Struct StateGen

pub struct StateGen<'a, A: Arch, M: MappableArea> {
    pub accesses: &'a MemoryAccesses<A>,
    /* private fields */
}

Generates random SystemStates consistent with a set of MemoryAccesses.

Fields

accesses: &'a MemoryAccesses<A>

The memory accesses to which all generated SystemStates must adhere.

Implementations

impl<'a, A: Arch, M: MappableArea> StateGen<'a, A, M>

pub fn new( accesses: &'a MemoryAccesses<A>, mappable: &'a M, ) -> Result<Self, RandomizationError>

Creates a new randomized state generator. This function builds memory access constraints for the random state generation. If it is not possible to generate a state of non-overlapping memory mappings, this function will return an error.

pub fn needs_adapt_from_bytes( &self, view: &SystemStateByteView<'_, A>, bytes_modified: &[StateByte], ) -> bool

Returns true if any of the bytes in bytes_modified are used in a memory mapping. If they are, this means that you need to call StateGen::adapt after modifying one of these bytes.

pub fn needs_adapt_from_gpregs(&self, gpregs: &[A::GpReg]) -> bool

Returns true if any of the general purpose registers in gpregs are used in a memory mapping. If they are, this means that you need to call StateGen::adapt after modifying one of these registers.

pub fn adapt(&self, s: &mut SystemState<A>, changed_instr: bool) -> bool

Adapts the memory mappings to the current CPU state in s.cpu(). This only changes s.memory. If it is impossible to map the memory to the new CPU state, false is returned. If false is returned, the memory mappings in state s may be in a partially modified state. Another successful call to this function is needed before the state is valid.

pub fn randomize_register<R: Rng>(&self, rng: &mut R, reg: A::Reg) -> u64

Returns a randomized value for the register reg. The random value is masked to Register::mask, if any.

If the register is the program counter, a random address where the full instruction can be mapped is returned. If the register is an address register (such as the FS/GS base registers), a random valid mappable address is returned.

pub fn randomize_new<R: Rng>( &self, rng: &mut R, ) -> Result<SystemState<A>, RandomizationError>

Generates a new random CPU state with valid memory mappings.

pub fn randomize_new_with_locations<R: Rng>( &self, base: &SystemState<A>, locations: &[Location<A>], rng: &mut R, ) -> Result<SystemState<A>, RandomizationError>

Randomizes the state, but only guarantees to change values in locations. Other values may be copied from base as an optimization, or may be randomized.

pub fn fill_with_byte<R: Rng>( &self, rng: &mut R, state: &mut SystemState<A>, b: u8, )

Fills as many storage locations with the byte b.

pub fn fill_from_address_register<R: Rng>( &self, rng: &mut R, state: &mut SystemState<A>, reg: A::GpReg, )

Fills as many storage locations as possible with the value of the register reg.

pub fn remap( &self, cs: &SystemState<A>, ) -> Result<SystemState<A>, RemapError<A>>

Remaps a provide system state from other memory accesses to the memory accesses belonging to this StateGen.

pub fn randomize_location<R: Rng>( &self, location: &Location<A>, state: &mut SystemState<A>, rng: &mut R, bytes_to_keep_unchanged: &[bool], )

Randomizes the storage location location while keeping a byte at position N in the location unchanged if bytes_to_keep_unchanged[N] is true.

pub fn address_registers(&self) -> &[A::GpReg]

Returns all address registers involved in the address computations of memory mappings.

Trait Implementations

impl<A: Arch, M: MappableArea> Clone for StateGen<'_, A, M>

fn clone(&self) -> Self

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.