Implement symbolic branch tracking in core, add new fork event #433
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR implements tracking of symbolic branches in each
State
(specificallystate.context['branches']
). It does this using a new event:forking_state
. Similar towill_fork_state
,forking_state
fires when a state fork occurs, however it fires once for each individual state forked, being passed the specific value that has been concretized.will_fork_state
fires once on a general state forking event, being passed the collection of all concretized values. This is unsuitable for tracking symbolic branches per state because theState
the event handler has access to duringwill_fork_state
is the parent state, and not a child state. For tracking symbolic branches, we want to only modify the specific child state.Points of discussion and controversy:
Whether we should track symbolic branches in the core, versus requiring users to do this.
I think this is general enough and useful enough functionality to compute in the core and have available to users "for free".
The name of the event:
forking_state
.I'm open to suggestions for other names!
forking_child_state
, ...The introduction of
State._init_context
.I thought it would be useful to have a central place where all the entries of
state.context
are initialized, versus them largely being initialized ad hoc in various places in hooks in manticore.py. Initializing entries ofstate.context
here allows code that usesstate.context
to be less cautious about whether a entry actually exists or not. For example:manticore/manticore/manticore.py
Line 558 in 5ad18e7
manticore/manticore/manticore.py
Line 568 in 5ad18e7
manticore/manticore/manticore.py
Line 601 in 5ad18e7
Currently only
context['branches']
is initialized here, but the idea is to eventually port other usees ofstate.context
in the core to initialize those members here.