-
Notifications
You must be signed in to change notification settings - Fork 142
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Can Phasar be used to identify control-dependent instructions #685
Comments
While
|
Here is my program
|
Stmt |
Hi Mohannad, I am not sure whether I understand your question correctly. How do you mean your notion of "control dependent"? Are you referring to the problem "which values influence which controlflow decision"? The examples you referred to look like dataflow properties though.
The extended taint analysis is optimized particularly for identifying flows that reach a sink, choosing to not generate facts at loads but instead following back def-use chains at sinks, with the idea of reducing the size of the ESG and also to simplify the implementation of the field-sensitivity. With that, unfortunately you don't see the dataflow facts at the individual statements. There is another taint analysis, the IFDS taint analysis, in which this kind of optimization is not present and it should report the dataflow that you asked for. The same applies to the other flow you asked for in the same post. Downside of that analysis is the lack of field sensitivity, but at least in the example you provided it does not seem to matter that much. Generally, the report of the IFDS/IDE solver lists for each program statement which dataflow facts hold before executing that statement. In the taint analysis, it should list the variables that are tainted there. It does not describe control dependency. We have another analysis in phasar, the InstInteractionAnalysis, which describes interactions between instructions, but not just for one particular seed, but for all instructions. I am not sure to what extent this might be helpful for your purposes though. Hope that helps. Best regards |
Let's close this, |
@MMory I used
|
I'm using phasar taint analysis to identify data-dependent and control-dependent instructions on
argv
.The
IDESolver
results are as follows:how to interpret
IDESolver
raw results to identify control-dependent instructions. For example,N: %17 = load i8**, i8*** %5, align 8, !dbg !70, !psr.id !73 | ID: 153
uses%5 = alloca i8**, align 8, !psr.id !22 | ID: 126
, which usesargv
, but how can I determine that%25 = icmp eq i32 %24, 45, !dbg !82, !psr.id !83 | ID: 161
is also depends on%17
?The text was updated successfully, but these errors were encountered: