初识程序分析的小白，后续将有更多KLEE的代码笔记，想要交流请绑定～
转载请注明出处：https://www.cnblogs.com/linkJ/
从main函数开始，分析KLEE的执行流程
主要函数笔记：
int main(int argc, char **argv, char **envp) {
atexit(llvm_shutdown); // Call llvm_shutdown() on exit.
llvm::InitializeNativeTarget();
parseArguments(argc, argv);//在屏幕打印klee的版本以及输入的命令行参数
sys::PrintStackTraceOnErrorSignal();
if (Watchdog) {
//当指定-maxtime的时候，用Watchdog来监控执行的时间
}
sys::SetInterruptFunction(interrupt_handle);//当ctrl-c的时候，运行终止
// Load the bytecode...
std::string errorMsg;
LLVMContext ctx;
Module *mainModule = klee::loadModule(ctx, InputFile, errorMsg);//读取输入的.bc
if (WithPOSIXRuntime) {//指定了posixruntime就
int r = initEnv(mainModule);//对入口函数的参数和环境信息进行初始化
if (r != 0)
return r;
}
std::string LibraryDir = KleeHandler::getRunTimeLibraryPath(argv[0]);//获取RuntimeLibraryPath
Interpreter::ModuleOptions Opts(LibraryDir.c_str(), EntryPoint,//对Module进行一些操作
/*Optimize=*/OptimizeModule,
/*CheckDivZero=*/CheckDivZero,
/*CheckOvershift=*/CheckOvershift);
switch (Libc) {//根据对libc参数的指定来链接相应的库
case NoLibc: /* silence compiler warning */
case KleeLibc:
case UcLibc:
mainModule = linkWithUclibc(mainModule, LibraryDir);
break;
}
if (WithPOSIXRuntime) {
//mianModule链接相应的posix-runtime库
}
// Get the desired main function. klee_main initializes uClibc
// locale and other data and then calls main.
Function *mainFn = mainModule->getFunction(EntryPoint);//获取入口函数为mainFn
//argc以及argv的复制
std::vector<bool> replayPath;
if (ReplayPathFile != "") {
KleeHandler::loadPathFile(ReplayPathFile, replayPath);
}
Interpreter::InterpreterOptions IOpts;
IOpts.MakeConcreteSymbolic = MakeConcreteSymbolic;//确认是否正确对具体程序符号化
//创建handler,interpreter,并setInterpreter
KleeHandler *handler = new KleeHandler(pArgc, pArgv);
Interpreter *interpreter =
theInterpreter = Interpreter::create(ctx, IOpts, handler);//返回Executor(ctx,IOpts,handler)
handler->setInterpreter(interpreter);//打印参数、PID信息到info文件
const Module *finalModule =
interpreter->setModule(mainModule, Opts);//调用Executor::setmodule,好像是形成了assembly.bc吧，绑定了各种信息
externalsAndGlobalsCheck(finalModule);//对函数、基本块、指令、全局变量等进行安全性检测，类似于静态分析的感觉？？
if (ReplayPathFile != "") {
interpreter->setReplayPath(&replayPath);
}
//打印时间信息
//判断ReplayKTestDir和ReplayKTestFile是否为空(××di定位这些种子都是啥，谁给他的 ）
非空则
//将所有的ReplayKTestFile中的种子都放到KTests中
//××这里的种子是怎么给的？？？？
每次从KTests取一个种子进行
interpreter->setReplayKTest(out);//确认KTest是否可用
llvm::errs() << "KLEE: replaying: " << *it << " (" << kTest_numBytes(out)
<< " bytes)"
<< " (" << ++i << "/" << kTestFiles.size() << ")
";
// XXX should put envp in .ktest ?
interpreter->runFunctionAsMain(mainFn, out->numArgs, out->args, pEnvp);//调用Executor中的函数,这是每个KTest都执行一次
if (interrupted) break;
循环结束，设置ReplayKTest为空：interpreter->setReplayKTest(0);
如果没有提供ReplayKTest,即ReplayKTestDir为空line1420
就将SeedOutFile的每个KTest都放到seeds中。
根据SeedOutDir中的内容从KTest_fromFile中取KTest放进seeds中。
if (!seeds.empty()) {
klee_message("KLEE: using %lu seeds
", seeds.size());
interpreter->useSeeds(&seeds);//设置usingSeeds为seeds
}
interpreter->runFunctionAsMain(mainFn, pArgc, pArgv, pEnvp);//函数调用，仅此一次
while (!seeds.empty()) {
kTest_free(seeds.back());
seeds.pop_back();
}
记录时间
打印信息：各种统计信息
class KleeHandler : public InterpreterHandler
KleeHandler::KleeHandler(int argc, char **argv)
创建输出目录以及相应文件 info warning.txt *.test等,获取各种路径以及文件
定义了一些函数
-----------------------Executor.cpp------------------------------------------------------
Executor::Executor(LLVMContext &ctx, const InterpreterOptions &opts,
InterpreterHandler *ih)
: Interpreter(opts), kmodule(0), interpreterHandler(ih), searcher(0),
externalDispatcher(new ExternalDispatcher(ctx)), statsTracker(0),
pathWriter(0), symPathWriter(0), specialFunctionHandler(0),
processTree(0), replayKTest(0), replayPath(0), usingSeeds(0),
atMemoryLimit(false), inhibitForking(false), haltExecution(false),
ivcEnabled(false),
coreSolverTimeout(MaxCoreSolverTime != 0 && MaxInstructionTime != 0
? std::min(MaxCoreSolverTime, MaxInstructionTime)
: std::max(MaxCoreSolverTime, MaxInstructionTime)),
debugInstFile(0), debugLogBuffer(debugBufferString) {
//Executor类的对象初始化，以上是其变量初始化，具体都是什么意思再说。
if (coreSolverTimeout) UseForkedCoreSolver = true;
Solver *coreSolver = klee::createCoreSolver(CoreSolverToUse);
if (!coreSolver) {
klee_error("Failed to create core solver
");
}
Solver *solver = constructSolverChain(
coreSolver,
interpreterHandler->getOutputFilename(ALL_QUERIES_SMT2_FILE_NAME),
interpreterHandler->getOutputFilename(SOLVER_QUERIES_SMT2_FILE_NAME),
interpreterHandler->getOutputFilename(ALL_QUERIES_KQUERY_FILE_NAME),
interpreterHandler->getOutputFilename(SOLVER_QUERIES_KQUERY_FILE_NAME));
this->solver = new TimingSolver(solver, EqualitySubstitution);//初始化求解器solver，定义了很多方法，如evaluate,mustBeTrue,getValue等。
memory = new MemoryManager(&arrayCache);//memory在哪里初始化的？memory是Executor类的 MemoryManager变量,定义了allocate函数，细节不清楚
设置debug相关信息以及err message的写入
}
}
}
const Module *Executor::setModule(llvm::Module *module,
const ModuleOptions &opts) {
assert(!kmodule && module && "can only register one module"); // XXX gross
kmodule = new KModule(module);//转化为KModule
// Initialize the context.
#if LLVM_VERSION_CODE <= LLVM_VERSION(3, 1)
TargetData *TD = kmodule->targetData;
#else
DataLayout *TD = kmodule->targetData;//不知道代表何种含义
#endif
Context::initialize(TD->isLittleEndian(),
(Expr::Width) TD->getPointerSizeInBits());
specialFunctionHandler = new SpecialFunctionHandler(*this);
specialFunctionHandler->prepare();//遍历handlerInfo中的函数，加入了一些函数的属性信息，NoReturn属性
kmodule->prepare(opts, interpreterHandler);//将module中的信息都升级为KFunction、KInstruction,写入到assembly.ll中
specialFunctionHandler->bind();//遍历handlerInfo中的函数，绑定函数及其hasReturnValue信息
//跟踪状态，输出klee-out-*中的istate和states文件，各种统计信息(如覆盖率)吧
if (StatsTracker::useStatistics() || userSearcherRequiresMD2U()) {
statsTracker =
new StatsTracker(*this,
interpreterHandler->getOutputFilename("assembly.ll"),
userSearcherRequiresMD2U());
}
return module;
}
---------runFunctionAsMain()----------
void Executor::runFunctionAsMain(Function *f,
int argc,
char **argv,
char **envp) {
定义了局部变量：
std::vector<ref<Expr> > arguments;//存储argc,argv地址和环境配置的向量
创建Expr向量arguments
创建MemoryObject* argvMO，为argv和envp参数分配空间并压到arguments中
argvMO =
memory->allocate((argc + 1 + envc + 1 + 1) * NumPtrBytes,
/*isLocal=*/false, /*isGlobal=*/true,
/*allocSite=*/first, /*alignment=*/8);
//创建ExecutionState *state实例
ExecutionState *state = new ExecutionState(kmodule->functionMap[f]);
bindArgument(kf,i,*state,arguments)
//创建ObjectState *argvOS实例，将arvMO与argvMO放进state.Address space中
ObjectState *argvOS = bindObjectInState(*state, argvMO, false);
对每个argv，
//创建Memoryobject对象arg，分配空间
MemoryObject *arg =
memory->allocate(len + 1, /*isLocal=*/false, /*isGlobal=*/true,
/*allocSite=*/state->pc->inst, /*alignment=*/8);
//同时创建ObjectState对象os，绑定state和arg
ObjectState *os = bindObjectInState(*state, arg, false);
for (j=0; j<len+1; j++)
os->write8(j, s[j]);
//向argvOS中写入初始化argv/envp c-string
argvOS->write(i * NumPtrBytes, arg->getBaseExpr());
initializeGlobals(*state)
以state为参创建PTree类型实例processTree,state->ptreeNode=processTree->root
run(*state)
各种释放
}
void Executor::run(ExecutionState &initialState) {
bindModuleConstants();//将Module中每个函数的每条指令都绑定常量
initTimers();
states.insert(&initialState);//将initialState加入到states中
if (usingSeeds) {
std::vector<SeedInfo> &v = seedMap[&initialState];//当state遇到符号分支的时候，满足约束的种子会被加入到seedMap[state]中
//初始的时候，所有KTest都放在initialstate的seedMap[initialState]中
for (std::vector<KTest*>::const_iterator it = usingSeeds->begin(),
ie = usingSeeds->end(); it != ie; ++it)
v.push_back(SeedInfo(*it));
int lastNumSeeds = usingSeeds->size()+10;
double lastTime, startTime = lastTime = util::getWallTime();
ExecutionState *lastState = 0;
while (!seedMap.empty()) {//seedMap非空。seedMap是在Executor类中的变量。里面到底存了多少东西不是很清楚，感觉就是seedMap[initialState]，其他没看到往里放，应该会在executeInstruction的时候放进新的元素吧？？
std::map<ExecutionState*, std::vector<SeedInfo> >::iterator it =
seedMap.upper_bound(lastState);//迭代seedMap中的元素
lastState = it->first;
unsigned numSeeds = it->second.size();
ExecutionState &state = *lastState;//创建state引用，指向lastState
KInstruction *ki = state.pc;//ki指向state的当前指令
stepInstruction(state);//states的instructions计数加1，pc下移
executeInstruction(state, ki);//按照指令的操作符类型，进行相应的处理
processTimers(&state, MaxInstructionTime * numSeeds);
updateStates(&state);//将addedState加入到states,并将removedStates从states中移出，清空added/removedState
if ((stats::instructions % 1000) == 0) {//每当一共执行的指令到1000的倍数
对当前state剩余的seed以及states中剩余的state进行信息提示
}
//seedMap为空
klee_message("seeding done (%d states remain)", (int) states.size());
设置state的权重都为1
searcher = constructUserSearcher(*this);//创建searcher
std::vector<ExecutionState *> newStates(states.begin(), states.end());
searcher->update(0, newStates, std::vector<ExecutionState *>());
while (!states.empty() && !haltExecution) {//如果states非空
ExecutionState &state = searcher->selectState();//选择一个state
KInstruction *ki = state.pc;//获取state的当前指令
stepInstruction(state);//指令下移
executeInstruction(state, ki);//执行指令
processTimers(&state, MaxInstructionTime);
checkMemoryUsage();//检查内存使用
updateStates(&state);//更新states
}
delete searcher;
searcher = 0;
doDumpStates();
}
后面是一些对指令的处理操作，如ret,br,switch等