package binsec

  1. Overview
  2. Docs
Semantic analysis of binary executables

Install 

dune-project
 Dependency

binsec.github.io Readme Changelog LGPL-2.1-or-later License Edit opam file Versions (20)

Authors

  1. A
    Adel Djoudi
  2. B
    Benoit Boero
  3. B
    Benjamin Farinier
  4. C
    Chakib Foulani
  5. D
    Dorian Lesbre
  6. F
    Frédéric Recoules
  7. G
    Guillaume Girol
  8. J
    Josselin Feist
  9. L
    Lesly-Ann Daniel
  10. M
    Mahmudul Faisal Al Ameen
  11. M
    Manh-Dung Nguyen
  12. M
    Mathéo Vergnolle
  13. M
    Matthieu Lemerre
  14. N
    Nicolas Bellec
  15. O
    Olivier Nicole
  16. R
    Richard Bonichon
  17. R
    Robin David
  18. S
    Sébastien Bardin
  19. S
    Soline Ducousso
  20. T
    Ta Thanh Dinh
  21. Y
    Yaëlle Vinçont
  22. Y
    Yanis Sellami

Maintainers

  1. B
    BINSEC <binsec@saxifrage.saclay.cea.fr>

Sources

binsec-0.11.1.tbz
sha256=bb48234a4b60a872015a88282df4873f01dcc984753d49ad2583d49c1ae7d705
sha512=e8aa47a736b83bfd47d5b5e96d0988859b4873ad4a112fee7cd21d02bc72ecec61b7de610a959e38d2f2f5eef8082a2c100c201e5eae5ae3a880c747dce6ae63

doc/binsec_kernel_dba/Binsec_kernel_dba/Dhunk/index.html

Module Binsec_kernel_dba.DhunkSource

DBA hunks, aka dhunk

DBA blocks

Sourcetype t

A DBA block represents a set of DBA instructions with explicit links to the next one. The first instruction of the block always has id 0. Typically, DBA a block is the translation of one binary/assembly instruction.

Sourceval empty : t

The one and only empty DBA hunk. Get it here!

Sourceval stop : t

A simple dhunk of one instruction stopping with an OK Dba.state

Sourceval is_empty : t -> bool
Sourceval init : int -> (int -> Dba.Instr.t) -> t
Sourceval singleton : Dba.Instr.t -> t

A simple dhunk of one instruction jumping to the virtual address.

Sourceval length : t -> int
Sourceval inst : t -> int -> Dba.Instr.t option
Sourceval inst_exn : t -> int -> Dba.Instr.t
Sourceval start : t -> int

start b is the first index of block b

Sourceval exits : t -> int list

exits b are the instruction indexes which end the block b

Sourceval copy : t -> t
Sourceval iter : f:(Dba.Instr.t -> unit) -> t -> unit
Sourceval iteri : f:(int -> Dba.Instr.t -> unit) -> t -> unit
Sourceval of_list : Dba.Instr.t list -> t

of_list l assumes the list is sorted in increasing order inside the block

Sourceval of_labelled_list : (int * Dba.Instr.t) list -> t

of_list l assumes the list is sorted in increasing order inside the block, i.e. the labels are contiguous starting from 0.

Sourceval mapi : f:(int -> Dba.Instr.t -> Dba.Instr.t) -> t -> t
Sourceval flatten : t -> (int * Dba.Instr.t) list
Sourceval to_list : t -> Dba.Instr.t list
Sourceval fold : ('a -> Dba.Instr.t -> 'a) -> 'a -> t -> 'a
Sourceval for_all : (Dba.Instr.t -> bool) -> t -> bool

unlink dh i skips the ith instruction. Its predecessors go to its successor.

  • raises Invalid_argument

    if inst dh i has not exactly one successor.

Sourceval export_and_view : ?cmd:string -> t -> unit

view dh Visualize dot-rendered DBA hunk dh using cmd.

Default value for cmd is firefox.

Sourceval pred : t -> int -> int list
Sourceval succ : t -> int -> int list
Sourceval optimize : ?inplace:bool -> t -> t

optimize dh Performs some "compiler" optimizations and return the simplified block.

  • parameter inplace

    Directly modify the block without making a copy. Default: false.

include Binsec_base.Sigs.PRINTABLE with type t := t
Sourceval pp : Format.formatter -> t -> unit

Dhunk properties

Sourcemodule Check : sig ... end

outer_jumps b computes the set of jumps to external addresses in hunk b. Due to dynamic jumps, this represents a syntactic under-approximation of the possible jumps from this block.

callees b computes the set of addresses this block may call

Sourceval is_return : t -> bool

is_return d check if dhunk d encodes a return

Sourceval has_indirect_jump : t -> bool

has_indirect_jump d returns true if the hunk contains an indirect jump instruction

Sourcetype conditional = {
  1. condition : Dba.Expr.t;
  2. consequent : Binsec_base.Virtual_address.t;
  3. alternative : Binsec_base.Virtual_address.t;
}
Sourceval conditional : t -> conditional option
Sourceval constant_propagation : t -> t
Sourceval dead_code_elimination : t -> t