package bap-std
Regular
interface for BIL expressions
type t = Bil.exp
val slot : (Bap_core_theory.Theory.Value.cls, exp) Bap_core_theory.KB.slot
the Exp.t property.
This property of a value denotes it in terms of Bil expressions.
class state : object ... end
All visitors provide some information about the current position of the visitor
class 'a visitor : object ... end
expression visitor.
class 'a finder : object ... end
A visitor with a shortcut. Finder is a specialization of a visitor, that uses return
as its folding argument. At any time you can stop the traversing by calling return
function of the provided argument (which is by itself is a record with one field - a function accepting argument of type 'a option
).
class mapper : object ... end
Exp mapper. By default performs deep identity mapping. Non-leaf methods deconstructs terms, calls corresponding methods on its parts and the constructs it back. So if you're overriding a non-leaf method, then make sure that you called the parent method if you want a normal traversal.
fold visitor ~init exp
traverse the exp
tree with provided visitor
. For example, the following will collect all address that are accessed with a load operation: {
let collect_load_addresses = Exp.fold ~init:[] (object
inherit [word list] Bil.visitor
method! enter_load ~mem ~addr _ _ addrs =
match addr with
| Bil.Int addr -> addr :: addrs
| _ -> addrs
end)
}
See also Bil.fold
and Stmt.fold
iter visitor exp
iterates over all terms of the exp
using provided visitor. See also Bil.iter
and Stmt.iter
find finder exp
returns Some thing
if finder finds some thing
. See also Bil.find
and Stmt.find
exists finder exp
is true
if finder
finds something. See also Bil.exists
and Stmt.exists
substitute pat rep x
subsitutes each occurrence of an expression pat
in x
with an expression rep
normalize x
ensures no-lets and normalized-memory (BNF2).
Inlines all let expressions, expands multibyte loads to a concatenation of one byte loads, and expands multibyte stores into chains of one byte stores.
The function may duplicate expressions even those that are not generative, thus breaking the semantics of the expression.
Precondition: x
is well-typed and in BNF1.
See Stmt.normalize
for the definition of the BNF1 and BNF2.
simpl ~ignore:effects x
iff expression x
is well-typed, then returns an expression with the same semantics as x
, that might smaller according to some metrics. A subexression is removed from x
if it doesn't manifest any effects other than those that are specified with the ~ignore:effects
parameter (defaults to an empty list).
The following code simplification are applied:
- constant folding: if an expression can be computed statically then it is substituted with the result of computation, e.g.,
1 + 2 -> 3
- neutral element elimination: binary operations with one of the operands being known to be neutral, are substituted with the other operand, e.g.,
x * 1 -> x
- zero element propagation: binary operations applied to a zero element are substituted with the zero element, e.g.,
x * 0 -> 0
- symbolic equality reduction: if both branches of a comparison are syntactically equal then the comparison is reduced to a boolean constant, e.g.,
a = a -> true
,a < a -> false
. Note, by default a read from a register is considered as a (co)effect, hence the above transformations wouldn't be applied, consider passing~ignore:[Eff.reads]
if you want such expressions to be reduced.
- double complement reduction: an odd amount of complement operations (one and two) are reduced to one complement of the same sort, e.g.,
~~~1 -> ~1
- binary to unary reduction: reduce a subtraction from zero to the unary negation, e.g.,
0 - x -> -x
- exclusive disjunction reduction: reduces an exclusive disjunction of syntactically equal expressions to zero, e.g,
42 ^ 42 -> 0
. Note, by default a read from a register is considered as a (co)effect, thusxor eax eax
is not reduced, consider passing~ignore:[Eff.reads]
if you want such expressions to be reduced.
is_referenced x exp
true if exp
contains Var x
on one of its leafs. See also Bil.is_referenced
and Stmt.is_referenced
normalize_negatives exp
returns an exp where all negative additions are substituted by subtractions. See Bil.normalize_negatives
for more details
fold_consts x
performs constant folding of the expression x
.
Reduces all computable expressions to integers.
See also Bil.fold_consts
fixpoint f
applies transformation f
to t
until it reaches a fixpoint, i.e., such point x
that f x
= f (f x)
. See also Bil.fixpoint
and Stmt.fixpoint
free_vars exp
returns a set of all unbound variables, that occurs in the expression exp
.
include Regular.Std.Regular.S with type t := t
val bin_size_t : t Bin_prot.Size.sizer
val bin_write_t : t Bin_prot.Write.writer
val bin_read_t : t Bin_prot.Read.reader
val __bin_read_t__ : (int -> t) Bin_prot.Read.reader
val bin_writer_t : t Bin_prot.Type_class.writer
val bin_reader_t : t Bin_prot.Type_class.reader
val bin_t : t Bin_prot.Type_class.t
val t_of_sexp : Sexplib0__.Sexp.t -> t
val sexp_of_t : t -> Sexplib0__.Sexp.t
val to_string : t -> string
val str : unit -> t -> string
val pps : unit -> t -> string
val ppo : Core_kernel.Out_channel.t -> t -> unit
val pp_seq : Stdlib.Format.formatter -> t Core_kernel.Sequence.t -> unit
val pp : Base__.Formatter.t -> t -> unit
module Replace_polymorphic_compare : sig ... end
val comparator : (t, comparator_witness) Core_kernel__Comparator.comparator
module Map : sig ... end
module Set : sig ... end
val hash_fold_t :
Ppx_hash_lib.Std.Hash.state ->
t ->
Ppx_hash_lib.Std.Hash.state
val hash : t -> Ppx_hash_lib.Std.Hash.hash_value
val hashable : t Core_kernel__.Hashtbl.Hashable.t
module Table : sig ... end
module Hash_set : sig ... end
module Hash_queue : sig ... end
val size_in_bytes : ?ver:string -> ?fmt:string -> t -> int
val of_bytes : ?ver:string -> ?fmt:string -> Regular.Std.bytes -> t
val to_bytes : ?ver:string -> ?fmt:string -> t -> Regular.Std.bytes
val blit_to_bytes :
?ver:string ->
?fmt:string ->
Regular.Std.bytes ->
t ->
int ->
unit
val of_bigstring : ?ver:string -> ?fmt:string -> Core_kernel.bigstring -> t
val to_bigstring : ?ver:string -> ?fmt:string -> t -> Core_kernel.bigstring
val blit_to_bigstring :
?ver:string ->
?fmt:string ->
Core_kernel.bigstring ->
t ->
int ->
unit
module Io : sig ... end
module Cache : sig ... end
val add_reader :
?desc:string ->
ver:string ->
string ->
t Regular.Std.reader ->
unit
val add_writer :
?desc:string ->
ver:string ->
string ->
t Regular.Std.writer ->
unit
val available_readers : unit -> info list
val default_reader : unit -> info
val available_writers : unit -> info list
val default_writer : unit -> info
val default_printer : unit -> info option
val find_reader : ?ver:string -> string -> t Regular.Std.reader option
val find_writer : ?ver:string -> string -> t Regular.Std.writer option
val pp_adt : Stdlib.Format.formatter -> t -> unit