search

PKU-ASAL / SeeWasm

A native symbolic execution engine for WebAssembly
40 stars 4 forks source link

Refine CFG #70

Closed HNYuuu closed 2 years ago

HNYuuu commented 2 years ago

Is your feature request related to a problem? Please describe. Currently, if the control flow calls exit, it should be terminated. However, we have to continue analysis on other paths. Thus, either we pop the call stack, which is highly coupled with current logic, or we combine all the basic blocks of functions into one big graph.

Please see the below image:

image image

Note that, except for the call instruction, call_indirect can also lead to call relationship. Thus, we have to link each call indirect instruction to each function in elem seciton.

HNYuuu commented 2 years ago

I have modified the CFG as the figures show, please recheck the interval generation and the call of exit() @zzhzz .

Note that, if the callee is an import function, we do not link the caller block to the dummy entry block of the import function as there is no body of import functions. Thus, we just keep the fall_through link from caller block to the successive callee block.

Refer to: 62fa8f5

HNYuuu commented 2 years ago

Pass all the samples specifically designed for this feature: simple_call, simple_call_with_exit, bubble, fac and fib. Also, the base64 is passed.

However, the modification of CFG imports around 50% overhead in running time, we should pay attention for it.