Crate haybale

For an introduction to the crate and how to get started, see the crate’s README.

Re-exports

• pub use config::Config;

Modules

• alloc_utils
  Utility functions for performing memory allocation. These may be useful in implementing hooks for various functions that perform memory allocation.
• backend
  Traits which abstract over the backend (BV types, memory implementation, etc) being used.
• callbacks
  Functions and structures for defining and activating instruction callbacks
• cell_memory
  Implementation of a Memory based on a Boolector array and 64-bit cells. Handles fully general read and write operations: arbitrary addresses, sizes, and alignments.
• config
  The Config structure for configuring haybale, and other associated definitions
• function_hooks
  Functions and structures for defining and activating function hooks
• hook_utils
  Utility functions for performing memset or memcpy operations. These may be useful in implementing hooks for other functions.
• simple_memory
  Simple implementation of a Memory based on a Boolector array and 8-bit cells. Like the more complicated Memory in cell_memory.rs, this handles fully general read and write operations: arbitrary addresses, sizes, and alignments. Despite being simpler, it seems to outperform the Memory in cell_memory.rs in many situations.
• solver_utils
  Simple utilities for interacting with the solver
• watchpoints
  Structures for defining and processing memory watchpoints

Structs

• ExecutionManager
  An ExecutionManager allows you to symbolically explore executions of a function. Conceptually, it is an Iterator over possible paths through the function. Calling next() on an ExecutionManager explores another possible path, returning either an Ok with a ReturnValue representing the function’s symbolic return value at the end of that path, or an Err if an error was encountered while processing the path.
• Location
  Fully describes a code location within the LLVM IR.
• LocationDescription
  Describes a location in LLVM IR in a format more suitable for printing - for instance, uses function names rather than references to Function objects. For a richer representation of a code location, see Location.
• PathEntry
  Describes one segment of a path through the LLVM IR. The “segment” will be one or more consecutive instructions in a single basic block.
• Project
  A Project is a collection of LLVM code to be explored, consisting of one or more LLVM modules.
• State
  A State describes the full program state at a given moment during symbolic execution.

Enums

• BBInstrIndex
  Denotes either a particular instruction in a basic block, or its terminator.
• Error
  Error types used throughout this crate.
• ParameterVal
• ReturnValue
  A simple enum describing the value returned from a function
• SolutionValue
  A simple enum describing either an integer value or a pointer

Functions

• find_zero_of_func
  Given a function, find values of its inputs such that it returns zero.
• get_path_length
  Returns the number of LLVM instructions in a passed path. The returned value is only accurate if the path under analysis does not include a panic, exception, exit, or any hooked calls (such as inline assembly).
• get_possible_return_values_of_func
  Get a description of the possible return values of a function, for given argument values. Considers all possible paths through the function given these arguments.
• symex_function
  Begin symbolic execution of the function named funcname, obtaining an ExecutionManager.

Type Aliases

• Result
  A type alias for convenience, similar to how std::io::Result is used for I/O operations