Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Repo info
Activity
  • Sep 14 07:54
    wonderluster edited #994
  • Sep 14 07:54
    wonderluster opened #994
  • Sep 14 07:52
    XVilka synchronize #972
  • Sep 13 20:46
    gitoleg synchronize #993
  • Sep 13 09:22
    XVilka synchronize #957
  • Sep 13 09:01
    XVilka synchronize #976
  • Sep 13 08:02
    wonderluster closed #992
  • Sep 12 21:00
    gitoleg labeled #993
  • Sep 12 21:00
    gitoleg edited #993
  • Sep 12 20:59
    gitoleg opened #993
  • Sep 12 20:49
    gitoleg labeled #988
  • Sep 12 16:27
    gitoleg synchronize #988
  • Sep 12 16:24

    gitoleg on master

    tweaks the print plugin The pr… fixes a bug in adt printer (whi… (compare)

  • Sep 12 16:24
    gitoleg closed #991
  • Sep 12 15:09
    gitoleg synchronize #988
  • Sep 12 14:51
    gitoleg synchronize #988
  • Sep 12 13:35
    gitoleg synchronize #988
  • Sep 12 13:32
    ivg closed #954
  • Sep 12 13:31
    ivg closed #917
  • Sep 12 13:25
    gitoleg synchronize #988
gitoleg
@gitoleg
@ivg yeap!
Chloe Fortuna
@fortunac

Hi, I have a question about Words. I created a word with width 3 from an int -2, casted it to signed, then converted it to an int. In 1.6 I would get -2, but in 2.0 I would get 6. Why does this happen?

1.6:

utop # let n_two = Word.of_int (-2) ~width:3;;
val n_two : word = <abstr>

utop # n_two |> Word.signed |> Word.to_int_exn;;
- : int = -2

2.0:

utop # let n_two = Word.of_int (-2) ~width:3;;
val n_two : word = <abstr>

utop # n_two |> Word.signed |> Word.to_int_exn;;
- : int = 6
gitoleg
@gitoleg
@fortunac looks like a bug at first glance. I will take a look. Although I thought that we already fixed it(
Chloe Fortuna
@fortunac
Thanks for taking a look at it!
Anton Kochkov
@XVilka
I have another question then
what is the code to load the binary for my dalvik plugin in plugins/dalvik/dalvik_dex.ml
asking for the example of boilerplate
Ivan Gotovchits
@ivg
I will give it later, it is not something one could type from a phone :)
Anton Kochkov
@XVilka
sure, no rush
matrixbot
@matrixbot
Wojciech Nawrocki Hello, and congrats on releasing BAP 2! I'm new to BAP and reading through the docs. My question - the existing BAR docs (annotated reference) are still 1.6, right? Are there any docs for 2.0 out already or is it still WIP?
shamila wickramasuriya
@visitWicky_twitter
In ubuntu 18 due to libjsoncpp0 dependency llvm-3.8-dev can't be installed. Because of that when installing bap, bap-llvm is failing. Is there any other way to install bap in ubuntu 18?
Enkelmann
@Enkelmann
@visitWicky_twitter You don't need llvm-3.8 anymore. If I remember correctly, installing the standard llvm package instead should do the trick
Ivan Gotovchits
@ivg

Hello, and congrats on releasing BAP 2! I'm new to BAP and reading through the docs. My question - the existing BAR docs (annotated reference) are still 1.6, right? Are there any docs for 2.0 out already or is it still WIP?

We didn't upload 2.0 docs yet, and they are still WIP. With all that said, BAP 1.6 is subsumed by BAP 2.0, so everything that is said in the currently uploaded documentation is still valid for the latest release.

@visitWicky_twitter, indeed 3.8 is not needed and is probably not the best idea to install it at all, given how outdated it is. You can install BAP using any version of LLVM up to the latest released. Just make sure that you have the llvm-dev packaged installed, and that you have llvm-config tool available in your path, so that BAP can find LLVM.
Ivan Gotovchits
@ivg

@fortunac, please see the #983 it should restore the old behavior of the Word.to_intX functions, they will now extend the sign bit if the passed value is marked as unsigned (a previously undocumented feature).

However, I would advise against relying on fragile native integers. The mere fact that your code depends on the fact that 110 is -2 is very suspicious. If you need arithmetics then you should use Word module for that everywhere. I don't think, that there is a need (or legit use cases) for translating a bitvector to the host integer, especially if such use cases depend on the sign (so that you end up treating 110 differently in different contexts). The word data type is indexable, comparable, printable, efficient, etc.

Chloe Fortuna
@fortunac
Thanks Ivan! We'll take a look at our code and see how to improve it based on what you mentioned
Ivan Gotovchits
@ivg
You're welcome, it was just merged, so make sure that you've updated. Concerning my advice, it could be expressed even simpler - never use Word.to_int*
(the only legit use case that we were able to justify so far is translating a bitvector to OCaml float via int64 for testing purposes)
Enkelmann
@Enkelmann
@ivg I still don't get your last point in the discussion of #982. If you put edge transition function and node transition function into one function (e.g. f:('d -> 'n -> 'e -> 'd)), then you have to compute the node transition either for each incoming edge or for each outgoing edge. Both would be inefficient for graphs with lots of edges. Am I missing something here?
Ivan Gotovchits
@ivg
There are two simple solutions:
  1. Use partial applications:
    let transfer data node =
       let data = compute_genkill node data in
       fun _edge -> data
    here the transfer function has type 'd -> Node.t -> Edge.label -> 'd but the heavy compute_genkill is called only once per block.
  2. Let the users to explicitly select which transfer function they want (i.e., by overloading) the transfer function now is a variant having the following type
    [
    | `node of Node.t -> 'd -> 'd
    | `edge of Edge.label -> 'd -> 'd
    | `both of Node.t -> Edge.label -> 'd -> 'd
    ]
    So a user may explicitly tell whether his transfer function depends on a node, an edge, or both.
I'm actually sticking to the latter solution as it is explicit and lets us provide the most performant implementation for any case. I'm not completely satisfied with the choice of names, but we will figure this out
Ivan Gotovchits
@ivg
I would probably make it an abstract data type (because another good example is the identity transfer function, for which we can also provide a more efficient implementation)
Ivan Gotovchits
@ivg

Something like this

type ('n,'e,'d) transmittance
val transfer_identity : (_,_,_) transmittance
val transfer_node : ('n -> 'd -> 'd) -> ('n,_,'d) transmittance
val transfer_edge : ('e -> 'd -> 'd) -> ('_,'e,'d) transmittance
val transfer : ('n -> 'e -> 'd -> 'd) -> ('n,'e,'d) transmittance

(* and  the following type of `Solution.compute` *)
module Solution : sig
...
 val compute : (module Graph with type t = 'c
                              and type node = 'n
                              and type Edge.label = 'e) ->
  ?steps:int -> ?start:'n -> ?rev:bool ->
  ?step:(int -> 'n -> 'd -> 'd -> 'd) ->
  init:('n,'d) Fixpoint.t ->
  equal:('d -> 'd -> bool) ->
  merge:('d -> 'd -> 'd) -> f:('n,'e,'d) transmittance -> 'c -> ('n,'d) Fixpoint.t
end

in fact, we can even make f optional and default it to transfer_identity

Enkelmann
@Enkelmann
But variant 2 still suffers from the problem that if the user chooses both the implementation will be inefficient for certain graphs.
Ivan Gotovchits
@ivg
well why would a user specify both if his function doesn't depend on both? The whole idea of having both is to handle the case when an analysis is not distributive over node+edge, so in order to compute the transfer function they need both of them.
or you're thinking of the case, when an analysis is distributive, but a user wants to compute the node transmittance once and reuse it for each outcoming edge?
Enkelmann
@Enkelmann
Yes, the latter
which may be relevant for my use cases since I will need both, but the node functions will be computationally heavier.
Well, except in one case where the edge function is computationally heavy...
Enkelmann
@Enkelmann
On the other hand I don't have any cases yet where I cannot separate into one node and one edge function, so the advantage of your approach is moot for me.
Ivan Gotovchits
@ivg

for that case we can add a yet another variant... can't come up with a proper name right now, but something like this:
implementation (underneath the hood the transmittance type is a simple GADT)

type (_,_,_) transmittance = 
   | Identity : ('n,'e,'d) transmittance
   | ...
   | Distributive : ('n -> 'd -> 's) * ('e -> 's -> 'd) -> ('n,'e,'d) transmittance
   | General : ('n -> 'e -> d -> 'd) -> ('n,'e,'d) transmittance

Note, that for the distributive case we have an existential 's type representing the partially computed result from the node only (this could be the 'd of course)

Enkelmann
@Enkelmann
Yeah, this would be a solution, although an unnecessarily complicated one in my opinion. ;-)
Ivan Gotovchits
@ivg
and there will be a simple constructor for the users:
val transfer_distributive : node:('n -> 'd -> 's) -> edge:('e -> 's -> 'd) -> ('n,'e,'d) transmittance
why do you think it is complicated? I'm seeing a simple apply_transmittance function in the implementation, that will just dispatch the user-provided transmittance. A very minimal change. The good thing is that we will also get a concrete notion of the transmittance where we can explain all cons and pros of different variants)
Enkelmann
@Enkelmann
I expect most cases to be distributive. And the ones that are not can probably be handled by transforming the input graph.
But I want to gather some experience as a user of a more complicated fixpoint algorithm before I suggest an interface for the BAP-version anyway.
Enkelmann
@Enkelmann
By the way: Are you still interested in a minimal and backwards-compatible version now or do you want to wait until I get around writing a more powerful one?
Ivan Gotovchits
@ivg

I expect most cases to be distributive. And the ones that are not can probably be handled by transforming the input graph.

Well, the whole point is that in case of a non-distributive version it could not be solved by transferring the graph, this is the why the problem is non-distributive, i.e., in that case your transfer function could not be expressed in terms of one node. That's why we need to support the general case.

By the way: Are you still interested in a minimal and backwards-compatible version now or do you want to wait until I get around writing a more powerful one?

I'm thinking of the solution with different transmittances as the minimal and backward-compatible (provided that we will put the new function in the Solution namespace, and left the old one for backward compatibility (marking as deprecated)).

Enkelmann
@Enkelmann
Well, right now this is probably too much work for me to implement considering that I probably end up not using it anyway. So I interpret it as you prefer to wait for now. ;-)
Ivan Gotovchits
@ivg
the good think of transmittance being abstract is that you can start with the distributive case, the one that you need, and left the non-distributive for later time ;)
shamila wickramasuriya
@visitWicky_twitter
BapIssue.PNG
I am trying to install bap using opam in ubuntu 18. But end up in here.
@FactionCube I am trying to install bap using opam in ubuntu 18. I have llvm 8. But opam is looking for llvm-3.8-dev and fails with libjsoncpp0 dependency. Any idea how to install BAP on ubuntu18?
gitoleg
@gitoleg

@visitWicky_twitter Hi!

vagrant@ubuntu-bionic:~ opam depext bap
# Detecting depexts using vars: arch=x86_64, os=linux, os-distribution=ubuntu, os-family=debian
# The following system packages are needed:
binutils-multiarch
clang
debianutils
libgmp-dev
libzip-dev
llvm-6.0-dev
m4
perl
pkg-config
zlib1g-dev
The following command needs to be run through "sudo":
apt-get install binutils-multiarch clang debianutils libgmp-dev libzip-dev llvm-6.0-dev m4 perl pkg-config zlib1g-dev

So it's quite weird that in your case opam depext bap suggests you to install llvm-3.8. So first things first, to be sure that we're on the same page, let's do the following:
opam update
and make sure that
opam --version is 2.0 or later

and what about installing bap with llvm 8, you can just set your version of llvm-config manually, e.g. LLVM_CONFIG=llvm-config-8 opam install conf-bap-llvm and then opam depext bap and opam install bap
shamila wickramasuriya
@visitWicky_twitter
@gitoleg Thank you. opam update from 1.2 to 2.0 did the trick.
hluwa
@hluwa
Excuse me, How i use the --loader=ida? the command tip me only support llvm and bap-elf, but i see the document has ida option. I want translate to BIL by asm(x86, arm, ...) on IDAPython script, or is there any other way? Thank very much.
Ivan Gotovchits
@ivg
If there is no ida in the list of loaders, then it means that you don't have an ida plugin installed (or it is misconfigured, so that the plugin can't find IDA Pro on your machine)

I want translate to BIL by asm(x86, arm, ...) on IDAPython script, or is there any other way? Thank very much.

I'm not sure I understand what do you want, but you definitely don't need a loader for that :)

So what are you trying to do? Can you elaborate?