draperlaboratory / cbat_tools

Program analysis tools developed at Draper on the CBAT project.
MIT License
101 stars 14 forks source link

Extract Lambda Models, Fix GDB/BilDB + Boolector combo #305

Open philzook58 opened 3 years ago

philzook58 commented 3 years ago

Currently serializing from Boolector asserts a lambda model to Z3 for the memory array. The model extractor in output.ml does not handle this case well. It is currently expected that asking for bildb or gdb output will crash when using Boolector.

It is at least a bit confusing how extract a first order model from the lambda term in the general case.

My suggestion: Walk the AST looking for bitvector literals. Use Z3.Model.eval to evaluate the lambda term applied to these values. Find one fresh value in the domain. Also eval that for the else case. This is a hack and I could probably get cases where it would evaluate incorrectly.