cozy.terminal_state

Module Contents

Classes

TerminalState

Stores information pertaining specifically to a single SimState.

DeadendedState

This class is used to indicate that execution terminated normally in the contained state.

AssertFailedState

This class is used to indicate that execution failed due to an Assert being satisfiable.

PostconditionFailedState

This class is used to indicate that execution failed due to an Assert being satisfiable.

ErrorState

This class is used to indicate a state that resulted in an error (either my an execution error or ErrorDirective).

class cozy.terminal_state.TerminalState(state: angr.SimState, state_id: int, state_type_str: str)

Stores information pertaining specifically to a single SimState.

Variables:
  • state (SimState) – The state we are storing information about.

  • state_id (int) – The index of this particular state in the corresponding list in RunResult. Note that errored states have separate state_ids from deadended states. Therefore a particular input state here is uniquely identified by the pair (state_id, state_tag), not just state_id by itself.

  • state_type_str (str) – A string representation of the state’s type

property std_out: bytes

The data that has been written to stdout when the program is in this state.

Getter:

The data written to stdout

Type:

bytes

property std_err: bytes

The data that has been written to stderr when the program is in this state.

Getter:

The data written to stderr

Type:

bytes

property side_effects: dict[str, list[cozy.side_effect.PerformedSideEffect]]
property virtual_prints: list[cozy.side_effect.PerformedSideEffect]

Returns the output of the virtual prints that occurred while reaching this state.

Getter:

A list of VirtualPrint directives, along with the values they produced.

Type:

list[tuple[VirtualPrint, claripy.ast.Base]]

property mem_writes: portion.IntervalDict

The memory writes that occurred while reaching this state.

Getter:

An interval dictionary, with the keys being ranges and the values being tuple[int, frozenset[int]]. The first element of the tuple is a unique placeholder, the second element of the tuple are the possible instruction pointer values that wrote to this memory.

Type:

P.IntervalDict

property malloced_names: portion.IntervalDict
concrete_examples(args: any, num_examples=3) list[cozy.concrete.TerminalStateInput]

Concretizes the arguments used to put the program in this singleton state.

Parameters:
  • args (any) – The input arguments to concretize. This argument may be a Python datastructure, the concretizer will make a deep copy with claripy symbolic variables replaced with concrete values.

  • num_examples (int) – The maximum number of concrete examples to generate for this singleton state.

Returns:

A list of concrete inputs that satisfies the constraints attached to the state.

Return type:

list[TerminalStateInput]

class cozy.terminal_state.DeadendedState(state: angr.SimState, state_id: int)

Bases: TerminalState

This class is used to indicate that execution terminated normally in the contained state.

Constructor for DeadendedState

Variables:
  • state (SimState) – The state that terminated normally.

  • state_id (int) – The identifer of the state, determined by its position in the list cozy.project.RunResult.deadended

class cozy.terminal_state.AssertFailedState(assertion: cozy.directive.Assert, cond: claripy.ast.bool, failure_state: angr.SimState, state_id: int)

Bases: TerminalState

This class is used to indicate that execution failed due to an Assert being satisfiable.

Variables:
  • assertion (Assert) – The assertion that was triggered.

  • cond (claripy.ast.bool) – The condition that caused the assertion to trigger

Constructor for AssertFailedState

Parameters:
  • assertion (Assert) – The assertion that was triggered.

  • claripy.ast.bool – The condition which if falsified will trigger the assertion.

  • failure_state (SimState) – The state that was created to test the assertion.

  • state_id (int) – The identifier of the state, determined by its position in the list cozy.project.RunResult.asserts_failed

class cozy.terminal_state.PostconditionFailedState(postcondition: cozy.directive.Postcondition, cond: claripy.ast.bool, failure_state: angr.SimState, state_id: int)

Bases: TerminalState

This class is used to indicate that execution failed due to an Assert being satisfiable.

Variables:
  • assertion (Assert) – The assertion that was triggered.

  • cond (claripy.ast.bool) – The condition that caused the assertion to trigger

Constructor for AssertFailedState

Parameters:
  • assertion (Postcondition) – The postcondition that was triggered.

  • claripy.ast.bool – The condition which if falsified will trigger the postcondition assertion.

  • failure_state (SimState) – The state that was created to test the postcondition assertion.

  • state_id (int) – The identifier of the state, determined by its position in the list cozy.project.RunResult.postconditions_failed

class cozy.terminal_state.ErrorState(error_record: angr.sim_manager.ErrorRecord, state_id: int)

Bases: TerminalState

This class is used to indicate a state that resulted in an error (either my an execution error or ErrorDirective).

Variables:
  • error (SimError) – The error that was thrown.

  • traceback – The traceback attached to the error.

Constructor for ErrorState

Parameters:
  • error_record (ErrorRecord) – The error thrown for this state.

  • state_id (int) – The identifier of the state, determined by it’s position in the list cozy.project.RunResult.errored