Assignment 2 - SVF-tools/Software-Security-Analysis GitHub Wiki

Assignment-2 folder layout

../Assignment-2
|-- CPP
|   |-- Assignment-2.cpp
|   |-- Assignment-2.h
|   |-- CMakeLists.txt
|   |-- Z3SSEMgr.cpp
|   |-- Z3SSEMgr.h
|   `-- test-sse.cpp
|-- Python
|   |-- Ass2_helper.py
|   |-- Assignment2.py
|   |-- CMakeLists.txt
|   |-- Main.py
|   `-- Test.py
`-- Tests
    `-- testcases
        `-- sse
            |-- test1.c
            |-- test1.ll
            |-- test2.c
            |-- test2.ll
            |-- test3.c
            `-- test3.ll

1. Get the latest assignment-2 code template

* Before coding, please type cd $HOME/Software-Security-Analysis and git pull in your terminal to make sure you always have the latest version of the code template before each assignment.

If git pull fails due to the conflict with your local changes, type git stash to store your current code in a temporal branch and type git pull again. If you want to retrieve your code back, type git stash pop.

width=600px

Make sure to switch your program to ass2 before coding.

2. Assignment 2 task

- Implement the following methods of class SSE in Assignment_2.cpp or Assignment_2.py

Method Description
SSE::reachability Control-flow reachability analysis starting from the entry (GlobalICFGNode) of the program. The method differs from Assignment-1 only in the first argument which is ICFGEdge* rather than ICFGNode*
SSE::collectAndTranslatePath Collect each program path from the entry to each assertion of the program. In this function, you will need to (1) add each path into the paths set, (2) call translatePath to convert each path into Z3 expressions. Note that translatePath returns true if the path is feasible, infeasible otherwise. (3) If a path is feasible, you will need to call assertchecking to verify the assertion (which is the last ICFGNode of this path).
SSE::handleCall Translate callPE in a context-sensitive manner
SSE::handleRet Translate retPE in a context-sensitive manner
SSE::handleBranch Translate branch intraICFGEdge and evaluate the branch condition and return true if the branch evaluated is feasible, otherwise infeasible
SSE::handleNonBranch Translate AddrStmt, CopyStmt, LoadStmt, StoreStmt, GepStmt, CmpStmt into constraints

- Run Tests

For C++, you can refer to this section
For Python, you can refer to this section

Submitting Your Work

For C++, you can refer to this section
For Python, you can refer to this section

3. Configuration, Debug and visualize ICFG

For C++, you can refer to this section
For Python, you can refer to this section