Optimizations for symbolic variables

[Ciprian Paduraru]

Hello,

Here is my use-case and my current implementation of it:

• I want to run multiple tests over a binary with a large input buffer B (e.g. 4096 bytes).
• Since I want symbolic execution, each of the 4096 bytes needs to be a symbolic variable
• From my understanding I need to call symbolizeMemory(MemoryAccess(byteAddr, CPUSIZE.BYTE)) in a loop with byteAddr in [INPUT_BEGIN to INPUT_BEGIN + 4096].

The problem is this:

• each time I set a new value on buffer B, I need to call setConcreteMemoryValue which invalidates the symbolic variables that I've built previously, and I need to call over and over again symbolizeMemory after each change !

Why it is not possible to do this :

• Call symbolizeMemory only once for the entire input buffer indices
• When something changes in the input buffer values, just call setConcreteVariableValue(symVar, newValue) to update the value referred to by the symbolic variable?

This would give a huge performance boost I suppose if it is correct in my use-case, because at each new run with different values for input buffer B, i would have only to update the content using setConcreteVariableValue instead of recreating everything symbolically.

Thanks !

[Alexey Vishnyakov]

IMHO, this can break SSA.

[Jonathan Salwan]

Mmmmh,

I don't understand why you cannot do this: setConcreteVariableValue(symVar, newValue) ?

>>> from triton import *
>>> 
>>> ctx = TritonContext(ARCH.X86_64)
>>> mem = MemoryAccess(0x1000, CPUSIZE.BYTE)

>>> ctx.setConcreteMemoryValue(mem, 0xff)
>>> var = ctx.symbolizeMemory(mem)
>>> print(hex(ctx.getConcreteMemoryValue(mem)))
0xff

>>> ctx.setConcreteVariableValue(var, 0xee)
>>> print(hex(ctx.getConcreteMemoryValue(mem)))
0xee

[Ciprian Paduraru]

It works, thank you!
I didn't observe that setConcreteVariableValue actually sets the concrete memory space too.