status.idle": "2024-04-27T13:49:08.927483Z",
     "shell.execute_reply": "2024-04-27T13:49:08.927231Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'my_bool_arg': 'Bool'}, [])"
      ]
     },
     "execution_count": 48,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "val.context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Negation of Encoded formula\n",
    "\n",
    "The `zbool` class allows negation of its concrete and symbolic values."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 49,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.929293Z",
     "iopub.status.busy": "2024-04-27T13:49:08.929158Z",
     "iopub.status.idle": "2024-04-27T13:49:08.931157Z",
     "shell.execute_reply": "2024-04-27T13:49:08.930865Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zbool(zbool):\n",
    "    def __not__(self):\n",
    "        return zbool(self.context, z3.Not(self.z), not self.v)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Here is how it can be used."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 50,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.932862Z",
     "iopub.status.busy": "2024-04-27T13:49:08.932730Z",
     "iopub.status.idle": "2024-04-27T13:49:08.935077Z",
     "shell.execute_reply": "2024-04-27T13:49:08.934712Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    val = zbool.create(_.context, 'my_bool_arg', True).__not__()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 51,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.936794Z",
     "iopub.status.busy": "2024-04-27T13:49:08.936557Z",
     "iopub.status.idle": "2024-04-27T13:49:08.939095Z",
     "shell.execute_reply": "2024-04-27T13:49:08.938829Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "&not;my_bool_arg"
      ],
      "text/plain": [
       "Not(my_bool_arg)"
      ]
     },
     "execution_count": 51,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "val.z"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 52,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.940561Z",
     "iopub.status.busy": "2024-04-27T13:49:08.940432Z",
     "iopub.status.idle": "2024-04-27T13:49:08.942522Z",
     "shell.execute_reply": "2024-04-27T13:49:08.942237Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "False"
      ]
     },
     "execution_count": 52,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "val.v"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 53,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.944051Z",
     "iopub.status.busy": "2024-04-27T13:49:08.943930Z",
     "iopub.status.idle": "2024-04-27T13:49:08.946358Z",
     "shell.execute_reply": "2024-04-27T13:49:08.945971Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'my_bool_arg': 'Bool'}, [])"
      ]
     },
     "execution_count": 53,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Registering Predicates on Conditionals\n",
    "\n",
    "The `zbool` class is being used to track Boolean conditions that arise during program execution. It tracks such conditions by registering the corresponding symbolic expressions in the context as soon as it is evaluated. On evaluation, the `__bool__()` method is called; so we can hook into this one:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 54,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.947964Z",
     "iopub.status.busy": "2024-04-27T13:49:08.947748Z",
     "iopub.status.idle": "2024-04-27T13:49:08.950005Z",
     "shell.execute_reply": "2024-04-27T13:49:08.949699Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zbool(zbool):\n",
    "    def __bool__(self):\n",
    "        r, pred = (True, self.z) if self.v else (False, z3.Not(self.z))\n",
    "        self.path.append(pred)\n",
    "        return r"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `zbool` class can be used to keep track of Boolean values and conditions encountered during the execution. For example, we can encode the conditions encountered by Line 6 in `factorial()` as follows:"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "First, we define the concrete value (`ca`), and its shadow symbolic variable (`za`)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 55,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.951749Z",
     "iopub.status.busy": "2024-04-27T13:49:08.951633Z",
     "iopub.status.idle": "2024-04-27T13:49:08.953336Z",
     "shell.execute_reply": "2024-04-27T13:49:08.953102Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "ca = 5\n",
    "za = z3.Int('a')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Then, we wrap it in `zbool`, and use it in a conditional, forcing the conditional to be registered in the context."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 56,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.955061Z",
     "iopub.status.busy": "2024-04-27T13:49:08.954927Z",
     "iopub.status.idle": "2024-04-27T13:49:08.957316Z",
     "shell.execute_reply": "2024-04-27T13:49:08.957057Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "success\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    if zbool(_.context, za == z3.IntVal(5), ca == 5):\n",
    "        print('success')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can retrieve the registered conditional as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 57,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.959105Z",
     "iopub.status.busy": "2024-04-27T13:49:08.958988Z",
     "iopub.status.idle": "2024-04-27T13:49:08.961761Z",
     "shell.execute_reply": "2024-04-27T13:49:08.961433Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[5 == a]"
      ]
     },
     "execution_count": 57,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.path"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    },
    "toc-hr-collapsed": false
   },
   "source": [
    "#### A Proxy Class for Integers"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Next, we define a symbolic wrapper `zint` for `int`.\n",
    "This class keeps track of the `int` variables used and the predicates encountered in `context`. Finally, it also keeps the concrete value so that it can be used to determine the path to take. As the `zint` extends the primitive `int` class, we have to define a _new_ method to open it for extension."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 58,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.963419Z",
     "iopub.status.busy": "2024-04-27T13:49:08.963310Z",
     "iopub.status.idle": "2024-04-27T13:49:08.965158Z",
     "shell.execute_reply": "2024-04-27T13:49:08.964895Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zint(int):\n",
    "    def __new__(cls, context, zn, v, *args, **kw):\n",
    "        return int.__new__(cls, v, *args, **kw)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "As in the case of `zbool`, the initialization takes place in two parts. The first using `create()` if a new symbolic argument is being registered, and then the usual initialization."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 59,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.966796Z",
     "iopub.status.busy": "2024-04-27T13:49:08.966680Z",
     "iopub.status.idle": "2024-04-27T13:49:08.968907Z",
     "shell.execute_reply": "2024-04-27T13:49:08.968665Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zint(zint):\n",
    "    @classmethod\n",
    "    def create(cls, context, zn, v=None):\n",
    "        return zproxy_create(cls, 'Int', z3.Int, context, zn, v)\n",
    "\n",
    "    def __init__(self, context, z, v=None):\n",
    "        self.z, self.v = z, v\n",
    "        self.context = context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `int` value of a `zint` object is its concrete value."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 60,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.970506Z",
     "iopub.status.busy": "2024-04-27T13:49:08.970355Z",
     "iopub.status.idle": "2024-04-27T13:49:08.972346Z",
     "shell.execute_reply": "2024-04-27T13:49:08.971997Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zint(zint):\n",
    "    def __int__(self):\n",
    "        return self.v\n",
    "\n",
    "    def __pos__(self):\n",
    "        return self.v"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Using these proxies is as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 61,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.973926Z",
     "iopub.status.busy": "2024-04-27T13:49:08.973814Z",
     "iopub.status.idle": "2024-04-27T13:49:08.975614Z",
     "shell.execute_reply": "2024-04-27T13:49:08.975304Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    val = zint.create(_.context, 'int_arg', 0)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 62,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.977423Z",
     "iopub.status.busy": "2024-04-27T13:49:08.977298Z",
     "iopub.status.idle": "2024-04-27T13:49:08.979620Z",
     "shell.execute_reply": "2024-04-27T13:49:08.979375Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "int_arg"
      ],
      "text/plain": [
       "int_arg"
      ]
     },
     "execution_count": 62,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "val.z"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 63,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.981195Z",
     "iopub.status.busy": "2024-04-27T13:49:08.981064Z",
     "iopub.status.idle": "2024-04-27T13:49:08.983207Z",
     "shell.execute_reply": "2024-04-27T13:49:08.982946Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0"
      ]
     },
     "execution_count": 63,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "val.v"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 64,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.984897Z",
     "iopub.status.busy": "2024-04-27T13:49:08.984787Z",
     "iopub.status.idle": "2024-04-27T13:49:08.987089Z",
     "shell.execute_reply": "2024-04-27T13:49:08.986769Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'int_arg': 'Int'}, [])"
      ]
     },
     "execution_count": 64,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `zint` class is often used to do arithmetic with, or compare to other `int`s. These `int`s can be either a variable or a constant value. We define a helper method `_zv()` that checks what kind of `int` a given value is, and produces the correct symbolic equivalent."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 65,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.988717Z",
     "iopub.status.busy": "2024-04-27T13:49:08.988604Z",
     "iopub.status.idle": "2024-04-27T13:49:08.990452Z",
     "shell.execute_reply": "2024-04-27T13:49:08.990213Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zint(zint):\n",
    "    def _zv(self, o):\n",
    "        return (o.z, o.v) if isinstance(o, zint) else (z3.IntVal(o), o)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "It can be used as follows"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 66,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.991943Z",
     "iopub.status.busy": "2024-04-27T13:49:08.991827Z",
     "iopub.status.idle": "2024-04-27T13:49:08.993548Z",
     "shell.execute_reply": "2024-04-27T13:49:08.993213Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    val = zint.create(_.context, 'int_arg', 0)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 67,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.995263Z",
     "iopub.status.busy": "2024-04-27T13:49:08.995140Z",
     "iopub.status.idle": "2024-04-27T13:49:08.997648Z",
     "shell.execute_reply": "2024-04-27T13:49:08.997314Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(0, 0)"
      ]
     },
     "execution_count": 67,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "val._zv(0)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 68,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:08.999207Z",
     "iopub.status.busy": "2024-04-27T13:49:08.999087Z",
     "iopub.status.idle": "2024-04-27T13:49:09.001356Z",
     "shell.execute_reply": "2024-04-27T13:49:09.001088Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(int_arg, 0)"
      ]
     },
     "execution_count": 68,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "val._zv(val)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Equality between Integers\n",
    "\n",
    "Two integers can be compared for equality using _ne_ and _eq_."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 69,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.003064Z",
     "iopub.status.busy": "2024-04-27T13:49:09.002877Z",
     "iopub.status.idle": "2024-04-27T13:49:09.005182Z",
     "shell.execute_reply": "2024-04-27T13:49:09.004916Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zint(zint):\n",
    "    def __ne__(self, other):\n",
    "        z, v = self._zv(other)\n",
    "        return zbool(self.context, self.z != z, self.v != v)\n",
    "\n",
    "    def __eq__(self, other):\n",
    "        z, v = self._zv(other)\n",
    "        return zbool(self.context, self.z == z, self.v == v)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    " We also define _req_ using _eq_ in case the int being compared is on the left-hand side."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 70,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.006637Z",
     "iopub.status.busy": "2024-04-27T13:49:09.006532Z",
     "iopub.status.idle": "2024-04-27T13:49:09.008338Z",
     "shell.execute_reply": "2024-04-27T13:49:09.008021Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zint(zint):\n",
    "    def __req__(self, other):\n",
    "        return self.__eq__(other)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "It can be used as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 71,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.009986Z",
     "iopub.status.busy": "2024-04-27T13:49:09.009857Z",
     "iopub.status.idle": "2024-04-27T13:49:09.013886Z",
     "shell.execute_reply": "2024-04-27T13:49:09.013492Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "int_a == int_b int_a != int_b 0 != int_b\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    ia = zint.create(_.context, 'int_a', 0)\n",
    "    ib = zint.create(_.context, 'int_b', 0)\n",
    "    v1 = ia == ib\n",
    "    v2 = ia != ib\n",
    "    v3 = 0 != ib\n",
    "    print(v1.z, v2.z, v3.z)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Comparisons between Integers\n",
    "\n",
    "Integers can also be compared for ordering, and the methods for this are defined below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 72,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.015711Z",
     "iopub.status.busy": "2024-04-27T13:49:09.015560Z",
     "iopub.status.idle": "2024-04-27T13:49:09.017892Z",
     "shell.execute_reply": "2024-04-27T13:49:09.017520Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zint(zint):\n",
    "    def __lt__(self, other):\n",
    "        z, v = self._zv(other)\n",
    "        return zbool(self.context, self.z < z, self.v < v)\n",
    "\n",
    "    def __gt__(self, other):\n",
    "        z, v = self._zv(other)\n",
    "        return zbool(self.context, self.z > z, self.v > v)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We use the comparisons and equality operators to provide the other missing operators."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 73,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.019905Z",
     "iopub.status.busy": "2024-04-27T13:49:09.019729Z",
     "iopub.status.idle": "2024-04-27T13:49:09.022404Z",
     "shell.execute_reply": "2024-04-27T13:49:09.022071Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zint(zint):\n",
    "    def __le__(self, other):\n",
    "        z, v = self._zv(other)\n",
    "        return zbool(self.context, z3.Or(self.z < z, self.z == z),\n",
    "                     self.v < v or self.v == v)\n",
    "\n",
    "    def __ge__(self, other):\n",
    "        z, v = self._zv(other)\n",
    "        return zbool(self.context, z3.Or(self.z > z, self.z == z),\n",
    "                     self.v > v or self.v == v)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "These functions can be used as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 74,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.024074Z",
     "iopub.status.busy": "2024-04-27T13:49:09.023959Z",
     "iopub.status.idle": "2024-04-27T13:49:09.029634Z",
     "shell.execute_reply": "2024-04-27T13:49:09.029340Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "int_a > int_b int_a < int_b\n",
      "Or(int_a > int_b, int_a == int_b) Or(int_a < int_b, int_a == int_b)\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    ia = zint.create(_.context, 'int_a', 0)\n",
    "    ib = zint.create(_.context, 'int_b', 1)\n",
    "    v1 = ia > ib\n",
    "    v2 = ia < ib\n",
    "    print(v1.z, v2.z)\n",
    "    v3 = ia >= ib\n",
    "    v4 = ia <= ib\n",
    "    print(v3.z, v4.z)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Binary Operators for Integers\n",
    "\n",
    "We implement relevant arithmetic operators for integers as described in the [Python documentation](https://docs.python.org/3/reference/datamodel.html#object.__add__). (The commented out operators are not directly available for `z3.ArithRef`. They need to be implemented separately if needed. See the exercises for how it can be done.)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 75,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.031276Z",
     "iopub.status.busy": "2024-04-27T13:49:09.031154Z",
     "iopub.status.idle": "2024-04-27T13:49:09.033323Z",
     "shell.execute_reply": "2024-04-27T13:49:09.032981Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "INT_BINARY_OPS = [\n",
    "    '__add__',\n",
    "    '__sub__',\n",
    "    '__mul__',\n",
    "    '__truediv__',\n",
    "    # '__div__',\n",
    "    '__mod__',\n",
    "    # '__divmod__',\n",
    "    '__pow__',\n",
    "    # '__lshift__',\n",
    "    # '__rshift__',\n",
    "    # '__and__',\n",
    "    # '__xor__',\n",
    "    # '__or__',\n",
    "    '__radd__',\n",
    "    '__rsub__',\n",
    "    '__rmul__',\n",
    "    '__rtruediv__',\n",
    "    # '__rdiv__',\n",
    "    '__rmod__',\n",
    "    # '__rdivmod__',\n",
    "    '__rpow__',\n",
    "    # '__rlshift__',\n",
    "    # '__rrshift__',\n",
    "    # '__rand__',\n",
    "    # '__rxor__',\n",
    "    # '__ror__',\n",
    "]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 76,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.035039Z",
     "iopub.status.busy": "2024-04-27T13:49:09.034914Z",
     "iopub.status.idle": "2024-04-27T13:49:09.037429Z",
     "shell.execute_reply": "2024-04-27T13:49:09.037159Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def make_int_binary_wrapper(fname, fun, zfun):  # type: ignore\n",
    "    def proxy(self, other):\n",
    "        z, v = self._zv(other)\n",
    "        z_ = zfun(self.z, z)\n",
    "        v_ = fun(self.v, v)\n",
    "        if isinstance(v_, float):\n",
    "            # we do not implement float results yet.\n",
    "            assert round(v_) == v_\n",
    "            v_ = round(v_)\n",
    "        return zint(self.context, z_, v_)\n",
    "\n",
    "    return proxy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 77,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.038918Z",
     "iopub.status.busy": "2024-04-27T13:49:09.038815Z",
     "iopub.status.idle": "2024-04-27T13:49:09.040569Z",
     "shell.execute_reply": "2024-04-27T13:49:09.040307Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "INITIALIZER_LIST: List[Callable] = []"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 78,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.042137Z",
     "iopub.status.busy": "2024-04-27T13:49:09.042023Z",
     "iopub.status.idle": "2024-04-27T13:49:09.043745Z",
     "shell.execute_reply": "2024-04-27T13:49:09.043474Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def initialize():\n",
    "    for fn in INITIALIZER_LIST:\n",
    "        fn()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 79,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.045134Z",
     "iopub.status.busy": "2024-04-27T13:49:09.045035Z",
     "iopub.status.idle": "2024-04-27T13:49:09.046907Z",
     "shell.execute_reply": "2024-04-27T13:49:09.046676Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def init_concolic_1():\n",
    "    for fname in INT_BINARY_OPS:\n",
    "        fun = getattr(int, fname)\n",
    "        zfun = getattr(z3.ArithRef, fname)\n",
    "        setattr(zint, fname, make_int_binary_wrapper(fname, fun, zfun))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 80,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.048421Z",
     "iopub.status.busy": "2024-04-27T13:49:09.048314Z",
     "iopub.status.idle": "2024-04-27T13:49:09.049979Z",
     "shell.execute_reply": "2024-04-27T13:49:09.049708Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "INITIALIZER_LIST.append(init_concolic_1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 81,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.051669Z",
     "iopub.status.busy": "2024-04-27T13:49:09.051513Z",
     "iopub.status.idle": "2024-04-27T13:49:09.053242Z",
     "shell.execute_reply": "2024-04-27T13:49:09.052935Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "init_concolic_1()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 82,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.054686Z",
     "iopub.status.busy": "2024-04-27T13:49:09.054577Z",
     "iopub.status.idle": "2024-04-27T13:49:09.060936Z",
     "shell.execute_reply": "2024-04-27T13:49:09.060682Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "int_a + int_b\n",
      "int_a + 10\n",
      "11 + int_b\n",
      "int_a - int_b\n",
      "int_a*int_b\n",
      "int_a/int_b\n",
      "int_a**int_b\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    ia = zint.create(_.context, 'int_a', 0)\n",
    "    ib = zint.create(_.context, 'int_b', 1)\n",
    "    print((ia + ib).z)\n",
    "    print((ia + 10).z)\n",
    "    print((11 + ib).z)\n",
    "    print((ia - ib).z)\n",
    "    print((ia * ib).z)\n",
    "    print((ia / ib).z)\n",
    "    print((ia ** ib).z)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Integer Unary Operators\n",
    "\n",
    "We also implement the relevant unary operators as below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 83,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.062518Z",
     "iopub.status.busy": "2024-04-27T13:49:09.062408Z",
     "iopub.status.idle": "2024-04-27T13:49:09.064218Z",
     "shell.execute_reply": "2024-04-27T13:49:09.063846Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "INT_UNARY_OPS = [\n",
    "    '__neg__',\n",
    "    '__pos__',\n",
    "    # '__abs__',\n",
    "    # '__invert__',\n",
    "    # '__round__',\n",
    "    # '__ceil__',\n",
    "    # '__floor__',\n",
    "    # '__trunc__',\n",
    "]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 84,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.065816Z",
     "iopub.status.busy": "2024-04-27T13:49:09.065694Z",
     "iopub.status.idle": "2024-04-27T13:49:09.067581Z",
     "shell.execute_reply": "2024-04-27T13:49:09.067312Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def make_int_unary_wrapper(fname, fun, zfun):\n",
    "    def proxy(self):\n",
    "        return zint(self.context, zfun(self.z), fun(self.v))\n",
    "\n",
    "    return proxy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 85,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.069167Z",
     "iopub.status.busy": "2024-04-27T13:49:09.068946Z",
     "iopub.status.idle": "2024-04-27T13:49:09.071024Z",
     "shell.execute_reply": "2024-04-27T13:49:09.070757Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def init_concolic_2():\n",
    "    for fname in INT_UNARY_OPS:\n",
    "        fun = getattr(int, fname)\n",
    "        zfun = getattr(z3.ArithRef, fname)\n",
    "        setattr(zint, fname, make_int_unary_wrapper(fname, fun, zfun))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 86,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.072783Z",
     "iopub.status.busy": "2024-04-27T13:49:09.072674Z",
     "iopub.status.idle": "2024-04-27T13:49:09.074321Z",
     "shell.execute_reply": "2024-04-27T13:49:09.074066Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "INITIALIZER_LIST.append(init_concolic_2)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 87,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.075944Z",
     "iopub.status.busy": "2024-04-27T13:49:09.075789Z",
     "iopub.status.idle": "2024-04-27T13:49:09.077643Z",
     "shell.execute_reply": "2024-04-27T13:49:09.077348Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "init_concolic_2()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can use the unary operators we defined above as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 88,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.079441Z",
     "iopub.status.busy": "2024-04-27T13:49:09.079323Z",
     "iopub.status.idle": "2024-04-27T13:49:09.081960Z",
     "shell.execute_reply": "2024-04-27T13:49:09.081556Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "-int_a\n",
      "int_a\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    ia = zint.create(_.context, 'int_a', 0)\n",
    "    print((-ia).z)\n",
    "    print((+ia).z)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Using an Integer in a Boolean Context\n",
    "\n",
    "An integer may be converted to a boolean context in conditionals or as part of boolean predicates such as `or`, `and` and `not`. In these cases, the `__bool__()` method gets called. Unfortunately, this method requires a primitive boolean value. Hence, we force the current integer formula to a boolean predicate and register it in the current context."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 89,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.083545Z",
     "iopub.status.busy": "2024-04-27T13:49:09.083436Z",
     "iopub.status.idle": "2024-04-27T13:49:09.085502Z",
     "shell.execute_reply": "2024-04-27T13:49:09.085201Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zint(zint):\n",
    "    def __bool__(self):\n",
    "        # return zbool(self.context, self.z, self.v) <-- not allowed\n",
    "        # force registering boolean condition\n",
    "        if self != 0:\n",
    "            return True\n",
    "        return False"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "It is used as follows"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 90,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.087082Z",
     "iopub.status.busy": "2024-04-27T13:49:09.086976Z",
     "iopub.status.idle": "2024-04-27T13:49:09.089206Z",
     "shell.execute_reply": "2024-04-27T13:49:09.088880Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    za = zint.create(_.context, 'int_a', 1)\n",
    "    zb = zint.create(_.context, 'int_b', 0)\n",
    "    if za and zb:\n",
    "        print(1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 91,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.090914Z",
     "iopub.status.busy": "2024-04-27T13:49:09.090783Z",
     "iopub.status.idle": "2024-04-27T13:49:09.094107Z",
     "shell.execute_reply": "2024-04-27T13:49:09.093840Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'int_a': 'Int', 'int_b': 'Int'}, [0 != int_a, Not(0 != int_b)])"
      ]
     },
     "execution_count": 91,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    },
    "toc-hr-collapsed": true
   },
   "source": [
    "#### Remaining Methods of the  ConcolicTracer\n",
    "\n",
    "We now complete some methods of the `ConcolicTracer`."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Translating to the SMT Expression Format\n",
    "\n",
    "Given that we are using an SMT Solver z3, it is often useful to retrieve the corresponding SMT expression for a symbolic expression. This can be used as an argument to `z3` or other SMT solvers.\n",
    "\n",
    "The format of the SMT expression ([SMT-LIB](http://smtlib.github.io/jSMTLIB/SMTLIBTutorial.pdf)) is as follows:\n",
    "\n",
    "* Variables declarations in [S-EXP](https://en.wikipedia.org/wiki/S-expression) format.\n",
    "  E.g. The following declares a symbolic integer variable `x`\n",
    "```\n",
    "(declare-const x Int)\n",
    "```\n",
    " This declares a `bit vector` `b` of length `8`\n",
    "```\n",
    "(declare-const b (_ BitVec 8))\n",
    "```\n",
    " This declares a symbolic real variable `r`\n",
    "```\n",
    "(declare-const x Real)\n",
    "```\n",
    " This declares a symbolic string variable `s`\n",
    "```\n",
    "(declare-const s String)\n",
    "```\n",
    "\n",
    "The declared variables can be used in logical formulas that are encoded in *S-EXP* format. For example, here is a logical formula.\n",
    "\n",
    "```\n",
    "(assert\n",
    "    (and\n",
    "        (= a b)\n",
    "        (= a c)\n",
    "        (! b c)))\n",
    "```\n",
    "Here is another example, using string variables.\n",
    "\n",
    "```\n",
    "(or (< 0 (str.indexof (str.substr my_str1 7 19) \" where \" 0))\n",
    "    (= (str.indexof (str.substr my_str1 7 19) \" where \" 0) 0))\n",
    "```\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 92,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.095920Z",
     "iopub.status.busy": "2024-04-27T13:49:09.095791Z",
     "iopub.status.idle": "2024-04-27T13:49:09.099102Z",
     "shell.execute_reply": "2024-04-27T13:49:09.098865Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ConcolicTracer(ConcolicTracer):\n",
    "    def smt_expr(self, show_decl=False, simplify=False, path=[]):\n",
    "        r = []\n",
    "        if show_decl:\n",
    "            for decl in self.decls:\n",
    "                v = self.decls[decl]\n",
    "                v = '(_ BitVec 8)' if v == 'BitVec' else v\n",
    "                r.append(\"(declare-const %s %s)\" % (decl, v))\n",
    "        path = path if path else self.path\n",
    "        if path:\n",
    "            path = z3.And(path)\n",
    "            if show_decl:\n",
    "                if simplify:\n",
    "                    return '\\n'.join([\n",
    "                        *r,\n",
    "                        \"(assert %s)\" % z3.simplify(path).sexpr()\n",
    "                    ])\n",
    "                else:\n",
    "                    return '\\n'.join(\n",
    "                        [*r, \"(assert %s)\" % path.sexpr()])\n",
    "            else:\n",
    "                return z3.simplify(path).sexpr()\n",
    "        else:\n",
    "            return ''"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "To see how to use `smt_expr()`, let us consider an example. The `triangle()` function is used to determine if the given sides to a triangle result in an `equilateral` triangle, an `isosceles` triangle, or a `scalene` triangle. It is implemented as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 93,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.100643Z",
     "iopub.status.busy": "2024-04-27T13:49:09.100548Z",
     "iopub.status.idle": "2024-04-27T13:49:09.103013Z",
     "shell.execute_reply": "2024-04-27T13:49:09.102654Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def triangle(a, b, c):\n",
    "    if a == b:\n",
    "        if b == c:\n",
    "            return 'equilateral'\n",
    "        else:\n",
    "            return 'isosceles'\n",
    "    else:\n",
    "        if b == c:\n",
    "            return 'isosceles'\n",
    "        else:\n",
    "            if a == c:\n",
    "                return 'isosceles'\n",
    "            else:\n",
    "                return 'scalene'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 94,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.104504Z",
     "iopub.status.busy": "2024-04-27T13:49:09.104394Z",
     "iopub.status.idle": "2024-04-27T13:49:09.106772Z",
     "shell.execute_reply": "2024-04-27T13:49:09.106415Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'isosceles'"
      ]
     },
     "execution_count": 94,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "triangle(1, 2, 1)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "To make `triangle()` run under `ConcolicTracer`, we first define the (symbolic) arguments. The triangle being defined has sides `1, 1, 1`. i.e. it is an `equilateral` triangle."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 95,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.108495Z",
     "iopub.status.busy": "2024-04-27T13:49:09.108389Z",
     "iopub.status.idle": "2024-04-27T13:49:09.111679Z",
     "shell.execute_reply": "2024-04-27T13:49:09.111432Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "({'int_a': 'Int', 'int_b': 'Int', 'int_c': 'Int'}, [int_a == int_b, int_b == int_c])\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    za = zint.create(_.context, 'int_a', 1)\n",
    "    zb = zint.create(_.context, 'int_b', 1)\n",
    "    zc = zint.create(_.context, 'int_c', 1)\n",
    "    triangle(za, zb, zc)\n",
    "print(_.context)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can now call `smt_expr()` to retrieve the SMT expression as below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 96,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.113243Z",
     "iopub.status.busy": "2024-04-27T13:49:09.113148Z",
     "iopub.status.idle": "2024-04-27T13:49:09.115870Z",
     "shell.execute_reply": "2024-04-27T13:49:09.115586Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(declare-const int_a Int)\n",
      "(declare-const int_b Int)\n",
      "(declare-const int_c Int)\n",
      "(assert (and (= int_a int_b) (= int_b int_c)))\n"
     ]
    }
   ],
   "source": [
    "print(_.smt_expr(show_decl=True))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The collected predicates can also be solved directly using the Python z3 API."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 97,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.117376Z",
     "iopub.status.busy": "2024-04-27T13:49:09.117273Z",
     "iopub.status.idle": "2024-04-27T13:49:09.125929Z",
     "shell.execute_reply": "2024-04-27T13:49:09.125635Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[int_c = 0, int_a = 0, int_b = 0]\n"
     ]
    }
   ],
   "source": [
    "z3.solve(_.path)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Generating Fresh Names\n",
    "While using the proxy classes, we often will have to generate new symbolic variables, with names that have not been used before. For this, we define `fresh_name()` that always generates unique integers for names."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 98,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.127509Z",
     "iopub.status.busy": "2024-04-27T13:49:09.127384Z",
     "iopub.status.idle": "2024-04-27T13:49:09.129135Z",
     "shell.execute_reply": "2024-04-27T13:49:09.128828Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "COUNTER = 0"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 99,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.130986Z",
     "iopub.status.busy": "2024-04-27T13:49:09.130709Z",
     "iopub.status.idle": "2024-04-27T13:49:09.132601Z",
     "shell.execute_reply": "2024-04-27T13:49:09.132338Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def fresh_name():\n",
    "    global COUNTER\n",
    "    COUNTER += 1\n",
    "    return COUNTER"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "It can be used as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 100,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.134004Z",
     "iopub.status.busy": "2024-04-27T13:49:09.133904Z",
     "iopub.status.idle": "2024-04-27T13:49:09.135832Z",
     "shell.execute_reply": "2024-04-27T13:49:09.135593Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "1"
      ]
     },
     "execution_count": 100,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "fresh_name()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 101,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.137203Z",
     "iopub.status.busy": "2024-04-27T13:49:09.137074Z",
     "iopub.status.idle": "2024-04-27T13:49:09.138805Z",
     "shell.execute_reply": "2024-04-27T13:49:09.138548Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def reset_counter():\n",
    "    global COUNTER\n",
    "    COUNTER = 0"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 102,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.140253Z",
     "iopub.status.busy": "2024-04-27T13:49:09.140140Z",
     "iopub.status.idle": "2024-04-27T13:49:09.142062Z",
     "shell.execute_reply": "2024-04-27T13:49:09.141812Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class ConcolicTracer(ConcolicTracer):\n",
    "    def __enter__(self):\n",
    "        reset_counter()\n",
    "        return self\n",
    "\n",
    "    def __exit__(self, exc_type, exc_value, tb):\n",
    "        return"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    " ##### Translating Arguments to Concolic Proxies\n",
    " \n",
    "We had previously defined `concolic()` as a transparent function. We now provide the full implementation of this function. It inspects a given function's parameters, and infers the parameter types from the concrete arguments passed in. It then uses this information to instantiate the correct proxy classes for each argument."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 103,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.143492Z",
     "iopub.status.busy": "2024-04-27T13:49:09.143392Z",
     "iopub.status.idle": "2024-04-27T13:49:09.145642Z",
     "shell.execute_reply": "2024-04-27T13:49:09.145412Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ConcolicTracer(ConcolicTracer):\n",
    "    def concolic(self, args):\n",
    "        my_args = []\n",
    "        for name, arg in zip(self.fn_args, args):\n",
    "            t = type(arg).__name__\n",
    "            zwrap = globals()['z' + t]\n",
    "            vname = \"%s_%s_%s_%s\" % (self.fn.__name__, name, t, fresh_name())\n",
    "            my_args.append(zwrap.create(self.context, vname, arg))\n",
    "            self.fn_args[name] = vname\n",
    "        return my_args"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "This is how it gets used:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 104,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.147146Z",
     "iopub.status.busy": "2024-04-27T13:49:09.147029Z",
     "iopub.status.idle": "2024-04-27T13:49:09.149994Z",
     "shell.execute_reply": "2024-04-27T13:49:09.149751Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    _[factorial](5)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "With the new `concolic()` method, the arguments to the factorial are correctly associated with symbolic variables, which allows us to retrieve the predicates encountered."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 105,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.151434Z",
     "iopub.status.busy": "2024-04-27T13:49:09.151329Z",
     "iopub.status.idle": "2024-04-27T13:49:09.161320Z",
     "shell.execute_reply": "2024-04-27T13:49:09.160995Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'factorial_n_int_1': 'Int'},\n",
       " [Not(0 > factorial_n_int_1),\n",
       "  Not(0 == factorial_n_int_1),\n",
       "  Not(1 == factorial_n_int_1),\n",
       "  0 != factorial_n_int_1,\n",
       "  0 != factorial_n_int_1 - 1,\n",
       "  0 != factorial_n_int_1 - 1 - 1,\n",
       "  0 != factorial_n_int_1 - 1 - 1 - 1,\n",
       "  0 != factorial_n_int_1 - 1 - 1 - 1 - 1,\n",
       "  Not(0 != factorial_n_int_1 - 1 - 1 - 1 - 1 - 1)])"
      ]
     },
     "execution_count": 105,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "As before, we can also print out the SMT expression which can be passed directly to command line SMT solvers."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 106,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.162749Z",
     "iopub.status.busy": "2024-04-27T13:49:09.162661Z",
     "iopub.status.idle": "2024-04-27T13:49:09.165494Z",
     "shell.execute_reply": "2024-04-27T13:49:09.165170Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(declare-const factorial_n_int_1 Int)\n",
      "(assert (let ((a!1 (distinct 0 (- (- (- factorial_n_int_1 1) 1) 1)))\n",
      "      (a!2 (- (- (- (- factorial_n_int_1 1) 1) 1) 1)))\n",
      "  (and (not (> 0 factorial_n_int_1))\n",
      "       (not (= 0 factorial_n_int_1))\n",
      "       (not (= 1 factorial_n_int_1))\n",
      "       (distinct 0 factorial_n_int_1)\n",
      "       (distinct 0 (- factorial_n_int_1 1))\n",
      "       (distinct 0 (- (- factorial_n_int_1 1) 1))\n",
      "       a!1\n",
      "       (distinct 0 a!2)\n",
      "       (not (distinct 0 (- a!2 1))))))\n"
     ]
    }
   ],
   "source": [
    "print(_.smt_expr(show_decl=True))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We next define methods to evaluate the SMT expression both in Python and from command line."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Evaluating the Concolic Expressions\n",
    "\n",
    "We define `zeval()` to solve the predicates in a context, and return results. It has two modes. The `python` mode uses `z3` Python API to solve and return the results. If the `python` mode is false, it writes the SMT expression to a file, and invokes the command line `z3` for a solution."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 107,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.167008Z",
     "iopub.status.busy": "2024-04-27T13:49:09.166917Z",
     "iopub.status.idle": "2024-04-27T13:49:09.170149Z",
     "shell.execute_reply": "2024-04-27T13:49:09.169894Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ConcolicTracer(ConcolicTracer):\n",
    "    def zeval(self, predicates=None, *,python=False, log=False):\n",
    "        \"\"\"Evaluate `predicates` in current context.\n",
    "        - If `python` is set, use the z3 Python API; otherwise use z3 standalone.\n",
    "        - If `log` is set, show input to z3.\n",
    "        Return a pair (`result`, `solution`) where\n",
    "        - `result` is either `'sat'` (satisfiable); then \n",
    "           solution` is a mapping of variables to (value, type) pairs; or\n",
    "        - `result` is not `'sat'`, indicating an error; then `solution` is `None`\n",
    "        \"\"\"\n",
    "        if predicates is None:\n",
    "            path = self.path\n",
    "        else:\n",
    "            path = list(self.path)\n",
    "            for i in sorted(predicates):\n",
    "                if len(path) > i:\n",
    "                    path[i] = predicates[i]\n",
    "                else:\n",
    "                    path.append(predicates[i])\n",
    "        if log:\n",
    "            print('Predicates in path:')\n",
    "            for i, p in enumerate(path):\n",
    "                print(i, p)\n",
    "            print()\n",
    "\n",
    "        r, sol = (zeval_py if python else zeval_smt)(path, self, log)\n",
    "        if r == 'sat':\n",
    "            return r, {k: sol.get(self.fn_args[k], None) for k in self.fn_args}\n",
    "        else:\n",
    "            return r, None"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Using the Python API\n",
    "\n",
    "Given a set of predicates that the function encountered, and the tracer under which the function was executed, the `zeval_py()` function first declares the relevant symbolic variables, and uses the `z3.Solver()`to provide a set of inputs that would trace the same path through the function."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 108,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.171630Z",
     "iopub.status.busy": "2024-04-27T13:49:09.171551Z",
     "iopub.status.idle": "2024-04-27T13:49:09.174219Z",
     "shell.execute_reply": "2024-04-27T13:49:09.173969Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def zeval_py(path, cc, log):\n",
    "    for decl in cc.decls:\n",
    "        if cc.decls[decl] == 'BitVec':\n",
    "            v = \"z3.%s('%s', 8)\" % (cc.decls[decl], decl)\n",
    "        else:\n",
    "            v = \"z3.%s('%s')\" % (cc.decls[decl], decl)\n",
    "        exec(v)\n",
    "    s = z3.Solver()\n",
    "    s.add(z3.And(path))\n",
    "    if s.check() == z3.unsat:\n",
    "        return 'No Solutions', {}\n",
    "    elif s.check() == z3.unknown:\n",
    "        return 'Gave up', None\n",
    "    assert s.check() == z3.sat\n",
    "    m = s.model()\n",
    "    return 'sat', {d.name(): m[d] for d in m.decls()}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "It can be used as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 109,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.175740Z",
     "iopub.status.busy": "2024-04-27T13:49:09.175643Z",
     "iopub.status.idle": "2024-04-27T13:49:09.178783Z",
     "shell.execute_reply": "2024-04-27T13:49:09.178528Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    _[factorial](5)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 110,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.180156Z",
     "iopub.status.busy": "2024-04-27T13:49:09.180073Z",
     "iopub.status.idle": "2024-04-27T13:49:09.192983Z",
     "shell.execute_reply": "2024-04-27T13:49:09.192726Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'n': 5})"
      ]
     },
     "execution_count": 110,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval(python=True)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "That is, given the set of constraints, the assignment `n == 5` conforms to all constraints."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Using the Command Line\n",
    "\n",
    "The `zeval_smt()` function writes the SMT expression to the file system, and calls the `z3` SMT solver command line to solve it. The result of SMT expression is again an `sexpr`. Hence, we first define `parse_sexp()` to parse and return the correct values."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 111,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.194585Z",
     "iopub.status.busy": "2024-04-27T13:49:09.194490Z",
     "iopub.status.idle": "2024-04-27T13:49:09.196229Z",
     "shell.execute_reply": "2024-04-27T13:49:09.195898Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "import re"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 112,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.197669Z",
     "iopub.status.busy": "2024-04-27T13:49:09.197555Z",
     "iopub.status.idle": "2024-04-27T13:49:09.199394Z",
     "shell.execute_reply": "2024-04-27T13:49:09.199048Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "import subprocess"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 113,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.201122Z",
     "iopub.status.busy": "2024-04-27T13:49:09.200971Z",
     "iopub.status.idle": "2024-04-27T13:49:09.203071Z",
     "shell.execute_reply": "2024-04-27T13:49:09.202821Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "SEXPR_TOKEN = r'''(?mx)\n",
    "    \\s*(?:\n",
    "        (?P<bra>\\()|\n",
    "        (?P<ket>\\))|\n",
    "        (?P<token>[^\"()\\s]+)|\n",
    "        (?P<string>\"[^\"]*\")\n",
    "       )'''"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 114,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.204433Z",
     "iopub.status.busy": "2024-04-27T13:49:09.204323Z",
     "iopub.status.idle": "2024-04-27T13:49:09.206943Z",
     "shell.execute_reply": "2024-04-27T13:49:09.206680Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def parse_sexp(sexp):\n",
    "    stack, res = [], []\n",
    "    for elements in re.finditer(SEXPR_TOKEN, sexp):\n",
    "        kind, value = [(t, v) for t, v in elements.groupdict().items() if v][0]\n",
    "        if kind == 'bra':\n",
    "            stack.append(res)\n",
    "            res = []\n",
    "        elif kind == 'ket':\n",
    "            last, res = res, stack.pop(-1)\n",
    "            res.append(last)\n",
    "        elif kind == 'token':\n",
    "            res.append(value)\n",
    "        elif kind == 'string':\n",
    "            res.append(value[1:-1])\n",
    "        else:\n",
    "            assert False\n",
    "    return res"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The `parse_sexp()` function can be used as follows"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 115,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.208518Z",
     "iopub.status.busy": "2024-04-27T13:49:09.208408Z",
     "iopub.status.idle": "2024-04-27T13:49:09.210864Z",
     "shell.execute_reply": "2024-04-27T13:49:09.210598Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['abcd', ['hello', '123', ['world', 'hello world']]]"
      ]
     },
     "execution_count": 115,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "parse_sexp('abcd (hello 123 (world \"hello world\"))')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We now define `zeval_smt()` which uses the `z3` command line directly, and uses `parse_sexp()` to parse and return the solutions to function arguments if any."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 116,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.212884Z",
     "iopub.status.busy": "2024-04-27T13:49:09.212738Z",
     "iopub.status.idle": "2024-04-27T13:49:09.214593Z",
     "shell.execute_reply": "2024-04-27T13:49:09.214281Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "import tempfile\n",
    "import os"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 117,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.216517Z",
     "iopub.status.busy": "2024-04-27T13:49:09.216289Z",
     "iopub.status.idle": "2024-04-27T13:49:09.218306Z",
     "shell.execute_reply": "2024-04-27T13:49:09.218041Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "Z3_BINARY = 'z3'  # Z3 binary to invoke"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 118,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.219898Z",
     "iopub.status.busy": "2024-04-27T13:49:09.219788Z",
     "iopub.status.idle": "2024-04-27T13:49:09.221545Z",
     "shell.execute_reply": "2024-04-27T13:49:09.221252Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "Z3_OPTIONS = '-t:6000'  # Z3 options - a soft timeout of 6000 milliseconds"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 119,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.223077Z",
     "iopub.status.busy": "2024-04-27T13:49:09.222975Z",
     "iopub.status.idle": "2024-04-27T13:49:09.227114Z",
     "shell.execute_reply": "2024-04-27T13:49:09.226697Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def zeval_smt(path, cc, log):\n",
    "    s = cc.smt_expr(True, True, path)\n",
    "\n",
    "    with tempfile.NamedTemporaryFile(mode='w', suffix='.smt',\n",
    "                                     delete=False) as f:\n",
    "        f.write(s + \"\\n\")\n",
    "        f.write(\"(check-sat)\\n\")\n",
    "        f.write(\"(get-model)\\n\")\n",
    "\n",
    "    if log:\n",
    "        print(open(f.name).read())\n",
    "\n",
    "    cmd = f\"{Z3_BINARY} {Z3_OPTIONS} {f.name}\"\n",
    "    if log:\n",
    "        print(cmd)\n",
    "\n",
    "    output = subprocess.getoutput(cmd)\n",
    "\n",
    "    os.remove(f.name)\n",
    "\n",
    "    if log:\n",
    "        print(output)\n",
    "\n",
    "    o = parse_sexp(output)\n",
    "    if not o:\n",
    "        return 'Gave up', None\n",
    "\n",
    "    kind = o[0]\n",
    "    if kind == 'unknown':\n",
    "        return 'Gave up', None\n",
    "    elif kind == 'timeout':\n",
    "        return 'Timeout', None\n",
    "    elif kind == 'unsat':\n",
    "        return 'No Solutions', {}\n",
    "\n",
    "    assert kind == 'sat', kind\n",
    "    if o[1][0] == 'model': # up to 4.8.8.0\n",
    "        return 'sat', {i[1]: (i[-1], i[-2]) for i in o[1][1:]}\n",
    "    else:\n",
    "        return 'sat', {i[1]: (i[-1], i[-2]) for i in o[1][0:]}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We can now use `zeval()` as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 120,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.228670Z",
     "iopub.status.busy": "2024-04-27T13:49:09.228576Z",
     "iopub.status.idle": "2024-04-27T13:49:09.231892Z",
     "shell.execute_reply": "2024-04-27T13:49:09.231589Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    _[factorial](5)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 121,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.233417Z",
     "iopub.status.busy": "2024-04-27T13:49:09.233296Z",
     "iopub.status.idle": "2024-04-27T13:49:09.543637Z",
     "shell.execute_reply": "2024-04-27T13:49:09.543129Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Predicates in path:\n",
      "0 Not(0 > factorial_n_int_1)\n",
      "1 Not(0 == factorial_n_int_1)\n",
      "2 Not(1 == factorial_n_int_1)\n",
      "3 0 != factorial_n_int_1\n",
      "4 0 != factorial_n_int_1 - 1\n",
      "5 0 != factorial_n_int_1 - 1 - 1\n",
      "6 0 != factorial_n_int_1 - 1 - 1 - 1\n",
      "7 0 != factorial_n_int_1 - 1 - 1 - 1 - 1\n",
      "8 Not(0 != factorial_n_int_1 - 1 - 1 - 1 - 1 - 1)\n",
      "\n",
      "(declare-const factorial_n_int_1 Int)\n",
      "(assert (and (<= 0 factorial_n_int_1)\n",
      "     (not (= 0 factorial_n_int_1))\n",
      "     (not (= 1 factorial_n_int_1))\n",
      "     (not (= 2 factorial_n_int_1))\n",
      "     (not (= 3 factorial_n_int_1))\n",
      "     (not (= 4 factorial_n_int_1))\n",
      "     (= 5 factorial_n_int_1)))\n",
      "(check-sat)\n",
      "(get-model)\n",
      "\n",
      "z3 -t:6000 /var/folders/n2/xd9445p97rb3xh7m1dfx8_4h0006ts/T/tmp2ykztzja.smt\n",
      "sat\n",
      "(\n",
      "  (define-fun factorial_n_int_1 () Int\n",
      "    5)\n",
      ")\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "('sat', {'n': ('5', 'Int')})"
      ]
     },
     "execution_count": 121,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval(log=True)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Indeed, we get similar results (`n == 5`)  from using the command line as from using the Python API."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    },
    "toc-hr-collapsed": true
   },
   "source": [
    "#### A Proxy Class for Strings\n",
    "\n",
    "Here, we define the proxy string class `zstr`. First we define our initialization routines. Since `str` is a primitive type, we define `new` to extend it."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 122,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.545632Z",
     "iopub.status.busy": "2024-04-27T13:49:09.545375Z",
     "iopub.status.idle": "2024-04-27T13:49:09.547537Z",
     "shell.execute_reply": "2024-04-27T13:49:09.547269Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(str):\n",
    "    def __new__(cls, context, zn, v):\n",
    "        return str.__new__(cls, v)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "As before, initialization proceeds with `create()` and the constructor."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 123,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.549167Z",
     "iopub.status.busy": "2024-04-27T13:49:09.548916Z",
     "iopub.status.idle": "2024-04-27T13:49:09.551423Z",
     "shell.execute_reply": "2024-04-27T13:49:09.551149Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    @classmethod\n",
    "    def create(cls, context, zn, v=None):\n",
    "        return zproxy_create(cls, 'String', z3.String, context, zn, v)\n",
    "\n",
    "    def __init__(self, context, z, v=None):\n",
    "        self.context, self.z, self.v = context, z, v\n",
    "        self._len = zint(context, z3.Length(z), len(v))\n",
    "        #self.context[1].append(z3.Length(z) == z3.IntVal(len(v)))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We also define `_zv()` helper to help us with methods that accept another string"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 124,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.553151Z",
     "iopub.status.busy": "2024-04-27T13:49:09.552981Z",
     "iopub.status.idle": "2024-04-27T13:49:09.555107Z",
     "shell.execute_reply": "2024-04-27T13:49:09.554779Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def _zv(self, o):\n",
    "        return (o.z, o.v) if isinstance(o, zstr) else (z3.StringVal(o), o)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Hack to use the ASCII value of a character."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "**Note:** Temporary solution; This block should go away as soon as [this commit](https://github.com/Z3Prover/z3/issues/5764)\n",
    "is released, which allows us to use the Python API directly."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 125,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.556640Z",
     "iopub.status.busy": "2024-04-27T13:49:09.556525Z",
     "iopub.status.idle": "2024-04-27T13:49:09.561118Z",
     "shell.execute_reply": "2024-04-27T13:49:09.560833Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from typing import Union, Optional, Dict, Generator, Set\n",
    "\n",
    "def visit_z3_expr(\n",
    "        e: Union[z3.ExprRef, z3.QuantifierRef],\n",
    "        seen: Optional[Dict[Union[z3.ExprRef, z3.QuantifierRef], bool]] = None) -> \\\n",
    "        Generator[Union[z3.ExprRef, z3.QuantifierRef], None, None]:\n",
    "    if seen is None:\n",
    "        seen = {}\n",
    "    elif e in seen:\n",
    "        return\n",
    "\n",
    "    seen[e] = True\n",
    "    yield e\n",
    "\n",
    "    if z3.is_app(e):\n",
    "        for ch in e.children():\n",
    "            for e in visit_z3_expr(ch, seen):\n",
    "                yield e\n",
    "        return\n",
    "\n",
    "    if z3.is_quantifier(e):\n",
    "        for e in visit_z3_expr(e.body(), seen):\n",
    "            yield e\n",
    "        return\n",
    "\n",
    "\n",
    "def is_z3_var(e: z3.ExprRef) -> bool:\n",
    "    return z3.is_const(e) and e.decl().kind() == z3.Z3_OP_UNINTERPRETED\n",
    "\n",
    "\n",
    "def get_all_vars(e: z3.ExprRef) -> Set[z3.ExprRef]:\n",
    "    return {sub for sub in visit_z3_expr(e) if is_z3_var(sub)}\n",
    "\n",
    "\n",
    "def z3_ord(str_expr: z3.SeqRef) -> z3.ArithRef:\n",
    "    return z3.parse_smt2_string(\n",
    "        f\"(assert (= 42 (str.to_code {str_expr.sexpr()})))\",\n",
    "        decls={str(c): c for c in get_all_vars(str_expr)}\n",
    "    )[0].children()[1]\n",
    "\n",
    "\n",
    "def z3_chr(int_expr: z3.ArithRef) -> z3.SeqRef:\n",
    "    return z3.parse_smt2_string(\n",
    "        f\"(assert (= \\\"4\\\" (str.from_code {int_expr.sexpr()})))\",\n",
    "        decls={str(c): c for c in get_all_vars(int_expr)}\n",
    "    )[0].children()[1]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Retrieving Ordinal Value\n",
    "We define `zord` that given a symbolic one character long string, obtains the `ord()` for that."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 126,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.562545Z",
     "iopub.status.busy": "2024-04-27T13:49:09.562457Z",
     "iopub.status.idle": "2024-04-27T13:49:09.564179Z",
     "shell.execute_reply": "2024-04-27T13:49:09.563952Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def zord(context, c):\n",
    "    return z3_ord(c)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We use it as follows"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 127,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.565633Z",
     "iopub.status.busy": "2024-04-27T13:49:09.565554Z",
     "iopub.status.idle": "2024-04-27T13:49:09.567515Z",
     "shell.execute_reply": "2024-04-27T13:49:09.567266Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "zc = z3.String('arg_%d' % fresh_name())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 128,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.569014Z",
     "iopub.status.busy": "2024-04-27T13:49:09.568912Z",
     "iopub.status.idle": "2024-04-27T13:49:09.573560Z",
     "shell.execute_reply": "2024-04-27T13:49:09.573305Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    zi = zord(_.context, zc)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "No new variables are defined."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 129,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.574967Z",
     "iopub.status.busy": "2024-04-27T13:49:09.574864Z",
     "iopub.status.idle": "2024-04-27T13:49:09.576923Z",
     "shell.execute_reply": "2024-04-27T13:49:09.576648Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({}, [])"
      ]
     },
     "execution_count": 129,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Here is the smtlib representation."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 130,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.578557Z",
     "iopub.status.busy": "2024-04-27T13:49:09.578445Z",
     "iopub.status.idle": "2024-04-27T13:49:09.580581Z",
     "shell.execute_reply": "2024-04-27T13:49:09.580312Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'(str.to_code arg_2)'"
      ]
     },
     "execution_count": 130,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "zi.sexpr()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We can specify what the result of `ord()` should be, and call `z3.solve()` to provide us with a solution that will provide the required result."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 131,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.581946Z",
     "iopub.status.busy": "2024-04-27T13:49:09.581846Z",
     "iopub.status.idle": "2024-04-27T13:49:09.584246Z",
     "shell.execute_reply": "2024-04-27T13:49:09.583974Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'(= (str.to_code arg_2) 65)'"
      ]
     },
     "execution_count": 131,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "(zi == 65).sexpr()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 132,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.585643Z",
     "iopub.status.busy": "2024-04-27T13:49:09.585540Z",
     "iopub.status.idle": "2024-04-27T13:49:09.608483Z",
     "shell.execute_reply": "2024-04-27T13:49:09.608183Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[arg_2 = \"A\"]\n"
     ]
    }
   ],
   "source": [
    "z3.solve([zi == 65])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Translating an Ordinal Value to ASCII\n",
    "Similarly, we can convert the ASCII value back to a single character string using `zchr()`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 133,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.610168Z",
     "iopub.status.busy": "2024-04-27T13:49:09.610052Z",
     "iopub.status.idle": "2024-04-27T13:49:09.611760Z",
     "shell.execute_reply": "2024-04-27T13:49:09.611500Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def zchr(context, i):\n",
    "    return z3_chr(i)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "For using it, we first define a bitvector that is 8 bits long."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 134,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.613289Z",
     "iopub.status.busy": "2024-04-27T13:49:09.613174Z",
     "iopub.status.idle": "2024-04-27T13:49:09.615053Z",
     "shell.execute_reply": "2024-04-27T13:49:09.614787Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "i = z3.Int('ival_%d' % fresh_name())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can now retrieve the `chr()` representation as below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 135,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.616657Z",
     "iopub.status.busy": "2024-04-27T13:49:09.616452Z",
     "iopub.status.idle": "2024-04-27T13:49:09.618936Z",
     "shell.execute_reply": "2024-04-27T13:49:09.618668Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    zc = zchr(_.context, i)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "No new variables are defined."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 136,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.620575Z",
     "iopub.status.busy": "2024-04-27T13:49:09.620457Z",
     "iopub.status.idle": "2024-04-27T13:49:09.622501Z",
     "shell.execute_reply": "2024-04-27T13:49:09.622261Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({}, [])"
      ]
     },
     "execution_count": 136,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 137,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.623980Z",
     "iopub.status.busy": "2024-04-27T13:49:09.623850Z",
     "iopub.status.idle": "2024-04-27T13:49:09.626374Z",
     "shell.execute_reply": "2024-04-27T13:49:09.626015Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'(= (str.from_code ival_1) \"a\")'"
      ]
     },
     "execution_count": 137,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "(zc== z3.StringVal('a')).sexpr()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "As before, we can specify what the end result of calling `chr()` should be to get the original argument."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 138,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.628107Z",
     "iopub.status.busy": "2024-04-27T13:49:09.627971Z",
     "iopub.status.idle": "2024-04-27T13:49:09.636771Z",
     "shell.execute_reply": "2024-04-27T13:49:09.636499Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[ival_1 = 97]\n"
     ]
    }
   ],
   "source": [
    "z3.solve([zc == z3.StringVal('a')])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Equality between Strings\n",
    "\n",
    "The equality of `zstr` is defined similar to that of `zint`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 139,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.638337Z",
     "iopub.status.busy": "2024-04-27T13:49:09.638192Z",
     "iopub.status.idle": "2024-04-27T13:49:09.640363Z",
     "shell.execute_reply": "2024-04-27T13:49:09.640115Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def __eq__(self, other):\n",
    "        z, v = self._zv(other)\n",
    "        return zbool(self.context, self.z == z, self.v == v)\n",
    "\n",
    "    def __req__(self, other):\n",
    "        return self.__eq__(other)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `zstr` class is used as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 140,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.641842Z",
     "iopub.status.busy": "2024-04-27T13:49:09.641737Z",
     "iopub.status.idle": "2024-04-27T13:49:09.643441Z",
     "shell.execute_reply": "2024-04-27T13:49:09.643189Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def tstr1(s):\n",
    "    if s == 'h':\n",
    "        return True\n",
    "    else:\n",
    "        return False"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 141,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.644890Z",
     "iopub.status.busy": "2024-04-27T13:49:09.644791Z",
     "iopub.status.idle": "2024-04-27T13:49:09.646965Z",
     "shell.execute_reply": "2024-04-27T13:49:09.646672Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[tstr1]('h')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 142,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.648456Z",
     "iopub.status.busy": "2024-04-27T13:49:09.648347Z",
     "iopub.status.idle": "2024-04-27T13:49:09.671337Z",
     "shell.execute_reply": "2024-04-27T13:49:09.670814Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('h', 'String')})"
      ]
     },
     "execution_count": 142,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "It works even if we have more than one character."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 143,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.673505Z",
     "iopub.status.busy": "2024-04-27T13:49:09.673354Z",
     "iopub.status.idle": "2024-04-27T13:49:09.675465Z",
     "shell.execute_reply": "2024-04-27T13:49:09.675183Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def tstr1(s):  # type: ignore\n",
    "    if s == 'hello world':\n",
    "        return True\n",
    "    else:\n",
    "        return False"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 144,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.677182Z",
     "iopub.status.busy": "2024-04-27T13:49:09.677051Z",
     "iopub.status.idle": "2024-04-27T13:49:09.679465Z",
     "shell.execute_reply": "2024-04-27T13:49:09.679148Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[tstr1]('hello world')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 145,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.681044Z",
     "iopub.status.busy": "2024-04-27T13:49:09.680921Z",
     "iopub.status.idle": "2024-04-27T13:49:09.683675Z",
     "shell.execute_reply": "2024-04-27T13:49:09.683383Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'tstr1_s_str_1': 'String'}, [tstr1_s_str_1 == \"hello world\"])"
      ]
     },
     "execution_count": 145,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 146,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.685194Z",
     "iopub.status.busy": "2024-04-27T13:49:09.685082Z",
     "iopub.status.idle": "2024-04-27T13:49:09.704783Z",
     "shell.execute_reply": "2024-04-27T13:49:09.704433Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('hello world', 'String')})"
      ]
     },
     "execution_count": 146,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Length of Strings\n",
    "\n",
    "Unfortunately, in Python, we can't override `len()` to return a new datatype. Hence, we work around that."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 147,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.706606Z",
     "iopub.status.busy": "2024-04-27T13:49:09.706475Z",
     "iopub.status.idle": "2024-04-27T13:49:09.708433Z",
     "shell.execute_reply": "2024-04-27T13:49:09.708187Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def __len__(self):\n",
    "        raise NotImplemented()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 148,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.710084Z",
     "iopub.status.busy": "2024-04-27T13:49:09.709977Z",
     "iopub.status.idle": "2024-04-27T13:49:09.711610Z",
     "shell.execute_reply": "2024-04-27T13:49:09.711375Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def length(self):\n",
    "        return self._len"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 149,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.712992Z",
     "iopub.status.busy": "2024-04-27T13:49:09.712878Z",
     "iopub.status.idle": "2024-04-27T13:49:09.715269Z",
     "shell.execute_reply": "2024-04-27T13:49:09.715025Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "1\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    za = zstr.create(_.context, 'str_a', \"s\")\n",
    "    if za.length() > 0:\n",
    "        print(1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 150,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.716791Z",
     "iopub.status.busy": "2024-04-27T13:49:09.716672Z",
     "iopub.status.idle": "2024-04-27T13:49:09.719676Z",
     "shell.execute_reply": "2024-04-27T13:49:09.719334Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'str_a': 'String'}, [0 < Length(str_a)])"
      ]
     },
     "execution_count": 150,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 151,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.721560Z",
     "iopub.status.busy": "2024-04-27T13:49:09.721429Z",
     "iopub.status.idle": "2024-04-27T13:49:09.723302Z",
     "shell.execute_reply": "2024-04-27T13:49:09.722993Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def tstr2(s):\n",
    "    if s.length() > 1:\n",
    "        return True\n",
    "    else:\n",
    "        return False"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 152,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.725037Z",
     "iopub.status.busy": "2024-04-27T13:49:09.724946Z",
     "iopub.status.idle": "2024-04-27T13:49:09.727141Z",
     "shell.execute_reply": "2024-04-27T13:49:09.726819Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[tstr2]('hello world')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 153,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.728553Z",
     "iopub.status.busy": "2024-04-27T13:49:09.728470Z",
     "iopub.status.idle": "2024-04-27T13:49:09.731358Z",
     "shell.execute_reply": "2024-04-27T13:49:09.731054Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'tstr2_s_str_1': 'String'}, [1 < Length(tstr2_s_str_1)])"
      ]
     },
     "execution_count": 153,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 154,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.732837Z",
     "iopub.status.busy": "2024-04-27T13:49:09.732741Z",
     "iopub.status.idle": "2024-04-27T13:49:09.754271Z",
     "shell.execute_reply": "2024-04-27T13:49:09.753847Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Predicates in path:\n",
      "0 1 < Length(tstr2_s_str_1)\n",
      "\n",
      "(declare-const tstr2_s_str_1 String)\n",
      "(assert (not (<= (str.len tstr2_s_str_1) 1)))\n",
      "(check-sat)\n",
      "(get-model)\n",
      "\n",
      "z3 -t:6000 /var/folders/n2/xd9445p97rb3xh7m1dfx8_4h0006ts/T/tmp9hlj0s51.smt\n",
      "sat\n",
      "(\n",
      "  (define-fun tstr2_s_str_1 () String\n",
      "    \"AB\")\n",
      ")\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('AB', 'String')})"
      ]
     },
     "execution_count": 154,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval(log=True)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Concatenation of Strings\n",
    "What if we need to concatenate two strings? We need additional helpers to accomplish that."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 155,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.755971Z",
     "iopub.status.busy": "2024-04-27T13:49:09.755844Z",
     "iopub.status.idle": "2024-04-27T13:49:09.758238Z",
     "shell.execute_reply": "2024-04-27T13:49:09.757914Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def __add__(self, other):\n",
    "        z, v = self._zv(other)\n",
    "        return zstr(self.context, self.z + z, self.v + v)\n",
    "\n",
    "    def __radd__(self, other):\n",
    "        return self.__add__(other)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Here is how it can be used. First, we create the wrapped arguments"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 156,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.759683Z",
     "iopub.status.busy": "2024-04-27T13:49:09.759581Z",
     "iopub.status.idle": "2024-04-27T13:49:09.762370Z",
     "shell.execute_reply": "2024-04-27T13:49:09.762091Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "hello world\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    v1, v2 = [zstr.create(_.context, 'arg_%d' % fresh_name(), s)\n",
    "              for s in ['hello', 'world']]\n",
    "    if (v1 + ' ' + v2) == 'hello world':\n",
    "        print('hello world')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The addition of symbolic variables is preserved in `context`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 157,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.764000Z",
     "iopub.status.busy": "2024-04-27T13:49:09.763880Z",
     "iopub.status.idle": "2024-04-27T13:49:09.766771Z",
     "shell.execute_reply": "2024-04-27T13:49:09.766510Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'arg_1': 'String', 'arg_2': 'String'},\n",
       " [Concat(Concat(arg_1, \" \"), arg_2) == \"hello world\"])"
      ]
     },
     "execution_count": 157,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Producing Substrings\n",
    "Similarly, accessing substrings also require extra help."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 158,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.768342Z",
     "iopub.status.busy": "2024-04-27T13:49:09.768207Z",
     "iopub.status.idle": "2024-04-27T13:49:09.770998Z",
     "shell.execute_reply": "2024-04-27T13:49:09.770672Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def __getitem__(self, idx):\n",
    "        if isinstance(idx, slice):\n",
    "            start, stop, step = idx.indices(len(self.v))\n",
    "            assert step == 1  # for now\n",
    "            assert stop >= start  # for now\n",
    "            rz = z3.SubString(self.z, start, stop - start)\n",
    "            rv = self.v[idx]\n",
    "        elif isinstance(idx, int):\n",
    "            rz = z3.SubString(self.z, idx, 1)\n",
    "            rv = self.v[idx]\n",
    "        else:\n",
    "            assert False  # for now\n",
    "        return zstr(self.context, rz, rv)\n",
    "\n",
    "    def __iter__(self):\n",
    "        return zstr_iterator(self.context, self)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### An Iterator Class for Strings\n",
    "\n",
    "We define the iterator as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 159,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.772843Z",
     "iopub.status.busy": "2024-04-27T13:49:09.772726Z",
     "iopub.status.idle": "2024-04-27T13:49:09.775199Z",
     "shell.execute_reply": "2024-04-27T13:49:09.774817Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zstr_iterator():\n",
    "    def __init__(self, context, zstr):\n",
    "        self.context = context\n",
    "        self._zstr = zstr\n",
    "        self._str_idx = 0\n",
    "        self._str_max = zstr._len  # intz is not an _int_\n",
    "\n",
    "    def __next__(self):\n",
    "        if self._str_idx == self._str_max:  # intz#eq\n",
    "            raise StopIteration\n",
    "        c = self._zstr[self._str_idx]\n",
    "        self._str_idx += 1\n",
    "        return c\n",
    "\n",
    "    def __len__(self):\n",
    "        return self._len"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Here is how it can be used."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 160,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.777142Z",
     "iopub.status.busy": "2024-04-27T13:49:09.776826Z",
     "iopub.status.idle": "2024-04-27T13:49:09.779008Z",
     "shell.execute_reply": "2024-04-27T13:49:09.778633Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def tstr3(s):\n",
    "    if s[0] == 'h' and s[1] == 'e' and s[3] == 'l':\n",
    "        return True\n",
    "    else:\n",
    "        return False"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 161,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.780473Z",
     "iopub.status.busy": "2024-04-27T13:49:09.780358Z",
     "iopub.status.idle": "2024-04-27T13:49:09.782675Z",
     "shell.execute_reply": "2024-04-27T13:49:09.782415Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[tstr3]('hello')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Again, the context shows predicates encountered."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 162,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.784391Z",
     "iopub.status.busy": "2024-04-27T13:49:09.784270Z",
     "iopub.status.idle": "2024-04-27T13:49:09.787569Z",
     "shell.execute_reply": "2024-04-27T13:49:09.787214Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'tstr3_s_str_1': 'String'},\n",
       " [str.substr(tstr3_s_str_1, 0, 1) == \"h\",\n",
       "  str.substr(tstr3_s_str_1, 1, 1) == \"e\",\n",
       "  str.substr(tstr3_s_str_1, 3, 1) == \"l\"])"
      ]
     },
     "execution_count": 162,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The function `zeval()` returns a solution for the predicate. Note that the value returned is not exactly the argument that we passed in. This is a consequence of the predicates we have. That is, we have no constraints on what the character value on `s[2]` should be."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 163,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.789448Z",
     "iopub.status.busy": "2024-04-27T13:49:09.789332Z",
     "iopub.status.idle": "2024-04-27T13:49:09.810889Z",
     "shell.execute_reply": "2024-04-27T13:49:09.810483Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('heAl', 'String')})"
      ]
     },
     "execution_count": 163,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Translating to Upper and Lower Equivalents\n",
    "\n",
    "A major complication is supporting `upper()` and `lower()` methods. We use the previously defined `zchr()` and `zord()` functions to accomplish this."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 164,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.812682Z",
     "iopub.status.busy": "2024-04-27T13:49:09.812534Z",
     "iopub.status.idle": "2024-04-27T13:49:09.816353Z",
     "shell.execute_reply": "2024-04-27T13:49:09.816059Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def upper(self):\n",
    "        empty = ''\n",
    "        ne = 'empty_%d' % fresh_name()\n",
    "        result = zstr.create(self.context, ne, empty)\n",
    "        self.context[1].append(z3.StringVal(empty) == result.z)\n",
    "        cdiff = (ord('a') - ord('A'))\n",
    "        for i in self:\n",
    "            oz = zord(self.context, i.z)\n",
    "            uz = zchr(self.context, oz - cdiff)\n",
    "            rz = z3.And([oz >= ord('a'), oz <= ord('z')])\n",
    "            ov = ord(i.v)\n",
    "            uv = chr(ov - cdiff)\n",
    "            rv = ov >= ord('a') and ov <= ord('z')\n",
    "            if zbool(self.context, rz, rv):\n",
    "                i = zstr(self.context, uz, uv)\n",
    "            else:\n",
    "                i = zstr(self.context, i.z, i.v)\n",
    "            result += i\n",
    "        return result"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The `lower()` function is similar to `upper()` except that the character ranges are switched, and the lowercase is above uppercase. Hence, we add the difference to the ordinal to make a character to lowercase."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 165,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.818064Z",
     "iopub.status.busy": "2024-04-27T13:49:09.817979Z",
     "iopub.status.idle": "2024-04-27T13:49:09.821161Z",
     "shell.execute_reply": "2024-04-27T13:49:09.820859Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def lower(self):\n",
    "        empty = ''\n",
    "        ne = 'empty_%d' % fresh_name()\n",
    "        result = zstr.create(self.context, ne, empty)\n",
    "        self.context[1].append(z3.StringVal(empty) == result.z)\n",
    "        cdiff = (ord('a') - ord('A'))\n",
    "        for i in self:\n",
    "            oz = zord(self.context, i.z)\n",
    "            uz = zchr(self.context, oz + cdiff)\n",
    "            rz = z3.And([oz >= ord('A'), oz <= ord('Z')])\n",
    "            ov = ord(i.v)\n",
    "            uv = chr(ov + cdiff)\n",
    "            rv = ov >= ord('A') and ov <= ord('Z')\n",
    "            if zbool(self.context, rz, rv):\n",
    "                i = zstr(self.context, uz, uv)\n",
    "            else:\n",
    "                i = zstr(self.context, i.z, i.v)\n",
    "            result += i\n",
    "        return result"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Here is how `upper()` is used."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 166,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.822745Z",
     "iopub.status.busy": "2024-04-27T13:49:09.822656Z",
     "iopub.status.idle": "2024-04-27T13:49:09.824527Z",
     "shell.execute_reply": "2024-04-27T13:49:09.824166Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def tstr4(s):\n",
    "    if s.upper() == 'H':\n",
    "        return True\n",
    "    else:\n",
    "        return False"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 167,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.826260Z",
     "iopub.status.busy": "2024-04-27T13:49:09.826141Z",
     "iopub.status.idle": "2024-04-27T13:49:09.830075Z",
     "shell.execute_reply": "2024-04-27T13:49:09.829794Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[tstr4]('h')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Again, we use `zeval()` to solve the collected constraints, and verify that our constraints are correct. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 168,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.831663Z",
     "iopub.status.busy": "2024-04-27T13:49:09.831573Z",
     "iopub.status.idle": "2024-04-27T13:49:09.857044Z",
     "shell.execute_reply": "2024-04-27T13:49:09.856666Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('h', 'String')})"
      ]
     },
     "execution_count": 168,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Here is a larger example using `lower()`:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 169,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.859000Z",
     "iopub.status.busy": "2024-04-27T13:49:09.858797Z",
     "iopub.status.idle": "2024-04-27T13:49:09.860865Z",
     "shell.execute_reply": "2024-04-27T13:49:09.860578Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def tstr5(s):\n",
    "    if s.lower() == 'hello world':\n",
    "        return True\n",
    "    else:\n",
    "        return False"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 170,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.862384Z",
     "iopub.status.busy": "2024-04-27T13:49:09.862237Z",
     "iopub.status.idle": "2024-04-27T13:49:09.874893Z",
     "shell.execute_reply": "2024-04-27T13:49:09.874615Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[tstr5]('Hello World')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 171,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.876435Z",
     "iopub.status.busy": "2024-04-27T13:49:09.876342Z",
     "iopub.status.idle": "2024-04-27T13:49:09.934094Z",
     "shell.execute_reply": "2024-04-27T13:49:09.933446Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('Hello World', 'String')})"
      ]
     },
     "execution_count": 171,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Again, we obtain the right input value."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Checking for String Prefixes\n",
    "We define `startswith()`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 172,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.936400Z",
     "iopub.status.busy": "2024-04-27T13:49:09.936234Z",
     "iopub.status.idle": "2024-04-27T13:49:09.939195Z",
     "shell.execute_reply": "2024-04-27T13:49:09.938921Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def startswith(self, other, beg=0, end=None):\n",
    "        assert end is None  # for now\n",
    "        assert isinstance(beg, int)  # for now\n",
    "        zb = z3.IntVal(beg)\n",
    "\n",
    "        others = other if isinstance(other, tuple) else (other, )\n",
    "\n",
    "        last = False\n",
    "        for o in others:\n",
    "            z, v = self._zv(o)\n",
    "            r = z3.IndexOf(self.z, z, zb)\n",
    "            last = zbool(self.context, r == zb, self.v.startswith(v))\n",
    "            if last:\n",
    "                return last\n",
    "        return last"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "An example."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 173,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.940906Z",
     "iopub.status.busy": "2024-04-27T13:49:09.940698Z",
     "iopub.status.idle": "2024-04-27T13:49:09.942739Z",
     "shell.execute_reply": "2024-04-27T13:49:09.942382Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def tstr6(s):\n",
    "    if s.startswith('hello'):\n",
    "        return True\n",
    "    else:\n",
    "        return False"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 174,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.944457Z",
     "iopub.status.busy": "2024-04-27T13:49:09.944337Z",
     "iopub.status.idle": "2024-04-27T13:49:09.946938Z",
     "shell.execute_reply": "2024-04-27T13:49:09.946578Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[tstr6]('hello world')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 175,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.948662Z",
     "iopub.status.busy": "2024-04-27T13:49:09.948524Z",
     "iopub.status.idle": "2024-04-27T13:49:09.971260Z",
     "shell.execute_reply": "2024-04-27T13:49:09.970827Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('helloAhello', 'String')})"
      ]
     },
     "execution_count": 175,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 176,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.973325Z",
     "iopub.status.busy": "2024-04-27T13:49:09.973163Z",
     "iopub.status.idle": "2024-04-27T13:49:09.975671Z",
     "shell.execute_reply": "2024-04-27T13:49:09.975366Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[tstr6]('my world')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 177,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:09.977203Z",
     "iopub.status.busy": "2024-04-27T13:49:09.977061Z",
     "iopub.status.idle": "2024-04-27T13:49:09.998253Z",
     "shell.execute_reply": "2024-04-27T13:49:09.997786Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('', 'String')})"
      ]
     },
     "execution_count": 177,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "As before, the predicates only ensure that the `startswith()` returned a true value. Hence, our solution reflects that."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Finding Substrings\n",
    "We also define `find()`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 178,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.000382Z",
     "iopub.status.busy": "2024-04-27T13:49:10.000201Z",
     "iopub.status.idle": "2024-04-27T13:49:10.002982Z",
     "shell.execute_reply": "2024-04-27T13:49:10.002716Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def find(self, other, beg=0, end=None):\n",
    "        assert end is None  # for now\n",
    "        assert isinstance(beg, int)  # for now\n",
    "        zb = z3.IntVal(beg)\n",
    "        z, v = self._zv(other)\n",
    "        zi = z3.IndexOf(self.z, z, zb)\n",
    "        vi = self.v.find(v, beg, end)\n",
    "        return zint(self.context, zi, vi)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "An example."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 179,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.004503Z",
     "iopub.status.busy": "2024-04-27T13:49:10.004388Z",
     "iopub.status.idle": "2024-04-27T13:49:10.006117Z",
     "shell.execute_reply": "2024-04-27T13:49:10.005898Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def tstr7(s):\n",
    "    if s.find('world') != -1:\n",
    "        return True\n",
    "    else:\n",
    "        return False"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 180,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.007651Z",
     "iopub.status.busy": "2024-04-27T13:49:10.007532Z",
     "iopub.status.idle": "2024-04-27T13:49:10.009833Z",
     "shell.execute_reply": "2024-04-27T13:49:10.009594Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[tstr7]('hello world')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 181,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.011268Z",
     "iopub.status.busy": "2024-04-27T13:49:10.011155Z",
     "iopub.status.idle": "2024-04-27T13:49:10.033306Z",
     "shell.execute_reply": "2024-04-27T13:49:10.032952Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('worldAworld', 'String')})"
      ]
     },
     "execution_count": 181,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "As before, the predicates only ensure that the `find()` returned a value greater than -1. Hence, our solution reflects that."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Remove Space from Ends"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We next implement `strip()`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 182,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.035044Z",
     "iopub.status.busy": "2024-04-27T13:49:10.034910Z",
     "iopub.status.idle": "2024-04-27T13:49:10.036810Z",
     "shell.execute_reply": "2024-04-27T13:49:10.036516Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "import string"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 183,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.038645Z",
     "iopub.status.busy": "2024-04-27T13:49:10.038430Z",
     "iopub.status.idle": "2024-04-27T13:49:10.041719Z",
     "shell.execute_reply": "2024-04-27T13:49:10.041190Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def rstrip(self, chars=None):\n",
    "        if chars is None:\n",
    "            chars = string.whitespace\n",
    "        if self._len == 0:\n",
    "            return self\n",
    "        else:\n",
    "            last_idx = self._len - 1\n",
    "            cz = z3.SubString(self.z, last_idx.z, 1)\n",
    "            cv = self.v[-1]\n",
    "            zcheck_space = z3.Or([cz == z3.StringVal(char) for char in chars])\n",
    "            vcheck_space = any(cv == char for char in chars)\n",
    "            if zbool(self.context, zcheck_space, vcheck_space):\n",
    "                return zstr(self.context, z3.SubString(self.z, 0, last_idx.z),\n",
    "                            self.v[0:-1]).rstrip(chars)\n",
    "            else:\n",
    "                return self"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 184,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.043445Z",
     "iopub.status.busy": "2024-04-27T13:49:10.043354Z",
     "iopub.status.idle": "2024-04-27T13:49:10.045382Z",
     "shell.execute_reply": "2024-04-27T13:49:10.045040Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def tstr8(s):\n",
    "    if s.rstrip(' ') == 'a b':\n",
    "        return True\n",
    "    else:\n",
    "        return False"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 185,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.046927Z",
     "iopub.status.busy": "2024-04-27T13:49:10.046836Z",
     "iopub.status.idle": "2024-04-27T13:49:10.050488Z",
     "shell.execute_reply": "2024-04-27T13:49:10.050219Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "True\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[tstr8]('a b   ')\n",
    "    print(r)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 186,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.052027Z",
     "iopub.status.busy": "2024-04-27T13:49:10.051908Z",
     "iopub.status.idle": "2024-04-27T13:49:10.077680Z",
     "shell.execute_reply": "2024-04-27T13:49:10.077229Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('a b   ', 'String')})"
      ]
     },
     "execution_count": 186,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 187,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.079628Z",
     "iopub.status.busy": "2024-04-27T13:49:10.079493Z",
     "iopub.status.idle": "2024-04-27T13:49:10.082987Z",
     "shell.execute_reply": "2024-04-27T13:49:10.082693Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def lstrip(self, chars=None):\n",
    "        if chars is None:\n",
    "            chars = string.whitespace\n",
    "        if self._len == 0:\n",
    "            return self\n",
    "        else:\n",
    "            first_idx = 0\n",
    "            cz = z3.SubString(self.z, 0, 1)\n",
    "            cv = self.v[0]\n",
    "            zcheck_space = z3.Or([cz == z3.StringVal(char) for char in chars])\n",
    "            vcheck_space = any(cv == char for char in chars)\n",
    "            if zbool(self.context, zcheck_space, vcheck_space):\n",
    "                return zstr(self.context, z3.SubString(\n",
    "                    self.z, 1, self._len.z), self.v[1:]).lstrip(chars)\n",
    "            else:\n",
    "                return self"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 188,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.084674Z",
     "iopub.status.busy": "2024-04-27T13:49:10.084575Z",
     "iopub.status.idle": "2024-04-27T13:49:10.086619Z",
     "shell.execute_reply": "2024-04-27T13:49:10.086333Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def tstr9(s):\n",
    "    if s.lstrip(' ') == 'a b':\n",
    "        return True\n",
    "    else:\n",
    "        return False"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 189,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.088378Z",
     "iopub.status.busy": "2024-04-27T13:49:10.088263Z",
     "iopub.status.idle": "2024-04-27T13:49:10.091674Z",
     "shell.execute_reply": "2024-04-27T13:49:10.091375Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "True\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[tstr9]('   a b')\n",
    "    print(r)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 190,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.093539Z",
     "iopub.status.busy": "2024-04-27T13:49:10.093356Z",
     "iopub.status.idle": "2024-04-27T13:49:10.116608Z",
     "shell.execute_reply": "2024-04-27T13:49:10.116255Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('   a b', 'String')})"
      ]
     },
     "execution_count": 190,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 191,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.118405Z",
     "iopub.status.busy": "2024-04-27T13:49:10.118284Z",
     "iopub.status.idle": "2024-04-27T13:49:10.120467Z",
     "shell.execute_reply": "2024-04-27T13:49:10.120141Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def strip(self, chars=None):\n",
    "        return self.lstrip(chars).rstrip(chars)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Example usage."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 192,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.122254Z",
     "iopub.status.busy": "2024-04-27T13:49:10.122120Z",
     "iopub.status.idle": "2024-04-27T13:49:10.124032Z",
     "shell.execute_reply": "2024-04-27T13:49:10.123724Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def tstr10(s):\n",
    "    if s.strip() == 'a b':\n",
    "        return True\n",
    "    else:\n",
    "        return False"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 193,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.125646Z",
     "iopub.status.busy": "2024-04-27T13:49:10.125543Z",
     "iopub.status.idle": "2024-04-27T13:49:10.131755Z",
     "shell.execute_reply": "2024-04-27T13:49:10.131472Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "True\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[tstr10]('    a b  ')\n",
    "    print(r)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 194,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.133260Z",
     "iopub.status.busy": "2024-04-27T13:49:10.133123Z",
     "iopub.status.idle": "2024-04-27T13:49:10.162808Z",
     "shell.execute_reply": "2024-04-27T13:49:10.162389Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('\\\\u{c}\\\\u{a}\\\\u{9}\\\\u{a}a b\\\\u{d}\\\\u{d}', 'String')})"
      ]
     },
     "execution_count": 194,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `strip()` has generated the right constraints. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Splitting Strings\n",
    "\n",
    "We implement string `split()` as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 195,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.164860Z",
     "iopub.status.busy": "2024-04-27T13:49:10.164713Z",
     "iopub.status.idle": "2024-04-27T13:49:10.168275Z",
     "shell.execute_reply": "2024-04-27T13:49:10.167981Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zstr(zstr):\n",
    "    def split(self, sep=None, maxsplit=-1):\n",
    "        assert sep is not None  # default space based split is complicated\n",
    "        assert maxsplit == -1  # for now.\n",
    "        zsep = z3.StringVal(sep)\n",
    "        zl = z3.Length(zsep)\n",
    "        # zi would be the length of prefix\n",
    "        zi = z3.IndexOf(self.z, zsep, z3.IntVal(0))\n",
    "        # Z3Bug: There is a bug in the `z3.IndexOf` method which returns\n",
    "        # `z3.SeqRef` instead of `z3.ArithRef`. So we need to fix it.\n",
    "        zi = z3.ArithRef(zi.ast, zi.ctx)\n",
    "\n",
    "        vi = self.v.find(sep)\n",
    "        if zbool(self.context, zi >= z3.IntVal(0), vi >= 0):\n",
    "            zprefix = z3.SubString(self.z, z3.IntVal(0), zi)\n",
    "            zmid = z3.SubString(self.z, zi, zl)\n",
    "            zsuffix = z3.SubString(self.z, zi + zl,\n",
    "                                   z3.Length(self.z))\n",
    "            return [zstr(self.context, zprefix, self.v[0:vi])] + zstr(\n",
    "                self.context, zsuffix, self.v[vi + len(sep):]).split(\n",
    "                    sep, maxsplit)\n",
    "        else:\n",
    "            return [self]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 196,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.169901Z",
     "iopub.status.busy": "2024-04-27T13:49:10.169812Z",
     "iopub.status.idle": "2024-04-27T13:49:10.171738Z",
     "shell.execute_reply": "2024-04-27T13:49:10.171449Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def tstr11(s):\n",
    "    if s.split(',') == ['a', 'b', 'c']:\n",
    "        return True\n",
    "    else:\n",
    "        return False"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 197,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.173222Z",
     "iopub.status.busy": "2024-04-27T13:49:10.173135Z",
     "iopub.status.idle": "2024-04-27T13:49:10.176299Z",
     "shell.execute_reply": "2024-04-27T13:49:10.176000Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "True\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[tstr11]('a,b,c')\n",
    "    print(r)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 198,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.177815Z",
     "iopub.status.busy": "2024-04-27T13:49:10.177724Z",
     "iopub.status.idle": "2024-04-27T13:49:10.211087Z",
     "shell.execute_reply": "2024-04-27T13:49:10.210632Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('a,b,c', 'String')})"
      ]
     },
     "execution_count": 198,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "##### Trip Wire\n",
    "\n",
    "For easier debugging, we abort any calls to methods in `str` that are not overridden by `zstr`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 199,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.212792Z",
     "iopub.status.busy": "2024-04-27T13:49:10.212666Z",
     "iopub.status.idle": "2024-04-27T13:49:10.214921Z",
     "shell.execute_reply": "2024-04-27T13:49:10.214559Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def make_str_abort_wrapper(fun):\n",
    "    def proxy(*args, **kwargs):\n",
    "        raise Exception('%s Not implemented in `zstr`' % fun.__name__)\n",
    "    return proxy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 200,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.216583Z",
     "iopub.status.busy": "2024-04-27T13:49:10.216448Z",
     "iopub.status.idle": "2024-04-27T13:49:10.219384Z",
     "shell.execute_reply": "2024-04-27T13:49:10.219084Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def init_concolic_3():\n",
    "    strmembers = inspect.getmembers(zstr, callable)\n",
    "    zstrmembers = {m[0] for m in strmembers if len(\n",
    "        m) == 2 and 'zstr' in m[1].__qualname__}\n",
    "    for name, fn in inspect.getmembers(str, callable):\n",
    "        # Omitted 'splitlines' as this is needed for formatting output in\n",
    "        # IPython/Jupyter\n",
    "        if name not in zstrmembers and name not in [\n",
    "            'splitlines',\n",
    "            '__class__',\n",
    "            '__contains__',\n",
    "            '__delattr__',\n",
    "            '__dir__',\n",
    "            '__format__',\n",
    "            '__ge__',\n",
    "            '__getattribute__',\n",
    "            '__getnewargs__',\n",
    "            '__gt__',\n",
    "            '__hash__',\n",
    "            '__le__',\n",
    "            '__len__',\n",
    "            '__lt__',\n",
    "            '__mod__',\n",
    "            '__mul__',\n",
    "            '__ne__',\n",
    "            '__reduce__',\n",
    "            '__reduce_ex__',\n",
    "            '__repr__',\n",
    "            '__rmod__',\n",
    "            '__rmul__',\n",
    "            '__setattr__',\n",
    "            '__sizeof__',\n",
    "                '__str__']:\n",
    "            setattr(zstr, name, make_str_abort_wrapper(fn))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 201,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.220816Z",
     "iopub.status.busy": "2024-04-27T13:49:10.220710Z",
     "iopub.status.idle": "2024-04-27T13:49:10.222345Z",
     "shell.execute_reply": "2024-04-27T13:49:10.222090Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "INITIALIZER_LIST.append(init_concolic_3)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 202,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.223694Z",
     "iopub.status.busy": "2024-04-27T13:49:10.223611Z",
     "iopub.status.idle": "2024-04-27T13:49:10.225545Z",
     "shell.execute_reply": "2024-04-27T13:49:10.225260Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    },
    "tags": []
   },
   "outputs": [],
   "source": [
    "init_concolic_3()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### End of Excursion"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Example: Triangle\n",
    "\n",
    "We previously showed how to run `triangle()` under `ConcolicTracer`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 203,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.227206Z",
     "iopub.status.busy": "2024-04-27T13:49:10.227095Z",
     "iopub.status.idle": "2024-04-27T13:49:10.229697Z",
     "shell.execute_reply": "2024-04-27T13:49:10.229330Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "scalene\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    print(_[triangle](1, 2, 3))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The symbolic variables are as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 204,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.231187Z",
     "iopub.status.busy": "2024-04-27T13:49:10.231064Z",
     "iopub.status.idle": "2024-04-27T13:49:10.233249Z",
     "shell.execute_reply": "2024-04-27T13:49:10.233001Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    },
    "tags": []
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'triangle_a_int_1': 'Int',\n",
       " 'triangle_b_int_2': 'Int',\n",
       " 'triangle_c_int_3': 'Int'}"
      ]
     },
     "execution_count": 204,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.decls"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The predicates are as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 205,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.234872Z",
     "iopub.status.busy": "2024-04-27T13:49:10.234750Z",
     "iopub.status.idle": "2024-04-27T13:49:10.238490Z",
     "shell.execute_reply": "2024-04-27T13:49:10.238198Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[Not(triangle_a_int_1 == triangle_b_int_2),\n",
       " Not(triangle_b_int_2 == triangle_c_int_3),\n",
       " Not(triangle_a_int_1 == triangle_c_int_3)]"
      ]
     },
     "execution_count": 205,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.path"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Using `zeval()`, we solve these path conditions and obtain a solution. We find that Z3 gives us three distinct integer values:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 206,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.239933Z",
     "iopub.status.busy": "2024-04-27T13:49:10.239844Z",
     "iopub.status.idle": "2024-04-27T13:49:10.259980Z",
     "shell.execute_reply": "2024-04-27T13:49:10.259535Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat',\n",
       " {'a': ('0', 'Int'), 'b': (['-', '2'], 'Int'), 'c': (['-', '1'], 'Int')})"
      ]
     },
     "execution_count": 206,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "(Note that some values may be negative. Indeed, `triangle()` works with negative length values, too, even if real triangles only have positive lengths.)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "If we invoke `triangle()` with these very values, we take the _exact same path_ as the original input:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 207,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.262063Z",
     "iopub.status.busy": "2024-04-27T13:49:10.261936Z",
     "iopub.status.idle": "2024-04-27T13:49:10.264229Z",
     "shell.execute_reply": "2024-04-27T13:49:10.263936Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'scalene'"
      ]
     },
     "execution_count": 207,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "triangle(0, -2, -1)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can have z3 _negate_ individual conditions – and thus take different paths.\n",
    "First, we retrieve the symbolic variables."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 208,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.265771Z",
     "iopub.status.busy": "2024-04-27T13:49:10.265661Z",
     "iopub.status.idle": "2024-04-27T13:49:10.267725Z",
     "shell.execute_reply": "2024-04-27T13:49:10.267462Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "za, zb, zc = [z3.Int(s) for s in _.decls.keys()]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 209,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.269468Z",
     "iopub.status.busy": "2024-04-27T13:49:10.269328Z",
     "iopub.status.idle": "2024-04-27T13:49:10.272243Z",
     "shell.execute_reply": "2024-04-27T13:49:10.271982Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "(triangle_a_int_1, triangle_b_int_2, triangle_c_int_3)"
      ]
     },
     "execution_count": 209,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "za, zb, zc"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Then, we pass a negated predicate to `zeval()`. The key (here: `1`) determines which predicate the new predicate will replace."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 210,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.273875Z",
     "iopub.status.busy": "2024-04-27T13:49:10.273765Z",
     "iopub.status.idle": "2024-04-27T13:49:10.294261Z",
     "shell.execute_reply": "2024-04-27T13:49:10.293888Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'a': ('1', 'Int'), 'b': ('0', 'Int'), 'c': ('0', 'Int')})"
      ]
     },
     "execution_count": 210,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval({1: zb == zc})"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 211,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.295988Z",
     "iopub.status.busy": "2024-04-27T13:49:10.295860Z",
     "iopub.status.idle": "2024-04-27T13:49:10.298505Z",
     "shell.execute_reply": "2024-04-27T13:49:10.298185Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'isosceles'"
      ]
     },
     "execution_count": 211,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "triangle(1, 0, 1)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The updated predicate returns `isosceles` as expected. By negating further conditions, we can systematically explore all branches in `triangle()`."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Example: Decoding CGI Strings"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Let us apply `ConcolicTracer` on our example program `cgi_decode()` from the [chapter on coverage](Coverage.ipynb). Note that we need to rewrite its code slightly, as the hash lookups in `hex_values` can not be used for transferring constraints yet."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 212,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.300536Z",
     "iopub.status.busy": "2024-04-27T13:49:10.300400Z",
     "iopub.status.idle": "2024-04-27T13:49:10.304646Z",
     "shell.execute_reply": "2024-04-27T13:49:10.304402Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def cgi_decode(s):\n",
    "    \"\"\"Decode the CGI-encoded string `s`:\n",
    "       * replace \"+\" by \" \"\n",
    "       * replace \"%xx\" by the character with hex number xx.\n",
    "       Return the decoded string.  Raise `ValueError` for invalid inputs.\"\"\"\n",
    "\n",
    "    # Mapping of hex digits to their integer values\n",
    "    hex_values = {\n",
    "        '0': 0, '1': 1, '2': 2, '3': 3, '4': 4,\n",
    "        '5': 5, '6': 6, '7': 7, '8': 8, '9': 9,\n",
    "        'a': 10, 'b': 11, 'c': 12, 'd': 13, 'e': 14, 'f': 15,\n",
    "        'A': 10, 'B': 11, 'C': 12, 'D': 13, 'E': 14, 'F': 15,\n",
    "    }\n",
    "\n",
    "    t = ''\n",
    "    i = 0\n",
    "    while i < s.length():\n",
    "        c = s[i]\n",
    "        if c == '+':\n",
    "            t += ' '\n",
    "        elif c == '%':\n",
    "            digit_high, digit_low = s[i + 1], s[i + 2]\n",
    "            i = i + 2\n",
    "            found = 0\n",
    "            v = 0\n",
    "            for key in hex_values:\n",
    "                if key == digit_high:\n",
    "                    found = found + 1\n",
    "                    v = hex_values[key] * 16\n",
    "                    break\n",
    "            for key in hex_values:\n",
    "                if key == digit_low:\n",
    "                    found = found + 1\n",
    "                    v = v + hex_values[key]\n",
    "                    break\n",
    "            if found == 2:\n",
    "                if v >= 128:\n",
    "                    # z3.StringVal(urllib.parse.unquote('%80')) <-- bug in z3\n",
    "                    raise ValueError(\"Invalid encoding\")\n",
    "                t = t + chr(v)\n",
    "            else:\n",
    "                raise ValueError(\"Invalid encoding\")\n",
    "        else:\n",
    "            t = t + c\n",
    "        i = i + 1\n",
    "    return t"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 213,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.306397Z",
     "iopub.status.busy": "2024-04-27T13:49:10.306257Z",
     "iopub.status.idle": "2024-04-27T13:49:10.308656Z",
     "shell.execute_reply": "2024-04-27T13:49:10.308391Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    _[cgi_decode]('')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 214,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.310064Z",
     "iopub.status.busy": "2024-04-27T13:49:10.309961Z",
     "iopub.status.idle": "2024-04-27T13:49:10.312899Z",
     "shell.execute_reply": "2024-04-27T13:49:10.312588Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'cgi_decode_s_str_1': 'String'}, [Not(0 < Length(cgi_decode_s_str_1))])"
      ]
     },
     "execution_count": 214,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 215,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.314651Z",
     "iopub.status.busy": "2024-04-27T13:49:10.314515Z",
     "iopub.status.idle": "2024-04-27T13:49:10.318716Z",
     "shell.execute_reply": "2024-04-27T13:49:10.318430Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    _[cgi_decode]('a%20d')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Once executed, we can retrieve the symbolic variables in the `decls` attribute. This is a mapping of symbolic variables to types."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 216,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.320214Z",
     "iopub.status.busy": "2024-04-27T13:49:10.320123Z",
     "iopub.status.idle": "2024-04-27T13:49:10.322357Z",
     "shell.execute_reply": "2024-04-27T13:49:10.322043Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'cgi_decode_s_str_1': 'String'}"
      ]
     },
     "execution_count": 216,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.decls"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The extracted path conditions can be found in the `path` attribute:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 217,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.323968Z",
     "iopub.status.busy": "2024-04-27T13:49:10.323861Z",
     "iopub.status.idle": "2024-04-27T13:49:10.330087Z",
     "shell.execute_reply": "2024-04-27T13:49:10.329840Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[0 < Length(cgi_decode_s_str_1),\n",
       " Not(str.substr(cgi_decode_s_str_1, 0, 1) == \"+\"),\n",
       " Not(str.substr(cgi_decode_s_str_1, 0, 1) == \"%\"),\n",
       " 1 < Length(cgi_decode_s_str_1),\n",
       " Not(str.substr(cgi_decode_s_str_1, 1, 1) == \"+\"),\n",
       " str.substr(cgi_decode_s_str_1, 1, 1) == \"%\",\n",
       " Not(str.substr(cgi_decode_s_str_1, 2, 1) == \"0\"),\n",
       " Not(str.substr(cgi_decode_s_str_1, 2, 1) == \"1\"),\n",
       " str.substr(cgi_decode_s_str_1, 2, 1) == \"2\",\n",
       " str.substr(cgi_decode_s_str_1, 3, 1) == \"0\",\n",
       " 4 < Length(cgi_decode_s_str_1),\n",
       " Not(str.substr(cgi_decode_s_str_1, 4, 1) == \"+\"),\n",
       " Not(str.substr(cgi_decode_s_str_1, 4, 1) == \"%\"),\n",
       " Not(5 < Length(cgi_decode_s_str_1))]"
      ]
     },
     "execution_count": 217,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.path"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The `context` attribute holds a pair of `decls` and `path` attributes; this is useful for passing it into the `ConcolicTracer` constructor."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 218,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.331748Z",
     "iopub.status.busy": "2024-04-27T13:49:10.331642Z",
     "iopub.status.idle": "2024-04-27T13:49:10.333473Z",
     "shell.execute_reply": "2024-04-27T13:49:10.333200Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "assert _.context == (_.decls, _.path)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can solve these constraints to obtain a value for the function parameters that follow the same path as the original (traced) invocation:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 219,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.335254Z",
     "iopub.status.busy": "2024-04-27T13:49:10.335121Z",
     "iopub.status.idle": "2024-04-27T13:49:10.357582Z",
     "shell.execute_reply": "2024-04-27T13:49:10.357233Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('A%20B', 'String')})"
      ]
     },
     "execution_count": 219,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "_Negating_ some of these constraints will yield different paths taken, and thus greater code coverage. This is what our concolic fuzzers (see later) do. Let us go and negate the first constraint, namely that the first character should _not_ be a `+` character:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 220,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.359439Z",
     "iopub.status.busy": "2024-04-27T13:49:10.359314Z",
     "iopub.status.idle": "2024-04-27T13:49:10.362725Z",
     "shell.execute_reply": "2024-04-27T13:49:10.362396Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "0 &lt; Length(cgi_decode_s_str_1)"
      ],
      "text/plain": [
       "0 < Length(cgi_decode_s_str_1)"
      ]
     },
     "execution_count": 220,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.path[0]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "To compute the negated string, we have to construct it via z3 primitives:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 221,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.364631Z",
     "iopub.status.busy": "2024-04-27T13:49:10.364533Z",
     "iopub.status.idle": "2024-04-27T13:49:10.366584Z",
     "shell.execute_reply": "2024-04-27T13:49:10.366330Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "zs = z3.String('cgi_decode_s_str_1')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 222,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.367940Z",
     "iopub.status.busy": "2024-04-27T13:49:10.367853Z",
     "iopub.status.idle": "2024-04-27T13:49:10.371550Z",
     "shell.execute_reply": "2024-04-27T13:49:10.371284Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "str.substr(cgi_decode_s_str_1, 0, 1) = \"a\""
      ],
      "text/plain": [
       "str.substr(cgi_decode_s_str_1, 0, 1) == \"a\""
      ]
     },
     "execution_count": 222,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "z3.SubString(zs, 0, 1) == z3.StringVal('a')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Invoking `zeval()` with the path condition to be changed obtains a new input that satisfies the negated predicate:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 223,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.373262Z",
     "iopub.status.busy": "2024-04-27T13:49:10.373113Z",
     "iopub.status.idle": "2024-04-27T13:49:10.398279Z",
     "shell.execute_reply": "2024-04-27T13:49:10.397805Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "(result, new_vars) = _.zeval({1: z3.SubString(zs, 0, 1) == z3.StringVal('+')})\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 224,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.400326Z",
     "iopub.status.busy": "2024-04-27T13:49:10.400188Z",
     "iopub.status.idle": "2024-04-27T13:49:10.403410Z",
     "shell.execute_reply": "2024-04-27T13:49:10.402858Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'s': ('+%20A', 'String')}"
      ]
     },
     "execution_count": 224,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "new_vars"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 225,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.405120Z",
     "iopub.status.busy": "2024-04-27T13:49:10.404972Z",
     "iopub.status.idle": "2024-04-27T13:49:10.407216Z",
     "shell.execute_reply": "2024-04-27T13:49:10.406826Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "(new_s, new_s_type) = new_vars['s']"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 226,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.408804Z",
     "iopub.status.busy": "2024-04-27T13:49:10.408687Z",
     "iopub.status.idle": "2024-04-27T13:49:10.411263Z",
     "shell.execute_reply": "2024-04-27T13:49:10.410942Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'+%20A'"
      ]
     },
     "execution_count": 226,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "new_s"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can validate that `new_s` indeed takes the new path by re-running the tracer with `new_s` as input:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 227,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.413011Z",
     "iopub.status.busy": "2024-04-27T13:49:10.412879Z",
     "iopub.status.idle": "2024-04-27T13:49:10.416067Z",
     "shell.execute_reply": "2024-04-27T13:49:10.415808Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    _[cgi_decode](new_s)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 228,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.417721Z",
     "iopub.status.busy": "2024-04-27T13:49:10.417499Z",
     "iopub.status.idle": "2024-04-27T13:49:10.423481Z",
     "shell.execute_reply": "2024-04-27T13:49:10.423158Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[0 < Length(cgi_decode_s_str_1),\n",
       " str.substr(cgi_decode_s_str_1, 0, 1) == \"+\",\n",
       " 1 < Length(cgi_decode_s_str_1),\n",
       " Not(str.substr(cgi_decode_s_str_1, 1, 1) == \"+\"),\n",
       " str.substr(cgi_decode_s_str_1, 1, 1) == \"%\",\n",
       " Not(str.substr(cgi_decode_s_str_1, 2, 1) == \"0\"),\n",
       " Not(str.substr(cgi_decode_s_str_1, 2, 1) == \"1\"),\n",
       " str.substr(cgi_decode_s_str_1, 2, 1) == \"2\",\n",
       " str.substr(cgi_decode_s_str_1, 3, 1) == \"0\",\n",
       " 4 < Length(cgi_decode_s_str_1),\n",
       " Not(str.substr(cgi_decode_s_str_1, 4, 1) == \"+\"),\n",
       " Not(str.substr(cgi_decode_s_str_1, 4, 1) == \"%\"),\n",
       " Not(5 < Length(cgi_decode_s_str_1))]"
      ]
     },
     "execution_count": 228,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.path"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "By negating further conditions, we can explore more and more code."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Example: Round\n",
    "\n",
    "Here is a function that gives you the nearest ten's multiplier"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 229,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.425180Z",
     "iopub.status.busy": "2024-04-27T13:49:10.425070Z",
     "iopub.status.idle": "2024-04-27T13:49:10.426931Z",
     "shell.execute_reply": "2024-04-27T13:49:10.426579Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def round10(r):\n",
    "    while r % 10 != 0:\n",
    "        r += 1\n",
    "    return r"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "As before, we execute the function under the `ConcolicTracer` context."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 230,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.428602Z",
     "iopub.status.busy": "2024-04-27T13:49:10.428477Z",
     "iopub.status.idle": "2024-04-27T13:49:10.432042Z",
     "shell.execute_reply": "2024-04-27T13:49:10.431710Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    r = _[round10](1)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We verify that we were able to capture all the predicates:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 231,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.433649Z",
     "iopub.status.busy": "2024-04-27T13:49:10.433561Z",
     "iopub.status.idle": "2024-04-27T13:49:10.537663Z",
     "shell.execute_reply": "2024-04-27T13:49:10.537352Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'round10_r_int_1': 'Int'},\n",
       " [0 != round10_r_int_1%10,\n",
       "  0 != (round10_r_int_1 + 1)%10,\n",
       "  0 != (round10_r_int_1 + 1 + 1)%10,\n",
       "  0 != (round10_r_int_1 + 1 + 1 + 1)%10,\n",
       "  0 != (round10_r_int_1 + 1 + 1 + 1 + 1)%10,\n",
       "  0 != (round10_r_int_1 + 1 + 1 + 1 + 1 + 1)%10,\n",
       "  0 != (round10_r_int_1 + 1 + 1 + 1 + 1 + 1 + 1)%10,\n",
       "  0 != (round10_r_int_1 + 1 + 1 + 1 + 1 + 1 + 1 + 1)%10,\n",
       "  0 != (round10_r_int_1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1)%10,\n",
       "  Not(0 !=\n",
       "      (round10_r_int_1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1)%10)])"
      ]
     },
     "execution_count": 231,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We use `zeval()` to obtain more inputs that take the same path."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 232,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.539534Z",
     "iopub.status.busy": "2024-04-27T13:49:10.539416Z",
     "iopub.status.idle": "2024-04-27T13:49:10.561254Z",
     "shell.execute_reply": "2024-04-27T13:49:10.560779Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'r': (['-', '9'], 'Int')})"
      ]
     },
     "execution_count": 232,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Example: Absolute Maximum\n",
    "\n",
    "Do our concolic proxies work across functions? Say we have a function `max_value()` as below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 233,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.563047Z",
     "iopub.status.busy": "2024-04-27T13:49:10.562921Z",
     "iopub.status.idle": "2024-04-27T13:49:10.564870Z",
     "shell.execute_reply": "2024-04-27T13:49:10.564617Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def abs_value(a):\n",
    "    if a > 0:\n",
    "        return a\n",
    "    else:\n",
    "        return -a"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "It is called by another function `abs_max()`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 234,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.566315Z",
     "iopub.status.busy": "2024-04-27T13:49:10.566203Z",
     "iopub.status.idle": "2024-04-27T13:49:10.568081Z",
     "shell.execute_reply": "2024-04-27T13:49:10.567797Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def abs_max(a, b):\n",
    "    a1 = abs_value(a)\n",
    "    b1 = abs_value(b)\n",
    "    if a1 > b1:\n",
    "        c = a1\n",
    "    else:\n",
    "        c = b1\n",
    "    return c"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Using the `Concolic()` context on `abs_max()`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 235,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.569852Z",
     "iopub.status.busy": "2024-04-27T13:49:10.569726Z",
     "iopub.status.idle": "2024-04-27T13:49:10.572195Z",
     "shell.execute_reply": "2024-04-27T13:49:10.571942Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    _[abs_max](2, 1)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "As expected, we have the predicates across functions."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 236,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.573849Z",
     "iopub.status.busy": "2024-04-27T13:49:10.573641Z",
     "iopub.status.idle": "2024-04-27T13:49:10.577176Z",
     "shell.execute_reply": "2024-04-27T13:49:10.576839Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'abs_max_a_int_1': 'Int', 'abs_max_b_int_2': 'Int'},\n",
       " [0 < abs_max_a_int_1, 0 < abs_max_b_int_2, abs_max_a_int_1 > abs_max_b_int_2])"
      ]
     },
     "execution_count": 236,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 237,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.578814Z",
     "iopub.status.busy": "2024-04-27T13:49:10.578717Z",
     "iopub.status.idle": "2024-04-27T13:49:10.599844Z",
     "shell.execute_reply": "2024-04-27T13:49:10.599388Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'a': ('2', 'Int'), 'b': ('1', 'Int')})"
      ]
     },
     "execution_count": 237,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Solving the predicates works as expected."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Using negative numbers as arguments so that a different branch is taken in `abs_value()`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 238,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.601852Z",
     "iopub.status.busy": "2024-04-27T13:49:10.601709Z",
     "iopub.status.idle": "2024-04-27T13:49:10.604407Z",
     "shell.execute_reply": "2024-04-27T13:49:10.604146Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    _[abs_max](-2, -1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 239,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.606192Z",
     "iopub.status.busy": "2024-04-27T13:49:10.606053Z",
     "iopub.status.idle": "2024-04-27T13:49:10.609957Z",
     "shell.execute_reply": "2024-04-27T13:49:10.609554Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'abs_max_a_int_1': 'Int', 'abs_max_b_int_2': 'Int'},\n",
       " [Not(0 < abs_max_a_int_1),\n",
       "  Not(0 < abs_max_b_int_2),\n",
       "  -abs_max_a_int_1 > -abs_max_b_int_2])"
      ]
     },
     "execution_count": 239,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 240,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.611652Z",
     "iopub.status.busy": "2024-04-27T13:49:10.611546Z",
     "iopub.status.idle": "2024-04-27T13:49:10.631753Z",
     "shell.execute_reply": "2024-04-27T13:49:10.631418Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'a': (['-', '1'], 'Int'), 'b': ('0', 'Int')})"
      ]
     },
     "execution_count": 240,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The solution reflects our predicates. (We used `a > 0` in `abs_value()`)."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Example: Binomial Coefficient\n",
    "\n",
    "For a larger example that uses different kinds of variables, say we want to compute the binomial coefficient by the following formulas\n",
    "\n",
    "$$ \n",
    "^nP_k=\\frac{n!}{(n-k)!}\n",
    "$$\n",
    "\n",
    "$$\n",
    "\\binom nk=\\,^nC_k=\\frac{^nP_k}{k!}\n",
    "$$\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "we define the functions as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 241,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.633710Z",
     "iopub.status.busy": "2024-04-27T13:49:10.633537Z",
     "iopub.status.idle": "2024-04-27T13:49:10.635925Z",
     "shell.execute_reply": "2024-04-27T13:49:10.635536Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def factorial(n):  # type: ignore\n",
    "    v = 1\n",
    "    while n != 0:\n",
    "        v *= n\n",
    "        n -= 1\n",
    "\n",
    "    return v"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 242,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.637771Z",
     "iopub.status.busy": "2024-04-27T13:49:10.637592Z",
     "iopub.status.idle": "2024-04-27T13:49:10.639433Z",
     "shell.execute_reply": "2024-04-27T13:49:10.639176Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def permutation(n, k):\n",
    "    return factorial(n) / factorial(n - k)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 243,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.641108Z",
     "iopub.status.busy": "2024-04-27T13:49:10.640985Z",
     "iopub.status.idle": "2024-04-27T13:49:10.642694Z",
     "shell.execute_reply": "2024-04-27T13:49:10.642435Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def combination(n, k):\n",
    "    return permutation(n, k) / factorial(k)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 244,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.644036Z",
     "iopub.status.busy": "2024-04-27T13:49:10.643953Z",
     "iopub.status.idle": "2024-04-27T13:49:10.645718Z",
     "shell.execute_reply": "2024-04-27T13:49:10.645496Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def binomial(n, k):\n",
    "    if n < 0 or k < 0 or n < k:\n",
    "        raise Exception('Invalid values')\n",
    "    return combination(n, k)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "As before, we run the function under `ConcolicTracer`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 245,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.647400Z",
     "iopub.status.busy": "2024-04-27T13:49:10.647127Z",
     "iopub.status.idle": "2024-04-27T13:49:10.650778Z",
     "shell.execute_reply": "2024-04-27T13:49:10.650425Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    v = _[binomial](4, 2)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Then call `zeval()` to evaluate."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 246,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.652353Z",
     "iopub.status.busy": "2024-04-27T13:49:10.652260Z",
     "iopub.status.idle": "2024-04-27T13:49:10.673280Z",
     "shell.execute_reply": "2024-04-27T13:49:10.672850Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'n': ('4', 'Int'), 'k': ('2', 'Int')})"
      ]
     },
     "execution_count": 246,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "raw",
   "metadata": {
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "source": [
    "The values returned are same as the input values as expected."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Example: Database"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    },
    "toc-hr-collapsed": true
   },
   "source": [
    "For a larger example using the Concolic String class `zstr`, we use the DB class from the [chapter on information flow](InformationFlow.ipynb)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 247,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.675380Z",
     "iopub.status.busy": "2024-04-27T13:49:10.675262Z",
     "iopub.status.idle": "2024-04-27T13:49:10.677482Z",
     "shell.execute_reply": "2024-04-27T13:49:10.677105Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Note: The following example may not work with your Z3 version;\n",
      "see https://github.com/Z3Prover/z3/issues/5763 for details.\n",
      "Consider `pip install z3-solver==4.8.7.0` as a workaround.\n"
     ]
    }
   ],
   "source": [
    "if __name__ == '__main__':\n",
    "    if z3.get_version() > (4, 8, 7, 0):\n",
    "        print(\"\"\"Note: The following example may not work with your Z3 version;\n",
    "see https://github.com/Z3Prover/z3/issues/5763 for details.\n",
    "Consider `pip install z3-solver==4.8.7.0` as a workaround.\"\"\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 248,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.679186Z",
     "iopub.status.busy": "2024-04-27T13:49:10.679074Z",
     "iopub.status.idle": "2024-04-27T13:49:10.896300Z",
     "shell.execute_reply": "2024-04-27T13:49:10.895993Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from InformationFlow import DB, sample_db, update_inventory"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We first populate our database."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 249,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:10.898156Z",
     "iopub.status.busy": "2024-04-27T13:49:10.898047Z",
     "iopub.status.idle": "2024-04-27T13:49:11.479468Z",
     "shell.execute_reply": "2024-04-27T13:49:11.479138Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from GrammarMiner import VEHICLES  # minor dependency"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 250,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:11.481209Z",
     "iopub.status.busy": "2024-04-27T13:49:11.481094Z",
     "iopub.status.idle": "2024-04-27T13:49:11.482987Z",
     "shell.execute_reply": "2024-04-27T13:49:11.482758Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "db = sample_db()\n",
    "for V in VEHICLES:\n",
    "    update_inventory(db, V)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 251,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:11.484384Z",
     "iopub.status.busy": "2024-04-27T13:49:11.484279Z",
     "iopub.status.idle": "2024-04-27T13:49:11.486762Z",
     "shell.execute_reply": "2024-04-27T13:49:11.486518Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'inventory': ({'year': int, 'kind': str, 'company': str, 'model': str},\n",
       "  [{'year': 1997, 'kind': 'van', 'company': 'Ford', 'model': 'E350'},\n",
       "   {'year': 2000, 'kind': 'car', 'company': 'Mercury', 'model': 'Cougar'},\n",
       "   {'year': 1999, 'kind': 'car', 'company': 'Chevy', 'model': 'Venture'}])}"
      ]
     },
     "execution_count": 251,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "db.db"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We are now ready to fuzz our `DB` class. Hash functions are difficult to handle directly (because they rely on internal C functions). Hence we modify `table()` slightly."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 252,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:11.488161Z",
     "iopub.status.busy": "2024-04-27T13:49:11.488065Z",
     "iopub.status.idle": "2024-04-27T13:49:11.490514Z",
     "shell.execute_reply": "2024-04-27T13:49:11.490185Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ConcolicDB(DB):\n",
    "    def table(self, t_name):\n",
    "        for k, v in self.db:\n",
    "            if t_name == k:\n",
    "                return v\n",
    "        raise SQLException('Table (%s) was not found' % repr(t_name))\n",
    "\n",
    "    def column(self, decl, c_name):\n",
    "        for k in decl:\n",
    "            if c_name == k:\n",
    "                return decl[k]\n",
    "        raise SQLException('Column (%s) was not found' % repr(c_name))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "To make it easy, we define a single function `db_select()` that directly invokes `db.sql()`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 253,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:11.492376Z",
     "iopub.status.busy": "2024-04-27T13:49:11.492267Z",
     "iopub.status.idle": "2024-04-27T13:49:11.494352Z",
     "shell.execute_reply": "2024-04-27T13:49:11.494090Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def db_select(s):\n",
    "    my_db = ConcolicDB()\n",
    "    my_db.db = [(k, v) for (k, v) in db.db.items()]\n",
    "    r = my_db.sql(s)\n",
    "    return r"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We now want to run SQL statements under our `ConcolicTracer`, and collect predicates obtained."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 254,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:11.496058Z",
     "iopub.status.busy": "2024-04-27T13:49:11.495944Z",
     "iopub.status.idle": "2024-04-27T13:49:11.498814Z",
     "shell.execute_reply": "2024-04-27T13:49:11.498540Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    _[db_select]('select kind from inventory')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The predicates encountered during the execution are as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 255,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:11.500433Z",
     "iopub.status.busy": "2024-04-27T13:49:11.500325Z",
     "iopub.status.idle": "2024-04-27T13:49:11.505081Z",
     "shell.execute_reply": "2024-04-27T13:49:11.504819Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[0 == IndexOf(db_select_s_str_1, \"select \", 0),\n",
       " 0 == IndexOf(db_select_s_str_1, \"select \", 0),\n",
       " Not(0 >\n",
       "     IndexOf(str.substr(db_select_s_str_1, 7, 19),\n",
       "             \" from \",\n",
       "             0)),\n",
       " Not(Or(0 <\n",
       "        IndexOf(str.substr(db_select_s_str_1, 7, 19),\n",
       "                \" where \",\n",
       "                0),\n",
       "        0 ==\n",
       "        IndexOf(str.substr(db_select_s_str_1, 7, 19),\n",
       "                \" where \",\n",
       "                0))),\n",
       " str.substr(str.substr(db_select_s_str_1, 7, 19), 10, 9) ==\n",
       " \"inventory\"]"
      ]
     },
     "execution_count": 255,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.path"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We can use `zeval()` as before to solve the constraints."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 256,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:11.506550Z",
     "iopub.status.busy": "2024-04-27T13:49:11.506461Z",
     "iopub.status.idle": "2024-04-27T13:49:17.582342Z",
     "shell.execute_reply": "2024-04-27T13:49:17.581862Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('Gave up', None)"
      ]
     },
     "execution_count": 256,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    },
    "tags": []
   },
   "source": [
    "## Fuzzing with Constraints\n",
    "\n",
    "The `SimpleConcolicFuzzer` class starts with a sample input generated by some other fuzzer. It then runs the function being tested under `ConcolicTracer`, and collects the path predicates. It then negates random predicates within the path and solves it with Z3 to produce a new output that is guaranteed to take a different path than the original."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "As with `ConcolicTracer`, above, please first look at the examples before digging into the implementation."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Excursion: Implementing SimpleConcolicFuzzer"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "First, we import the `Fuzzer` interface, and write example program `hang_if_no_space()`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 257,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.584904Z",
     "iopub.status.busy": "2024-04-27T13:49:17.584722Z",
     "iopub.status.idle": "2024-04-27T13:49:17.587277Z",
     "shell.execute_reply": "2024-04-27T13:49:17.586850Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from Fuzzer import Fuzzer"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 258,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.589473Z",
     "iopub.status.busy": "2024-04-27T13:49:17.589331Z",
     "iopub.status.idle": "2024-04-27T13:49:17.592189Z",
     "shell.execute_reply": "2024-04-27T13:49:17.591612Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def hang_if_no_space(s):\n",
    "    i = 0\n",
    "    while True:\n",
    "        if i < s.length():\n",
    "            if s[i] == ' ':\n",
    "                break\n",
    "        i += 1"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 259,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.594010Z",
     "iopub.status.busy": "2024-04-27T13:49:17.593883Z",
     "iopub.status.idle": "2024-04-27T13:49:17.595891Z",
     "shell.execute_reply": "2024-04-27T13:49:17.595385Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from ExpectError import ExpectTimeout, ExpectError"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 260,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.598129Z",
     "iopub.status.busy": "2024-04-27T13:49:17.597996Z",
     "iopub.status.idle": "2024-04-27T13:49:17.600054Z",
     "shell.execute_reply": "2024-04-27T13:49:17.599578Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "import random"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "#### Representing Decisions"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "To make the fuzzer work, we need a way to represent decisions made during trace. We keep this in a _binary tree_ where each node represents a decision made, and each leaf represents a complete path. A node in the binary tree is represented by the `TraceNode` class.\n",
    "\n",
    "When a new node is added, it represents a decision taken by the parent on some predicate. This predicate is supplied as `smt_val`, which is `True` for this child to be reached. Since the predicate is actually present in the parent node, we also carry a member `smt` which will be updated by the first child to be added."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 261,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.601911Z",
     "iopub.status.busy": "2024-04-27T13:49:17.601769Z",
     "iopub.status.idle": "2024-04-27T13:49:17.605182Z",
     "shell.execute_reply": "2024-04-27T13:49:17.604788Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class TraceNode:\n",
    "    def __init__(self, smt_val, parent, info):\n",
    "        # This is the smt that lead to this node\n",
    "        self._smt_val = z3.simplify(smt_val) if smt_val is not None else None\n",
    "\n",
    "        # This is the predicate that this node might perform at a future point\n",
    "        self.smt = None\n",
    "        self.info = info\n",
    "        self.parent = parent\n",
    "        self.children = {}\n",
    "        self.path = None\n",
    "        self.tree = None\n",
    "        self._pattern = None\n",
    "        self.log = True\n",
    "\n",
    "    def no(self): return self.children.get(self.tree.no_bit)\n",
    "\n",
    "    def yes(self): return self.children.get(self.tree.yes_bit)\n",
    "\n",
    "    def get_children(self): return (self.no(), self.yes())\n",
    "\n",
    "    def __str__(self):\n",
    "        return 'TraceNode[%s]' % ','.join(self.children.keys())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We add a `PlausibleChild` class to track the leaf nodes."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 262,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.606818Z",
     "iopub.status.busy": "2024-04-27T13:49:17.606707Z",
     "iopub.status.idle": "2024-04-27T13:49:17.608970Z",
     "shell.execute_reply": "2024-04-27T13:49:17.608686Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class PlausibleChild:\n",
    "    def __init__(self, parent, cond, tree):\n",
    "        self.parent = parent\n",
    "        self.cond = cond\n",
    "        self.tree = tree\n",
    "        self._smt_val = None\n",
    "\n",
    "    def __repr__(self):\n",
    "        return 'PlausibleChild[%s]' % (self.parent.pattern() + ':' + self.cond)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "When the leaf nodes are used to generate new paths, we expect its sibling `TraceNode` to have been already explored. Hence, we make use of the sibling's values for context `cc`, and the `smt_val` from the parent."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 263,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.610540Z",
     "iopub.status.busy": "2024-04-27T13:49:17.610430Z",
     "iopub.status.idle": "2024-04-27T13:49:17.613556Z",
     "shell.execute_reply": "2024-04-27T13:49:17.613239Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class PlausibleChild(PlausibleChild):\n",
    "    def smt_val(self):\n",
    "        if self._smt_val is not None:\n",
    "            return self._smt_val\n",
    "        # if the parent has other children, then that child would have updatd the parent's smt\n",
    "        # Hence, we can use that child's smt_value's opposite as our value.\n",
    "        assert self.parent.smt is not None\n",
    "        if self.cond == self.tree.no_bit:\n",
    "            self._smt_val = z3.Not(self.parent.smt)\n",
    "        else:\n",
    "            self._smt_val = self.parent.smt\n",
    "        return self._smt_val\n",
    "\n",
    "    def cc(self):\n",
    "        if self.parent.info.get('cc') is not None:\n",
    "            return self.parent.info['cc']\n",
    "        # if there is a plausible child node, it means that there can\n",
    "        # be at most one child.\n",
    "        siblings = list(self.parent.children.values())\n",
    "        assert len(siblings) == 1\n",
    "        # We expect at the other child to have cc\n",
    "        return siblings[0].info['cc']"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The `PlausibleChild` instance is used to generate new paths to explore using `path_expression()`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 264,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.615197Z",
     "iopub.status.busy": "2024-04-27T13:49:17.615083Z",
     "iopub.status.idle": "2024-04-27T13:49:17.617411Z",
     "shell.execute_reply": "2024-04-27T13:49:17.617136Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class PlausibleChild(PlausibleChild):\n",
    "    def path_expression(self):\n",
    "        path_to_root = self.parent.get_path_to_root()\n",
    "        assert path_to_root[0]._smt_val is None\n",
    "        return [i._smt_val for i in path_to_root[1:]] + [self.smt_val()]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `TraceTree` class helps us keep track of the binary tree. In the beginning, the root is a sentinel `TraceNode` instance, and simply have two plausible children as leaves. As soon as the first trace is added, one of the plausible children will become a true child."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 265,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.618905Z",
     "iopub.status.busy": "2024-04-27T13:49:17.618801Z",
     "iopub.status.idle": "2024-04-27T13:49:17.621158Z",
     "shell.execute_reply": "2024-04-27T13:49:17.620859Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class TraceTree:\n",
    "    def __init__(self):\n",
    "        self.root = TraceNode(smt_val=None, parent=None, info={'num': 0})\n",
    "        self.root.tree = self\n",
    "        self.leaves = {}\n",
    "        self.no_bit, self.yes_bit = '0', '1'\n",
    "\n",
    "        pprefix = ':'\n",
    "        for bit in [self.no_bit, self.yes_bit]:\n",
    "            self.leaves[pprefix + bit] = PlausibleChild(self.root, bit, self)\n",
    "        self.completed_paths = {}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `add_trace()` method of the `TraceTree` provides a way for new traces to be added. It is kept separate from the initialization as we might want to add more than one trace from the same function."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 266,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.622986Z",
     "iopub.status.busy": "2024-04-27T13:49:17.622863Z",
     "iopub.status.idle": "2024-04-27T13:49:17.625532Z",
     "shell.execute_reply": "2024-04-27T13:49:17.625130Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class TraceTree(TraceTree):\n",
    "    def add_trace(self, tracer, string):\n",
    "        last = self.root\n",
    "        i = 0\n",
    "        for i, elt in enumerate(tracer.path):\n",
    "            last = last.add_child(elt=elt, i=i + 1, cc=tracer, string=string)\n",
    "        last.add_child(elt=z3.BoolVal(True), i=i + 1, cc=tracer, string=string)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "To make `add_trace()` work, we need a little more infrastructure, that we define below.\n",
    "\n",
    "The `bit()` method translates a predicate to a bit that corresponds to the decision taken at each predicate. If the `if` branch is taken, the result is `1`, while `else` branch is indicated by `0`. The pattern indicates the bit-pattern of decisions required to reach the leaf from the root."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 267,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.627240Z",
     "iopub.status.busy": "2024-04-27T13:49:17.627119Z",
     "iopub.status.idle": "2024-04-27T13:49:17.629993Z",
     "shell.execute_reply": "2024-04-27T13:49:17.629699Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class TraceNode(TraceNode):\n",
    "    def bit(self):\n",
    "        if self._smt_val is None:\n",
    "            return None\n",
    "        return self.tree.no_bit if self._smt_val.decl(\n",
    "        ).name() == 'not' else self.tree.yes_bit\n",
    "\n",
    "    def pattern(self):\n",
    "        if self._pattern is not None:\n",
    "            return self._pattern\n",
    "        path = self.get_path_to_root()\n",
    "        assert path[0]._smt_val is None\n",
    "        assert path[0].parent is None\n",
    "\n",
    "        self._pattern = ''.join([p.bit() for p in path[1:]])\n",
    "        return self._pattern"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Each node knows how to add a new child, and get the path to root, which is cached.\n",
    "\n",
    "When we add a child to the root node, it means that there was a decision in the current node, and the child is the result of the decision. Hence, to get the decision being made, we simplify the `smt` expression, and check if it starts with `not`. If it does not start with a `not`, we interpret that as the current decision in the node. If it starts with `not`, then we interpret that `not(smt)` was the expression being evaluated in the current node.\n",
    "\n",
    "We know the first decision made only after going through the program at least once. As soon as the program is traversed, we update the parent with the decision that resulted in the current child."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 268,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.631579Z",
     "iopub.status.busy": "2024-04-27T13:49:17.631472Z",
     "iopub.status.idle": "2024-04-27T13:49:17.636385Z",
     "shell.execute_reply": "2024-04-27T13:49:17.635936Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class TraceNode(TraceNode):\n",
    "    def add_child(self, elt, i, cc, string):\n",
    "        if elt == z3.BoolVal(True):\n",
    "            # No more exploration here. Simply unregister the leaves of *this*\n",
    "            # node and possibly register them in completed nodes, and exit\n",
    "            for bit in [self.tree.no_bit, self.tree.yes_bit]:\n",
    "                child_leaf = self.pattern() + ':' + bit\n",
    "                if child_leaf in self.tree.leaves:\n",
    "                    del self.tree.leaves[child_leaf]\n",
    "            self.tree.completed_paths[self.pattern()] = self\n",
    "            return None\n",
    "\n",
    "        child_node = TraceNode(smt_val=elt,\n",
    "                               parent=self,\n",
    "                               info={'num': i, 'cc': cc, 'string': string})\n",
    "        child_node.tree = self.tree\n",
    "\n",
    "        # bit represents the path that child took from this node.\n",
    "        bit = child_node.bit()\n",
    "\n",
    "        # first we update our smt decision\n",
    "        if bit == self.tree.yes_bit:  # yes, which means the smt can be used as is\n",
    "            if self.smt is not None:\n",
    "                assert self.smt == child_node._smt_val\n",
    "            else:\n",
    "                self.smt = child_node._smt_val\n",
    "        # no, which means we have to negate it to get the decision.\n",
    "        elif bit == self.tree.no_bit:\n",
    "            smt_ = z3.simplify(z3.Not(child_node._smt_val))\n",
    "            if self.smt is not None:\n",
    "                assert smt_ == self.smt\n",
    "            else:\n",
    "                self.smt = smt_\n",
    "        else:\n",
    "            assert False\n",
    "\n",
    "        if bit in self.children:\n",
    "            #    if self.log:\n",
    "            #print(elt, child_node.bit(), i, string)\n",
    "            #print(i,'overwriting', bit,'=>',self.children[bit],'with',child_node)\n",
    "            child_node = self.children[bit]\n",
    "            #self.children[bit] = child_node\n",
    "            #child_node.children = old.children\n",
    "        else:\n",
    "            self.children[bit] = child_node\n",
    "\n",
    "        # At this point, we have to unregister any leaves that correspond to this child from tree,\n",
    "        # and add the plausible children of this child as leaves to be explored. Note that\n",
    "        # if it is the end (z3.True), we do not have any more children.\n",
    "        child_leaf = self.pattern() + ':' + bit\n",
    "        if child_leaf in self.tree.leaves:\n",
    "            del self.tree.leaves[child_leaf]\n",
    "\n",
    "        pprefix = child_node.pattern() + ':'\n",
    "\n",
    "        # Plausible children.\n",
    "        for bit in [self.tree.no_bit, self.tree.yes_bit]:\n",
    "            self.tree.leaves[pprefix +\n",
    "                             bit] = PlausibleChild(child_node, bit, self.tree)\n",
    "        return child_node"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The path to root from any node is computed once and cached."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 269,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.638187Z",
     "iopub.status.busy": "2024-04-27T13:49:17.638062Z",
     "iopub.status.idle": "2024-04-27T13:49:17.640588Z",
     "shell.execute_reply": "2024-04-27T13:49:17.640174Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class TraceNode(TraceNode):\n",
    "    def get_path_to_root(self):\n",
    "        if self.path is not None:\n",
    "            return self.path\n",
    "        parent_path = []\n",
    "        if self.parent is not None:\n",
    "            parent_path = self.parent.get_path_to_root()\n",
    "        self.path = parent_path + [self]\n",
    "        return self.path"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "#### The SimpleConcolicFuzzer class"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `SimpleConcolicFuzzer` is defined with the `Fuzzer` interface. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 270,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.642440Z",
     "iopub.status.busy": "2024-04-27T13:49:17.642278Z",
     "iopub.status.idle": "2024-04-27T13:49:17.644345Z",
     "shell.execute_reply": "2024-04-27T13:49:17.644028Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class SimpleConcolicFuzzer(Fuzzer):\n",
    "    def __init__(self):\n",
    "        self.ct = TraceTree()\n",
    "        self.max_tries = 1000\n",
    "        self.last = None\n",
    "        self.last_idx = None"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `add_trace()` method we defined earlier is used as follows. First, we use a random string to generate the concolic trace."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 271,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.646198Z",
     "iopub.status.busy": "2024-04-27T13:49:17.646020Z",
     "iopub.status.idle": "2024-04-27T13:49:17.649672Z",
     "shell.execute_reply": "2024-04-27T13:49:17.649278Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ExpectTimeout(2):\n",
    "    with ConcolicTracer() as _:\n",
    "        _[hang_if_no_space]('ab d')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Next, we initialize and add this trace to the fuzzer."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 272,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.651841Z",
     "iopub.status.busy": "2024-04-27T13:49:17.651628Z",
     "iopub.status.idle": "2024-04-27T13:49:17.656706Z",
     "shell.execute_reply": "2024-04-27T13:49:17.656275Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[0 < Length(hang_if_no_space_s_str_1),\n",
       " Not(str.substr(hang_if_no_space_s_str_1, 0, 1) == \" \"),\n",
       " 1 < Length(hang_if_no_space_s_str_1),\n",
       " Not(str.substr(hang_if_no_space_s_str_1, 1, 1) == \" \"),\n",
       " 2 < Length(hang_if_no_space_s_str_1),\n",
       " str.substr(hang_if_no_space_s_str_1, 2, 1) == \" \"]"
      ]
     },
     "execution_count": 272,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.path"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 273,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.658351Z",
     "iopub.status.busy": "2024-04-27T13:49:17.658219Z",
     "iopub.status.idle": "2024-04-27T13:49:17.662014Z",
     "shell.execute_reply": "2024-04-27T13:49:17.661693Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "scf = SimpleConcolicFuzzer()\n",
    "scf.ct.add_trace(_, 'ab d')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The path we added above can be obtained from the `TraceTree` as below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 274,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.664111Z",
     "iopub.status.busy": "2024-04-27T13:49:17.663929Z",
     "iopub.status.idle": "2024-04-27T13:49:17.668980Z",
     "shell.execute_reply": "2024-04-27T13:49:17.668701Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[None,\n",
       " Not(Length(hang_if_no_space_s_str_1) <= 0),\n",
       " Not(str.substr(hang_if_no_space_s_str_1, 0, 1) == \" \"),\n",
       " Not(Length(hang_if_no_space_s_str_1) <= 1),\n",
       " Not(str.substr(hang_if_no_space_s_str_1, 1, 1) == \" \"),\n",
       " Not(Length(hang_if_no_space_s_str_1) <= 2),\n",
       " str.substr(hang_if_no_space_s_str_1, 2, 1) == \" \"]"
      ]
     },
     "execution_count": 274,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "[i._smt_val for i in scf.ct.root.get_children(\n",
    ")[0].get_children(\n",
    ")[0].get_children(\n",
    ")[0].get_children(\n",
    ")[0].get_children(\n",
    ")[0].get_children(\n",
    ")[1].get_path_to_root()]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Below are the registered leaves that we can explore at this moment."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 275,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.670448Z",
     "iopub.status.busy": "2024-04-27T13:49:17.670338Z",
     "iopub.status.idle": "2024-04-27T13:49:17.672317Z",
     "shell.execute_reply": "2024-04-27T13:49:17.672039Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      ":1 \t PlausibleChild[:1]\n",
      "0:1 \t PlausibleChild[0:1]\n",
      "00:1 \t PlausibleChild[00:1]\n",
      "000:1 \t PlausibleChild[000:1]\n",
      "0000:1 \t PlausibleChild[0000:1]\n",
      "00000:0 \t PlausibleChild[00000:0]\n"
     ]
    }
   ],
   "source": [
    "for key in scf.ct.leaves:\n",
    "    print(key, '\\t', scf.ct.leaves[key])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Next, we need a way to visualize the constructed tree."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 276,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.674214Z",
     "iopub.status.busy": "2024-04-27T13:49:17.674014Z",
     "iopub.status.idle": "2024-04-27T13:49:17.675996Z",
     "shell.execute_reply": "2024-04-27T13:49:17.675741Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from GrammarFuzzer import display_tree"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 277,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.677507Z",
     "iopub.status.busy": "2024-04-27T13:49:17.677397Z",
     "iopub.status.idle": "2024-04-27T13:49:17.679190Z",
     "shell.execute_reply": "2024-04-27T13:49:17.678883Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "TREE_NODES = {}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 278,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.680759Z",
     "iopub.status.busy": "2024-04-27T13:49:17.680633Z",
     "iopub.status.idle": "2024-04-27T13:49:17.683164Z",
     "shell.execute_reply": "2024-04-27T13:49:17.682893Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def my_extract_node(tnode, id):\n",
    "    key, node, parent = tnode\n",
    "    if node is None:\n",
    "        # return '? (%s:%s)' % (parent.pattern(), key) , [], ''\n",
    "        return '?', [], ''\n",
    "    if node.smt is None:\n",
    "        return '* %s' % node.info.get('string', ''), [], ''\n",
    "\n",
    "    no, yes = node.get_children()\n",
    "    num = str(node.info.get('num'))\n",
    "    children = [('0', no, node), ('1', yes, node)]\n",
    "    TREE_NODES[id] = 0\n",
    "    return \"(%s) %s\" % (num, str(node.smt)), children, ''"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 279,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.684723Z",
     "iopub.status.busy": "2024-04-27T13:49:17.684595Z",
     "iopub.status.idle": "2024-04-27T13:49:17.686974Z",
     "shell.execute_reply": "2024-04-27T13:49:17.686678Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def my_edge_attr(dot, start_node, stop_node):\n",
    "    # the edges are always drawn '0:NO' first.\n",
    "    if TREE_NODES[start_node] == 0:\n",
    "        color, label = 'red', '0'\n",
    "        TREE_NODES[start_node] = 1\n",
    "    else:\n",
    "        color, label = 'blue', '1'\n",
    "        TREE_NODES[start_node] = 2\n",
    "    dot.edge(repr(start_node), repr(stop_node), color=color, label=label)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 280,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.688590Z",
     "iopub.status.busy": "2024-04-27T13:49:17.688460Z",
     "iopub.status.idle": "2024-04-27T13:49:17.690518Z",
     "shell.execute_reply": "2024-04-27T13:49:17.690223Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def display_trace_tree(root):\n",
    "    TREE_NODES.clear()\n",
    "    return display_tree(\n",
    "        ('', root, None), extract_node=my_extract_node, edge_attr=my_edge_attr)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 281,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:17.692110Z",
     "iopub.status.busy": "2024-04-27T13:49:17.691979Z",
     "iopub.status.idle": "2024-04-27T13:49:18.159297Z",
     "shell.execute_reply": "2024-04-27T13:49:18.158642Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "image/svg+xml": [
       "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\n",
       "<!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\"\n",
       " \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n",
       "<!-- Generated by graphviz version 9.0.0 (20230911.1827)\n",
       " -->\n",
       "<!-- Pages: 1 -->\n",
       "<svg width=\"700pt\" height=\"409pt\"\n",
       " viewBox=\"0.00 0.00 699.50 409.25\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n",
       "<g id=\"graph0\" class=\"graph\" transform=\"scale(1 1) rotate(0) translate(4 405.25)\">\n",
       "<polygon fill=\"white\" stroke=\"none\" points=\"-4,4 -4,-405.25 695.5,-405.25 695.5,4 -4,4\"/>\n",
       "<!-- 0 -->\n",
       "<g id=\"node1\" class=\"node\">\n",
       "<title>0</title>\n",
       "<text text-anchor=\"middle\" x=\"570.75\" y=\"-387.95\" font-family=\"Times,serif\" font-size=\"14.00\">(0) Length(hang_if_no_space_s_str_1) &lt;= 0</text>\n",
       "</g>\n",
       "<!-- 1 -->\n",
       "<g id=\"node2\" class=\"node\">\n",
       "<title>1</title>\n",
       "<text text-anchor=\"middle\" x=\"480.75\" y=\"-323.45\" font-family=\"Times,serif\" font-size=\"14.00\">(1) str.substr(hang_if_no_space_s_str_1, 0, 1) == &quot; &quot;</text>\n",
       "</g>\n",
       "<!-- 0&#45;&gt;1 -->\n",
       "<g id=\"edge1\" class=\"edge\">\n",
       "<title>0&#45;&gt;1</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M562.12,-387.13C547.58,-377.03 517.89,-356.42 498.68,-343.08\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"500.94,-340.38 490.73,-337.55 496.95,-346.13 500.94,-340.38\"/>\n",
       "<text text-anchor=\"middle\" x=\"538.12\" y=\"-355.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 12 -->\n",
       "<g id=\"node13\" class=\"node\">\n",
       "<title>12</title>\n",
       "<text text-anchor=\"middle\" x=\"659.75\" y=\"-323.45\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 0&#45;&gt;12 -->\n",
       "<g id=\"edge12\" class=\"edge\">\n",
       "<title>0&#45;&gt;12</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M579.28,-387.13C593.6,-377.08 622.75,-356.61 641.76,-343.26\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"643.7,-346.17 649.87,-337.56 639.68,-340.44 643.7,-346.17\"/>\n",
       "<text text-anchor=\"middle\" x=\"627.12\" y=\"-355.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 2 -->\n",
       "<g id=\"node3\" class=\"node\">\n",
       "<title>2</title>\n",
       "<text text-anchor=\"middle\" x=\"402.75\" y=\"-258.95\" font-family=\"Times,serif\" font-size=\"14.00\">(2) Length(hang_if_no_space_s_str_1) &lt;= 1</text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;2 -->\n",
       "<g id=\"edge2\" class=\"edge\">\n",
       "<title>1&#45;&gt;2</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M473.27,-322.63C460.78,-312.62 435.39,-292.28 418.73,-278.93\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"421.27,-276.48 411.27,-272.95 416.89,-281.94 421.27,-276.48\"/>\n",
       "<text text-anchor=\"middle\" x=\"452.12\" y=\"-291.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 11 -->\n",
       "<g id=\"node12\" class=\"node\">\n",
       "<title>11</title>\n",
       "<text text-anchor=\"middle\" x=\"557.75\" y=\"-258.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;11 -->\n",
       "<g id=\"edge11\" class=\"edge\">\n",
       "<title>1&#45;&gt;11</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M488.13,-322.63C500.47,-312.62 525.53,-292.28 541.98,-278.93\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"543.77,-281.98 549.33,-272.96 539.36,-276.55 543.77,-281.98\"/>\n",
       "<text text-anchor=\"middle\" x=\"530.12\" y=\"-291.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 3 -->\n",
       "<g id=\"node4\" class=\"node\">\n",
       "<title>3</title>\n",
       "<text text-anchor=\"middle\" x=\"312.75\" y=\"-194.45\" font-family=\"Times,serif\" font-size=\"14.00\">(3) str.substr(hang_if_no_space_s_str_1, 1, 1) == &quot; &quot;</text>\n",
       "</g>\n",
       "<!-- 2&#45;&gt;3 -->\n",
       "<g id=\"edge3\" class=\"edge\">\n",
       "<title>2&#45;&gt;3</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M394.12,-258.13C379.58,-248.03 349.89,-227.42 330.68,-214.08\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"332.94,-211.38 322.73,-208.55 328.95,-217.13 332.94,-211.38\"/>\n",
       "<text text-anchor=\"middle\" x=\"370.12\" y=\"-226.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 10 -->\n",
       "<g id=\"node11\" class=\"node\">\n",
       "<title>10</title>\n",
       "<text text-anchor=\"middle\" x=\"491.75\" y=\"-194.45\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 2&#45;&gt;10 -->\n",
       "<g id=\"edge10\" class=\"edge\">\n",
       "<title>2&#45;&gt;10</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M411.28,-258.13C425.6,-248.08 454.75,-227.61 473.76,-214.26\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"475.7,-217.17 481.87,-208.56 471.68,-211.44 475.7,-217.17\"/>\n",
       "<text text-anchor=\"middle\" x=\"459.12\" y=\"-226.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 4 -->\n",
       "<g id=\"node5\" class=\"node\">\n",
       "<title>4</title>\n",
       "<text text-anchor=\"middle\" x=\"234.75\" y=\"-129.95\" font-family=\"Times,serif\" font-size=\"14.00\">(4) Length(hang_if_no_space_s_str_1) &lt;= 2</text>\n",
       "</g>\n",
       "<!-- 3&#45;&gt;4 -->\n",
       "<g id=\"edge4\" class=\"edge\">\n",
       "<title>3&#45;&gt;4</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M305.27,-193.63C292.78,-183.62 267.39,-163.28 250.73,-149.93\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"253.27,-147.48 243.27,-143.95 248.89,-152.94 253.27,-147.48\"/>\n",
       "<text text-anchor=\"middle\" x=\"284.12\" y=\"-162.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 9 -->\n",
       "<g id=\"node10\" class=\"node\">\n",
       "<title>9</title>\n",
       "<text text-anchor=\"middle\" x=\"389.75\" y=\"-129.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 3&#45;&gt;9 -->\n",
       "<g id=\"edge9\" class=\"edge\">\n",
       "<title>3&#45;&gt;9</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M320.13,-193.63C332.47,-183.62 357.53,-163.28 373.98,-149.93\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"375.77,-152.98 381.33,-143.96 371.36,-147.55 375.77,-152.98\"/>\n",
       "<text text-anchor=\"middle\" x=\"362.12\" y=\"-162.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 5 -->\n",
       "<g id=\"node6\" class=\"node\">\n",
       "<title>5</title>\n",
       "<text text-anchor=\"middle\" x=\"144.75\" y=\"-65.45\" font-family=\"Times,serif\" font-size=\"14.00\">(5) str.substr(hang_if_no_space_s_str_1, 2, 1) == &quot; &quot;</text>\n",
       "</g>\n",
       "<!-- 4&#45;&gt;5 -->\n",
       "<g id=\"edge5\" class=\"edge\">\n",
       "<title>4&#45;&gt;5</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M226.12,-129.13C211.58,-119.03 181.89,-98.42 162.68,-85.08\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"164.94,-82.38 154.73,-79.55 160.95,-88.13 164.94,-82.38\"/>\n",
       "<text text-anchor=\"middle\" x=\"202.12\" y=\"-97.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 8 -->\n",
       "<g id=\"node9\" class=\"node\">\n",
       "<title>8</title>\n",
       "<text text-anchor=\"middle\" x=\"323.75\" y=\"-65.45\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 4&#45;&gt;8 -->\n",
       "<g id=\"edge8\" class=\"edge\">\n",
       "<title>4&#45;&gt;8</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M243.28,-129.13C257.6,-119.08 286.75,-98.61 305.76,-85.26\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"307.7,-88.17 313.87,-79.56 303.68,-82.44 307.7,-88.17\"/>\n",
       "<text text-anchor=\"middle\" x=\"291.12\" y=\"-97.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 6 -->\n",
       "<g id=\"node7\" class=\"node\">\n",
       "<title>6</title>\n",
       "<text text-anchor=\"middle\" x=\"119.75\" y=\"-0.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 5&#45;&gt;6 -->\n",
       "<g id=\"edge6\" class=\"edge\">\n",
       "<title>5&#45;&gt;6</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M142.44,-64.86C138.82,-55.79 131.64,-37.86 126.33,-24.57\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"129.65,-23.45 122.69,-15.47 123.15,-26.05 129.65,-23.45\"/>\n",
       "<text text-anchor=\"middle\" x=\"138.12\" y=\"-33.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 7 -->\n",
       "<g id=\"node8\" class=\"node\">\n",
       "<title>7</title>\n",
       "<text text-anchor=\"middle\" x=\"170.75\" y=\"-0.95\" font-family=\"Times,serif\" font-size=\"14.00\">* ab d</text>\n",
       "</g>\n",
       "<!-- 5&#45;&gt;7 -->\n",
       "<g id=\"edge7\" class=\"edge\">\n",
       "<title>5&#45;&gt;7</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M147.15,-64.86C150.92,-55.79 158.38,-37.86 163.91,-24.57\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"167.09,-26.04 167.7,-15.46 160.63,-23.35 167.09,-26.04\"/>\n",
       "<text text-anchor=\"middle\" x=\"164.12\" y=\"-33.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "</g>\n",
       "</svg>\n"
      ],
      "text/plain": [
       "<graphviz.graphs.Digraph at 0x12e9ce5f0>"
      ]
     },
     "execution_count": 281,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "display_trace_tree(scf.ct.root)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "For example, the pattern `00000:0` corresponds to the following predicates."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 282,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.161687Z",
     "iopub.status.busy": "2024-04-27T13:49:18.161537Z",
     "iopub.status.idle": "2024-04-27T13:49:18.164924Z",
     "shell.execute_reply": "2024-04-27T13:49:18.164491Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "PlausibleChild[00000:0]"
      ]
     },
     "execution_count": 282,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "scf.ct.leaves['00000:0']"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 283,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.166856Z",
     "iopub.status.busy": "2024-04-27T13:49:18.166718Z",
     "iopub.status.idle": "2024-04-27T13:49:18.172526Z",
     "shell.execute_reply": "2024-04-27T13:49:18.172223Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[Not(Length(hang_if_no_space_s_str_1) <= 0),\n",
       " Not(str.substr(hang_if_no_space_s_str_1, 0, 1) == \" \"),\n",
       " Not(Length(hang_if_no_space_s_str_1) <= 1),\n",
       " Not(str.substr(hang_if_no_space_s_str_1, 1, 1) == \" \"),\n",
       " Not(Length(hang_if_no_space_s_str_1) <= 2),\n",
       " Not(str.substr(hang_if_no_space_s_str_1, 2, 1) == \" \")]"
      ]
     },
     "execution_count": 283,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "scf.ct.leaves['00000:0'].path_expression()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Similarly the pattern `:1` corresponds to the following predicates."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 284,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.174265Z",
     "iopub.status.busy": "2024-04-27T13:49:18.174143Z",
     "iopub.status.idle": "2024-04-27T13:49:18.176653Z",
     "shell.execute_reply": "2024-04-27T13:49:18.176223Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "PlausibleChild[:1]"
      ]
     },
     "execution_count": 284,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "scf.ct.leaves[':1']"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 285,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.178206Z",
     "iopub.status.busy": "2024-04-27T13:49:18.178094Z",
     "iopub.status.idle": "2024-04-27T13:49:18.181028Z",
     "shell.execute_reply": "2024-04-27T13:49:18.180744Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[Length(hang_if_no_space_s_str_1) <= 0]"
      ]
     },
     "execution_count": 285,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "scf.ct.leaves[':1'].path_expression()"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can now generate the next input to be generated by looking for a leaf that is incompletely explored. The idea is to collect all leaf nodes, and choose one at random."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 286,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.182784Z",
     "iopub.status.busy": "2024-04-27T13:49:18.182568Z",
     "iopub.status.idle": "2024-04-27T13:49:18.185210Z",
     "shell.execute_reply": "2024-04-27T13:49:18.184901Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class SimpleConcolicFuzzer(SimpleConcolicFuzzer):\n",
    "    def add_trace(self, trace, s):\n",
    "        self.ct.add_trace(trace, s)\n",
    "\n",
    "    def next_choice(self):\n",
    "        #lst = sorted(list(self.ct.leaves.keys()), key=len)\n",
    "        c = random.choice(list(self.ct.leaves.keys()))\n",
    "        #c = lst[0]\n",
    "        return self.ct.leaves[c]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We use the `next_choice()` as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 287,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.186749Z",
     "iopub.status.busy": "2024-04-27T13:49:18.186631Z",
     "iopub.status.idle": "2024-04-27T13:49:18.190506Z",
     "shell.execute_reply": "2024-04-27T13:49:18.190217Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "scf = SimpleConcolicFuzzer()\n",
    "scf.add_trace(_, 'ab d')\n",
    "node = scf.next_choice()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 288,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.192128Z",
     "iopub.status.busy": "2024-04-27T13:49:18.192046Z",
     "iopub.status.idle": "2024-04-27T13:49:18.194578Z",
     "shell.execute_reply": "2024-04-27T13:49:18.194265Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "PlausibleChild[0000:1]"
      ]
     },
     "execution_count": 288,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "node"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 289,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.196164Z",
     "iopub.status.busy": "2024-04-27T13:49:18.196074Z",
     "iopub.status.idle": "2024-04-27T13:49:18.200901Z",
     "shell.execute_reply": "2024-04-27T13:49:18.200636Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[Not(Length(hang_if_no_space_s_str_1) <= 0),\n",
       " Not(str.substr(hang_if_no_space_s_str_1, 0, 1) == \" \"),\n",
       " Not(Length(hang_if_no_space_s_str_1) <= 1),\n",
       " Not(str.substr(hang_if_no_space_s_str_1, 1, 1) == \" \"),\n",
       " Length(hang_if_no_space_s_str_1) <= 2]"
      ]
     },
     "execution_count": 289,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "node.path_expression()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We get the next choice for exploration, and expand the path expression, and return it together with a context using `get_newpath()`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 290,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.202456Z",
     "iopub.status.busy": "2024-04-27T13:49:18.202349Z",
     "iopub.status.idle": "2024-04-27T13:49:18.204498Z",
     "shell.execute_reply": "2024-04-27T13:49:18.204162Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class SimpleConcolicFuzzer(SimpleConcolicFuzzer):\n",
    "    def get_newpath(self):\n",
    "        node = self.next_choice()\n",
    "        path = node.path_expression()\n",
    "        return path, node.cc()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 291,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.206189Z",
     "iopub.status.busy": "2024-04-27T13:49:18.206082Z",
     "iopub.status.idle": "2024-04-27T13:49:18.210503Z",
     "shell.execute_reply": "2024-04-27T13:49:18.210186Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[Length(hang_if_no_space_s_str_1) <= 0]"
      ]
     },
     "execution_count": 291,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "scf = SimpleConcolicFuzzer()\n",
    "scf.add_trace(_, 'abcd')\n",
    "path, cc = scf.get_newpath()\n",
    "path"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "#### The fuzzing method\n",
    "\n",
    "The `fuzz()` method simply generates new lists of predicates, and solves them to produce new inputs."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 292,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.212052Z",
     "iopub.status.busy": "2024-04-27T13:49:18.211965Z",
     "iopub.status.idle": "2024-04-27T13:49:18.216541Z",
     "shell.execute_reply": "2024-04-27T13:49:18.216215Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class SimpleConcolicFuzzer(SimpleConcolicFuzzer):\n",
    "    def fuzz(self):\n",
    "        if self.ct.root.children == {}:\n",
    "            # a random value to generate comparisons. This would be\n",
    "            # the initial value around which we explore with concolic\n",
    "            # fuzzing.\n",
    "            # str_len = random.randint(1,100)\n",
    "            # return ' '*str_len\n",
    "            return ' '\n",
    "        for i in range(self.max_tries):\n",
    "            path, last = self.get_newpath()\n",
    "            s, v = zeval_smt(path, last, log=False)\n",
    "            if s != 'sat':\n",
    "                # raise Exception(\"Unexpected UNSAT\")\n",
    "                continue\n",
    "\n",
    "            val = list(v.values())[0]\n",
    "            elt, typ = val\n",
    "\n",
    "            # make sure that we do not retry the tried paths\n",
    "            # The tracer we add here is incomplete. This gets updated when\n",
    "            # the add_trace is called from the concolic fuzzer context.\n",
    "            # self.add_trace(ConcolicTracer((last.decls, path)), elt)\n",
    "            if typ == 'Int':\n",
    "                if len(elt) == 2 and elt[0] == '-':  # negative numbers are [-, x]\n",
    "                    return -1*int(elt[1])\n",
    "                return int(elt)\n",
    "            elif typ == 'String':\n",
    "                return elt\n",
    "            return elt\n",
    "        return None"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### End of Excursion"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "To illustrate `SimpleConcolicFuzzer`, let us apply it on our example program `cgi_decode()` from the `Coverage` chapter. Note that we cannot use it directly as the hash lookups in `hex_values` can not be used for transferring constraints yet."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 293,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.218308Z",
     "iopub.status.busy": "2024-04-27T13:49:18.218194Z",
     "iopub.status.idle": "2024-04-27T13:49:18.221656Z",
     "shell.execute_reply": "2024-04-27T13:49:18.221303Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    _[cgi_decode]('a+c')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 294,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.223462Z",
     "iopub.status.busy": "2024-04-27T13:49:18.223363Z",
     "iopub.status.idle": "2024-04-27T13:49:18.228554Z",
     "shell.execute_reply": "2024-04-27T13:49:18.228260Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[0 < Length(cgi_decode_s_str_1),\n",
       " Not(str.substr(cgi_decode_s_str_1, 0, 1) == \"+\"),\n",
       " Not(str.substr(cgi_decode_s_str_1, 0, 1) == \"%\"),\n",
       " 1 < Length(cgi_decode_s_str_1),\n",
       " str.substr(cgi_decode_s_str_1, 1, 1) == \"+\",\n",
       " 2 < Length(cgi_decode_s_str_1),\n",
       " Not(str.substr(cgi_decode_s_str_1, 2, 1) == \"+\"),\n",
       " Not(str.substr(cgi_decode_s_str_1, 2, 1) == \"%\"),\n",
       " Not(3 < Length(cgi_decode_s_str_1))]"
      ]
     },
     "execution_count": 294,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.path"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 295,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.230155Z",
     "iopub.status.busy": "2024-04-27T13:49:18.230010Z",
     "iopub.status.idle": "2024-04-27T13:49:18.233927Z",
     "shell.execute_reply": "2024-04-27T13:49:18.233579Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "scf = SimpleConcolicFuzzer()\n",
    "scf.add_trace(_, 'a+c')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The _trace tree_ shows the path conditions encountered so far. Any blue edge towards a \"?\" implies that there is a path not yet taken."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 296,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.235430Z",
     "iopub.status.busy": "2024-04-27T13:49:18.235346Z",
     "iopub.status.idle": "2024-04-27T13:49:18.678375Z",
     "shell.execute_reply": "2024-04-27T13:49:18.677914Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "image/svg+xml": [
       "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\n",
       "<!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\"\n",
       " \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n",
       "<!-- Generated by graphviz version 9.0.0 (20230911.1827)\n",
       " -->\n",
       "<!-- Pages: 1 -->\n",
       "<svg width=\"674pt\" height=\"603pt\"\n",
       " viewBox=\"0.00 0.00 673.75 602.75\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n",
       "<g id=\"graph0\" class=\"graph\" transform=\"scale(1 1) rotate(0) translate(4 598.75)\">\n",
       "<polygon fill=\"white\" stroke=\"none\" points=\"-4,4 -4,-598.75 669.75,-598.75 669.75,4 -4,4\"/>\n",
       "<!-- 0 -->\n",
       "<g id=\"node1\" class=\"node\">\n",
       "<title>0</title>\n",
       "<text text-anchor=\"middle\" x=\"563.38\" y=\"-581.45\" font-family=\"Times,serif\" font-size=\"14.00\">(0) Length(cgi_decode_s_str_1) &lt;= 0</text>\n",
       "</g>\n",
       "<!-- 1 -->\n",
       "<g id=\"node2\" class=\"node\">\n",
       "<title>1</title>\n",
       "<text text-anchor=\"middle\" x=\"481.38\" y=\"-516.95\" font-family=\"Times,serif\" font-size=\"14.00\">(1) str.substr(cgi_decode_s_str_1, 0, 1) == &quot;+&quot;</text>\n",
       "</g>\n",
       "<!-- 0&#45;&gt;1 -->\n",
       "<g id=\"edge1\" class=\"edge\">\n",
       "<title>0&#45;&gt;1</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M555.51,-580.63C542.38,-570.62 515.69,-550.28 498.17,-536.93\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"500.37,-534.2 490.3,-530.93 496.13,-539.77 500.37,-534.2\"/>\n",
       "<text text-anchor=\"middle\" x=\"533.75\" y=\"-549.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 18 -->\n",
       "<g id=\"node19\" class=\"node\">\n",
       "<title>18</title>\n",
       "<text text-anchor=\"middle\" x=\"644.38\" y=\"-516.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 0&#45;&gt;18 -->\n",
       "<g id=\"edge18\" class=\"edge\">\n",
       "<title>0&#45;&gt;18</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M571.14,-580.63C584.12,-570.62 610.48,-550.28 627.78,-536.93\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"629.77,-539.81 635.55,-530.93 625.5,-534.27 629.77,-539.81\"/>\n",
       "<text text-anchor=\"middle\" x=\"614.75\" y=\"-549.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 2 -->\n",
       "<g id=\"node3\" class=\"node\">\n",
       "<title>2</title>\n",
       "<text text-anchor=\"middle\" x=\"398.38\" y=\"-452.45\" font-family=\"Times,serif\" font-size=\"14.00\">(2) str.substr(cgi_decode_s_str_1, 0, 1) == &quot;%&quot;</text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;2 -->\n",
       "<g id=\"edge2\" class=\"edge\">\n",
       "<title>1&#45;&gt;2</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M473.42,-516.13C460.12,-506.12 433.11,-485.78 415.38,-472.43\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"417.49,-469.64 407.4,-466.42 413.28,-475.23 417.49,-469.64\"/>\n",
       "<text text-anchor=\"middle\" x=\"450.75\" y=\"-484.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 17 -->\n",
       "<g id=\"node18\" class=\"node\">\n",
       "<title>17</title>\n",
       "<text text-anchor=\"middle\" x=\"563.38\" y=\"-452.45\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;17 -->\n",
       "<g id=\"edge17\" class=\"edge\">\n",
       "<title>1&#45;&gt;17</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M489.24,-516.13C502.37,-506.12 529.06,-485.78 546.58,-472.43\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"548.62,-475.27 554.45,-466.43 544.38,-469.7 548.62,-475.27\"/>\n",
       "<text text-anchor=\"middle\" x=\"533.75\" y=\"-484.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 3 -->\n",
       "<g id=\"node4\" class=\"node\">\n",
       "<title>3</title>\n",
       "<text text-anchor=\"middle\" x=\"329.38\" y=\"-387.95\" font-family=\"Times,serif\" font-size=\"14.00\">(3) Length(cgi_decode_s_str_1) &lt;= 1</text>\n",
       "</g>\n",
       "<!-- 2&#45;&gt;3 -->\n",
       "<g id=\"edge3\" class=\"edge\">\n",
       "<title>2&#45;&gt;3</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M391.76,-451.63C380.91,-441.81 359.08,-422.03 344.34,-408.68\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"346.75,-406.14 336.99,-402.02 342.05,-411.33 346.75,-406.14\"/>\n",
       "<text text-anchor=\"middle\" x=\"373.75\" y=\"-420.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 16 -->\n",
       "<g id=\"node17\" class=\"node\">\n",
       "<title>16</title>\n",
       "<text text-anchor=\"middle\" x=\"466.38\" y=\"-387.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 2&#45;&gt;16 -->\n",
       "<g id=\"edge16\" class=\"edge\">\n",
       "<title>2&#45;&gt;16</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M404.9,-451.63C415.58,-441.81 437.1,-422.03 451.62,-408.68\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"453.87,-411.38 458.86,-402.03 449.13,-406.22 453.87,-411.38\"/>\n",
       "<text text-anchor=\"middle\" x=\"442.75\" y=\"-420.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 4 -->\n",
       "<g id=\"node5\" class=\"node\">\n",
       "<title>4</title>\n",
       "<text text-anchor=\"middle\" x=\"247.38\" y=\"-323.45\" font-family=\"Times,serif\" font-size=\"14.00\">(4) str.substr(cgi_decode_s_str_1, 1, 1) == &quot;+&quot;</text>\n",
       "</g>\n",
       "<!-- 3&#45;&gt;4 -->\n",
       "<g id=\"edge4\" class=\"edge\">\n",
       "<title>3&#45;&gt;4</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M321.51,-387.13C308.38,-377.12 281.69,-356.78 264.17,-343.43\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"266.37,-340.7 256.3,-337.43 262.13,-346.27 266.37,-340.7\"/>\n",
       "<text text-anchor=\"middle\" x=\"299.75\" y=\"-355.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 15 -->\n",
       "<g id=\"node16\" class=\"node\">\n",
       "<title>15</title>\n",
       "<text text-anchor=\"middle\" x=\"410.38\" y=\"-323.45\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 3&#45;&gt;15 -->\n",
       "<g id=\"edge15\" class=\"edge\">\n",
       "<title>3&#45;&gt;15</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M337.14,-387.13C350.12,-377.12 376.48,-356.78 393.78,-343.43\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"395.77,-346.31 401.55,-337.43 391.5,-340.77 395.77,-346.31\"/>\n",
       "<text text-anchor=\"middle\" x=\"380.75\" y=\"-355.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 5 -->\n",
       "<g id=\"node6\" class=\"node\">\n",
       "<title>5</title>\n",
       "<text text-anchor=\"middle\" x=\"232.38\" y=\"-258.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 4&#45;&gt;5 -->\n",
       "<g id=\"edge5\" class=\"edge\">\n",
       "<title>4&#45;&gt;5</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M245.99,-322.86C243.84,-313.88 239.6,-296.22 236.42,-282.98\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"239.89,-282.44 234.15,-273.53 233.08,-284.07 239.89,-282.44\"/>\n",
       "<text text-anchor=\"middle\" x=\"244.75\" y=\"-291.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 6 -->\n",
       "<g id=\"node7\" class=\"node\">\n",
       "<title>6</title>\n",
       "<text text-anchor=\"middle\" x=\"369.38\" y=\"-258.95\" font-family=\"Times,serif\" font-size=\"14.00\">(5) Length(cgi_decode_s_str_1) &lt;= 2</text>\n",
       "</g>\n",
       "<!-- 4&#45;&gt;6 -->\n",
       "<g id=\"edge6\" class=\"edge\">\n",
       "<title>4&#45;&gt;6</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M259.07,-322.63C279.42,-312.21 321.65,-290.58 347.54,-277.31\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"348.88,-280.56 356.19,-272.88 345.69,-274.33 348.88,-280.56\"/>\n",
       "<text text-anchor=\"middle\" x=\"322.75\" y=\"-291.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 7 -->\n",
       "<g id=\"node8\" class=\"node\">\n",
       "<title>7</title>\n",
       "<text text-anchor=\"middle\" x=\"254.38\" y=\"-194.45\" font-family=\"Times,serif\" font-size=\"14.00\">(6) str.substr(cgi_decode_s_str_1, 2, 1) == &quot;+&quot;</text>\n",
       "</g>\n",
       "<!-- 6&#45;&gt;7 -->\n",
       "<g id=\"edge7\" class=\"edge\">\n",
       "<title>6&#45;&gt;7</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M358.35,-258.13C339.34,-247.8 300.07,-226.46 275.61,-213.17\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"277.32,-210.11 266.87,-208.41 273.98,-216.26 277.32,-210.11\"/>\n",
       "<text text-anchor=\"middle\" x=\"325.75\" y=\"-226.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 14 -->\n",
       "<g id=\"node15\" class=\"node\">\n",
       "<title>14</title>\n",
       "<text text-anchor=\"middle\" x=\"417.38\" y=\"-194.45\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 6&#45;&gt;14 -->\n",
       "<g id=\"edge14\" class=\"edge\">\n",
       "<title>6&#45;&gt;14</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M373.8,-258.36C381.05,-248.92 395.68,-229.88 405.98,-216.47\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"408.58,-218.82 411.89,-208.76 403.03,-214.56 408.58,-218.82\"/>\n",
       "<text text-anchor=\"middle\" x=\"401.75\" y=\"-226.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 8 -->\n",
       "<g id=\"node9\" class=\"node\">\n",
       "<title>8</title>\n",
       "<text text-anchor=\"middle\" x=\"171.38\" y=\"-129.95\" font-family=\"Times,serif\" font-size=\"14.00\">(7) str.substr(cgi_decode_s_str_1, 2, 1) == &quot;%&quot;</text>\n",
       "</g>\n",
       "<!-- 7&#45;&gt;8 -->\n",
       "<g id=\"edge8\" class=\"edge\">\n",
       "<title>7&#45;&gt;8</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M246.42,-193.63C233.12,-183.62 206.11,-163.28 188.38,-149.93\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"190.49,-147.14 180.4,-143.92 186.28,-152.73 190.49,-147.14\"/>\n",
       "<text text-anchor=\"middle\" x=\"223.75\" y=\"-162.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 13 -->\n",
       "<g id=\"node14\" class=\"node\">\n",
       "<title>13</title>\n",
       "<text text-anchor=\"middle\" x=\"336.38\" y=\"-129.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 7&#45;&gt;13 -->\n",
       "<g id=\"edge13\" class=\"edge\">\n",
       "<title>7&#45;&gt;13</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M262.24,-193.63C275.37,-183.62 302.06,-163.28 319.58,-149.93\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"321.62,-152.77 327.45,-143.93 317.38,-147.2 321.62,-152.77\"/>\n",
       "<text text-anchor=\"middle\" x=\"306.75\" y=\"-162.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 9 -->\n",
       "<g id=\"node10\" class=\"node\">\n",
       "<title>9</title>\n",
       "<text text-anchor=\"middle\" x=\"102.38\" y=\"-65.45\" font-family=\"Times,serif\" font-size=\"14.00\">(8) Length(cgi_decode_s_str_1) &lt;= 3</text>\n",
       "</g>\n",
       "<!-- 8&#45;&gt;9 -->\n",
       "<g id=\"edge9\" class=\"edge\">\n",
       "<title>8&#45;&gt;9</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M164.76,-129.13C153.91,-119.31 132.08,-99.53 117.34,-86.18\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"119.75,-83.64 109.99,-79.52 115.05,-88.83 119.75,-83.64\"/>\n",
       "<text text-anchor=\"middle\" x=\"146.75\" y=\"-97.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 12 -->\n",
       "<g id=\"node13\" class=\"node\">\n",
       "<title>12</title>\n",
       "<text text-anchor=\"middle\" x=\"239.38\" y=\"-65.45\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 8&#45;&gt;12 -->\n",
       "<g id=\"edge12\" class=\"edge\">\n",
       "<title>8&#45;&gt;12</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M177.9,-129.13C188.58,-119.31 210.1,-99.53 224.62,-86.18\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"226.87,-88.88 231.86,-79.53 222.13,-83.72 226.87,-88.88\"/>\n",
       "<text text-anchor=\"middle\" x=\"215.75\" y=\"-97.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 10 -->\n",
       "<g id=\"node11\" class=\"node\">\n",
       "<title>10</title>\n",
       "<text text-anchor=\"middle\" x=\"77.38\" y=\"-0.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 9&#45;&gt;10 -->\n",
       "<g id=\"edge10\" class=\"edge\">\n",
       "<title>9&#45;&gt;10</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M100.07,-64.86C96.44,-55.79 89.27,-37.86 83.95,-24.57\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"87.28,-23.45 80.31,-15.47 80.78,-26.05 87.28,-23.45\"/>\n",
       "<text text-anchor=\"middle\" x=\"95.75\" y=\"-33.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 11 -->\n",
       "<g id=\"node12\" class=\"node\">\n",
       "<title>11</title>\n",
       "<text text-anchor=\"middle\" x=\"127.38\" y=\"-0.95\" font-family=\"Times,serif\" font-size=\"14.00\">* a+c</text>\n",
       "</g>\n",
       "<!-- 9&#45;&gt;11 -->\n",
       "<g id=\"edge11\" class=\"edge\">\n",
       "<title>9&#45;&gt;11</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M104.68,-64.86C108.31,-55.79 115.48,-37.86 120.8,-24.57\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"123.97,-26.05 124.44,-15.47 117.47,-23.45 123.97,-26.05\"/>\n",
       "<text text-anchor=\"middle\" x=\"120.75\" y=\"-33.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "</g>\n",
       "</svg>\n"
      ],
      "text/plain": [
       "<graphviz.graphs.Digraph at 0x12e9cdcf0>"
      ]
     },
     "execution_count": 296,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "display_trace_tree(scf.ct.root)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "So, we fuzz to get a new path that is not empty."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 297,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.680553Z",
     "iopub.status.busy": "2024-04-27T13:49:18.680323Z",
     "iopub.status.idle": "2024-04-27T13:49:18.702334Z",
     "shell.execute_reply": "2024-04-27T13:49:18.701963Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "A+\n"
     ]
    }
   ],
   "source": [
    "v = scf.fuzz()\n",
    "print(v)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can now obtain the new trace as before."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 298,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.704065Z",
     "iopub.status.busy": "2024-04-27T13:49:18.703902Z",
     "iopub.status.idle": "2024-04-27T13:49:18.707501Z",
     "shell.execute_reply": "2024-04-27T13:49:18.707028Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ExpectError():\n",
    "    with ConcolicTracer() as _:\n",
    "        _[cgi_decode](v)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The new trace is added to our fuzzer using `add_trace()`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 299,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.709272Z",
     "iopub.status.busy": "2024-04-27T13:49:18.709184Z",
     "iopub.status.idle": "2024-04-27T13:49:18.713335Z",
     "shell.execute_reply": "2024-04-27T13:49:18.712944Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "scf.add_trace(_, v)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The updated binary tree is as follows. Note the difference between the child nodes of `Root` node."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 300,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:18.715093Z",
     "iopub.status.busy": "2024-04-27T13:49:18.714976Z",
     "iopub.status.idle": "2024-04-27T13:49:19.144683Z",
     "shell.execute_reply": "2024-04-27T13:49:19.144284Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "image/svg+xml": [
       "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\n",
       "<!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\"\n",
       " \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n",
       "<!-- Generated by graphviz version 9.0.0 (20230911.1827)\n",
       " -->\n",
       "<!-- Pages: 1 -->\n",
       "<svg width=\"673pt\" height=\"603pt\"\n",
       " viewBox=\"0.00 0.00 672.75 602.75\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n",
       "<g id=\"graph0\" class=\"graph\" transform=\"scale(1 1) rotate(0) translate(4 598.75)\">\n",
       "<polygon fill=\"white\" stroke=\"none\" points=\"-4,4 -4,-598.75 668.75,-598.75 668.75,4 -4,4\"/>\n",
       "<!-- 0 -->\n",
       "<g id=\"node1\" class=\"node\">\n",
       "<title>0</title>\n",
       "<text text-anchor=\"middle\" x=\"562.38\" y=\"-581.45\" font-family=\"Times,serif\" font-size=\"14.00\">(0) Length(cgi_decode_s_str_1) &lt;= 0</text>\n",
       "</g>\n",
       "<!-- 1 -->\n",
       "<g id=\"node2\" class=\"node\">\n",
       "<title>1</title>\n",
       "<text text-anchor=\"middle\" x=\"480.38\" y=\"-516.95\" font-family=\"Times,serif\" font-size=\"14.00\">(1) str.substr(cgi_decode_s_str_1, 0, 1) == &quot;+&quot;</text>\n",
       "</g>\n",
       "<!-- 0&#45;&gt;1 -->\n",
       "<g id=\"edge1\" class=\"edge\">\n",
       "<title>0&#45;&gt;1</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M554.51,-580.63C541.38,-570.62 514.69,-550.28 497.17,-536.93\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"499.37,-534.2 489.3,-530.93 495.13,-539.77 499.37,-534.2\"/>\n",
       "<text text-anchor=\"middle\" x=\"532.75\" y=\"-549.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 18 -->\n",
       "<g id=\"node19\" class=\"node\">\n",
       "<title>18</title>\n",
       "<text text-anchor=\"middle\" x=\"643.38\" y=\"-516.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 0&#45;&gt;18 -->\n",
       "<g id=\"edge18\" class=\"edge\">\n",
       "<title>0&#45;&gt;18</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M570.14,-580.63C583.12,-570.62 609.48,-550.28 626.78,-536.93\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"628.77,-539.81 634.55,-530.93 624.5,-534.27 628.77,-539.81\"/>\n",
       "<text text-anchor=\"middle\" x=\"613.75\" y=\"-549.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 2 -->\n",
       "<g id=\"node3\" class=\"node\">\n",
       "<title>2</title>\n",
       "<text text-anchor=\"middle\" x=\"397.38\" y=\"-452.45\" font-family=\"Times,serif\" font-size=\"14.00\">(2) str.substr(cgi_decode_s_str_1, 0, 1) == &quot;%&quot;</text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;2 -->\n",
       "<g id=\"edge2\" class=\"edge\">\n",
       "<title>1&#45;&gt;2</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M472.42,-516.13C459.12,-506.12 432.11,-485.78 414.38,-472.43\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"416.49,-469.64 406.4,-466.42 412.28,-475.23 416.49,-469.64\"/>\n",
       "<text text-anchor=\"middle\" x=\"449.75\" y=\"-484.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 17 -->\n",
       "<g id=\"node18\" class=\"node\">\n",
       "<title>17</title>\n",
       "<text text-anchor=\"middle\" x=\"562.38\" y=\"-452.45\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;17 -->\n",
       "<g id=\"edge17\" class=\"edge\">\n",
       "<title>1&#45;&gt;17</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M488.24,-516.13C501.37,-506.12 528.06,-485.78 545.58,-472.43\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"547.62,-475.27 553.45,-466.43 543.38,-469.7 547.62,-475.27\"/>\n",
       "<text text-anchor=\"middle\" x=\"532.75\" y=\"-484.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 3 -->\n",
       "<g id=\"node4\" class=\"node\">\n",
       "<title>3</title>\n",
       "<text text-anchor=\"middle\" x=\"328.38\" y=\"-387.95\" font-family=\"Times,serif\" font-size=\"14.00\">(3) Length(cgi_decode_s_str_1) &lt;= 1</text>\n",
       "</g>\n",
       "<!-- 2&#45;&gt;3 -->\n",
       "<g id=\"edge3\" class=\"edge\">\n",
       "<title>2&#45;&gt;3</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M390.76,-451.63C379.91,-441.81 358.08,-422.03 343.34,-408.68\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"345.75,-406.14 335.99,-402.02 341.05,-411.33 345.75,-406.14\"/>\n",
       "<text text-anchor=\"middle\" x=\"372.75\" y=\"-420.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 16 -->\n",
       "<g id=\"node17\" class=\"node\">\n",
       "<title>16</title>\n",
       "<text text-anchor=\"middle\" x=\"465.38\" y=\"-387.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 2&#45;&gt;16 -->\n",
       "<g id=\"edge16\" class=\"edge\">\n",
       "<title>2&#45;&gt;16</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M403.9,-451.63C414.58,-441.81 436.1,-422.03 450.62,-408.68\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"452.87,-411.38 457.86,-402.03 448.13,-406.22 452.87,-411.38\"/>\n",
       "<text text-anchor=\"middle\" x=\"441.75\" y=\"-420.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 4 -->\n",
       "<g id=\"node5\" class=\"node\">\n",
       "<title>4</title>\n",
       "<text text-anchor=\"middle\" x=\"246.38\" y=\"-323.45\" font-family=\"Times,serif\" font-size=\"14.00\">(4) str.substr(cgi_decode_s_str_1, 1, 1) == &quot;+&quot;</text>\n",
       "</g>\n",
       "<!-- 3&#45;&gt;4 -->\n",
       "<g id=\"edge4\" class=\"edge\">\n",
       "<title>3&#45;&gt;4</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M320.51,-387.13C307.38,-377.12 280.69,-356.78 263.17,-343.43\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"265.37,-340.7 255.3,-337.43 261.13,-346.27 265.37,-340.7\"/>\n",
       "<text text-anchor=\"middle\" x=\"298.75\" y=\"-355.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 15 -->\n",
       "<g id=\"node16\" class=\"node\">\n",
       "<title>15</title>\n",
       "<text text-anchor=\"middle\" x=\"409.38\" y=\"-323.45\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 3&#45;&gt;15 -->\n",
       "<g id=\"edge15\" class=\"edge\">\n",
       "<title>3&#45;&gt;15</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M336.14,-387.13C349.12,-377.12 375.48,-356.78 392.78,-343.43\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"394.77,-346.31 400.55,-337.43 390.5,-340.77 394.77,-346.31\"/>\n",
       "<text text-anchor=\"middle\" x=\"379.75\" y=\"-355.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 5 -->\n",
       "<g id=\"node6\" class=\"node\">\n",
       "<title>5</title>\n",
       "<text text-anchor=\"middle\" x=\"231.38\" y=\"-258.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 4&#45;&gt;5 -->\n",
       "<g id=\"edge5\" class=\"edge\">\n",
       "<title>4&#45;&gt;5</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M244.99,-322.86C242.84,-313.88 238.6,-296.22 235.42,-282.98\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"238.89,-282.44 233.15,-273.53 232.08,-284.07 238.89,-282.44\"/>\n",
       "<text text-anchor=\"middle\" x=\"243.75\" y=\"-291.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 6 -->\n",
       "<g id=\"node7\" class=\"node\">\n",
       "<title>6</title>\n",
       "<text text-anchor=\"middle\" x=\"368.38\" y=\"-258.95\" font-family=\"Times,serif\" font-size=\"14.00\">(5) Length(cgi_decode_s_str_1) &lt;= 2</text>\n",
       "</g>\n",
       "<!-- 4&#45;&gt;6 -->\n",
       "<g id=\"edge6\" class=\"edge\">\n",
       "<title>4&#45;&gt;6</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M258.07,-322.63C278.42,-312.21 320.65,-290.58 346.54,-277.31\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"347.88,-280.56 355.19,-272.88 344.69,-274.33 347.88,-280.56\"/>\n",
       "<text text-anchor=\"middle\" x=\"321.75\" y=\"-291.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 7 -->\n",
       "<g id=\"node8\" class=\"node\">\n",
       "<title>7</title>\n",
       "<text text-anchor=\"middle\" x=\"254.38\" y=\"-194.45\" font-family=\"Times,serif\" font-size=\"14.00\">(6) str.substr(cgi_decode_s_str_1, 2, 1) == &quot;+&quot;</text>\n",
       "</g>\n",
       "<!-- 6&#45;&gt;7 -->\n",
       "<g id=\"edge7\" class=\"edge\">\n",
       "<title>6&#45;&gt;7</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M357.44,-258.13C338.6,-247.8 299.68,-226.46 275.43,-213.17\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"277.22,-210.16 266.77,-208.42 273.85,-216.3 277.22,-210.16\"/>\n",
       "<text text-anchor=\"middle\" x=\"325.75\" y=\"-226.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 14 -->\n",
       "<g id=\"node15\" class=\"node\">\n",
       "<title>14</title>\n",
       "<text text-anchor=\"middle\" x=\"415.38\" y=\"-194.45\" font-family=\"Times,serif\" font-size=\"14.00\">* A+</text>\n",
       "</g>\n",
       "<!-- 6&#45;&gt;14 -->\n",
       "<g id=\"edge14\" class=\"edge\">\n",
       "<title>6&#45;&gt;14</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M372.71,-258.36C379.81,-248.92 394.13,-229.88 404.21,-216.47\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"406.79,-218.87 410,-208.77 401.19,-214.66 406.79,-218.87\"/>\n",
       "<text text-anchor=\"middle\" x=\"399.75\" y=\"-226.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 8 -->\n",
       "<g id=\"node9\" class=\"node\">\n",
       "<title>8</title>\n",
       "<text text-anchor=\"middle\" x=\"171.38\" y=\"-129.95\" font-family=\"Times,serif\" font-size=\"14.00\">(7) str.substr(cgi_decode_s_str_1, 2, 1) == &quot;%&quot;</text>\n",
       "</g>\n",
       "<!-- 7&#45;&gt;8 -->\n",
       "<g id=\"edge8\" class=\"edge\">\n",
       "<title>7&#45;&gt;8</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M246.42,-193.63C233.12,-183.62 206.11,-163.28 188.38,-149.93\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"190.49,-147.14 180.4,-143.92 186.28,-152.73 190.49,-147.14\"/>\n",
       "<text text-anchor=\"middle\" x=\"223.75\" y=\"-162.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 13 -->\n",
       "<g id=\"node14\" class=\"node\">\n",
       "<title>13</title>\n",
       "<text text-anchor=\"middle\" x=\"336.38\" y=\"-129.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 7&#45;&gt;13 -->\n",
       "<g id=\"edge13\" class=\"edge\">\n",
       "<title>7&#45;&gt;13</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M262.24,-193.63C275.37,-183.62 302.06,-163.28 319.58,-149.93\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"321.62,-152.77 327.45,-143.93 317.38,-147.2 321.62,-152.77\"/>\n",
       "<text text-anchor=\"middle\" x=\"306.75\" y=\"-162.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 9 -->\n",
       "<g id=\"node10\" class=\"node\">\n",
       "<title>9</title>\n",
       "<text text-anchor=\"middle\" x=\"102.38\" y=\"-65.45\" font-family=\"Times,serif\" font-size=\"14.00\">(8) Length(cgi_decode_s_str_1) &lt;= 3</text>\n",
       "</g>\n",
       "<!-- 8&#45;&gt;9 -->\n",
       "<g id=\"edge9\" class=\"edge\">\n",
       "<title>8&#45;&gt;9</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M164.76,-129.13C153.91,-119.31 132.08,-99.53 117.34,-86.18\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"119.75,-83.64 109.99,-79.52 115.05,-88.83 119.75,-83.64\"/>\n",
       "<text text-anchor=\"middle\" x=\"146.75\" y=\"-97.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 12 -->\n",
       "<g id=\"node13\" class=\"node\">\n",
       "<title>12</title>\n",
       "<text text-anchor=\"middle\" x=\"239.38\" y=\"-65.45\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 8&#45;&gt;12 -->\n",
       "<g id=\"edge12\" class=\"edge\">\n",
       "<title>8&#45;&gt;12</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M177.9,-129.13C188.58,-119.31 210.1,-99.53 224.62,-86.18\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"226.87,-88.88 231.86,-79.53 222.13,-83.72 226.87,-88.88\"/>\n",
       "<text text-anchor=\"middle\" x=\"215.75\" y=\"-97.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 10 -->\n",
       "<g id=\"node11\" class=\"node\">\n",
       "<title>10</title>\n",
       "<text text-anchor=\"middle\" x=\"77.38\" y=\"-0.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 9&#45;&gt;10 -->\n",
       "<g id=\"edge10\" class=\"edge\">\n",
       "<title>9&#45;&gt;10</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M100.07,-64.86C96.44,-55.79 89.27,-37.86 83.95,-24.57\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"87.28,-23.45 80.31,-15.47 80.78,-26.05 87.28,-23.45\"/>\n",
       "<text text-anchor=\"middle\" x=\"95.75\" y=\"-33.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 11 -->\n",
       "<g id=\"node12\" class=\"node\">\n",
       "<title>11</title>\n",
       "<text text-anchor=\"middle\" x=\"127.38\" y=\"-0.95\" font-family=\"Times,serif\" font-size=\"14.00\">* a+c</text>\n",
       "</g>\n",
       "<!-- 9&#45;&gt;11 -->\n",
       "<g id=\"edge11\" class=\"edge\">\n",
       "<title>9&#45;&gt;11</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M104.68,-64.86C108.31,-55.79 115.48,-37.86 120.8,-24.57\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"123.97,-26.05 124.44,-15.47 117.47,-23.45 123.97,-26.05\"/>\n",
       "<text text-anchor=\"middle\" x=\"120.75\" y=\"-33.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "</g>\n",
       "</svg>\n"
      ],
      "text/plain": [
       "<graphviz.graphs.Digraph at 0x12e9cf070>"
      ]
     },
     "execution_count": 300,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "display_trace_tree(scf.ct.root)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "A complete fuzzer run is as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 301,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.146810Z",
     "iopub.status.busy": "2024-04-27T13:49:19.146665Z",
     "iopub.status.idle": "2024-04-27T13:49:19.342617Z",
     "shell.execute_reply": "2024-04-27T13:49:19.342225Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "' '\n",
      "''\n",
      "'+'\n",
      "'%'\n",
      "'+A'\n",
      "'++'\n",
      "'AB'\n",
      "'++A'\n",
      "'A%'\n",
      "'+AB'\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "IndexError: string index out of range (expected)\n",
      "IndexError: string index out of range (expected)\n"
     ]
    }
   ],
   "source": [
    "scf = SimpleConcolicFuzzer()\n",
    "for i in range(10):\n",
    "    v = scf.fuzz()\n",
    "    print(repr(v))\n",
    "    if v is None:\n",
    "        continue\n",
    "    with ConcolicTracer() as _:\n",
    "        with ExpectError(print_traceback=False):\n",
    "            # z3.StringVal(urllib.parse.unquote('%80')) <-- bug in z3\n",
    "            _[cgi_decode](v)\n",
    "    scf.add_trace(_, v)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 302,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.344364Z",
     "iopub.status.busy": "2024-04-27T13:49:19.344236Z",
     "iopub.status.idle": "2024-04-27T13:49:19.783619Z",
     "shell.execute_reply": "2024-04-27T13:49:19.783181Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "image/svg+xml": [
       "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\n",
       "<!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\"\n",
       " \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n",
       "<!-- Generated by graphviz version 9.0.0 (20230911.1827)\n",
       " -->\n",
       "<!-- Pages: 1 -->\n",
       "<svg width=\"981pt\" height=\"603pt\"\n",
       " viewBox=\"0.00 0.00 980.88 602.75\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n",
       "<g id=\"graph0\" class=\"graph\" transform=\"scale(1 1) rotate(0) translate(4 598.75)\">\n",
       "<polygon fill=\"white\" stroke=\"none\" points=\"-4,4 -4,-598.75 976.88,-598.75 976.88,4 -4,4\"/>\n",
       "<!-- 0 -->\n",
       "<g id=\"node1\" class=\"node\">\n",
       "<title>0</title>\n",
       "<text text-anchor=\"middle\" x=\"715.38\" y=\"-581.45\" font-family=\"Times,serif\" font-size=\"14.00\">(0) Length(cgi_decode_s_str_1) &lt;= 0</text>\n",
       "</g>\n",
       "<!-- 1 -->\n",
       "<g id=\"node2\" class=\"node\">\n",
       "<title>1</title>\n",
       "<text text-anchor=\"middle\" x=\"639.38\" y=\"-516.95\" font-family=\"Times,serif\" font-size=\"14.00\">(1) str.substr(cgi_decode_s_str_1, 0, 1) == &quot;+&quot;</text>\n",
       "</g>\n",
       "<!-- 0&#45;&gt;1 -->\n",
       "<g id=\"edge1\" class=\"edge\">\n",
       "<title>0&#45;&gt;1</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M708.09,-580.63C696.03,-570.71 671.64,-550.66 655.4,-537.3\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"657.65,-534.62 647.7,-530.97 653.2,-540.02 657.65,-534.62\"/>\n",
       "<text text-anchor=\"middle\" x=\"687.75\" y=\"-549.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 36 -->\n",
       "<g id=\"node37\" class=\"node\">\n",
       "<title>36</title>\n",
       "<text text-anchor=\"middle\" x=\"791.38\" y=\"-516.95\" font-family=\"Times,serif\" font-size=\"14.00\">* </text>\n",
       "</g>\n",
       "<!-- 0&#45;&gt;36 -->\n",
       "<g id=\"edge36\" class=\"edge\">\n",
       "<title>0&#45;&gt;36</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M722.66,-580.63C735.34,-570.21 761.63,-548.58 777.77,-535.32\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"779.62,-538.33 785.12,-529.27 775.17,-532.92 779.62,-538.33\"/>\n",
       "<text text-anchor=\"middle\" x=\"763.75\" y=\"-549.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 2 -->\n",
       "<g id=\"node3\" class=\"node\">\n",
       "<title>2</title>\n",
       "<text text-anchor=\"middle\" x=\"514.38\" y=\"-452.45\" font-family=\"Times,serif\" font-size=\"14.00\">(2) str.substr(cgi_decode_s_str_1, 0, 1) == &quot;%&quot;</text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;2 -->\n",
       "<g id=\"edge2\" class=\"edge\">\n",
       "<title>1&#45;&gt;2</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M627.39,-516.13C606.54,-505.71 563.28,-484.08 536.74,-470.81\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"538.37,-467.71 527.86,-466.37 535.24,-473.97 538.37,-467.71\"/>\n",
       "<text text-anchor=\"middle\" x=\"591.75\" y=\"-484.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 13 -->\n",
       "<g id=\"node14\" class=\"node\">\n",
       "<title>13</title>\n",
       "<text text-anchor=\"middle\" x=\"765.38\" y=\"-452.45\" font-family=\"Times,serif\" font-size=\"14.00\">(2) Length(cgi_decode_s_str_1) &lt;= 1</text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;13 -->\n",
       "<g id=\"edge13\" class=\"edge\">\n",
       "<title>1&#45;&gt;13</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M651.46,-516.13C672.57,-505.66 716.47,-483.88 743.19,-470.63\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"744.39,-473.94 751.79,-466.36 741.28,-467.67 744.39,-473.94\"/>\n",
       "<text text-anchor=\"middle\" x=\"717.75\" y=\"-484.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 3 -->\n",
       "<g id=\"node4\" class=\"node\">\n",
       "<title>3</title>\n",
       "<text text-anchor=\"middle\" x=\"397.38\" y=\"-387.95\" font-family=\"Times,serif\" font-size=\"14.00\">(3) Length(cgi_decode_s_str_1) &lt;= 1</text>\n",
       "</g>\n",
       "<!-- 2&#45;&gt;3 -->\n",
       "<g id=\"edge3\" class=\"edge\">\n",
       "<title>2&#45;&gt;3</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M503.16,-451.63C483.73,-441.25 443.51,-419.77 418.64,-406.49\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"420.54,-403.53 410.07,-401.9 417.24,-409.7 420.54,-403.53\"/>\n",
       "<text text-anchor=\"middle\" x=\"469.75\" y=\"-420.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 12 -->\n",
       "<g id=\"node13\" class=\"node\">\n",
       "<title>12</title>\n",
       "<text text-anchor=\"middle\" x=\"529.38\" y=\"-387.95\" font-family=\"Times,serif\" font-size=\"14.00\">* %</text>\n",
       "</g>\n",
       "<!-- 2&#45;&gt;12 -->\n",
       "<g id=\"edge12\" class=\"edge\">\n",
       "<title>2&#45;&gt;12</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M515.76,-451.86C517.91,-442.88 522.15,-425.22 525.33,-411.98\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"528.67,-413.07 527.6,-402.53 521.86,-411.44 528.67,-413.07\"/>\n",
       "<text text-anchor=\"middle\" x=\"526.75\" y=\"-420.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 4 -->\n",
       "<g id=\"node5\" class=\"node\">\n",
       "<title>4</title>\n",
       "<text text-anchor=\"middle\" x=\"291.38\" y=\"-323.45\" font-family=\"Times,serif\" font-size=\"14.00\">(4) str.substr(cgi_decode_s_str_1, 1, 1) == &quot;+&quot;</text>\n",
       "</g>\n",
       "<!-- 3&#45;&gt;4 -->\n",
       "<g id=\"edge4\" class=\"edge\">\n",
       "<title>3&#45;&gt;4</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M387.21,-387.13C369.84,-376.89 334.15,-355.84 311.56,-342.53\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"313.36,-339.52 302.97,-337.46 309.8,-345.55 313.36,-339.52\"/>\n",
       "<text text-anchor=\"middle\" x=\"357.75\" y=\"-355.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 11 -->\n",
       "<g id=\"node12\" class=\"node\">\n",
       "<title>11</title>\n",
       "<text text-anchor=\"middle\" x=\"445.38\" y=\"-323.45\" font-family=\"Times,serif\" font-size=\"14.00\">* &#160;</text>\n",
       "</g>\n",
       "<!-- 3&#45;&gt;11 -->\n",
       "<g id=\"edge11\" class=\"edge\">\n",
       "<title>3&#45;&gt;11</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M401.8,-387.36C409.05,-377.92 423.68,-358.88 433.98,-345.47\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"436.58,-347.82 439.89,-337.76 431.03,-343.56 436.58,-347.82\"/>\n",
       "<text text-anchor=\"middle\" x=\"429.75\" y=\"-355.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 5 -->\n",
       "<g id=\"node6\" class=\"node\">\n",
       "<title>5</title>\n",
       "<text text-anchor=\"middle\" x=\"185.38\" y=\"-258.95\" font-family=\"Times,serif\" font-size=\"14.00\">(5) str.substr(cgi_decode_s_str_1, 1, 1) == &quot;%&quot;</text>\n",
       "</g>\n",
       "<!-- 4&#45;&gt;5 -->\n",
       "<g id=\"edge5\" class=\"edge\">\n",
       "<title>4&#45;&gt;5</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M281.21,-322.63C263.84,-312.39 228.15,-291.34 205.56,-278.03\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"207.36,-275.02 196.97,-272.96 203.8,-281.05 207.36,-275.02\"/>\n",
       "<text text-anchor=\"middle\" x=\"251.75\" y=\"-291.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 10 -->\n",
       "<g id=\"node11\" class=\"node\">\n",
       "<title>10</title>\n",
       "<text text-anchor=\"middle\" x=\"350.38\" y=\"-258.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 4&#45;&gt;10 -->\n",
       "<g id=\"edge10\" class=\"edge\">\n",
       "<title>4&#45;&gt;10</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M296.82,-322.86C305.91,-313.23 324.41,-293.63 337.1,-280.19\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"339.41,-282.84 343.73,-273.16 334.32,-278.03 339.41,-282.84\"/>\n",
       "<text text-anchor=\"middle\" x=\"329.75\" y=\"-291.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 6 -->\n",
       "<g id=\"node7\" class=\"node\">\n",
       "<title>6</title>\n",
       "<text text-anchor=\"middle\" x=\"102.38\" y=\"-194.45\" font-family=\"Times,serif\" font-size=\"14.00\">(6) Length(cgi_decode_s_str_1) &lt;= 2</text>\n",
       "</g>\n",
       "<!-- 5&#45;&gt;6 -->\n",
       "<g id=\"edge6\" class=\"edge\">\n",
       "<title>5&#45;&gt;6</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M177.42,-258.13C164.12,-248.12 137.11,-227.78 119.38,-214.43\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"121.49,-211.64 111.4,-208.42 117.28,-217.23 121.49,-211.64\"/>\n",
       "<text text-anchor=\"middle\" x=\"154.75\" y=\"-226.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 9 -->\n",
       "<g id=\"node10\" class=\"node\">\n",
       "<title>9</title>\n",
       "<text text-anchor=\"middle\" x=\"238.38\" y=\"-194.45\" font-family=\"Times,serif\" font-size=\"14.00\">* A%</text>\n",
       "</g>\n",
       "<!-- 5&#45;&gt;9 -->\n",
       "<g id=\"edge9\" class=\"edge\">\n",
       "<title>5&#45;&gt;9</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M190.27,-258.36C198.35,-248.82 214.73,-229.5 226.12,-216.07\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"228.56,-218.61 232.36,-208.72 223.23,-214.08 228.56,-218.61\"/>\n",
       "<text text-anchor=\"middle\" x=\"220.75\" y=\"-226.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 7 -->\n",
       "<g id=\"node8\" class=\"node\">\n",
       "<title>7</title>\n",
       "<text text-anchor=\"middle\" x=\"88.38\" y=\"-129.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 6&#45;&gt;7 -->\n",
       "<g id=\"edge7\" class=\"edge\">\n",
       "<title>6&#45;&gt;7</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M101.08,-193.86C99.07,-184.88 95.12,-167.22 92.15,-153.98\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"95.64,-153.53 90.04,-144.54 88.81,-155.06 95.64,-153.53\"/>\n",
       "<text text-anchor=\"middle\" x=\"100.75\" y=\"-162.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 8 -->\n",
       "<g id=\"node9\" class=\"node\">\n",
       "<title>8</title>\n",
       "<text text-anchor=\"middle\" x=\"136.38\" y=\"-129.95\" font-family=\"Times,serif\" font-size=\"14.00\">* AB</text>\n",
       "</g>\n",
       "<!-- 6&#45;&gt;8 -->\n",
       "<g id=\"edge8\" class=\"edge\">\n",
       "<title>6&#45;&gt;8</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M105.51,-193.86C110.5,-184.69 120.4,-166.49 127.65,-153.17\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"130.72,-154.85 132.42,-144.39 124.57,-151.5 130.72,-154.85\"/>\n",
       "<text text-anchor=\"middle\" x=\"126.75\" y=\"-162.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 14 -->\n",
       "<g id=\"node15\" class=\"node\">\n",
       "<title>14</title>\n",
       "<text text-anchor=\"middle\" x=\"692.38\" y=\"-387.95\" font-family=\"Times,serif\" font-size=\"14.00\">(3) str.substr(cgi_decode_s_str_1, 1, 1) == &quot;+&quot;</text>\n",
       "</g>\n",
       "<!-- 13&#45;&gt;14 -->\n",
       "<g id=\"edge14\" class=\"edge\">\n",
       "<title>13&#45;&gt;14</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M758.38,-451.63C746.79,-441.71 723.36,-421.66 707.77,-408.3\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"710.27,-405.84 700.4,-401.99 705.72,-411.16 710.27,-405.84\"/>\n",
       "<text text-anchor=\"middle\" x=\"739.75\" y=\"-420.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 35 -->\n",
       "<g id=\"node36\" class=\"node\">\n",
       "<title>35</title>\n",
       "<text text-anchor=\"middle\" x=\"848.38\" y=\"-387.95\" font-family=\"Times,serif\" font-size=\"14.00\">* +</text>\n",
       "</g>\n",
       "<!-- 13&#45;&gt;35 -->\n",
       "<g id=\"edge35\" class=\"edge\">\n",
       "<title>13&#45;&gt;35</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M773.33,-451.63C786.63,-441.62 813.64,-421.28 831.37,-407.93\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"833.47,-410.73 839.35,-401.92 829.26,-405.14 833.47,-410.73\"/>\n",
       "<text text-anchor=\"middle\" x=\"817.75\" y=\"-420.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 15 -->\n",
       "<g id=\"node16\" class=\"node\">\n",
       "<title>15</title>\n",
       "<text text-anchor=\"middle\" x=\"611.38\" y=\"-323.45\" font-family=\"Times,serif\" font-size=\"14.00\">(4) str.substr(cgi_decode_s_str_1, 1, 1) == &quot;%&quot;</text>\n",
       "</g>\n",
       "<!-- 14&#45;&gt;15 -->\n",
       "<g id=\"edge15\" class=\"edge\">\n",
       "<title>14&#45;&gt;15</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M684.61,-387.13C671.63,-377.12 645.27,-356.78 627.97,-343.43\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"630.25,-340.77 620.2,-337.43 625.98,-346.31 630.25,-340.77\"/>\n",
       "<text text-anchor=\"middle\" x=\"662.75\" y=\"-355.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 26 -->\n",
       "<g id=\"node27\" class=\"node\">\n",
       "<title>26</title>\n",
       "<text text-anchor=\"middle\" x=\"862.38\" y=\"-323.45\" font-family=\"Times,serif\" font-size=\"14.00\">(4) Length(cgi_decode_s_str_1) &lt;= 2</text>\n",
       "</g>\n",
       "<!-- 14&#45;&gt;26 -->\n",
       "<g id=\"edge26\" class=\"edge\">\n",
       "<title>14&#45;&gt;26</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M708.98,-387.02C738.39,-376.21 799.84,-353.62 835.39,-340.55\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"836.35,-343.92 844.53,-337.19 833.93,-337.35 836.35,-343.92\"/>\n",
       "<text text-anchor=\"middle\" x=\"796.75\" y=\"-355.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 16 -->\n",
       "<g id=\"node17\" class=\"node\">\n",
       "<title>16</title>\n",
       "<text text-anchor=\"middle\" x=\"495.38\" y=\"-258.95\" font-family=\"Times,serif\" font-size=\"14.00\">(5) Length(cgi_decode_s_str_1) &lt;= 2</text>\n",
       "</g>\n",
       "<!-- 15&#45;&gt;16 -->\n",
       "<g id=\"edge16\" class=\"edge\">\n",
       "<title>15&#45;&gt;16</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M600.25,-322.63C580.99,-312.25 541.11,-290.77 516.46,-277.49\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"518.43,-274.57 507.97,-272.91 515.11,-280.73 518.43,-274.57\"/>\n",
       "<text text-anchor=\"middle\" x=\"567.75\" y=\"-291.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 25 -->\n",
       "<g id=\"node26\" class=\"node\">\n",
       "<title>25</title>\n",
       "<text text-anchor=\"middle\" x=\"632.38\" y=\"-258.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 15&#45;&gt;25 -->\n",
       "<g id=\"edge25\" class=\"edge\">\n",
       "<title>15&#45;&gt;25</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M613.31,-322.86C616.36,-313.79 622.39,-295.86 626.85,-282.57\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"630.03,-284.09 629.9,-273.5 623.4,-281.86 630.03,-284.09\"/>\n",
       "<text text-anchor=\"middle\" x=\"627.75\" y=\"-291.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 17 -->\n",
       "<g id=\"node18\" class=\"node\">\n",
       "<title>17</title>\n",
       "<text text-anchor=\"middle\" x=\"449.38\" y=\"-194.45\" font-family=\"Times,serif\" font-size=\"14.00\">(6) str.substr(cgi_decode_s_str_1, 2, 1) == &quot;+&quot;</text>\n",
       "</g>\n",
       "<!-- 16&#45;&gt;17 -->\n",
       "<g id=\"edge17\" class=\"edge\">\n",
       "<title>16&#45;&gt;17</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M491.13,-258.36C484.18,-248.92 470.17,-229.88 460.3,-216.47\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"463.39,-214.76 454.64,-208.78 457.75,-218.91 463.39,-214.76\"/>\n",
       "<text text-anchor=\"middle\" x=\"480.75\" y=\"-226.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 24 -->\n",
       "<g id=\"node25\" class=\"node\">\n",
       "<title>24</title>\n",
       "<text text-anchor=\"middle\" x=\"610.38\" y=\"-194.45\" font-family=\"Times,serif\" font-size=\"14.00\">* +A</text>\n",
       "</g>\n",
       "<!-- 16&#45;&gt;24 -->\n",
       "<g id=\"edge24\" class=\"edge\">\n",
       "<title>16&#45;&gt;24</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M506.4,-258.13C525.41,-247.8 564.68,-226.46 589.14,-213.17\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"590.77,-216.26 597.88,-208.41 587.43,-210.11 590.77,-216.26\"/>\n",
       "<text text-anchor=\"middle\" x=\"566.75\" y=\"-226.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 18 -->\n",
       "<g id=\"node19\" class=\"node\">\n",
       "<title>18</title>\n",
       "<text text-anchor=\"middle\" x=\"349.38\" y=\"-129.95\" font-family=\"Times,serif\" font-size=\"14.00\">(7) str.substr(cgi_decode_s_str_1, 2, 1) == &quot;%&quot;</text>\n",
       "</g>\n",
       "<!-- 17&#45;&gt;18 -->\n",
       "<g id=\"edge18\" class=\"edge\">\n",
       "<title>17&#45;&gt;18</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M439.79,-193.63C423.48,-183.44 390.03,-162.54 368.71,-149.21\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"370.7,-146.33 360.36,-143.99 366.99,-152.26 370.7,-146.33\"/>\n",
       "<text text-anchor=\"middle\" x=\"411.75\" y=\"-162.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 23 -->\n",
       "<g id=\"node24\" class=\"node\">\n",
       "<title>23</title>\n",
       "<text text-anchor=\"middle\" x=\"514.38\" y=\"-129.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 17&#45;&gt;23 -->\n",
       "<g id=\"edge23\" class=\"edge\">\n",
       "<title>17&#45;&gt;23</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M455.37,-193.86C465.48,-184.14 486.16,-164.25 500.15,-150.8\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"502.33,-153.56 507.11,-144.11 497.48,-148.52 502.33,-153.56\"/>\n",
       "<text text-anchor=\"middle\" x=\"491.75\" y=\"-162.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 19 -->\n",
       "<g id=\"node20\" class=\"node\">\n",
       "<title>19</title>\n",
       "<text text-anchor=\"middle\" x=\"254.38\" y=\"-65.45\" font-family=\"Times,serif\" font-size=\"14.00\">(8) Length(cgi_decode_s_str_1) &lt;= 3</text>\n",
       "</g>\n",
       "<!-- 18&#45;&gt;19 -->\n",
       "<g id=\"edge19\" class=\"edge\">\n",
       "<title>18&#45;&gt;19</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M340.27,-129.13C324.84,-118.99 293.29,-98.23 273.02,-84.89\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"275.14,-82.1 264.86,-79.52 271.29,-87.94 275.14,-82.1\"/>\n",
       "<text text-anchor=\"middle\" x=\"314.75\" y=\"-97.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 22 -->\n",
       "<g id=\"node23\" class=\"node\">\n",
       "<title>22</title>\n",
       "<text text-anchor=\"middle\" x=\"391.38\" y=\"-65.45\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 18&#45;&gt;22 -->\n",
       "<g id=\"edge22\" class=\"edge\">\n",
       "<title>18&#45;&gt;22</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M353.25,-129.36C359.53,-120.01 372.14,-101.25 381.13,-87.86\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"383.87,-90.07 386.54,-79.82 378.06,-86.17 383.87,-90.07\"/>\n",
       "<text text-anchor=\"middle\" x=\"377.75\" y=\"-97.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 20 -->\n",
       "<g id=\"node21\" class=\"node\">\n",
       "<title>20</title>\n",
       "<text text-anchor=\"middle\" x=\"228.38\" y=\"-0.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 19&#45;&gt;20 -->\n",
       "<g id=\"edge20\" class=\"edge\">\n",
       "<title>19&#45;&gt;20</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M251.98,-64.86C248.2,-55.79 240.74,-37.86 235.22,-24.57\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"238.5,-23.35 231.43,-15.46 232.04,-26.04 238.5,-23.35\"/>\n",
       "<text text-anchor=\"middle\" x=\"247.75\" y=\"-33.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 21 -->\n",
       "<g id=\"node22\" class=\"node\">\n",
       "<title>21</title>\n",
       "<text text-anchor=\"middle\" x=\"281.38\" y=\"-0.95\" font-family=\"Times,serif\" font-size=\"14.00\">* +AB</text>\n",
       "</g>\n",
       "<!-- 19&#45;&gt;21 -->\n",
       "<g id=\"edge21\" class=\"edge\">\n",
       "<title>19&#45;&gt;21</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M256.87,-64.86C260.78,-55.79 268.53,-37.86 274.27,-24.57\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"277.46,-26.02 278.21,-15.45 271.03,-23.24 277.46,-26.02\"/>\n",
       "<text text-anchor=\"middle\" x=\"273.75\" y=\"-33.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 27 -->\n",
       "<g id=\"node28\" class=\"node\">\n",
       "<title>27</title>\n",
       "<text text-anchor=\"middle\" x=\"799.38\" y=\"-258.95\" font-family=\"Times,serif\" font-size=\"14.00\">(5) str.substr(cgi_decode_s_str_1, 2, 1) == &quot;+&quot;</text>\n",
       "</g>\n",
       "<!-- 26&#45;&gt;27 -->\n",
       "<g id=\"edge27\" class=\"edge\">\n",
       "<title>26&#45;&gt;27</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M856.56,-322.86C846.77,-313.14 826.72,-293.25 813.16,-279.8\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"816,-277.69 806.43,-273.13 811.07,-282.65 816,-277.69\"/>\n",
       "<text text-anchor=\"middle\" x=\"840.75\" y=\"-291.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 34 -->\n",
       "<g id=\"node35\" class=\"node\">\n",
       "<title>34</title>\n",
       "<text text-anchor=\"middle\" x=\"959.38\" y=\"-258.95\" font-family=\"Times,serif\" font-size=\"14.00\">* ++</text>\n",
       "</g>\n",
       "<!-- 26&#45;&gt;34 -->\n",
       "<g id=\"edge34\" class=\"edge\">\n",
       "<title>26&#45;&gt;34</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M871.68,-322.63C887.42,-312.49 919.64,-291.73 940.34,-278.39\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"942.18,-281.37 948.69,-273.01 938.39,-275.49 942.18,-281.37\"/>\n",
       "<text text-anchor=\"middle\" x=\"922.75\" y=\"-291.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 28 -->\n",
       "<g id=\"node29\" class=\"node\">\n",
       "<title>28</title>\n",
       "<text text-anchor=\"middle\" x=\"780.38\" y=\"-194.45\" font-family=\"Times,serif\" font-size=\"14.00\">(6) str.substr(cgi_decode_s_str_1, 2, 1) == &quot;%&quot;</text>\n",
       "</g>\n",
       "<!-- 27&#45;&gt;28 -->\n",
       "<g id=\"edge28\" class=\"edge\">\n",
       "<title>27&#45;&gt;28</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M797.62,-258.36C794.89,-249.38 789.52,-231.72 785.5,-218.48\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"788.88,-217.56 782.62,-209.01 782.18,-219.59 788.88,-217.56\"/>\n",
       "<text text-anchor=\"middle\" x=\"795.75\" y=\"-226.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 33 -->\n",
       "<g id=\"node34\" class=\"node\">\n",
       "<title>33</title>\n",
       "<text text-anchor=\"middle\" x=\"945.38\" y=\"-194.45\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 27&#45;&gt;33 -->\n",
       "<g id=\"edge33\" class=\"edge\">\n",
       "<title>27&#45;&gt;33</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M813.64,-258.02C838.56,-247.35 890.3,-225.2 921,-212.06\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"922.06,-215.41 929.88,-208.26 919.31,-208.98 922.06,-215.41\"/>\n",
       "<text text-anchor=\"middle\" x=\"888.75\" y=\"-226.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 29 -->\n",
       "<g id=\"node30\" class=\"node\">\n",
       "<title>29</title>\n",
       "<text text-anchor=\"middle\" x=\"676.38\" y=\"-129.95\" font-family=\"Times,serif\" font-size=\"14.00\">(7) Length(cgi_decode_s_str_1) &lt;= 3</text>\n",
       "</g>\n",
       "<!-- 28&#45;&gt;29 -->\n",
       "<g id=\"edge29\" class=\"edge\">\n",
       "<title>28&#45;&gt;29</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M770.4,-193.63C753.36,-183.39 718.34,-162.34 696.18,-149.03\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"698.14,-146.12 687.77,-143.97 694.54,-152.12 698.14,-146.12\"/>\n",
       "<text text-anchor=\"middle\" x=\"741.75\" y=\"-162.2\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 32 -->\n",
       "<g id=\"node33\" class=\"node\">\n",
       "<title>32</title>\n",
       "<text text-anchor=\"middle\" x=\"813.38\" y=\"-129.95\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 28&#45;&gt;32 -->\n",
       "<g id=\"edge32\" class=\"edge\">\n",
       "<title>28&#45;&gt;32</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M783.42,-193.86C788.26,-184.69 797.87,-166.49 804.91,-153.17\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"807.96,-154.88 809.53,-144.4 801.77,-151.61 807.96,-154.88\"/>\n",
       "<text text-anchor=\"middle\" x=\"803.75\" y=\"-162.2\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "<!-- 30 -->\n",
       "<g id=\"node31\" class=\"node\">\n",
       "<title>30</title>\n",
       "<text text-anchor=\"middle\" x=\"649.38\" y=\"-65.45\" font-family=\"Times,serif\" font-size=\"14.00\">? (63)</text>\n",
       "</g>\n",
       "<!-- 29&#45;&gt;30 -->\n",
       "<g id=\"edge30\" class=\"edge\">\n",
       "<title>29&#45;&gt;30</title>\n",
       "<path fill=\"none\" stroke=\"red\" d=\"M673.88,-129.36C669.97,-120.29 662.22,-102.36 656.48,-89.07\"/>\n",
       "<polygon fill=\"red\" stroke=\"red\" points=\"659.72,-87.74 652.54,-79.95 653.29,-90.52 659.72,-87.74\"/>\n",
       "<text text-anchor=\"middle\" x=\"668.75\" y=\"-97.7\" font-family=\"Times,serif\" font-size=\"14.00\">0</text>\n",
       "</g>\n",
       "<!-- 31 -->\n",
       "<g id=\"node32\" class=\"node\">\n",
       "<title>31</title>\n",
       "<text text-anchor=\"middle\" x=\"702.38\" y=\"-65.45\" font-family=\"Times,serif\" font-size=\"14.00\">* ++A</text>\n",
       "</g>\n",
       "<!-- 29&#45;&gt;31 -->\n",
       "<g id=\"edge31\" class=\"edge\">\n",
       "<title>29&#45;&gt;31</title>\n",
       "<path fill=\"none\" stroke=\"blue\" d=\"M678.77,-129.36C682.55,-120.29 690.01,-102.36 695.53,-89.07\"/>\n",
       "<polygon fill=\"blue\" stroke=\"blue\" points=\"698.71,-90.54 699.32,-79.96 692.25,-87.85 698.71,-90.54\"/>\n",
       "<text text-anchor=\"middle\" x=\"695.75\" y=\"-97.7\" font-family=\"Times,serif\" font-size=\"14.00\">1</text>\n",
       "</g>\n",
       "</g>\n",
       "</svg>\n"
      ],
      "text/plain": [
       "<graphviz.graphs.Digraph at 0x12e93d330>"
      ]
     },
     "execution_count": 302,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "display_trace_tree(scf.ct.root)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "**Note.** Our concolic tracer is limited in that it does not track changes in the string length. This leads it to treat every string with same prefix as the same string."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `SimpleConcolicFuzzer` is reasonably efficient at exploring paths near the path followed by a given sample input. However, it is not very intelligent when it comes to choosing which paths to follow. We look at another fuzzer that lifts the predicates obtained to the grammar and achieves better fuzzing."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Concolic Grammar Fuzzing\n",
    "\n",
    "The concolic framework can be used directly in grammar-based fuzzing. We implement a class `ConcolicGrammarFuzzer` wihich does this."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    },
    "tags": []
   },
   "source": [
    "### Excursion: Implementing ConcolicGrammarFuzzer"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "First, we extend our `GrammarFuzzer` with a helper method `tree_to_string()` such that we can retrieve the derivation tree of the fuzz output. We also define `prune_tree()` and `coalesce()` methods to reduce the depth of sub trees. These methods accept a list of tokens types such that a node belonging to the token type gets converted from a tree to a leaf node by calling `tree_to_string()`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 303,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.785870Z",
     "iopub.status.busy": "2024-04-27T13:49:19.785729Z",
     "iopub.status.idle": "2024-04-27T13:49:19.787977Z",
     "shell.execute_reply": "2024-04-27T13:49:19.787667Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from InformationFlow import INVENTORY_GRAMMAR, SQLException"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 304,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.789515Z",
     "iopub.status.busy": "2024-04-27T13:49:19.789390Z",
     "iopub.status.idle": "2024-04-27T13:49:19.791318Z",
     "shell.execute_reply": "2024-04-27T13:49:19.790855Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from GrammarFuzzer import GrammarFuzzer"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 305,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.792964Z",
     "iopub.status.busy": "2024-04-27T13:49:19.792846Z",
     "iopub.status.idle": "2024-04-27T13:49:19.796696Z",
     "shell.execute_reply": "2024-04-27T13:49:19.796339Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ConcolicGrammarFuzzer(GrammarFuzzer):\n",
    "    def tree_to_string(self, tree):\n",
    "        symbol, children, *_ = tree\n",
    "        e = ''\n",
    "        if children:\n",
    "            return e.join([self.tree_to_string(c) for c in children])\n",
    "        else:\n",
    "            return e if symbol in self.grammar else symbol\n",
    "\n",
    "    def prune_tree(self, tree, tokens):\n",
    "        name, children = tree\n",
    "        children = self.coalesce(children)\n",
    "        if name in tokens:\n",
    "            return (name, [(self.tree_to_string(tree), [])])\n",
    "        else:\n",
    "            return (name, [self.prune_tree(c, tokens) for c in children])\n",
    "\n",
    "    def coalesce(self, children):\n",
    "        last = ''\n",
    "        new_lst = []\n",
    "        for cn, cc in children:\n",
    "            if cn not in self.grammar:\n",
    "                last += cn\n",
    "            else:\n",
    "                if last:\n",
    "                    new_lst.append((last, []))\n",
    "                    last = ''\n",
    "                new_lst.append((cn, cc))\n",
    "        if last:\n",
    "            new_lst.append((last, []))\n",
    "        return new_lst"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We can now use the fuzzer to produce inputs for our DB."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 306,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.798409Z",
     "iopub.status.busy": "2024-04-27T13:49:19.798290Z",
     "iopub.status.idle": "2024-04-27T13:49:19.808582Z",
     "shell.execute_reply": "2024-04-27T13:49:19.808277Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "tgf = ConcolicGrammarFuzzer(INVENTORY_GRAMMAR)\n",
    "while True:\n",
    "    qtree = tgf.fuzz_tree()\n",
    "    query = str(tgf.tree_to_string(qtree))\n",
    "    if query.startswith('select'):\n",
    "        break"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 307,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.810614Z",
     "iopub.status.busy": "2024-04-27T13:49:19.810231Z",
     "iopub.status.idle": "2024-04-27T13:49:19.812540Z",
     "shell.execute_reply": "2024-04-27T13:49:19.812045Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from ExpectError import ExpectError"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 308,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.814763Z",
     "iopub.status.busy": "2024-04-27T13:49:19.814575Z",
     "iopub.status.idle": "2024-04-27T13:49:19.818974Z",
     "shell.execute_reply": "2024-04-27T13:49:19.818563Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "'select t4(I,N)!=b(k)/O!=(K4(:/Z)) from I7'\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "Traceback (most recent call last):\n",
      "  File \"/var/folders/n2/xd9445p97rb3xh7m1dfx8_4h0006ts/T/ipykernel_63074/2536269233.py\", line 4, in <cell line: 1>\n",
      "    res = _[db_select](str(query))\n",
      "  File \"/var/folders/n2/xd9445p97rb3xh7m1dfx8_4h0006ts/T/ipykernel_63074/2687284210.py\", line 3, in __call__\n",
      "    self.result = self.fn(*self.concolic(args))\n",
      "  File \"/var/folders/n2/xd9445p97rb3xh7m1dfx8_4h0006ts/T/ipykernel_63074/1994573112.py\", line 4, in db_select\n",
      "    r = my_db.sql(s)\n",
      "  File \"/Users/zeller/Projects/fuzzingbook/notebooks/InformationFlow.ipynb\", line 65, in sql\n",
      "    return method(query[len(key):])\n",
      "  File \"/Users/zeller/Projects/fuzzingbook/notebooks/InformationFlow.ipynb\", line 84, in do_select\n",
      "    _, table = self.table(t_name)\n",
      "  File \"/var/folders/n2/xd9445p97rb3xh7m1dfx8_4h0006ts/T/ipykernel_63074/2474817571.py\", line 6, in table\n",
      "    raise SQLException('Table (%s) was not found' % repr(t_name))\n",
      "InformationFlow.SQLException: Table ('I7') was not found (expected)\n"
     ]
    }
   ],
   "source": [
    "with ExpectError():\n",
    "    print(repr(query))\n",
    "    with ConcolicTracer() as _:\n",
    "        res = _[db_select](str(query))\n",
    "    print(repr(res))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Our fuzzer returns with an exception. It is unable to find the specified table. Let us examine the predicates it encountered."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 309,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.821020Z",
     "iopub.status.busy": "2024-04-27T13:49:19.820808Z",
     "iopub.status.idle": "2024-04-27T13:49:19.829360Z",
     "shell.execute_reply": "2024-04-27T13:49:19.828898Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0 0 == IndexOf(db_select_s_str_1, \"select \", 0)\n",
      "1 0 == IndexOf(db_select_s_str_1, \"select \", 0)\n",
      "2 Not(0 >\n",
      "    IndexOf(str.substr(db_select_s_str_1, 7, 34),\n",
      "            \" from \",\n",
      "            0))\n",
      "3 Not(Or(0 <\n",
      "       IndexOf(str.substr(db_select_s_str_1, 7, 34),\n",
      "               \" where \",\n",
      "               0),\n",
      "       0 ==\n",
      "       IndexOf(str.substr(db_select_s_str_1, 7, 34),\n",
      "               \" where \",\n",
      "               0)))\n",
      "4 Not(str.substr(str.substr(db_select_s_str_1, 7, 34), 32, 2) ==\n",
      "    \"inventory\")\n"
     ]
    }
   ],
   "source": [
    "for i, p in enumerate(_.path):\n",
    "    print(i, p)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Note that we can obtain constraints that are not present in the grammar from using the `ConcolicTracer`. In particular, see how we are able to obtain the condition that the table needs to be `inventory` (Predicate 11) for the fuzzing to succeed."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "How do we lift these to the grammar? and in particular how do we do it automatically? One option we have is to simply switch the last predicate obtained. In our case, the last predicate is (11). Can we simply invert the predicate and solve it again?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 310,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.831343Z",
     "iopub.status.busy": "2024-04-27T13:49:19.831238Z",
     "iopub.status.idle": "2024-04-27T13:49:19.833346Z",
     "shell.execute_reply": "2024-04-27T13:49:19.833073Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "new_path = _.path[0:-1] + [z3.Not(_.path[-1])]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 311,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.834836Z",
     "iopub.status.busy": "2024-04-27T13:49:19.834697Z",
     "iopub.status.idle": "2024-04-27T13:49:19.836565Z",
     "shell.execute_reply": "2024-04-27T13:49:19.836305Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "new_ = ConcolicTracer((_.decls, new_path))\n",
    "new_.fn = _.fn\n",
    "new_.fn_args = _.fn_args"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 312,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.838090Z",
     "iopub.status.busy": "2024-04-27T13:49:19.837975Z",
     "iopub.status.idle": "2024-04-27T13:49:19.866175Z",
     "shell.execute_reply": "2024-04-27T13:49:19.865714Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('No Solutions', None)"
      ]
     },
     "execution_count": 312,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "new_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Indeed, this will not work as the string lengths being compared to are different."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 313,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.868182Z",
     "iopub.status.busy": "2024-04-27T13:49:19.868040Z",
     "iopub.status.idle": "2024-04-27T13:49:19.892493Z",
     "shell.execute_reply": "2024-04-27T13:49:19.892109Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Not(str.substr(str.substr(db_select_s_str_1, 7, 34), 32, 2) ==\n",
      "    \"inventory\")\n",
      "no solution\n"
     ]
    }
   ],
   "source": [
    "print(_.path[-1])\n",
    "z3.solve(z3.Not(_.path[-1]))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "A better idea is to investigate what _string_ comparisons are being made, and associate that with the corresponding nodes in the grammar. Let us examine our derivation tree (pruned to avoid recursive structures, and to focus on important parts)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 314,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.894638Z",
     "iopub.status.busy": "2024-04-27T13:49:19.894497Z",
     "iopub.status.idle": "2024-04-27T13:49:19.896624Z",
     "shell.execute_reply": "2024-04-27T13:49:19.896261Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from GrammarFuzzer import display_tree"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 315,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:19.898330Z",
     "iopub.status.busy": "2024-04-27T13:49:19.898197Z",
     "iopub.status.idle": "2024-04-27T13:49:20.315931Z",
     "shell.execute_reply": "2024-04-27T13:49:20.315510Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "image/svg+xml": [
       "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\n",
       "<!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\"\n",
       " \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n",
       "<!-- Generated by graphviz version 9.0.0 (20230911.1827)\n",
       " -->\n",
       "<!-- Pages: 1 -->\n",
       "<svg width=\"220pt\" height=\"173pt\"\n",
       " viewBox=\"0.00 0.00 219.62 173.00\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n",
       "<g id=\"graph0\" class=\"graph\" transform=\"scale(1 1) rotate(0) translate(4 169)\">\n",
       "<polygon fill=\"white\" stroke=\"none\" points=\"-4,4 -4,-169 215.62,-169 215.62,4 -4,4\"/>\n",
       "<!-- 0 -->\n",
       "<g id=\"node1\" class=\"node\">\n",
       "<title>0</title>\n",
       "<text text-anchor=\"middle\" x=\"104.25\" y=\"-151.7\" font-family=\"Times,serif\" font-size=\"14.00\">&lt;start&gt;</text>\n",
       "</g>\n",
       "<!-- 1 -->\n",
       "<g id=\"node2\" class=\"node\">\n",
       "<title>1</title>\n",
       "<text text-anchor=\"middle\" x=\"104.25\" y=\"-101.45\" font-family=\"Times,serif\" font-size=\"14.00\">&lt;query&gt;</text>\n",
       "</g>\n",
       "<!-- 0&#45;&gt;1 -->\n",
       "<g id=\"edge1\" class=\"edge\">\n",
       "<title>0&#45;&gt;1</title>\n",
       "<path fill=\"none\" stroke=\"black\" d=\"M104.25,-150.96C104.25,-144.74 104.25,-134.65 104.25,-125.89\"/>\n",
       "<polygon fill=\"black\" stroke=\"black\" points=\"107.75,-126.1 104.25,-116.1 100.75,-126.1 107.75,-126.1\"/>\n",
       "</g>\n",
       "<!-- 2 -->\n",
       "<g id=\"node3\" class=\"node\">\n",
       "<title>2</title>\n",
       "<text text-anchor=\"middle\" x=\"17.25\" y=\"-51.2\" font-family=\"Times,serif\" font-size=\"14.00\">select </text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;2 -->\n",
       "<g id=\"edge2\" class=\"edge\">\n",
       "<title>1&#45;&gt;2</title>\n",
       "<path fill=\"none\" stroke=\"black\" d=\"M93.23,-100.51C79.37,-92.83 55.3,-79.47 37.95,-69.86\"/>\n",
       "<polygon fill=\"black\" stroke=\"black\" points=\"39.95,-66.96 29.5,-65.17 36.55,-73.08 39.95,-66.96\"/>\n",
       "</g>\n",
       "<!-- 3 -->\n",
       "<g id=\"node4\" class=\"node\">\n",
       "<title>3</title>\n",
       "<text text-anchor=\"middle\" x=\"75.25\" y=\"-51.2\" font-family=\"Times,serif\" font-size=\"14.00\">&lt;exprs&gt;</text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;3 -->\n",
       "<g id=\"edge3\" class=\"edge\">\n",
       "<title>1&#45;&gt;3</title>\n",
       "<path fill=\"none\" stroke=\"black\" d=\"M100.69,-100.71C96.74,-94.12 90.18,-83.22 84.71,-74.12\"/>\n",
       "<polygon fill=\"black\" stroke=\"black\" points=\"87.77,-72.41 79.61,-65.64 81.77,-76.01 87.77,-72.41\"/>\n",
       "</g>\n",
       "<!-- 5 -->\n",
       "<g id=\"node6\" class=\"node\">\n",
       "<title>5</title>\n",
       "<text text-anchor=\"middle\" x=\"133.25\" y=\"-51.2\" font-family=\"Times,serif\" font-size=\"14.00\"> from </text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;5 -->\n",
       "<g id=\"edge5\" class=\"edge\">\n",
       "<title>1&#45;&gt;5</title>\n",
       "<path fill=\"none\" stroke=\"black\" d=\"M107.81,-100.71C111.76,-94.12 118.32,-83.22 123.79,-74.12\"/>\n",
       "<polygon fill=\"black\" stroke=\"black\" points=\"126.73,-76.01 128.89,-65.64 120.73,-72.41 126.73,-76.01\"/>\n",
       "</g>\n",
       "<!-- 6 -->\n",
       "<g id=\"node7\" class=\"node\">\n",
       "<title>6</title>\n",
       "<text text-anchor=\"middle\" x=\"190.25\" y=\"-51.2\" font-family=\"Times,serif\" font-size=\"14.00\">&lt;table&gt;</text>\n",
       "</g>\n",
       "<!-- 1&#45;&gt;6 -->\n",
       "<g id=\"edge6\" class=\"edge\">\n",
       "<title>1&#45;&gt;6</title>\n",
       "<path fill=\"none\" stroke=\"black\" d=\"M115.14,-100.51C128.84,-92.83 152.64,-79.47 169.78,-69.86\"/>\n",
       "<polygon fill=\"black\" stroke=\"black\" points=\"171.12,-73.12 178.13,-65.18 167.69,-67.02 171.12,-73.12\"/>\n",
       "</g>\n",
       "<!-- 4 -->\n",
       "<g id=\"node5\" class=\"node\">\n",
       "<title>4</title>\n",
       "<text text-anchor=\"middle\" x=\"75.25\" y=\"-0.95\" font-family=\"Times,serif\" font-size=\"14.00\">t4(I,N)!=b(k)/O!=(K4(:/Z))</text>\n",
       "</g>\n",
       "<!-- 3&#45;&gt;4 -->\n",
       "<g id=\"edge4\" class=\"edge\">\n",
       "<title>3&#45;&gt;4</title>\n",
       "<path fill=\"none\" stroke=\"black\" d=\"M75.25,-50.46C75.25,-44.24 75.25,-34.15 75.25,-25.39\"/>\n",
       "<polygon fill=\"black\" stroke=\"black\" points=\"78.75,-25.6 75.25,-15.6 71.75,-25.6 78.75,-25.6\"/>\n",
       "</g>\n",
       "<!-- 7 -->\n",
       "<g id=\"node8\" class=\"node\">\n",
       "<title>7</title>\n",
       "<text text-anchor=\"middle\" x=\"190.25\" y=\"-0.95\" font-family=\"Times,serif\" font-size=\"14.00\">I7</text>\n",
       "</g>\n",
       "<!-- 6&#45;&gt;7 -->\n",
       "<g id=\"edge7\" class=\"edge\">\n",
       "<title>6&#45;&gt;7</title>\n",
       "<path fill=\"none\" stroke=\"black\" d=\"M190.25,-50.46C190.25,-44.24 190.25,-34.15 190.25,-25.39\"/>\n",
       "<polygon fill=\"black\" stroke=\"black\" points=\"193.75,-25.6 190.25,-15.6 186.75,-25.6 193.75,-25.6\"/>\n",
       "</g>\n",
       "</g>\n",
       "</svg>\n"
      ],
      "text/plain": [
       "<graphviz.graphs.Digraph at 0x12e9cadd0>"
      ]
     },
     "execution_count": 315,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "prune_tokens = [\n",
    "    '<value>', '<table>', '<column>', '<literals>', '<exprs>', '<bexpr>'\n",
    "]\n",
    "dt = tgf.prune_tree(qtree, prune_tokens)\n",
    "display_tree(dt)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Can we identify which part of the input was supplied by which part of the grammar? We define `span()` that can recover this information from the derivation tree. For a given node, let us assume that the start point is known. Then, for processing the children, we proceed as follows: We choose one child at a time from left to right, and compute the length of the child. The length of the children before the current child in addition to our starting point gives the starting point of the current child. The end point for each node is simply the end point of its last children (or the length of its node if it is a leaf)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 316,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.317904Z",
     "iopub.status.busy": "2024-04-27T13:49:20.317760Z",
     "iopub.status.idle": "2024-04-27T13:49:20.319758Z",
     "shell.execute_reply": "2024-04-27T13:49:20.319501Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from GrammarFuzzer import START_SYMBOL"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 317,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.321245Z",
     "iopub.status.busy": "2024-04-27T13:49:20.321143Z",
     "iopub.status.idle": "2024-04-27T13:49:20.323979Z",
     "shell.execute_reply": "2024-04-27T13:49:20.323600Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def span(node, g, node_start=0):\n",
    "    hm = {}\n",
    "    k, cs = node\n",
    "    end_i = node_start\n",
    "    new_cs = []\n",
    "    for c in cs:\n",
    "        chm, (ck, child_start, child_end, gcs) = span(c, g, end_i)\n",
    "        new_cs.append((ck, child_start, child_end, gcs))\n",
    "        end_i = child_end\n",
    "        hm.update(chm)\n",
    "    node_end = end_i if cs else node_start + len(k)\n",
    "    if k in g and k != START_SYMBOL:\n",
    "        hm[k] = (node_start, node_end - node_start)\n",
    "    return hm, (k, node_start, node_end, new_cs)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We use it as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 318,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.325572Z",
     "iopub.status.busy": "2024-04-27T13:49:20.325464Z",
     "iopub.status.idle": "2024-04-27T13:49:20.327342Z",
     "shell.execute_reply": "2024-04-27T13:49:20.327090Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "span_hm, _n = span(dt, INVENTORY_GRAMMAR)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 319,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.328980Z",
     "iopub.status.busy": "2024-04-27T13:49:20.328877Z",
     "iopub.status.idle": "2024-04-27T13:49:20.331209Z",
     "shell.execute_reply": "2024-04-27T13:49:20.330881Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'<exprs>': (7, 26), '<table>': (39, 2), '<query>': (0, 41)}"
      ]
     },
     "execution_count": 319,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "span_hm"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can check if we got the right values as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 320,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.332928Z",
     "iopub.status.busy": "2024-04-27T13:49:20.332792Z",
     "iopub.status.idle": "2024-04-27T13:49:20.334943Z",
     "shell.execute_reply": "2024-04-27T13:49:20.334703Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "query: select t4(I,N)!=b(k)/O!=(K4(:/Z)) from I7\n",
      "<exprs> t4(I,N)!=b(k)/O!=(K4(:/Z))\n",
      "<table> I7\n",
      "<query> select t4(I,N)!=b(k)/O!=(K4(:/Z)) from I7\n"
     ]
    }
   ],
   "source": [
    "print(\"query:\", query)\n",
    "for k in span_hm:\n",
    "    start, l = span_hm[k]\n",
    "    print(k, query[start:start + l])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Next, we need to obtain all the comparisons made in each predicate. For that, we define two helper functions. The first is `unwrap_substrings()` that translates multiple calls to `z3.SubString` and returns the start, and length of the given z3 string expression."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 321,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.336429Z",
     "iopub.status.busy": "2024-04-27T13:49:20.336317Z",
     "iopub.status.idle": "2024-04-27T13:49:20.338826Z",
     "shell.execute_reply": "2024-04-27T13:49:20.338552Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def unwrap_substrings(s):\n",
    "    assert s.decl().name() == 'str.substr'\n",
    "    cs, frm, l = s.children()\n",
    "    fl = frm.as_long()\n",
    "    ll = l.as_long()\n",
    "    if cs.decl().name() == 'str.substr':\n",
    "        newfrm, _l = unwrap_substrings(cs)\n",
    "        return (fl + newfrm, ll)\n",
    "    else:\n",
    "        return (fl, ll)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We define `traverse_z3()` that traverses a given z3 string expression, and collects all direct string comparisons to a substring of the original argument."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 322,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.340577Z",
     "iopub.status.busy": "2024-04-27T13:49:20.340239Z",
     "iopub.status.idle": "2024-04-27T13:49:20.345229Z",
     "shell.execute_reply": "2024-04-27T13:49:20.344946Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def traverse_z3(p, hm):\n",
    "    def z3_as_string(v):\n",
    "        return v.as_string()\n",
    "\n",
    "    n = p.decl().name()\n",
    "    if n == 'not':\n",
    "        return traverse_z3(p.children()[0], hm)\n",
    "    elif n == '=':\n",
    "        i, j = p.children()\n",
    "        if isinstance(i, (int, z3.IntNumRef)):\n",
    "            return traverse_z3(j, hm)\n",
    "        elif isinstance(j, (int, z3.IntNumRef)):\n",
    "            return traverse_z3(i, hm)\n",
    "        else:\n",
    "            if i.is_string() and j.is_string():\n",
    "                if i.is_string_value():\n",
    "                    cs, frm, l = j.children()\n",
    "                    if (isinstance(frm, z3.IntNumRef)\n",
    "                            and isinstance(l, z3.IntNumRef)):\n",
    "                        hm[z3_as_string(i)] = unwrap_substrings(j)\n",
    "                elif j.is_string_value():\n",
    "                    cs, frm, l = i.children()\n",
    "                    if (isinstance(frm, z3.IntNumRef)\n",
    "                            and isinstance(l, z3.IntNumRef)):\n",
    "                        hm[z3_as_string(j)] = unwrap_substrings(i)\n",
    "            else:\n",
    "                assert False  # for now\n",
    "    elif n == '<' or n == '>':\n",
    "        i, j = p.children()\n",
    "        if isinstance(i, (int, z3.IntNumRef)):\n",
    "            return traverse_z3(j, hm)\n",
    "        elif isinstance(j, (int, z3.IntNumRef)):\n",
    "            return traverse_z3(i, hm)\n",
    "        else:\n",
    "            assert False\n",
    "    return p"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 323,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.346734Z",
     "iopub.status.busy": "2024-04-27T13:49:20.346644Z",
     "iopub.status.idle": "2024-04-27T13:49:20.350329Z",
     "shell.execute_reply": "2024-04-27T13:49:20.350032Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'inventory': (39, 2)}"
      ]
     },
     "execution_count": 323,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "comparisons: Dict[str, Tuple] = {}\n",
    "for p in _.path:\n",
    "    traverse_z3(p, comparisons)\n",
    "comparisons"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "All that we need now is to declare string variables that match the substrings in `comparisons`, and solve for them for each item in the path. For that, we define `find_alternatives()`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 324,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.352002Z",
     "iopub.status.busy": "2024-04-27T13:49:20.351894Z",
     "iopub.status.idle": "2024-04-27T13:49:20.354571Z",
     "shell.execute_reply": "2024-04-27T13:49:20.354288Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def find_alternatives(spans, cmp):\n",
    "    alts = {}\n",
    "    for key in spans:\n",
    "        start, l = spans[key]\n",
    "        rset = set(range(start, start + l))\n",
    "        for ckey in cmp:\n",
    "            cstart, cl = cmp[ckey]\n",
    "            cset = set(range(cstart, cstart + cl))\n",
    "            # if rset.issubset(cset): <- ignoring subsets for now.\n",
    "            if rset == cset:\n",
    "                if key not in alts:\n",
    "                    alts[key] = set()\n",
    "                alts[key].add(ckey)\n",
    "    return alts"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We use it as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 325,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.356328Z",
     "iopub.status.busy": "2024-04-27T13:49:20.356198Z",
     "iopub.status.idle": "2024-04-27T13:49:20.358638Z",
     "shell.execute_reply": "2024-04-27T13:49:20.358361Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'<table>': {'inventory'}}"
      ]
     },
     "execution_count": 325,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "alternatives = find_alternatives(span_hm, comparisons)\n",
    "alternatives"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "So, we have our alternatives for each key in the grammar. We can now update our grammar as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 326,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.360345Z",
     "iopub.status.busy": "2024-04-27T13:49:20.360200Z",
     "iopub.status.idle": "2024-04-27T13:49:20.361956Z",
     "shell.execute_reply": "2024-04-27T13:49:20.361636Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "INVENTORY_GRAMMAR_NEW = dict(INVENTORY_GRAMMAR)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 327,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.363643Z",
     "iopub.status.busy": "2024-04-27T13:49:20.363530Z",
     "iopub.status.idle": "2024-04-27T13:49:20.365328Z",
     "shell.execute_reply": "2024-04-27T13:49:20.365070Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "for k in alternatives:\n",
    "    INVENTORY_GRAMMAR_NEW[k] = INVENTORY_GRAMMAR_NEW[k] + list(alternatives[k])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We made a choice here. We could have completely overwritten the definition of `<table>` . Instead, we added our new alternatives to the existing definition. This way, our fuzzer will also attempt other values for `<table>` once in a while."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 328,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.366853Z",
     "iopub.status.busy": "2024-04-27T13:49:20.366745Z",
     "iopub.status.idle": "2024-04-27T13:49:20.368676Z",
     "shell.execute_reply": "2024-04-27T13:49:20.368446Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['<word>', 'inventory']"
      ]
     },
     "execution_count": 328,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "INVENTORY_GRAMMAR_NEW['<table>']"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Let us try fuzzing with our new grammar."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 329,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.370242Z",
     "iopub.status.busy": "2024-04-27T13:49:20.370107Z",
     "iopub.status.idle": "2024-04-27T13:49:20.372228Z",
     "shell.execute_reply": "2024-04-27T13:49:20.371898Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "cgf = ConcolicGrammarFuzzer(INVENTORY_GRAMMAR_NEW)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 330,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.373843Z",
     "iopub.status.busy": "2024-04-27T13:49:20.373740Z",
     "iopub.status.idle": "2024-04-27T13:49:20.472474Z",
     "shell.execute_reply": "2024-04-27T13:49:20.472111Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "insert into inventory (i9Oam41gsP2,h97,q8J:.70J) values ('.q')\n",
      "Column ('i9Oam41gsP2') was not found\n",
      "\n",
      "select C from wy where R/s/y>_-X-.+C/u==(((---6.5)))\n",
      "Table ('wy') was not found\n",
      "\n",
      "update T set I=gj5 where (-8.6/O*.-W)==s-O<Z((R),((N==(:))))\n",
      "Table ('T') was not found\n",
      "\n",
      "update inventory set f=o,V=Q6 where l0!=(((((-5)))==(rGJ)))\n",
      "Column ('f') was not found\n",
      "\n",
      "delete from j where T==5.58\n",
      "Table ('j') was not found\n",
      "\n",
      "insert into inventory (py75) values ('R','/','fd8g',3883.0)\n",
      "Column ('py75') was not found\n",
      "\n",
      "update inventory set GY5=X where G-g/z(w)<2.5\n",
      "Column ('GY5') was not found\n",
      "\n",
      "update nb0 set i=K,b=R,u=: where D>A\n",
      "Table ('nb0') was not found\n",
      "\n",
      "insert into inventory (P,wmE,U,F) values (50,'/',--6.2)\n",
      "Column ('P') was not found\n",
      "\n",
      "delete from GTV3_ where :-M!=t>n+R/x+r*a/t-r-V\n",
      "Table ('GTV3_') was not found\n",
      "\n"
     ]
    }
   ],
   "source": [
    "for i in range(10):\n",
    "    qtree = cgf.fuzz_tree()\n",
    "    query = cgf.tree_to_string(qtree)\n",
    "    print(query)\n",
    "    with ExpectError(print_traceback=False):\n",
    "        try:\n",
    "            with ConcolicTracer() as _:\n",
    "                res = _[db_select](query)\n",
    "            print(repr(res))\n",
    "        except SQLException as e:\n",
    "            print(e)\n",
    "        print()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "That is, we were able to reach the dangerous method `my_eval()`.\n",
    "In effect, what we have done is to lift parts of predicates to the grammar. The new grammar can generate inputs that reach deeper into the program than before. Note that we have only handled the equality predicate. One can also lift the '<' and '>' comparison operators to the grammar if required.\n",
    "\n",
    "Compare the output of our fuzzer to the original `GrammarFuzzer` below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 331,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.474302Z",
     "iopub.status.busy": "2024-04-27T13:49:20.474165Z",
     "iopub.status.idle": "2024-04-27T13:49:20.544165Z",
     "shell.execute_reply": "2024-04-27T13:49:20.543755Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "insert into UCu4 (E,xM:lOq6,u38p,W54G3b0) values (':',1.835)\n",
      "Table ('UCu4') was not found\n",
      "\n",
      "insert into B81 (Np) values ('h')\n",
      "Table ('B81') was not found\n",
      "\n",
      "delete from w where Xn((T))>a(8.8,g)/h+t-P-j+L\n",
      "Table ('w') was not found\n",
      "\n",
      "update q75 set L=z4 where ((QUy+N))==A/P-L*ao(R)/I\n",
      "Table ('q75') was not found\n",
      "\n",
      "update q3 set x=F where l(N)-P-S+t==e\n",
      "Table ('q3') was not found\n",
      "\n",
      "update Dy06rr set h=F where (z!=Q)==(((a<q)))\n",
      "Table ('Dy06rr') was not found\n",
      "\n",
      "delete from Z where V(7)>a==O(mA,j(g)*:,s,B)-5-eD(c,F!=n)==eO41Xy\n",
      "Table ('Z') was not found\n",
      "\n",
      "select 1.8 from U3X8p\n",
      "Table ('U3X8p') was not found\n",
      "\n",
      "update N set w=X9,A=w,M=Z where ((b!=c))==U/N<I\n",
      "Table ('N') was not found\n",
      "\n",
      "insert into I1 (g,_Q,y8e0) values (5.7,'.&',05.2)\n",
      "Table ('I1') was not found\n",
      "\n"
     ]
    }
   ],
   "source": [
    "gf = GrammarFuzzer(INVENTORY_GRAMMAR)\n",
    "for i in range(10):\n",
    "    query = gf.fuzz()\n",
    "    print(query)\n",
    "    with ExpectError(print_traceback=False):\n",
    "        try:\n",
    "            res = db_select(query)\n",
    "            print(repr(res))\n",
    "        except SQLException as e:\n",
    "            print(e)\n",
    "        print()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "As can be seen, the original grammar fuzzer is unable to proceed beyond the table verification."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "#### Pruning and Updating\n",
    "\n",
    "We implement these methods in `ConcolicGrammarFuzzer`. The method `update_grammar()` allows `ConcolicGrammarFuzzer` to collect feedback from concolic fuzzing, and update the grammar used for fuzzing accordingly."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 332,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.546800Z",
     "iopub.status.busy": "2024-04-27T13:49:20.546622Z",
     "iopub.status.idle": "2024-04-27T13:49:20.549965Z",
     "shell.execute_reply": "2024-04-27T13:49:20.549489Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class ConcolicGrammarFuzzer(ConcolicGrammarFuzzer):\n",
    "    def prune_tokens(self, tokens):\n",
    "        self.prune_tokens = tokens\n",
    "\n",
    "    def update_grammar(self, trace):\n",
    "        self.comparisons = {}\n",
    "        for p in trace.path:\n",
    "            traverse_z3(p, self.comparisons)\n",
    "        alternatives = find_alternatives(self.span_range, self.comparisons)\n",
    "        if self.log:\n",
    "            print('Alternatives:', alternatives, 'Span:', self.span_range)\n",
    "        new_grammar = dict(self.grammar)\n",
    "        for k in alternatives:\n",
    "            new_grammar[k] = list(set(new_grammar[k] + list(alternatives[k])))\n",
    "        self.grammar = new_grammar"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The `fuzz()` method simply generates the derivation tree, computes the span range, and returns the string generated from the derivation tree."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 333,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.551619Z",
     "iopub.status.busy": "2024-04-27T13:49:20.551498Z",
     "iopub.status.idle": "2024-04-27T13:49:20.553921Z",
     "shell.execute_reply": "2024-04-27T13:49:20.553627Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class ConcolicGrammarFuzzer(ConcolicGrammarFuzzer):\n",
    "    def fuzz(self):\n",
    "        qtree = self.fuzz_tree()\n",
    "        self.pruned_tree = self.prune_tree(qtree, self.prune_tokens)\n",
    "        query = self.tree_to_string(qtree)\n",
    "        self.span_range, _n = span(self.pruned_tree, self.grammar)\n",
    "        return query"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "To ensure that our approach works, let us update our tables slightly."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 334,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.555411Z",
     "iopub.status.busy": "2024-04-27T13:49:20.555324Z",
     "iopub.status.idle": "2024-04-27T13:49:20.557494Z",
     "shell.execute_reply": "2024-04-27T13:49:20.557155Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "inventory = db.db.pop('inventory', None)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 335,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.559205Z",
     "iopub.status.busy": "2024-04-27T13:49:20.559090Z",
     "iopub.status.idle": "2024-04-27T13:49:20.562984Z",
     "shell.execute_reply": "2024-04-27T13:49:20.562722Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'vehicles': ({'year': int, 'kind': str, 'company': str, 'model': str},\n",
       "  [{'year': 1997, 'kind': 'van', 'company': 'Ford', 'model': 'E350'},\n",
       "   {'year': 2000, 'kind': 'car', 'company': 'Mercury', 'model': 'Cougar'},\n",
       "   {'year': 1999, 'kind': 'car', 'company': 'Chevy', 'model': 'Venture'}]),\n",
       " 'months': ({'month': int, 'name': str},\n",
       "  [{'month': 1, 'name': 'jan'},\n",
       "   {'month': 2, 'name': 'feb'},\n",
       "   {'month': 3, 'name': 'mar'},\n",
       "   {'month': 4, 'name': 'apr'},\n",
       "   {'month': 5, 'name': 'may'},\n",
       "   {'month': 6, 'name': 'jun'},\n",
       "   {'month': 7, 'name': 'jul'},\n",
       "   {'month': 8, 'name': 'aug'},\n",
       "   {'month': 9, 'name': 'sep'},\n",
       "   {'month': 10, 'name': 'oct'},\n",
       "   {'month': 11, 'name': 'nov'},\n",
       "   {'month': 12, 'name': 'dec'}])}"
      ]
     },
     "execution_count": 335,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "db.db['vehicles'] = inventory\n",
    "db.db['months'] = ({\n",
    "    'month': int,\n",
    "    'name': str\n",
    "}, [{\n",
    "    'month': i + 1,\n",
    "    'name': m\n",
    "} for i, m in enumerate([\n",
    "    'jan', 'feb', 'mar', 'apr', 'may', 'jun', 'jul', 'aug', 'sep', 'oct',\n",
    "    'nov', 'dec'\n",
    "])])\n",
    "db.db"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### End of Excursion"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `ConcolicGrammarFuzzer` is used as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 336,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.564672Z",
     "iopub.status.busy": "2024-04-27T13:49:20.564559Z",
     "iopub.status.idle": "2024-04-27T13:49:20.665036Z",
     "shell.execute_reply": "2024-04-27T13:49:20.664719Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "select Qq6L,(X) from LYg0 where ((x<w))!=(A)\n",
      "Table ('LYg0') was not found\n",
      "\n",
      "update a set P3=_ where p/h-g-Z<l-Q(U)\n",
      "Table ('a') was not found\n",
      "\n",
      "select W,H,s from months where I+N/S+k/R!=G2\n",
      "\n",
      "insert into vehicles (S,q1i) values (7.3,'3[s=K=','e')\n",
      "Column ('S') was not found\n",
      "\n",
      "delete from months where v-f*r/s/q>h-K-m(n,X)\n",
      "Invalid WHERE ('v-f*r/s/q>h-K-m(n,X)')\n",
      "\n",
      "select C*R*Y(A)/Z<J,(q)!=:(R),D from C\n",
      "Table ('C') was not found\n",
      "\n",
      "delete from vehicles where K-t/W(E)-Y+A<H+I*U+w\n",
      "Invalid WHERE ('K-t/W(E)-Y+A<H+I*U+w')\n",
      "\n",
      "select e*L*G-A/_ from _3 where (G)==B(F,H)\n",
      "Table ('_3') was not found\n",
      "\n",
      "select S(Y)<c,PF(j),h,s,_ from months\n",
      "Invalid WHERE ('(S(Y)<c,PF(j),h,s,_)')\n",
      "\n",
      "update e set m=:LMG where 6.48!=A+C-l+c<K(_)*f/o+h==H\n",
      "Table ('e') was not found\n",
      "\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "TypeError: 'NotImplementedType' object is not callable (expected)\n"
     ]
    }
   ],
   "source": [
    "cgf = ConcolicGrammarFuzzer(INVENTORY_GRAMMAR)\n",
    "cgf.prune_tokens(prune_tokens)\n",
    "for i in range(10):\n",
    "    query = cgf.fuzz()\n",
    "    print(query)\n",
    "    with ConcolicTracer() as _:\n",
    "        with ExpectError(print_traceback=False):\n",
    "            try:\n",
    "                res = _[db_select](query)\n",
    "                print(repr(res))\n",
    "            except SQLException as e:\n",
    "                print(e)\n",
    "        cgf.update_grammar(_)\n",
    "        print()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "As can be seen, the fuzzer starts with no knowledge of the tables `vehicles`, `months` and `years`, but identifies it from the concolic execution, and lifts it to the grammar. This allows us to improve the effectiveness of fuzzing."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Limitations\n",
    "\n",
    "As with dynamic taint analysis, implicit control flow can obscure the predicates encountered during concolic execution. However, this limitation could be overcome to some extent by wrapping any constants in the source with their respective proxy objects. Similarly, calls to internal C functions can cause the symbolic information to be discarded, and only partial information may be obtained."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Synopsis"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "This chapter defines two main classes: `SimpleConcolicFuzzer` and `ConcolicGrammarFuzzer`. The `SimpleConcolicFuzzer` first uses a sample input to collect predicates encountered. The fuzzer then negates random predicates to generate new input constraints. These, when solved, produce inputs that explore paths that are close to the original path."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### ConcolicTracer"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "At the heart of both fuzzers lies the concept of a _concolic tracer_, capturing symbolic variables and path conditions as a program gets executed.\n",
    "\n",
    "`ConcolicTracer` is used in a `with` block; the syntax `tracer[function]` executes `function` within the `tracer` while capturing conditions. Here is an example for the `cgi_decode()` function:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 337,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.666779Z",
     "iopub.status.busy": "2024-04-27T13:49:20.666630Z",
     "iopub.status.idle": "2024-04-27T13:49:20.670503Z",
     "shell.execute_reply": "2024-04-27T13:49:20.670234Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    _[cgi_decode]('a%20d')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Once executed, we can retrieve the symbolic variables in the `decls` attribute. This is a mapping of symbolic variables to types."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 338,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.672043Z",
     "iopub.status.busy": "2024-04-27T13:49:20.671947Z",
     "iopub.status.idle": "2024-04-27T13:49:20.674300Z",
     "shell.execute_reply": "2024-04-27T13:49:20.674028Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'cgi_decode_s_str_1': 'String'}"
      ]
     },
     "execution_count": 338,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.decls"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The extracted path conditions can be found in the `path` attribute:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 339,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.675878Z",
     "iopub.status.busy": "2024-04-27T13:49:20.675760Z",
     "iopub.status.idle": "2024-04-27T13:49:20.681907Z",
     "shell.execute_reply": "2024-04-27T13:49:20.681651Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[0 < Length(cgi_decode_s_str_1),\n",
       " Not(str.substr(cgi_decode_s_str_1, 0, 1) == \"+\"),\n",
       " Not(str.substr(cgi_decode_s_str_1, 0, 1) == \"%\"),\n",
       " 1 < Length(cgi_decode_s_str_1),\n",
       " Not(str.substr(cgi_decode_s_str_1, 1, 1) == \"+\"),\n",
       " str.substr(cgi_decode_s_str_1, 1, 1) == \"%\",\n",
       " Not(str.substr(cgi_decode_s_str_1, 2, 1) == \"0\"),\n",
       " Not(str.substr(cgi_decode_s_str_1, 2, 1) == \"1\"),\n",
       " str.substr(cgi_decode_s_str_1, 2, 1) == \"2\",\n",
       " str.substr(cgi_decode_s_str_1, 3, 1) == \"0\",\n",
       " 4 < Length(cgi_decode_s_str_1),\n",
       " Not(str.substr(cgi_decode_s_str_1, 4, 1) == \"+\"),\n",
       " Not(str.substr(cgi_decode_s_str_1, 4, 1) == \"%\"),\n",
       " Not(5 < Length(cgi_decode_s_str_1))]"
      ]
     },
     "execution_count": 339,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.path"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "The `context` attribute holds a pair of `decls` and `path` attributes; this is useful for passing it into the `ConcolicTracer` constructor."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 340,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.683422Z",
     "iopub.status.busy": "2024-04-27T13:49:20.683316Z",
     "iopub.status.idle": "2024-04-27T13:49:20.685117Z",
     "shell.execute_reply": "2024-04-27T13:49:20.684845Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "assert _.context == (_.decls, _.path)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We can solve these constraints to obtain a value for the function parameters that follow the same path as the original (traced) invocation:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 341,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.686555Z",
     "iopub.status.busy": "2024-04-27T13:49:20.686411Z",
     "iopub.status.idle": "2024-04-27T13:49:20.709011Z",
     "shell.execute_reply": "2024-04-27T13:49:20.708654Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'s': ('A%20B', 'String')})"
      ]
     },
     "execution_count": 341,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `zeval()` function also allows passing _alternate_ or _negated_ constraints. See the chapter for examples."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 342,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:20.710914Z",
     "iopub.status.busy": "2024-04-27T13:49:20.710694Z",
     "iopub.status.idle": "2024-04-27T13:49:21.145255Z",
     "shell.execute_reply": "2024-04-27T13:49:21.144822Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "image/svg+xml": [
       "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\n",
       "<!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\"\n",
       " \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n",
       "<!-- Generated by graphviz version 9.0.0 (20230911.1827)\n",
       " -->\n",
       "<!-- Pages: 1 -->\n",
       "<svg width=\"250pt\" height=\"133pt\"\n",
       " viewBox=\"0.00 0.00 250.25 133.00\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n",
       "<g id=\"graph0\" class=\"graph\" transform=\"scale(1 1) rotate(0) translate(4 129)\">\n",
       "<g id=\"a_graph0\"><a xlink:title=\"ConcolicTracer class hierarchy\">\n",
       "<polygon fill=\"white\" stroke=\"none\" points=\"-4,4 -4,-129 246.25,-129 246.25,4 -4,4\"/>\n",
       "</a>\n",
       "</g>\n",
       "<!-- ConcolicTracer -->\n",
       "<g id=\"node1\" class=\"node\">\n",
       "<title>ConcolicTracer</title>\n",
       "<g id=\"a_node1\"><a xlink:href=\"#\" xlink:title=\"class ConcolicTracer:&#10;Trace function execution, tracking variables and path conditions\">\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"0,-0.5 0,-124.5 105.25,-124.5 105.25,-0.5 0,-0.5\"/>\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-108.2\" font-family=\"Patua One, Helvetica, sans-serif\" font-weight=\"bold\" font-size=\"14.00\" fill=\"#b03a2e\">ConcolicTracer</text>\n",
       "<polyline fill=\"none\" stroke=\"black\" points=\"0,-98.5 105.25,-98.5\"/>\n",
       "<g id=\"a_node1_0\"><a xlink:href=\"#\" xlink:title=\"ConcolicTracer\">\n",
       "<g id=\"a_node1_1\"><a xlink:href=\"#\" xlink:title=\"__call__(self, *args):&#10;Call self as a function.\">\n",
       "<text text-anchor=\"start\" x=\"13.62\" y=\"-86\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">__call__()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_2\"><a xlink:href=\"#\" xlink:title=\"__init__(self, context=None):&#10;Constructor.\">\n",
       "<text text-anchor=\"start\" x=\"13.62\" y=\"-74.75\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">__init__()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_3\"><a xlink:href=\"#\" xlink:title=\"zeval(self, predicates=None, *, python=False, log=False):&#10;Evaluate `predicates` in current context.&#10;&#45; If `python` is set, use the z3 Python API; otherwise use z3 standalone.&#10;&#45; If `log` is set, show input to z3.&#10;Return a pair (`result`, `solution`) where&#10;&#45; `result` is either `&#39;sat&#39;` (satisfiable); then&#10;solution` is a mapping of variables to (value, type) pairs; or&#10;&#45; `result` is not `&#39;sat&#39;`, indicating an error; then `solution` is `None`\">\n",
       "<text text-anchor=\"start\" x=\"13.62\" y=\"-63.5\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">zeval()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_4\"><a xlink:href=\"#\" xlink:title=\"__enter__(self)\">\n",
       "<text text-anchor=\"start\" x=\"13.62\" y=\"-51.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"10.00\">__enter__()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_5\"><a xlink:href=\"#\" xlink:title=\"__exit__(self, exc_type, exc_value, tb)\">\n",
       "<text text-anchor=\"start\" x=\"13.62\" y=\"-40\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"10.00\">__exit__()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_6\"><a xlink:href=\"#\" xlink:title=\"__getitem__(self, fn)\">\n",
       "<text text-anchor=\"start\" x=\"13.62\" y=\"-28.75\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"10.00\">__getitem__()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_7\"><a xlink:href=\"#\" xlink:title=\"concolic(self, args)\">\n",
       "<text text-anchor=\"start\" x=\"13.62\" y=\"-17.5\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"10.00\">concolic()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_8\"><a xlink:href=\"#\" xlink:title=\"smt_expr(self, show_decl=False, simplify=False, path=[])\">\n",
       "<text text-anchor=\"start\" x=\"13.62\" y=\"-6.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"10.00\">smt_expr()</text>\n",
       "</a>\n",
       "</g>\n",
       "</a>\n",
       "</g>\n",
       "</a>\n",
       "</g>\n",
       "</g>\n",
       "<!-- Legend -->\n",
       "<g id=\"node2\" class=\"node\">\n",
       "<title>Legend</title>\n",
       "<text text-anchor=\"start\" x=\"123\" y=\"-78.5\" font-family=\"Patua One, Helvetica, sans-serif\" font-weight=\"bold\" font-size=\"10.00\" fill=\"#b03a2e\">Legend</text>\n",
       "<text text-anchor=\"start\" x=\"123\" y=\"-68.5\" font-family=\"Patua One, Helvetica, sans-serif\" font-size=\"10.00\">• </text>\n",
       "<text text-anchor=\"start\" x=\"129\" y=\"-68.5\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"8.00\">public_method()</text>\n",
       "<text text-anchor=\"start\" x=\"123\" y=\"-58.5\" font-family=\"Patua One, Helvetica, sans-serif\" font-size=\"10.00\">• </text>\n",
       "<text text-anchor=\"start\" x=\"129\" y=\"-58.5\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"8.00\">private_method()</text>\n",
       "<text text-anchor=\"start\" x=\"123\" y=\"-48.5\" font-family=\"Patua One, Helvetica, sans-serif\" font-size=\"10.00\">• </text>\n",
       "<text text-anchor=\"start\" x=\"129\" y=\"-48.5\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-style=\"italic\" font-size=\"8.00\">overloaded_method()</text>\n",
       "<text text-anchor=\"start\" x=\"123\" y=\"-39.45\" font-family=\"Helvetica,sans-Serif\" font-size=\"9.00\">Hover over names to see doc</text>\n",
       "</g>\n",
       "</g>\n",
       "</svg>\n"
      ],
      "text/plain": [
       "<graphviz.graphs.Digraph at 0x12e9b1030>"
      ]
     },
     "execution_count": 342,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# ignore\n",
    "from ClassDiagram import display_class_hierarchy\n",
    "display_class_hierarchy(ConcolicTracer)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### SimpleConcolicFuzzer"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The constraints obtained from `ConcolicTracer` are added to the concolic fuzzer as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 343,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:21.147309Z",
     "iopub.status.busy": "2024-04-27T13:49:21.147172Z",
     "iopub.status.idle": "2024-04-27T13:49:21.153731Z",
     "shell.execute_reply": "2024-04-27T13:49:21.153427Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "scf = SimpleConcolicFuzzer()\n",
    "scf.add_trace(_, 'a%20d')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The concolic fuzzer then uses the constraints added to guide its fuzzing as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 344,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:21.155625Z",
     "iopub.status.busy": "2024-04-27T13:49:21.155500Z",
     "iopub.status.idle": "2024-04-27T13:49:21.600214Z",
     "shell.execute_reply": "2024-04-27T13:49:21.599769Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "' '\n",
      "'%'\n",
      "'AB'\n",
      "''\n",
      "'ABC'\n",
      "'A'\n",
      "'AB+'\n",
      "'AB'\n",
      "'ABCD'\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "IndexError: string index out of range (expected)\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "'ABC+'\n",
      "'A'\n",
      "'ABC'\n",
      "'ABC%'\n",
      "'A%'\n",
      "'ABC+DE'\n",
      "'AB'\n",
      "'AB+'\n",
      "'A'\n",
      "'ABCD'\n",
      "'A'\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "IndexError: string index out of range (expected)\n",
      "IndexError: string index out of range (expected)\n"
     ]
    }
   ],
   "source": [
    "scf = SimpleConcolicFuzzer()\n",
    "for i in range(20):\n",
    "    v = scf.fuzz()\n",
    "    if v is None:\n",
    "        break\n",
    "    print(repr(v))\n",
    "    with ExpectError(print_traceback=False):\n",
    "        with ConcolicTracer() as _:\n",
    "            _[cgi_decode](v)\n",
    "    scf.add_trace(_, v)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We see how the additional inputs generated explore additional paths."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 345,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:21.602300Z",
     "iopub.status.busy": "2024-04-27T13:49:21.602174Z",
     "iopub.status.idle": "2024-04-27T13:49:22.052936Z",
     "shell.execute_reply": "2024-04-27T13:49:22.052553Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "image/svg+xml": [
       "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\n",
       "<!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\"\n",
       " \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n",
       "<!-- Generated by graphviz version 9.0.0 (20230911.1827)\n",
       " -->\n",
       "<!-- Pages: 1 -->\n",
       "<svg width=\"294pt\" height=\"215pt\"\n",
       " viewBox=\"0.00 0.00 294.38 215.25\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n",
       "<g id=\"graph0\" class=\"graph\" transform=\"scale(1 1) rotate(0) translate(4 211.25)\">\n",
       "<g id=\"a_graph0\"><a xlink:title=\"SimpleConcolicFuzzer class hierarchy\">\n",
       "<polygon fill=\"white\" stroke=\"none\" points=\"-4,4 -4,-211.25 290.38,-211.25 290.38,4 -4,4\"/>\n",
       "</a>\n",
       "</g>\n",
       "<!-- SimpleConcolicFuzzer -->\n",
       "<g id=\"node1\" class=\"node\">\n",
       "<title>SimpleConcolicFuzzer</title>\n",
       "<g id=\"a_node1\"><a xlink:href=\"#\" xlink:title=\"class SimpleConcolicFuzzer:&#10;Base class for fuzzers.\">\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"0,-0.5 0,-90.75 149.5,-90.75 149.5,-0.5 0,-0.5\"/>\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-74.45\" font-family=\"Patua One, Helvetica, sans-serif\" font-weight=\"bold\" font-size=\"14.00\" fill=\"#b03a2e\">SimpleConcolicFuzzer</text>\n",
       "<polyline fill=\"none\" stroke=\"black\" points=\"0,-64.75 149.5,-64.75\"/>\n",
       "<g id=\"a_node1_0\"><a xlink:href=\"#\" xlink:title=\"SimpleConcolicFuzzer\">\n",
       "<g id=\"a_node1_1\"><a xlink:href=\"#\" xlink:title=\"__init__(self):&#10;Constructor\">\n",
       "<text text-anchor=\"start\" x=\"35.75\" y=\"-52.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-style=\"italic\" font-size=\"10.00\">__init__()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_2\"><a xlink:href=\"#\" xlink:title=\"fuzz(self):&#10;Return fuzz input\">\n",
       "<text text-anchor=\"start\" x=\"35.75\" y=\"-41\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-style=\"italic\" font-size=\"10.00\">fuzz()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_3\"><a xlink:href=\"#\" xlink:title=\"add_trace(self, trace, s)\">\n",
       "<text text-anchor=\"start\" x=\"35.75\" y=\"-28.75\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"10.00\">add_trace()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_4\"><a xlink:href=\"#\" xlink:title=\"get_newpath(self)\">\n",
       "<text text-anchor=\"start\" x=\"35.75\" y=\"-17.5\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"10.00\">get_newpath()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_5\"><a xlink:href=\"#\" xlink:title=\"next_choice(self)\">\n",
       "<text text-anchor=\"start\" x=\"35.75\" y=\"-6.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"10.00\">next_choice()</text>\n",
       "</a>\n",
       "</g>\n",
       "</a>\n",
       "</g>\n",
       "</a>\n",
       "</g>\n",
       "</g>\n",
       "<!-- Fuzzer -->\n",
       "<g id=\"node2\" class=\"node\">\n",
       "<title>Fuzzer</title>\n",
       "<g id=\"a_node2\"><a xlink:href=\"Fuzzer.ipynb\" xlink:title=\"class Fuzzer:&#10;Base class for fuzzers.\">\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"36.75,-127.75 36.75,-206.75 112.75,-206.75 112.75,-127.75 36.75,-127.75\"/>\n",
       "<text text-anchor=\"start\" x=\"54.12\" y=\"-190.45\" font-family=\"Patua One, Helvetica, sans-serif\" font-weight=\"bold\" font-size=\"14.00\" fill=\"#b03a2e\">Fuzzer</text>\n",
       "<polyline fill=\"none\" stroke=\"black\" points=\"36.75,-180.75 112.75,-180.75\"/>\n",
       "<g id=\"a_node2_6\"><a xlink:href=\"#\" xlink:title=\"Fuzzer\">\n",
       "<g id=\"a_node2_7\"><a xlink:href=\"Fuzzer.ipynb\" xlink:title=\"__init__(self) &#45;&gt; None:&#10;Constructor\">\n",
       "<text text-anchor=\"start\" x=\"44.75\" y=\"-168.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-style=\"italic\" font-size=\"10.00\">__init__()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_8\"><a xlink:href=\"Fuzzer.ipynb\" xlink:title=\"fuzz(self) &#45;&gt; str:&#10;Return fuzz input\">\n",
       "<text text-anchor=\"start\" x=\"44.75\" y=\"-157\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-style=\"italic\" font-size=\"10.00\">fuzz()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_9\"><a xlink:href=\"Fuzzer.ipynb\" xlink:title=\"run(self, runner: Fuzzer.Runner = &lt;Fuzzer.Runner object at 0x1065d9ff0&gt;) &#45;&gt; Tuple[subprocess.CompletedProcess, str]:&#10;Run `runner` with fuzz input\">\n",
       "<text text-anchor=\"start\" x=\"44.75\" y=\"-145.75\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">run()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_10\"><a xlink:href=\"Fuzzer.ipynb\" xlink:title=\"runs(self, runner: Fuzzer.Runner = &lt;Fuzzer.PrintRunner object at 0x1065d9d50&gt;, trials: int = 10) &#45;&gt; List[Tuple[subprocess.CompletedProcess, str]]:&#10;Run `runner` with fuzz input, `trials` times\">\n",
       "<text text-anchor=\"start\" x=\"44.75\" y=\"-134.5\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">runs()</text>\n",
       "</a>\n",
       "</g>\n",
       "</a>\n",
       "</g>\n",
       "</a>\n",
       "</g>\n",
       "</g>\n",
       "<!-- SimpleConcolicFuzzer&#45;&gt;Fuzzer -->\n",
       "<g id=\"edge1\" class=\"edge\">\n",
       "<title>SimpleConcolicFuzzer&#45;&gt;Fuzzer</title>\n",
       "<path fill=\"none\" stroke=\"black\" d=\"M74.75,-91.17C74.75,-99.3 74.75,-107.83 74.75,-116.1\"/>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"71.25,-116.05 74.75,-126.05 78.25,-116.05 71.25,-116.05\"/>\n",
       "</g>\n",
       "<!-- Legend -->\n",
       "<g id=\"node3\" class=\"node\">\n",
       "<title>Legend</title>\n",
       "<text text-anchor=\"start\" x=\"167.12\" y=\"-61.62\" font-family=\"Patua One, Helvetica, sans-serif\" font-weight=\"bold\" font-size=\"10.00\" fill=\"#b03a2e\">Legend</text>\n",
       "<text text-anchor=\"start\" x=\"167.12\" y=\"-51.62\" font-family=\"Patua One, Helvetica, sans-serif\" font-size=\"10.00\">• </text>\n",
       "<text text-anchor=\"start\" x=\"173.12\" y=\"-51.62\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"8.00\">public_method()</text>\n",
       "<text text-anchor=\"start\" x=\"167.12\" y=\"-41.62\" font-family=\"Patua One, Helvetica, sans-serif\" font-size=\"10.00\">• </text>\n",
       "<text text-anchor=\"start\" x=\"173.12\" y=\"-41.62\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"8.00\">private_method()</text>\n",
       "<text text-anchor=\"start\" x=\"167.12\" y=\"-31.62\" font-family=\"Patua One, Helvetica, sans-serif\" font-size=\"10.00\">• </text>\n",
       "<text text-anchor=\"start\" x=\"173.12\" y=\"-31.62\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-style=\"italic\" font-size=\"8.00\">overloaded_method()</text>\n",
       "<text text-anchor=\"start\" x=\"167.12\" y=\"-22.57\" font-family=\"Helvetica,sans-Serif\" font-size=\"9.00\">Hover over names to see doc</text>\n",
       "</g>\n",
       "</g>\n",
       "</svg>\n"
      ],
      "text/plain": [
       "<graphviz.graphs.Digraph at 0x12e9cb6a0>"
      ]
     },
     "execution_count": 345,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# ignore\n",
    "display_class_hierarchy(SimpleConcolicFuzzer)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### ConcolicGrammarFuzzer\n",
    "\n",
    "The `SimpleConcolicFuzzer` simply explores all paths near the original path traversed by the sample input. It uses a simple mechanism to explore the paths that are near the paths that it knows about, and other than code paths, knows nothing about the input.\n",
    "\n",
    "The `ConcolicGrammarFuzzer` on the other hand, knows about the input grammar, and can collect feedback from the subject under fuzzing. It can lift some constraints encountered to the grammar, enabling deeper fuzzing. It is used as follows:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 346,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.055041Z",
     "iopub.status.busy": "2024-04-27T13:49:22.054829Z",
     "iopub.status.idle": "2024-04-27T13:49:22.057078Z",
     "shell.execute_reply": "2024-04-27T13:49:22.056749Z"
    },
    "slideshow": {
     "slide_type": "skip"
    }
   },
   "outputs": [],
   "source": [
    "from InformationFlow import INVENTORY_GRAMMAR, SQLException"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 347,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.058590Z",
     "iopub.status.busy": "2024-04-27T13:49:22.058467Z",
     "iopub.status.idle": "2024-04-27T13:49:22.147000Z",
     "shell.execute_reply": "2024-04-27T13:49:22.146605Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "insert into W (Ru_2,.Wj186518W8) values ('@','}','h')\n",
      "Table ('W') was not found\n",
      "\n",
      "select S>R(j),A from C3 where U4==9249\n",
      "Table ('C3') was not found\n",
      "\n",
      "select I/I*U/n1(M),T/E*d(S) from months\n",
      "Invalid WHERE ('(I/I*U/n1(M),T/E*d(S))')\n",
      "\n",
      "select (v==X),t,h,E from vehicles where r8(w)<D-e\n",
      "\n",
      "select e!=K,X from a25i where G/S-y<h/P\n",
      "Table ('a25i') was not found\n",
      "\n",
      "select C,: from vehicles where s*u!=W(Y)>B/P(g)\n",
      "\n",
      "select x/z+.(L)-h from vehicles where -9!=Y>G(A)\n",
      "\n",
      "delete from h4OB60J where K-w/M<t*N/A*S\n",
      "Table ('h4OB60J') was not found\n",
      "\n",
      "delete from vehicles where r/v+z*Y+A-k<(q<h)+y\n",
      "Invalid WHERE ('r/v+z*Y+A-k<(q<h)+y')\n",
      "\n",
      "select (V==b),(C>A) from months where B(e,R)>D\n",
      "\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "TypeError: 'NotImplementedType' object is not callable (expected)\n",
      "TypeError: 'NotImplementedType' object is not callable (expected)\n",
      "TypeError: 'NotImplementedType' object is not callable (expected)\n",
      "TypeError: 'NotImplementedType' object is not callable (expected)\n"
     ]
    }
   ],
   "source": [
    "cgf = ConcolicGrammarFuzzer(INVENTORY_GRAMMAR)\n",
    "cgf.prune_tokens(prune_tokens)\n",
    "for i in range(10):\n",
    "    query = cgf.fuzz()\n",
    "    print(query)\n",
    "    with ConcolicTracer() as _:\n",
    "        with ExpectError(print_traceback=False):\n",
    "            try:\n",
    "                res = _[db_select](query)\n",
    "                print(repr(res))\n",
    "            except SQLException as e:\n",
    "                print(e)\n",
    "        cgf.update_grammar(_)\n",
    "        print()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 348,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.148755Z",
     "iopub.status.busy": "2024-04-27T13:49:22.148652Z",
     "iopub.status.idle": "2024-04-27T13:49:22.577726Z",
     "shell.execute_reply": "2024-04-27T13:49:22.577332Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "data": {
      "image/svg+xml": [
       "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>\n",
       "<!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\"\n",
       " \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n",
       "<!-- Generated by graphviz version 9.0.0 (20230911.1827)\n",
       " -->\n",
       "<!-- Pages: 1 -->\n",
       "<svg width=\"318pt\" height=\"444pt\"\n",
       " viewBox=\"0.00 0.00 317.62 443.75\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\">\n",
       "<g id=\"graph0\" class=\"graph\" transform=\"scale(1 1) rotate(0) translate(4 439.75)\">\n",
       "<g id=\"a_graph0\"><a xlink:title=\"ConcolicGrammarFuzzer class hierarchy\">\n",
       "<polygon fill=\"white\" stroke=\"none\" points=\"-4,4 -4,-439.75 313.62,-439.75 313.62,4 -4,4\"/>\n",
       "</a>\n",
       "</g>\n",
       "<!-- ConcolicGrammarFuzzer -->\n",
       "<g id=\"node1\" class=\"node\">\n",
       "<title>ConcolicGrammarFuzzer</title>\n",
       "<g id=\"a_node1\"><a xlink:href=\"#\" xlink:title=\"class ConcolicGrammarFuzzer:&#10;Produce strings from grammars efficiently, using derivation trees.\">\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"5.62,-0.5 5.62,-102 172.38,-102 172.38,-0.5 5.62,-0.5\"/>\n",
       "<text text-anchor=\"start\" x=\"13.62\" y=\"-85.7\" font-family=\"Patua One, Helvetica, sans-serif\" font-weight=\"bold\" font-size=\"14.00\" fill=\"#b03a2e\">ConcolicGrammarFuzzer</text>\n",
       "<polyline fill=\"none\" stroke=\"black\" points=\"5.62,-76 172.38,-76\"/>\n",
       "<g id=\"a_node1_0\"><a xlink:href=\"#\" xlink:title=\"ConcolicGrammarFuzzer\">\n",
       "<g id=\"a_node1_1\"><a xlink:href=\"#\" xlink:title=\"fuzz(self):&#10;Produce a string from the grammar.\">\n",
       "<text text-anchor=\"start\" x=\"41\" y=\"-63.5\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-style=\"italic\" font-size=\"10.00\">fuzz()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_2\"><a xlink:href=\"#\" xlink:title=\"coalesce(self, children)\">\n",
       "<text text-anchor=\"start\" x=\"41\" y=\"-51.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"10.00\">coalesce()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_3\"><a xlink:href=\"#\" xlink:title=\"prune_tokens(self, tokens)\">\n",
       "<text text-anchor=\"start\" x=\"41\" y=\"-40\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"10.00\">prune_tokens()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_4\"><a xlink:href=\"#\" xlink:title=\"prune_tree(self, tree, tokens)\">\n",
       "<text text-anchor=\"start\" x=\"41\" y=\"-28.75\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"10.00\">prune_tree()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_5\"><a xlink:href=\"#\" xlink:title=\"tree_to_string(self, tree)\">\n",
       "<text text-anchor=\"start\" x=\"41\" y=\"-17.5\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"10.00\">tree_to_string()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node1_6\"><a xlink:href=\"#\" xlink:title=\"update_grammar(self, trace)\">\n",
       "<text text-anchor=\"start\" x=\"41\" y=\"-6.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"10.00\">update_grammar()</text>\n",
       "</a>\n",
       "</g>\n",
       "</a>\n",
       "</g>\n",
       "</a>\n",
       "</g>\n",
       "</g>\n",
       "<!-- GrammarFuzzer -->\n",
       "<g id=\"node2\" class=\"node\">\n",
       "<title>GrammarFuzzer</title>\n",
       "<g id=\"a_node2\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"class GrammarFuzzer:&#10;Produce strings from grammars efficiently, using derivation trees.\">\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"0,-139 0,-319.25 178,-319.25 178,-139 0,-139\"/>\n",
       "<text text-anchor=\"start\" x=\"39.12\" y=\"-302.95\" font-family=\"Patua One, Helvetica, sans-serif\" font-weight=\"bold\" font-size=\"14.00\" fill=\"#b03a2e\">GrammarFuzzer</text>\n",
       "<polyline fill=\"none\" stroke=\"black\" points=\"0,-293.25 178,-293.25\"/>\n",
       "<g id=\"a_node2_7\"><a xlink:href=\"#\" xlink:title=\"GrammarFuzzer\">\n",
       "<g id=\"a_node2_8\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"__init__(self, grammar: Dict[str, List[Union[str, Tuple[str, Dict[str, Any]]]]], start_symbol: str = &#39;&lt;start&gt;&#39;, min_nonterminals: int = 0, max_nonterminals: int = 10, disp: bool = False, log: Union[bool, int] = False) &#45;&gt; None:&#10;Produce strings from `grammar`, starting with `start_symbol`.&#10;If `min_nonterminals` or `max_nonterminals` is given, use them as limits&#10;for the number of nonterminals produced.&#10;If `disp` is set, display the intermediate derivation trees.&#10;If `log` is set, show intermediate steps as text on standard output.\">\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-280.75\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-style=\"italic\" font-size=\"10.00\">__init__()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_9\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"check_grammar(self) &#45;&gt; None:&#10;Check the grammar passed\">\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-269.5\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">check_grammar()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_10\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"choose_node_expansion(self, node: Tuple[str, Optional[List[Any]]], children_alternatives: List[List[Tuple[str, Optional[List[Any]]]]]) &#45;&gt; int:&#10;Return index of expansion in `children_alternatives` to be selected.&#10;&#39;children_alternatives`: a list of possible children for `node`.&#10;Defaults to random. To be overloaded in subclasses.\">\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-258.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-style=\"italic\" font-size=\"10.00\">choose_node_expansion()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_11\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"choose_tree_expansion(self, tree: Tuple[str, Optional[List[Any]]], children: List[Tuple[str, Optional[List[Any]]]]) &#45;&gt; int:&#10;Return index of subtree in `children` to be selected for expansion.&#10;Defaults to random.\">\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-247\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">choose_tree_expansion()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_12\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"expand_node_randomly(self, node: Tuple[str, Optional[List[Any]]]) &#45;&gt; Tuple[str, Optional[List[Any]]]:&#10;Choose a random expansion for `node` and return it\">\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-235.75\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">expand_node_randomly()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_13\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"expand_tree(self, tree: Tuple[str, Optional[List[Any]]]) &#45;&gt; Tuple[str, Optional[List[Any]]]:&#10;Expand `tree` in a three&#45;phase strategy until all expansions are complete.\">\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-224.5\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">expand_tree()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_14\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"expand_tree_once(self, tree: Tuple[str, Optional[List[Any]]]) &#45;&gt; Tuple[str, Optional[List[Any]]]:&#10;Choose an unexpanded symbol in tree; expand it.&#10;Can be overloaded in subclasses.\">\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-213.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-style=\"italic\" font-size=\"10.00\">expand_tree_once()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_15\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"expand_tree_with_strategy(self, tree: Tuple[str, Optional[List[Any]]], expand_node_method: Callable, limit: Optional[int] = None):&#10;Expand tree using `expand_node_method` as node expansion function&#10;until the number of possible expansions reaches `limit`.\">\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-202\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">expand_tree_with_strategy()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_16\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"fuzz(self) &#45;&gt; str:&#10;Produce a string from the grammar.\">\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-190.75\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-style=\"italic\" font-size=\"10.00\">fuzz()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_17\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"fuzz_tree(self) &#45;&gt; Tuple[str, Optional[List[Any]]]:&#10;Produce a derivation tree from the grammar.\">\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-179.5\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">fuzz_tree()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_18\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"log_tree(self, tree: Tuple[str, Optional[List[Any]]]) &#45;&gt; None:&#10;Output a tree if self.log is set; if self.display is also set, show the tree structure\">\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-168.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">log_tree()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_19\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"process_chosen_children(self, chosen_children: List[Tuple[str, Optional[List[Any]]]], expansion: Union[str, Tuple[str, Dict[str, Any]]]) &#45;&gt; List[Tuple[str, Optional[List[Any]]]]:&#10;Process children after selection. &#160;By default, does nothing.\">\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-157\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">process_chosen_children()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node2_20\"><a xlink:href=\"GrammarFuzzer.ipynb\" xlink:title=\"supported_opts(self) &#45;&gt; Set[str]:&#10;Set of supported options. To be overloaded in subclasses.\">\n",
       "<text text-anchor=\"start\" x=\"8\" y=\"-145.75\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-style=\"italic\" font-size=\"10.00\">supported_opts()</text>\n",
       "</a>\n",
       "</g>\n",
       "</a>\n",
       "</g>\n",
       "</a>\n",
       "</g>\n",
       "</g>\n",
       "<!-- ConcolicGrammarFuzzer&#45;&gt;GrammarFuzzer -->\n",
       "<g id=\"edge1\" class=\"edge\">\n",
       "<title>ConcolicGrammarFuzzer&#45;&gt;GrammarFuzzer</title>\n",
       "<path fill=\"none\" stroke=\"black\" d=\"M89,-102.18C89,-110.16 89,-118.65 89,-127.32\"/>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"85.5,-127.27 89,-137.27 92.5,-127.27 85.5,-127.27\"/>\n",
       "</g>\n",
       "<!-- Fuzzer -->\n",
       "<g id=\"node3\" class=\"node\">\n",
       "<title>Fuzzer</title>\n",
       "<g id=\"a_node3\"><a xlink:href=\"Fuzzer.ipynb\" xlink:title=\"class Fuzzer:&#10;Base class for fuzzers.\">\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"51,-356.25 51,-435.25 127,-435.25 127,-356.25 51,-356.25\"/>\n",
       "<text text-anchor=\"start\" x=\"68.38\" y=\"-418.95\" font-family=\"Patua One, Helvetica, sans-serif\" font-weight=\"bold\" font-size=\"14.00\" fill=\"#b03a2e\">Fuzzer</text>\n",
       "<polyline fill=\"none\" stroke=\"black\" points=\"51,-409.25 127,-409.25\"/>\n",
       "<g id=\"a_node3_21\"><a xlink:href=\"#\" xlink:title=\"Fuzzer\">\n",
       "<g id=\"a_node3_22\"><a xlink:href=\"Fuzzer.ipynb\" xlink:title=\"__init__(self) &#45;&gt; None:&#10;Constructor\">\n",
       "<text text-anchor=\"start\" x=\"59\" y=\"-396.75\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-style=\"italic\" font-size=\"10.00\">__init__()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node3_23\"><a xlink:href=\"Fuzzer.ipynb\" xlink:title=\"fuzz(self) &#45;&gt; str:&#10;Return fuzz input\">\n",
       "<text text-anchor=\"start\" x=\"59\" y=\"-385.5\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-style=\"italic\" font-size=\"10.00\">fuzz()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node3_24\"><a xlink:href=\"Fuzzer.ipynb\" xlink:title=\"run(self, runner: Fuzzer.Runner = &lt;Fuzzer.Runner object at 0x1065d9ff0&gt;) &#45;&gt; Tuple[subprocess.CompletedProcess, str]:&#10;Run `runner` with fuzz input\">\n",
       "<text text-anchor=\"start\" x=\"59\" y=\"-374.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">run()</text>\n",
       "</a>\n",
       "</g>\n",
       "<g id=\"a_node3_25\"><a xlink:href=\"Fuzzer.ipynb\" xlink:title=\"runs(self, runner: Fuzzer.Runner = &lt;Fuzzer.PrintRunner object at 0x1065d9d50&gt;, trials: int = 10) &#45;&gt; List[Tuple[subprocess.CompletedProcess, str]]:&#10;Run `runner` with fuzz input, `trials` times\">\n",
       "<text text-anchor=\"start\" x=\"59\" y=\"-363\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"10.00\">runs()</text>\n",
       "</a>\n",
       "</g>\n",
       "</a>\n",
       "</g>\n",
       "</a>\n",
       "</g>\n",
       "</g>\n",
       "<!-- GrammarFuzzer&#45;&gt;Fuzzer -->\n",
       "<g id=\"edge2\" class=\"edge\">\n",
       "<title>GrammarFuzzer&#45;&gt;Fuzzer</title>\n",
       "<path fill=\"none\" stroke=\"black\" d=\"M89,-319.66C89,-328.18 89,-336.58 89,-344.52\"/>\n",
       "<polygon fill=\"none\" stroke=\"black\" points=\"85.5,-344.26 89,-354.26 92.5,-344.26 85.5,-344.26\"/>\n",
       "</g>\n",
       "<!-- Legend -->\n",
       "<g id=\"node4\" class=\"node\">\n",
       "<title>Legend</title>\n",
       "<text text-anchor=\"start\" x=\"190.38\" y=\"-67.25\" font-family=\"Patua One, Helvetica, sans-serif\" font-weight=\"bold\" font-size=\"10.00\" fill=\"#b03a2e\">Legend</text>\n",
       "<text text-anchor=\"start\" x=\"190.38\" y=\"-57.25\" font-family=\"Patua One, Helvetica, sans-serif\" font-size=\"10.00\">• </text>\n",
       "<text text-anchor=\"start\" x=\"196.38\" y=\"-57.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-weight=\"bold\" font-size=\"8.00\">public_method()</text>\n",
       "<text text-anchor=\"start\" x=\"190.38\" y=\"-47.25\" font-family=\"Patua One, Helvetica, sans-serif\" font-size=\"10.00\">• </text>\n",
       "<text text-anchor=\"start\" x=\"196.38\" y=\"-47.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-size=\"8.00\">private_method()</text>\n",
       "<text text-anchor=\"start\" x=\"190.38\" y=\"-37.25\" font-family=\"Patua One, Helvetica, sans-serif\" font-size=\"10.00\">• </text>\n",
       "<text text-anchor=\"start\" x=\"196.38\" y=\"-37.25\" font-family=\"'Fira Mono', 'Source Code Pro', 'Courier', monospace\" font-style=\"italic\" font-size=\"8.00\">overloaded_method()</text>\n",
       "<text text-anchor=\"start\" x=\"190.38\" y=\"-28.2\" font-family=\"Helvetica,sans-Serif\" font-size=\"9.00\">Hover over names to see doc</text>\n",
       "</g>\n",
       "</g>\n",
       "</svg>\n"
      ],
      "text/plain": [
       "<graphviz.graphs.Digraph at 0x12d5fad40>"
      ]
     },
     "execution_count": 348,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# ignore\n",
    "display_class_hierarchy(ConcolicGrammarFuzzer)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "button": false,
    "new_sheet": true,
    "run_control": {
     "read_only": false
    },
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Lessons Learned\n",
    "\n",
    "* Concolic execution can often provide more information than taint analysis with respect to the program behavior. However, this comes at a much larger runtime cost. Hence, unlike taint analysis, real-time analysis is often not possible.\n",
    "\n",
    "* Similar to taint analysis, concolic execution also suffers from limitations such as indirect control flow and internal function calls.\n",
    "\n",
    "* Predicates from concolic execution can be used in conjunction with fuzzing to provide an even more robust indication of incorrect behavior than taints, and can be used to create grammars that are better at producing valid inputs."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "button": false,
    "new_sheet": false,
    "run_control": {
     "read_only": false
    },
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Next Steps\n",
    "\n",
    "A costlier but stronger alternative to concolic fuzzing is [symbolic fuzzing](SymbolicFuzzer.ipynb). Similarly, [search based fuzzing](SearchBasedFuzzer.ipynb) can often provide a cheaper exploration strategy than relying on SMT solvers to provide inputs slightly different from the current path."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Background\n",
    "\n",
    "The technique of concolic execution was originally used to inform and expand the scope of _symbolic execution_ \\cite{king1976symbolic}, a static analysis technique for program analysis. Laron et al. cite{Larson2003} was the first to use the concolic execution technique.\n",
    "\n",
    "The idea of using proxy objects for collecting constraints was pioneered by Cadar et al. \\cite{cadar2005execution}. The concolic execution technique for Python programs used in this chapter was pioneered by PeerCheck \\cite{PeerCheck}, and Python Error Finder \\cite{Barsotti2018}."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "button": false,
    "new_sheet": true,
    "run_control": {
     "read_only": false
    },
    "slideshow": {
     "slide_type": "slide"
    }
   },
   "source": [
    "## Exercises"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Exercise 1: Implment a Concolic Float Proxy Class\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "While implementing the `zint` binary operators, we asserted that the results were `int`. However, that need not be the case. For example, division can result in `float`. Hence, we need proxy objects for `float`. Can you implement a similar proxy object for `float` and fix the `zint` binary operator definition?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "__Solution.__ The solution is as follows."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "As in the case of `zint`, we first open up `zfloat` for extension."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 349,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.579870Z",
     "iopub.status.busy": "2024-04-27T13:49:22.579738Z",
     "iopub.status.idle": "2024-04-27T13:49:22.581989Z",
     "shell.execute_reply": "2024-04-27T13:49:22.581672Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zfloat(float):\n",
    "    def __new__(cls, context, zn, v, *args, **kw):\n",
    "        return float.__new__(cls, v, *args, **kw)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We then implement the initialization methods."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 350,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.583614Z",
     "iopub.status.busy": "2024-04-27T13:49:22.583503Z",
     "iopub.status.idle": "2024-04-27T13:49:22.585924Z",
     "shell.execute_reply": "2024-04-27T13:49:22.585571Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zfloat(zfloat):\n",
    "    @classmethod\n",
    "    def create(cls, context, zn, v=None):\n",
    "        return zproxy_create(cls, 'Real', z3.Real, context, zn, v)\n",
    "\n",
    "    def __init__(self, context, z, v=None):\n",
    "        self.z, self.v = z, v\n",
    "        self.context = context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The helper for when one of the arguments in a binary operation is not `float`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 351,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.588004Z",
     "iopub.status.busy": "2024-04-27T13:49:22.587812Z",
     "iopub.status.idle": "2024-04-27T13:49:22.589907Z",
     "shell.execute_reply": "2024-04-27T13:49:22.589636Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zfloat(zfloat):\n",
    "    def _zv(self, o):\n",
    "        return (o.z, o.v) if isinstance(o, zfloat) else (z3.RealVal(o), o)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Coerce `float` into bool value for use in conditionals."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 352,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.591567Z",
     "iopub.status.busy": "2024-04-27T13:49:22.591459Z",
     "iopub.status.idle": "2024-04-27T13:49:22.593406Z",
     "shell.execute_reply": "2024-04-27T13:49:22.593032Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "class zfloat(zfloat):\n",
    "    def __bool__(self):\n",
    "        # force registering boolean condition\n",
    "        if self != 0.0:\n",
    "            return True\n",
    "        return False"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Define the common proxy method for comparison methods"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 353,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.595222Z",
     "iopub.status.busy": "2024-04-27T13:49:22.594981Z",
     "iopub.status.idle": "2024-04-27T13:49:22.597474Z",
     "shell.execute_reply": "2024-04-27T13:49:22.597121Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def make_float_bool_wrapper(fname, fun, zfun):\n",
    "    def proxy(self, other):\n",
    "        z, v = self._zv(other)\n",
    "        z_ = zfun(self.z, z)\n",
    "        v_ = fun(self.v, v)\n",
    "        return zbool(self.context, z_, v_)\n",
    "\n",
    "    return proxy"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We apply the comparison methods on the defined `zfloat` class."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 354,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.599255Z",
     "iopub.status.busy": "2024-04-27T13:49:22.599064Z",
     "iopub.status.idle": "2024-04-27T13:49:22.601274Z",
     "shell.execute_reply": "2024-04-27T13:49:22.600884Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "FLOAT_BOOL_OPS = [\n",
    "    '__eq__',\n",
    "    # '__req__',\n",
    "    '__ne__',\n",
    "    # '__rne__',\n",
    "    '__gt__',\n",
    "    '__lt__',\n",
    "    '__le__',\n",
    "    '__ge__',\n",
    "]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 355,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.602709Z",
     "iopub.status.busy": "2024-04-27T13:49:22.602608Z",
     "iopub.status.idle": "2024-04-27T13:49:22.604576Z",
     "shell.execute_reply": "2024-04-27T13:49:22.604195Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "for fname in FLOAT_BOOL_OPS:\n",
    "    fun = getattr(float, fname)\n",
    "    zfun = getattr(z3.ArithRef, fname)\n",
    "    setattr(zfloat, fname, make_float_bool_wrapper(fname, fun, zfun))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "Similarly, we define the common proxy method for binary operators."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 356,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.606049Z",
     "iopub.status.busy": "2024-04-27T13:49:22.605946Z",
     "iopub.status.idle": "2024-04-27T13:49:22.608551Z",
     "shell.execute_reply": "2024-04-27T13:49:22.608138Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "def make_float_binary_wrapper(fname, fun, zfun):\n",
    "    def proxy(self, other):\n",
    "        z, v = self._zv(other)\n",
    "        z_ = zfun(self.z, z)\n",
    "        v_ = fun(self.v, v)\n",
    "        return zfloat(self.context, z_, v_)\n",
    "\n",
    "    return proxy"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "And apply them on `zfloat`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 357,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.610163Z",
     "iopub.status.busy": "2024-04-27T13:49:22.610055Z",
     "iopub.status.idle": "2024-04-27T13:49:22.612123Z",
     "shell.execute_reply": "2024-04-27T13:49:22.611826Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "FLOAT_BINARY_OPS = [\n",
    "    '__add__',\n",
    "    '__sub__',\n",
    "    '__mul__',\n",
    "    '__truediv__',\n",
    "    # '__div__',\n",
    "    '__mod__',\n",
    "    # '__divmod__',\n",
    "    '__pow__',\n",
    "    # '__lshift__',\n",
    "    # '__rshift__',\n",
    "    # '__and__',\n",
    "    # '__xor__',\n",
    "    # '__or__',\n",
    "    '__radd__',\n",
    "    '__rsub__',\n",
    "    '__rmul__',\n",
    "    '__rtruediv__',\n",
    "    # '__rdiv__',\n",
    "    '__rmod__',\n",
    "    # '__rdivmod__',\n",
    "    '__rpow__',\n",
    "    # '__rlshift__',\n",
    "    # '__rrshift__',\n",
    "    # '__rand__',\n",
    "    # '__rxor__',\n",
    "    # '__ror__',\n",
    "]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 358,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.613728Z",
     "iopub.status.busy": "2024-04-27T13:49:22.613625Z",
     "iopub.status.idle": "2024-04-27T13:49:22.615464Z",
     "shell.execute_reply": "2024-04-27T13:49:22.615094Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "for fname in FLOAT_BINARY_OPS:\n",
    "    fun = getattr(float, fname)\n",
    "    zfun = getattr(z3.ArithRef, fname)\n",
    "    setattr(zfloat, fname, make_float_binary_wrapper(fname, fun, zfun))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "These are used as follows."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 359,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.617018Z",
     "iopub.status.busy": "2024-04-27T13:49:22.616918Z",
     "iopub.status.idle": "2024-04-27T13:49:22.619632Z",
     "shell.execute_reply": "2024-04-27T13:49:22.619319Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    za = zfloat.create(_.context, 'float_a', 1.0)\n",
    "    zb = zfloat.create(_.context, 'float_b', 0.0)\n",
    "    if za * zb:\n",
    "        print(1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 360,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.621158Z",
     "iopub.status.busy": "2024-04-27T13:49:22.621050Z",
     "iopub.status.idle": "2024-04-27T13:49:22.624209Z",
     "shell.execute_reply": "2024-04-27T13:49:22.623921Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "({'float_a': 'Real', 'float_b': 'Real'}, [Not(float_a*float_b != 0)])"
      ]
     },
     "execution_count": 360,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.context"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Finally, we fix the `zint` binary wrapper to correctly create `zfloat` when needed."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 361,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.625761Z",
     "iopub.status.busy": "2024-04-27T13:49:22.625671Z",
     "iopub.status.idle": "2024-04-27T13:49:22.628431Z",
     "shell.execute_reply": "2024-04-27T13:49:22.628173Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def make_int_binary_wrapper(fname, fun, zfun):  # type: ignore\n",
    "    def proxy(self, other):\n",
    "        z, v = self._zv(other)\n",
    "        z_ = zfun(self.z, z)\n",
    "        v_ = fun(self.v, v)\n",
    "        if isinstance(v_, float):\n",
    "            return zfloat(self.context, z_, v_)\n",
    "        elif isinstance(v_, int):\n",
    "            return zint(self.context, z_, v_)\n",
    "        else:\n",
    "            assert False\n",
    "\n",
    "    return proxy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 362,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.629950Z",
     "iopub.status.busy": "2024-04-27T13:49:22.629867Z",
     "iopub.status.idle": "2024-04-27T13:49:22.631746Z",
     "shell.execute_reply": "2024-04-27T13:49:22.631488Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "for fname in INT_BINARY_OPS:\n",
    "    fun = getattr(int, fname)\n",
    "    zfun = getattr(z3.ArithRef, fname)\n",
    "    setattr(zint, fname, make_int_binary_wrapper(fname, fun, zfun))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Checking whether it worked as expected."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 363,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.633270Z",
     "iopub.status.busy": "2024-04-27T13:49:22.633186Z",
     "iopub.status.idle": "2024-04-27T13:49:22.636988Z",
     "shell.execute_reply": "2024-04-27T13:49:22.636728Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    v = _[binomial](4, 2)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 364,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.638384Z",
     "iopub.status.busy": "2024-04-27T13:49:22.638293Z",
     "iopub.status.idle": "2024-04-27T13:49:22.661646Z",
     "shell.execute_reply": "2024-04-27T13:49:22.661256Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('sat', {'n': ('4', 'Int'), 'k': ('2', 'Int')})"
      ]
     },
     "execution_count": 364,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Exercise 2: Bit Manipulation"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Similar to floats, implementing the bit manipulation functions such as `xor` involves converting `int` to its bit vector equivalents, performing operations on them, and converting it back to the original type. Can you implement the bit manipulation operations for `zint`?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "__Solution.__ The solution is as follows."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We first define the proxy method as before."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 365,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.663528Z",
     "iopub.status.busy": "2024-04-27T13:49:22.663403Z",
     "iopub.status.idle": "2024-04-27T13:49:22.665826Z",
     "shell.execute_reply": "2024-04-27T13:49:22.665557Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def make_int_bit_wrapper(fname, fun, zfun):\n",
    "    def proxy(self, other):\n",
    "        z, v = self._zv(other)\n",
    "        z_ = z3.BV2Int(\n",
    "            zfun(\n",
    "                z3.Int2BV(\n",
    "                    self.z, num_bits=64), z3.Int2BV(\n",
    "                    z, num_bits=64)))\n",
    "        v_ = fun(self.v, v)\n",
    "        return zint(self.context, z_, v_)\n",
    "\n",
    "    return proxy"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "It is then applied to the `zint` class."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 366,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.667432Z",
     "iopub.status.busy": "2024-04-27T13:49:22.667298Z",
     "iopub.status.idle": "2024-04-27T13:49:22.669242Z",
     "shell.execute_reply": "2024-04-27T13:49:22.668953Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "BIT_OPS = [\n",
    "    '__lshift__',\n",
    "    '__rshift__',\n",
    "    '__and__',\n",
    "    '__xor__',\n",
    "    '__or__',\n",
    "    '__rlshift__',\n",
    "    '__rrshift__',\n",
    "    '__rand__',\n",
    "    '__rxor__',\n",
    "    '__ror__',\n",
    "]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 367,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.670720Z",
     "iopub.status.busy": "2024-04-27T13:49:22.670605Z",
     "iopub.status.idle": "2024-04-27T13:49:22.672955Z",
     "shell.execute_reply": "2024-04-27T13:49:22.672679Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def init_concolic_4():\n",
    "    for fname in BIT_OPS:\n",
    "        fun = getattr(int, fname)\n",
    "        zfun = getattr(z3.BitVecRef, fname)\n",
    "        setattr(zint, fname, make_int_bit_wrapper(fname, fun, zfun))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 368,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.674568Z",
     "iopub.status.busy": "2024-04-27T13:49:22.674446Z",
     "iopub.status.idle": "2024-04-27T13:49:22.676301Z",
     "shell.execute_reply": "2024-04-27T13:49:22.676021Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "INITIALIZER_LIST.append(init_concolic_4)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 369,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.677853Z",
     "iopub.status.busy": "2024-04-27T13:49:22.677721Z",
     "iopub.status.idle": "2024-04-27T13:49:22.679459Z",
     "shell.execute_reply": "2024-04-27T13:49:22.679166Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "init_concolic_4()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Invert is the only unary bit manipulation method."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 370,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.680939Z",
     "iopub.status.busy": "2024-04-27T13:49:22.680833Z",
     "iopub.status.idle": "2024-04-27T13:49:22.682750Z",
     "shell.execute_reply": "2024-04-27T13:49:22.682497Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [],
   "source": [
    "class zint(zint):\n",
    "    def __invert__(self):\n",
    "        return zint(self.context, z3.BV2Int(\n",
    "            ~z3.Int2BV(self.z, num_bits=64)), ~self.v)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "The `my_fn()` computes `xor` and returns `True` if the `xor` results in a non-zero value."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 371,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.684181Z",
     "iopub.status.busy": "2024-04-27T13:49:22.684077Z",
     "iopub.status.idle": "2024-04-27T13:49:22.686112Z",
     "shell.execute_reply": "2024-04-27T13:49:22.685846Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [],
   "source": [
    "def my_fn(a, b):\n",
    "    o_ = (a | b)\n",
    "    a_ = (a & b)\n",
    "    if o_ & ~a_:\n",
    "        return True\n",
    "    else:\n",
    "        return False"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "Using that under `ConcolicTracer`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 372,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.687620Z",
     "iopub.status.busy": "2024-04-27T13:49:22.687496Z",
     "iopub.status.idle": "2024-04-27T13:49:22.690484Z",
     "shell.execute_reply": "2024-04-27T13:49:22.690230Z"
    },
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "True\n"
     ]
    }
   ],
   "source": [
    "with ConcolicTracer() as _:\n",
    "    print(_[my_fn](2, 1))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We log the computed SMT expression to verify that everything went well."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 373,
   "metadata": {
    "execution": {
     "iopub.execute_input": "2024-04-27T13:49:22.692099Z",
     "iopub.status.busy": "2024-04-27T13:49:22.691989Z",
     "iopub.status.idle": "2024-04-27T13:49:23.134972Z",
     "shell.execute_reply": "2024-04-27T13:49:23.134490Z"
    },
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Predicates in path:\n",
      "0 0 !=\n",
      "BV2Int(int2bv(BV2Int(int2bv(my_fn_a_int_1) |\n",
      "                     int2bv(my_fn_b_int_2))) &\n",
      "       int2bv(BV2Int(~int2bv(BV2Int(int2bv(my_fn_a_int_1) &\n",
      "                                    int2bv(my_fn_b_int_2))))))\n",
      "\n",
      "(declare-const my_fn_a_int_1 Int)\n",
      "(declare-const my_fn_b_int_2 Int)\n",
      "(assert (let ((a!1 (bvnot (bvor (bvnot ((_ int2bv 64) my_fn_a_int_1))\n",
      "                        (bvnot ((_ int2bv 64) my_fn_b_int_2))))))\n",
      "(let ((a!2 (bvor (bvnot (bvor ((_ int2bv 64) my_fn_a_int_1)\n",
      "                              ((_ int2bv 64) my_fn_b_int_2)))\n",
      "                 a!1)))\n",
      "  (not (= 0 (bv2int (bvnot a!2)))))))\n",
      "(check-sat)\n",
      "(get-model)\n",
      "\n",
      "z3 -t:6000 /var/folders/n2/xd9445p97rb3xh7m1dfx8_4h0006ts/T/tmp1xln0vsb.smt\n",
      "sat\n",
      "(\n",
      "  (define-fun my_fn_a_int_1 () Int\n",
      "    (- 1))\n",
      "  (define-fun my_fn_b_int_2 () Int\n",
      "    (- 9223372036854775809))\n",
      ")\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "('sat', {'a': (['-', '1'], 'Int'), 'b': (['-', '9223372036854775809'], 'Int')})"
      ]
     },
     "execution_count": 373,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "_.zeval(log=True)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "We can confirm from the formulas generated that the bit manipulation functions worked correctly. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "subslide"
    }
   },
   "source": [
    "### Exercise 3: String Translation Functions"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "We have seen how to define `upper()` and `lower()`. Can you define the `capitalize()`, `title()`, and `swapcase()` methods?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {
    "slideshow": {
     "slide_type": "fragment"
    }
   },
   "source": [
    "__Solution.__ Solution not yet available."
   ]
  }
 ],
 "metadata": {
  "ipub": {
   "bibliography": "fuzzingbook.bib",
   "toc": true
  },
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.2"
  },
  "toc": {
   "base_numbering": 1,
   "nav_menu": {},
   "number_sections": true,
   "sideBar": true,
   "skip_h1_title": true,
   "title_cell": "",
   "title_sidebar": "Contents",
   "toc_cell": false,
   "toc_position": {},
   "toc_section_display": true,
   "toc_window_display": true
  },
  "toc-autonumbering": false,
  "varInspector": {
   "cols": {
    "lenName": 16,
    "lenType": 16,
    "lenVar": 40
   },
   "kernels_config": {
    "python": {
     "delete_cmd_postfix": "",
     "delete_cmd_prefix": "del ",
     "library": "var_list.py",
     "varRefreshCmd": "print(var_dic_list())"
    },
    "r": {
     "delete_cmd_postfix": ") ",
     "delete_cmd_prefix": "rm(",
     "library": "var_list.r",
     "varRefreshCmd": "cat(var_dic_list()) "
    }
   },
   "types_to_exclude": [
    "module",
    "function",
    "builtin_function_or_method",
    "instance",
    "_Feature"
   ],
   "window_display": false
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}