A method and system for symbolizing memory mapping

Abstract

The application discloses a kind of symbolic memory mapping method and system, the method includes: step S1: according to memory read-write attribute configuration, initialize memory attribute judge;Step S2: according to symbolic memory configuration, initialize symbolic expression mapper;Step S3: input processor receives read operation or write operation, and memory attribute judge is according to the memory attribute judge in step S1, the legality of read-write operation is judged;For illegal operation, it is handed over to output processor to generate output;For legal operation, it is handed over to symbolic expression mapper to execute subsequent operation;Step S4: symbolic expression mapper according to read-write operation, and symbolic memory configuration in step S2, case processing symbolic memory read-write operation.The system is used to implement the above method.The application has the advantages of simple principle, wide application range, small hardware overhead, etc.

Description

Technical Field

[0001] This invention mainly relates to the field of computer program analysis technology, specifically a symbolic memory mapping method and system. Background Technology

[0002] Symbolic execution is a program analysis technique in the field of computer science that analyzes programs by using abstract symbolic values ​​instead of concrete values ​​as program variables.

[0003] When analyzing a program using symbolic execution, the program uses symbolic values ​​as input, rather than the concrete values ​​used in normal program execution. Upon reaching the target code, the analyzer obtains the corresponding path constraints, which are then solved by the constraint solver to obtain the concrete values ​​that trigger the target code.

[0004] Symbolic execution involves maintaining program memory space and requires establishing a mapping between program memory space and symbolic expressions. Whether applied to source code or binary programs, symbolic memory mapping methods are an indispensable component.

[0005] However, existing symbolic memory mapping methods still have some shortcomings:

[0006] (1) The read and write attributes of memory are not maintained;

[0007] (2) Symbolizing all the memory used by the program would be costly;

[0008] (3) If a part of the memory used by the program is symbolized, the symbolic expression read from the unsymbolized memory will be either null or a specific value. Summary of the Invention

[0009] The technical problem to be solved by this invention is to provide a symbolic memory mapping method and system that is simple in principle, has a wide range of applications, and low hardware overhead, in response to the technical problems existing in the prior art.

[0010] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0011] A symbolic memory mapping method, comprising:

[0012] Step S1: Initialize the memory attribute checker according to the memory read / write attribute configuration;

[0013] Step S2: Initialize the symbolic expression mapper according to the symbolic memory configuration;

[0014] Step S3: The input processor receives a read operation or a write operation. The memory attribute judge determines the legality of the read / write operation based on the memory attribute judge in step S1. For invalid operations, the output processor generates the output. For valid operations, the symbolic expression mapper performs subsequent operations.

[0015] Step S4: The symbolic expression mapper processes the read and write operations of symbolic memory according to the read and write operations and the symbolic memory configuration in step S2, depending on the case.

[0016] As a further improvement to the method of the present invention: step S4 includes: for a read operation, if the read memory ra1 is configured as symbolic memory; if the read memory is mapped to the symbolic expression sym_ra1, then the symbolic expression is handed over to the output processor for output; otherwise, according to the specific memory value ra1_value of the read memory, the symbolic expression sym_ra1_value is generated and handed over to the output processor for output.

[0017] As a further improvement to the method of the present invention: step S4 includes: for a read operation, if the read memory ra2 is not configured as symbolic memory; if the read memory is mapped to the symbolic expression sym_ra2, then the symbolic expression is passed to the output processor for output; otherwise, the specific memory value ra2_value of the read memory is passed to the output processor for output.

[0018] As a further improvement to the method of the present invention: step S4 includes: for a write operation, if the memory wa1 to be written is configured as symbolic memory; if the memory to be written is a concrete value wa1_value, then a symbolic value sym_wa1_value is generated based on this concrete value; if the memory to be written is a symbolic value sym_wa1_value, then this symbolic value is used directly; then, the mapping from the memory wa1 to the symbolic expression sym_wa1_value is recorded in the symbolic expression, and the symbolic expression sym_wa1_value is given to the output processor for output.

[0019] As a further improvement to the method of the present invention: step S4 includes: for a write operation, if the memory wa2 to be written is not configured as symbolic memory; if the value written to memory is a symbolic value sym_wa2_value, the symbolic expression records the mapping from the memory wa2 to the symbolic expression sym_wa2_value, and the symbolic expression sym_wa2_value is given to the output processor for output; if the value written to memory is a concrete value wa2_value, the concrete value wa2_value is given to the output processor for output.

[0020] As a further improvement to the method of the present invention: in step S1, the memory read / write attribute configuration describes a memory range that is either read-only (r) or readable and writable (rw), and is represented using JSON format syntax.

[0021] As a further improvement to the method of the present invention: in step S2, the symbolic memory configuration describes a range of symbolic memory, represented using JSON format syntax.

[0022] The present invention further provides a symbolic memory mapping system, which includes a memory attribute judge, a symbolic expression mapper, an input processor, and an output processor. The input processor is used to receive read operations or write operations. The memory attribute judge is used to determine the legality of read and write operations. For illegal operations, the output processor generates an output. For legal operations, the symbolic expression mapper performs subsequent operations. The symbolic expression mapper processes the read and write operations of symbolic memory according to the read and write operations and the symbolic memory configuration.

[0023] As a further improvement to the device of the present invention: the symbolic memory is divided into readable memory, writable memory, and readable-writable memory; for memory read and write operations, the following cases are handled:

[0024] (1) When reading from non-symmetric memory, if the content is a symbolic expression, return the symbolic expression; if the content is a non-symmetric expression, return the specific value.

[0025] (2) For writing to non-symmetric memory, if the written value is a symbolic expression, the memory is mapped to a symbolic expression; if the written value is a non-symmetric expression, it is ignored.

[0026] (3) For reading from symbolic memory, if the content is a symbolic expression, the symbolic expression is returned; if the content is a non-symbolic expression, the symbolic expression corresponding to the specific value is returned.

[0027] (4) For the case of writing to symbolic memory, the memory is recorded as a symbolic expression.

[0028] As a further improvement to the device of the present invention: the memory read / write attribute configuration describes a memory range that is either read-only (r) or readable / writable (rw), and is represented using JSON format syntax; the symbolic memory configuration describes a symbolic memory range, and is represented using JSON format syntax.

[0029] Compared with the prior art, the advantages of the present invention are: the symbolic memory mapping method and system of the present invention are simple in principle, have a wide range of applications, and low hardware overhead. The present invention handles memory read and write operations in different cases, thus maintaining the read and write attributes of memory and achieving better mapping results. Attached Figure Description

[0030] Figure 1 This is a flowchart illustrating the method of the present invention.

[0031] Figure 2 This is a schematic diagram illustrating the structural composition and principle of the device in a specific application example of the present invention. Detailed Implementation

[0032] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0033] This invention provides a symbolic memory mapping method that divides symbolic memory into readable memory, writable memory, and readable-writable memory; for memory read and write operations, the following cases are handled:

[0034] 1. When reading from non-symmetric memory, if the content is a symbolic expression, return the symbolic expression; if the content is a non-symmetric expression, return the specific value.

[0035] 2. For writes to non-symbolized memory, if the written value is a symbolic expression, the memory is mapped to a symbolic expression; if the written value is a non-symbolic expression, it is ignored.

[0036] 3. When reading from symbolic memory, if the content is a symbolic expression, the symbolic expression is returned; if the content is a non-symbolic expression, the symbolic expression corresponding to the specific value is returned.

[0037] 4. For writes to symbolic memory, the memory mapping to the symbolic expression is recorded.

[0038] like Figure 1 As shown, a symbolic memory mapping method of the present invention includes the following steps:

[0039] Step S1: Initialize the memory attribute checker according to the memory read / write attribute configuration;

[0040] The memory read / write attribute configuration describes a range of memory (from addr1 to addr2) that is either read-only (r) or read-write (rw), expressed using JSON syntax. For example:

[0041] {"range":{"start":addr1,"end":addr2},"attribute":"r"} or {"range":{"start":addr1,"end":addr2},"attribute":"rw"};

[0042] Step S2: Initialize the symbolic expression mapper according to the symbolic memory configuration.

[0043] The symbolic memory configuration describes a range of symbolic memory (from addr1 to addr2), represented using JSON syntax, for example: {"range":{"start":addr1,"end":addr2}};

[0044] Step S3: The input processor receives read or write operations. The memory attribute checker determines the validity of the read / write operation based on the memory attribute checker in step S1. For invalid operations, the output processor generates output; for valid operations, the symbolic expression mapper performs subsequent operations.

[0045] Step S4: The symbolic expression mapper processes the read and write operations of symbolic memory according to the read and write operations and the symbolic memory configuration in step S2, depending on the case.

[0046] In a specific application example, step S4 includes: for a read operation, if the read memory ra1 is configured as symbolic memory, and the read memory is mapped to the symbolic expression sym_ra1, then the symbolic expression is passed to the output processor for output; otherwise, based on the specific memory value ra1_value of the read memory, the symbolic expression sym_ra1_value is generated and passed to the output processor for output.

[0047] In a specific application example, step S4 includes: for a read operation, if the read memory ra2 is not configured as symbolic memory, and if the read memory is mapped to the symbolic expression sym_ra2, then the symbolic expression is passed to the output processor for output; otherwise, the specific memory value ra2_value of the read memory is passed to the output processor for output.

[0048] In a specific application example, step S4 includes: For a write operation, if the memory to be written, wa1, is configured as symbolic memory, then if the memory to be written is a concrete value wa1_value, a symbolic value sym_wa1_value is generated based on this concrete value; if the memory to be written is a symbolic value sym_wa1_value, this symbolic value is used directly. Then, the mapping from the memory to wa1 to the symbolic expression sym_wa1_value is recorded in the symbolic expression, and this symbolic expression sym_wa1_value is passed to the output processor for output.

[0049] In a specific application example, step S4 includes: For a write operation, if the memory wa2 to be written to is not configured as symbolic memory: If the value written to memory is a symbolic value sym_wa2_value, the symbolic expression records the mapping from the memory wa2 to the symbolic expression sym_wa2_value, and the symbolic expression sym_wa2_value is passed to the output processor for output. If the value written to memory is a concrete value wa2_value, then the concrete value wa2_value is passed to the output processor for output.

[0050] In a specific application example of this invention, this example employs a symbolic memory configuration where memory ranges 0x1000-0x5000 and 0x7000-0x9000 are configured as symbolic memory.

[0051] {"range":[{"start":"0x1000","end":"0x5000"},{"start":"0x7000","end":"0x9000"}]};

[0052] Configure memory read / write attributes for memory ranges 0x1000-0x3000 (read-only) and 0x4000-0x8000 (read-write), as follows:

[0053] [{"range":{"start":"0x1000","end":"0x3000"},"attribute":"r"},{"range":{"start":"0x4000","end":"0x8000"},"attribute":"rw"}];

[0054] The execution process of the instance is described in the following cases:

[0055] (1) The case of writing symbolic expressions to non-writable positions.

[0056] The symbolic expression sym_a is written to memory location 0x2000. The memory attribute checker determines that the write to memory location 0x2000 is invalid, and the output processor outputs an invalid operation.

[0057] (2) The case of writing a specific value to a non-writable location.

[0058] The specific value 0xa is written to memory location 0x2000. The memory attribute checker determines that the write to memory location 0x2000 is invalid, and the output processor outputs an invalid operation.

[0059] (3) The case of writing symbolic expressions to writable symbolic memory locations.

[0060] The symbolic expression sym_a is written to memory location 0x7000. The memory attribute checker determines that the write to memory location 0x7000 is valid. The symbolic expression mapper determines that memory location 0x7000 is symbolic memory. The symbolic expression mapper records the mapping from memory location 0x7000 to the symbolic expression sym_a. The output processor outputs the successfully written symbolic expression sym_a.

[0061] (4) The case of writing a specific value to a writable symbolic memory location.

[0062] The specific value 0xa is written to memory location 0x7000. The memory attribute checker determines that the write to memory location 0x7000 is valid, and generates the symbolic expression sym_a corresponding to the specific value 0xa. The symbolic expression mapper records the mapping from memory location 0x7000 to the symbolic expression sym_a. The output processor outputs the symbolic expression sym_a that was successfully written.

[0063] (5) The case of writing symbolic expressions to writable, non-symbolic memory locations.

[0064] The expression sym_a is written to memory location 0x6000. The memory attribute checker determines that the write to memory location 0x6000 is valid. The symbolic expression mapper records the mapping from memory location 0x6000 to the symbolic expression sym_a. The output processor outputs the successfully written symbolic expression sym_a.

[0065] (6) The case of writing a specific value to a writable, non-symbolic memory location.

[0066] The specific value 0xa is written to memory location 0x6000. The memory attribute judge determines that the write to memory location 0x6000 is valid. The symbolic expression mapper determines that memory location 0x6000 is non-symbolic memory and the written value is a specific value, so the write operation is ignored.

[0067] (7) Reading from an unreadable memory location.

[0068] The symbolic expression is read from memory location 0x5000. The memory attribute checker determines that the read from memory location 0x5000 is invalid and outputs an invalid operation to the processor.

[0069] (8) The case of reading from a readable symbolic memory location.

[0070] The symbolic expression is read from memory location 0x2000. The memory attribute checker determines that the read from memory location 0x2000 is valid. If the symbolic expression mapper records the mapping from memory location 0x2000 to the symbolic expression sym_b, the output processor outputs the symbolic expression sym_b. Otherwise, the symbolic expression sym_b is generated based on the specific value 0xb at memory location 0x2000, and the output processor outputs the symbolic expression sym_b.

[0071] (9) The case of reading from a readable, unsymbolized memory location.

[0072] The symbolic expression is read from memory location 0x6000. The memory attribute checker determines that the read from memory location 0x6000 is valid. The symbolic expression mapper determines that memory location 0x6000 is non-symbolic memory. If the symbolic expression mapper records the mapping from memory location 0x6000 to the symbolic expression sym_a, the output processor outputs the symbolic expression sym_a; otherwise, it outputs an empty symbolic expression.

[0073] The present invention further provides a symbolic memory mapping system, which includes a memory attribute judge, a symbolic expression mapper, an input processor, and an output processor. The input processor is used to receive read operations or write operations. The memory attribute judge is used to determine the legality of read and write operations. For illegal operations, the output processor generates an output. For legal operations, the symbolic expression mapper performs subsequent operations. The symbolic expression mapper processes the read and write operations of symbolic memory according to the read and write operations and the symbolic memory configuration.

[0074] As a further improvement to the device of the present invention: the symbolic memory is divided into readable memory, writable memory, and readable-writable memory; for memory read and write operations, the following cases are handled:

[0075] (1) When reading from non-symmetric memory, if the content is a symbolic expression, return the symbolic expression; if the content is a non-symmetric expression, return the specific value.

[0076] (2) For writing to non-symmetric memory, if the written value is a symbolic expression, the memory is mapped to a symbolic expression; if the written value is a non-symmetric expression, it is ignored.

[0077] (3) For reading from symbolic memory, if the content is a symbolic expression, the symbolic expression is returned; if the content is a non-symbolic expression, the symbolic expression corresponding to the specific value is returned.

[0078] (4) For the case of writing to symbolic memory, the memory is recorded as a symbolic expression.

[0079] As a further improvement to the device of the present invention: the memory read / write attribute configuration describes a memory range that is either read-only (r) or readable / writable (rw), and is represented using JSON format syntax; the symbolic memory configuration describes a symbolic memory range, and is represented using JSON format syntax.

[0080] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A symbolic memory mapping method, characterized in that, include: Step S1: Initialize the memory attribute checker according to the memory read / write attribute configuration; Step S2: Initialize the symbolic expression mapper according to the symbolic memory configuration; Step S3: The input processor receives a read operation or a write operation, and the memory attribute judge determines the legality of the read or write operation based on the memory attributes in step S1. For illegal operations, the output processor generates the output; for legal operations, the symbolic expression mapper performs subsequent operations. Step S4: The symbolic expression mapper processes the read and write operations of symbolic memory according to the read and write operations and the symbolic memory configuration in step S2, depending on the case. The symbolic memory is divided into readable memory, writable memory, and readable-writable memory; memory read and write operations are handled in the following ways: (1) For reading from non-symmetric memory, if the content is a symbolic expression, the symbolic expression is returned; if the content is a non-symmetric expression, the specific value is returned. (2) For writing to non-symmetric memory, if the written value is a symbolic expression, the memory is mapped to a symbolic expression; if the written value is a non-symmetric expression, it is ignored. (3) For reading from symbolic memory, if the content is a symbolic expression, the symbolic expression is returned; if the content is a non-symbolic expression, the symbolic expression corresponding to the specific value is returned. (4) For the case of writing to symbolic memory, the memory is recorded as a symbolic expression.

2. The symbolic memory mapping method according to claim 1, characterized in that, Step S4 includes: for a read operation, if the read memory ra1 is configured as symbolic memory; if the read memory is mapped to the symbolic expression sym_ra1, then the symbolic expression is passed to the output processor for output; otherwise, based on the specific memory value ra1_value of the read memory, the symbolic expression sym_ra1_value is generated and passed to the output processor for output.

3. The symbolic memory mapping method according to claim 1, characterized in that, Step S4 includes: for a read operation, if the read memory ra2 is not configured as symbolic memory; if the read memory is mapped to the symbolic expression sym_ra2, then the symbolic expression is passed to the output processor for output; otherwise, the specific memory value ra2_value of the read memory is passed to the output processor for output.

4. The symbolic memory mapping method according to claim 1, characterized in that, Step S4 includes: for a write operation, if the memory wa1 to be written is configured as symbolic memory; if the memory to be written is a concrete value wa1_value, then a symbolic value sym_wa1_value is generated based on this concrete value; if the memory to be written is a symbolic value sym_wa1_value, then this symbolic value is used directly; then, the mapping from the memory wa1 to the symbolic expression sym_wa1_value is recorded in the symbolic expression, and the symbolic expression sym_wa1_value is given to the output processor for output.

5. The symbolic memory mapping method according to claim 1, characterized in that, Step S4 includes: for a write operation, if the memory wa2 to be written is not configured as symbolic memory; if the value written to memory is a symbolic value sym_wa2_value, the symbolic expression records the mapping from the memory wa2 to the symbolic expression sym_wa2_value, and the symbolic expression sym_wa2_value is passed to the output processor for output; if the value written to memory is a concrete value wa2_value, the concrete value wa2_value is passed to the output processor for output.

6. The symbolic memory mapping method according to any one of claims 1-5, characterized in that, In step S1, the memory read / write attribute configuration describes a memory range that is either read-only (r) or read-write (rw), and is represented using JSON syntax.

7. The symbolic memory mapping method according to any one of claims 1-5, characterized in that, In step S2, the symbolic memory configuration describes a range of symbolic memory, represented using JSON syntax.

8. A symbolic memory mapping system, characterized in that, It includes a memory attribute checker, a symbolic expression mapper, an input processor, and an output processor. The input processor is used to receive read or write operations, and the memory attribute checker is used to determine the legality of the read or write operations. For illegal operations, the output processor generates the output; for... For legitimate operations, the symbolic expression mapper will execute subsequent operations; the symbolic expression mapper will handle the read and write operations of symbolic memory according to the read and write operations and the symbolic memory configuration. The symbolic memory is divided into readable memory, writable memory, and readable-writable memory; memory read and write operations are handled in the following ways: (1) For reading from non-symmetric memory, if the content is a symbolic expression, the symbolic expression is returned; if the content is a non-symmetric expression, the specific value is returned. (2) For writing to non-symmetric memory, if the written value is a symbolic expression, the memory is mapped to a symbolic expression; if the written value is a non-symmetric expression, it is ignored. (3) For reading from symbolic memory, if the content is a symbolic expression, the symbolic expression is returned; if the content is a non-symbolic expression, the symbolic expression corresponding to the specific value is returned. (4) For the case of writing to symbolic memory, the memory is recorded as a symbolic expression.

9. The symbolic memory mapping system according to claim 8, characterized in that, The memory read / write attribute configuration describes a range of memory that is either read-only (r) or read-write (rw), represented using JSON syntax; the symbolic memory configuration describes a range of symbolic memory, represented using JSON syntax.

Images