search

moralismercatus / crete

Open source concolic testing tool for binaries
1 stars 1 forks source link

Will trace graph exclude paths when they originate from helper function calls? #100

Open moralismercatus opened 9 years ago

moralismercatus commented 9 years ago

Case in point: ops_sse.h helper function calls.

The trace graph builds its graph via TB pc values. Since calls to helper functions are external to TBs, any paths therein are excluded, and the trace is subsequently seen as redundant and rejected.

moralismercatus commented 9 years ago

I'm not entirely sure this is a problem.

If the test case generated in a helper function impacts the program flow, then the subsequent flow will change the trace log that the trace graph uses, and the trace will not be rejected.

moralismercatus commented 9 years ago

Normally, I'd say that even helper calls constitute a "single instruction," and that is sufficient for control flow, but SSE seems to be an exception. Take the case of comparing two strings.

  1. 16 bytes from each string is loaded into respective XMM registers.
  2. With a single instruction, the XMM registers are compared.

Now, not using SSE, the control flow would be represented in the TBs required to carry out the comparison. With SSE, I'm not sure that this control flow information is present. In fact, when I turn on filter-traces, it appears that it's not present.