def freedom_search(language: Language, space, generate_rules_only=False,
distinct=False,
can_be_same=True):
rules = set()
names = language.all_card_names()
all_vars = list(map(z3.Int, names))
print(names)
print(all_vars)
for cut1 in tqdm(space(1)):
for cut2 in space(2, cut1):
for cut3 in space(3, cut1, cut2):
for sequence in permutations(range(4)):
cuts = (cut1, cut2, cut3)
rule = freedom_of_spelling(all_vars, cuts, sequence, language, can_be_same)
rules.add(rule)
if distinct:
rules.add(Distinct(all_vars))
else:
for position in range(0, 52):
at_starting_point = [card == position for card in all_vars]
rule = AtMost(*at_starting_point, 1)
rules.add(rule)
rules.add(rules_all_cards_on_deck(all_vars))
if generate_rules_only:
return
print(len(rules))
s = Solver()
s.set('smt.arith.random_initial_value', True)
# random_seed (unsigned int) random seed (default: 0)
s.set('random_seed', random.randint(0, 2 ** 8))
# seed (unsigned int) random seed. (default: 0)
s.set('seed', random.randint(0, 2 ** 8))
s.add(rules)
r = s.check()
if r == unsat:
print("no solution")
elif r == unknown:
print("failed to solve")
try:
print(s.reason_unknown())
print(s.model())
except Z3Exception:
return
else:
print(s.model())
def __init__(self, rand: random.Random, expr: z3.ExprRef, solver: z3.Solver):
if self.condition_value is None:
if not solver_is_sat(solver):
debug('bad solver', solver.sexpr())
raise CrosshairInternal('unexpected un sat')
self.condition_value = solver.model().evaluate(expr, model_completion=True)
WorstResultNode.__init__(self, rand, expr == self.condition_value, solver)
def main(known):
s = Solver()
matrix = [[Int(f"m{x}{y}") for x in range(1, 10)] for y in range(1, 10)]
for i in range(9):
for j in range(9):
v = matrix[i][j]
if known[i][j]:
s.add(v == known[i][j])
else:
s.add(v >= 1)
s.add(v <= 9)
for i in range(9):
s.add(Distinct(*[matrix[i][j] for j in range(9)]))
s.add(Distinct(*[matrix[j][i] for j in range(9)]))
for i in range(3):
for j in range(3):
s.add(
Distinct(*[
matrix[3 * i + k][3 * j + l] for k in range(3)
for l in range(3)
]))
s.check()
m = s.model()
print("Solution:")
for i in range(9):
print(*[m[matrix[i][j]] for j in range(9)])
def solve():
start = time.time()
s = Solver()
s.reset()
for req in conf.reqs:
target = req[0]
accessConstraint = req[1]
requirementEncoding = encodeRequirement(target, accessConstraint)
s.add(ForAll(template.getAttributeVars(), requirementEncoding))
timeToTranslate = time.time() - start
measurements.addToTranslationTime(timeToTranslate)
start = time.time()
solution = None
if s.check() == sat:
solution = {}
model = s.model()
for PEP in conf.PEPS:
solution[PEP] = template.PEPPolicy(PEP, model)
else:
solution = unsat
timeToSolve = time.time() - start
measurements.addToSMTTime(timeToSolve)
return solution
def collide(target_str, base_str, count=10, size_suffix=6, prefix=False):
'''Generates a string with the following properties:
* strcmp(res, base_str) = 0
* H(res) == H(target_str)'''
solver = Solver()
if prefix:
res = generate_ascii_printable_string(
'res', size_suffix, solver) + str_to_BitVecVals8(base_str)
else:
res = str_to_BitVecVals8(base_str) + generate_ascii_printable_string(
'res', size_suffix, solver)
target_checksum = H(str_to_BitVecVals8(target_str))
res_checksum = H(res)
solver.add(res_checksum == target_checksum)
for i in range(count):
if solver.check() == sat:
model = solver.model()
if prefix:
solution = "".join(
chr(model[x].as_long())
for x in res[:size_suffix]) + base_str
solver.add(
[x != model[x].as_long() for x in res[:size_suffix]])
else:
solution = base_str + "".join(
chr(model[x].as_long()) for x in res[-size_suffix:])
solver.add(
[x != model[x].as_long() for x in res[-size_suffix:]])
yield solution
def collide(target_str, base_str, count = 10, size_suffix = 6, prefix = False):
'''Generates a string with the following properties:
* strcmp(res, base_str) = 0
* H(res) == H(target_str)'''
solver = Solver()
if prefix:
res = generate_ascii_printable_string('res', size_suffix, solver) + str_to_BitVecVals8(base_str)
else:
res = str_to_BitVecVals8(base_str) + generate_ascii_printable_string('res', size_suffix, solver)
target_checksum = H(str_to_BitVecVals8(target_str))
res_checksum = H(res)
solver.add(res_checksum == target_checksum)
for i in range(count):
if solver.check() == sat:
model = solver.model()
if prefix:
solution = "".join(chr(model[x].as_long()) for x in res[:size_suffix]) + base_str
solver.add([x != model[x].as_long() for x in res[:size_suffix]])
else:
solution = base_str + "".join(chr(model[x].as_long()) for x in res[-size_suffix:])
solver.add([x != model[x].as_long() for x in res[-size_suffix:]])
yield solution
def check_adversarial_robustness_z3():
from z3 import Reals, Int, Solver, If, And
sk, sk_1, zk, zk_1 = Reals('sk sk_1 zk zk_1')
i = Int('i')
s = Solver()
s.add(And(i >= 0, i <= 20, sk_1 >= 0, sk >= 0, zk >= 0, zk_1 >= 0))
A = If(sk * 1 >= 0, sk * 1, 0)
B = If(zk * 1 >= 0, zk * 1, 0)
s.add(If(i == 0,
And(sk >= 0, sk <= 3, zk >= 10, zk <= 21, sk_1 == 0, zk_1 == 0),
sk - zk >= sk_1 - zk_1 + 21 / i))
s.add(And(A < B, i == 20))
# # we negate the condition, instead if for all sk condition we check if there exists sk not condition
# s.add(sk_ReLU * w > ylim)
t = s.check()
if t == sat:
print("z3 result:", s.model())
return False
else:
# print("z3 result:", t)
return True
def get_state(doubles, browser):
if browser == "node":
browser = "chrome"
elif browser not in ("chrome", "firefox", "safari"):
raise ValueError(f"invalid browser {browser}")
if browser == "chrome":
doubles = doubles[::-1]
# from the doubles, generate known piece of the original uint64
generated = [from_double(double, browser) for double in doubles]
# setup symbolic state for xorshift128+
ostate0, ostate1 = BitVecs("ostate0 ostate1", 64)
sym_state0 = ostate0
sym_state1 = ostate1
solver = Solver()
conditions = []
# run symbolic xorshift128+ algorithm for three iterations
# using the recovered numbers as constraints
for val in generated:
sym_state0, sym_state1, ret_conditions = sym_xs128p(
solver, sym_state0, sym_state1, val, browser)
conditions += ret_conditions
if solver.check(conditions) == sat:
# get a solved state
m = solver.model()
state0 = m[ostate0].as_long()
state1 = m[ostate1].as_long()
solver.add(Or(ostate0 != m[ostate0], ostate1 != m[ostate1]))
if solver.check(conditions) == sat:
print("WARNING: multiple solutions found! use more doubles!")
return state0, state1
else:
raise ValueError("unsat model")
def solve(formulas):
s = Solver()
s.add(formulas)
status = s.check(); print(status)
if status == sat:
m = s.model(); print(m)
return m
def solve():
start = time.time()
s = Solver()
s.reset()
for req in conf.reqs:
target = req[0]
accessConstraint = req[1]
requirementEncoding = encodeRequirement(target, accessConstraint)
s.add(ForAll(template.getAttributeVars(), requirementEncoding))
timeToTranslate = time.time() - start
measurements.addToTranslationTime(timeToTranslate)
start = time.time()
solution = None
if s.check() == sat:
solution = {}
model = s.model()
for PEP in conf.PEPS:
solution[PEP] = template.PEPPolicy(PEP, model)
else:
solution = unsat
timeToSolve = time.time() - start
measurements.addToSMTTime(timeToSolve)
return solution
def _z3_bounded_model_count(solver: z3.Solver, variables: List[z3.ExprRef],
u: int) -> Optional[int]:
"""
If the solver assertions have less than u models that are distinct for the given variables it
returns the exact model count, otherwise it returns None.
:param solver:
:param variables:
:param u:
"""
solver.push()
for i in range(u):
response = solver.check()
if response == z3.unknown:
solver.pop()
raise RuntimeError("Solver responded with unknown")
elif response == z3.unsat:
solver.pop()
return i
# in the last iteration adding the constraint would be unnecessary, thus is skipped
if i != u - 1:
# add assertion that found model cannot be satisfying again
m = solver.model()
solver.add(z3.Or([x != m[x] for x in variables]))
solver.pop()
return None
def z3_solve(self, n, timeout_amount):
""" Integer factorization using z3 theorem prover implementation:
We can factor composite integers by SAT solving the model N=PQ directly using the clasuse (n==p*q),
wich gives a lot of degree of freedom to z3, so we want to contraint the search space.
Since every composite number n=pq, there always exists some p>sqrt(n) and q<sqrt(n).
We can safely asume the divisor p is in the range n > p >= next_prime(sqrt(n))
if this later clause doesn't hold and sqrt(p) is prime the number is a perfect square.
We can also asume that p and q are alyaws odd otherwise our whole composite is even.
Not all composite numbers generate a valid model that z3 can SAT.
SAT solving is efficient with low bit count set in the factors,
the complexity of the algorithm grows exponential with every bit set.
The problem of SAT solving integer factorization still is NP complete,
making this just a showcase. Don't expect big gains.
"""
s = Solver()
s.set("timeout", timeout_amount * 1000)
p = Int("p")
q = Int("q")
i = int(isqrt(n))
np = int(next_prime(i))
s.add(p * q == n, n > p, n > q, p >= np, q < i, q > 1, p > 1,
q % 2 != 0, p % 2 != 0)
try:
s_check_output = s.check()
if s_check_output == sat:
res = s.model()
P, Q = res[p].as_long(), res[q].as_long()
assert P * Q == n
return P, Q
else:
return None, None
except:
return None, None
def sat_solve_prev(keystream, next, prev):
"""Find previous keystream by solving boolean satisfiability problem.
Parameters
----------
keystream : list of bool
Current keystream converted to list of boolean representing binary
values
next : list of z3.BoolRef
list containing bit triplet DNF constraints from the original next()
prev : list of z3.BoolRef
list containing bool representation of the previous keystream, to be
used as an index for Solver().model()
Returns
-------
keystream : list of bool
bool representation of keystream input from the previous call of next()
"""
solver = Solver()
for idx in range(N):
# add next keystream bools as constraints
solver.add(next[idx] == keystream[idx])
# check() should be 'sat' because we know we can get back to seed with
# these constraints, but we want to catch semantic errors just in case
if solver.check() == unsat:
raise Exception('Error in SAT DNF constraints')
model = solver.model()
# replace current keystream with solved previous values
for idx in range(N):
keystream[idx] = bool(model[prev[idx]])
return keystream
def solve(self, board, pieces, sum_requirements=[]):
if len(pieces) == 0:
return []
solver = Solver()
# Create z3 variables for each cell
extended_board = [(row, column, value, Int(self.cell_name(row,
column)))
for (row, column, value) in board]
constraints = \
self.set_prefilled_cell_values(extended_board) + \
self.set_possible_target_cell_values(extended_board, pieces) + \
self.require_unique_row_and_column_cells(extended_board) + \
self.match_sum_requirements(extended_board, sum_requirements) + \
self.target_cells_use_all_available_pieces(extended_board, pieces)
for constraint in constraints:
solver.add(constraint)
if solver.check() == sat:
model = solver.model()
return [(row, column, model[cell].as_long())
for (row, column, value, cell) in extended_board
if self.is_cell_empty(value)]
else:
return False
def main():
if len(sys.argv) != 2 or sys.argv[1] in ("-h", "help"):
print("Usage:", sys.argv[0], "NONOGRAMM-FILE")
exit(1)
elif not os.path.isfile(sys.argv[1]):
print("'{}' is not a valid file".format(sys.argv[1]))
exit(1)
nonogramm = Nonogramm.from_file(sys.argv[1])
if nonogramm is None:
print("'{}' doesn't contain a valid nonogramm".format(sys.argv[1]))
exit(2)
solver = Solver()
print("Generating constraints ...")
for constraint in nonogramm.gen_constraints():
solver.add(simplify(constraint))
print("Solving...")
if solver.check() == sat:
print("Solved:")
nonogramm.print_grid(solver.model())
else:
print("Unsolvable!")
def check_unique_solution(pins, problem):
s = Solver()
s.add(problem)
print(problem)
if s.check() == z3.sat:
print(s.model())
s.add(Not(model_to_condition(pins, s.model())))
if s.check() == z3.sat:
print(s.model())
print('Solution not unique!')
else:
print('Solution is unique!')
else:
print('Not solvable!')
def get_z3_result(query, debug=False) -> bool:
s = Solver()
s.add(query)
if s.check() == sat:
if debug:
print(s, s.model())
return True
return False
def _solve(*args, **keywords):
s = Solver()
s.set(**keywords)
s.add(*args)
if keywords.get('show', False):
print(s)
r = s.check()
if r == unsat:
print("no solution")
elif r == unknown:
print("failed to solve")
try:
return s.model()
except Z3Exception as e:
print(e)
return
else:
return s.model()
def fm(a: Formula, b: Formula, env: Environment, solver: z3.Solver,
timer: Timer) -> Tuple[z3.CheckSatResult, Optional[z3.ModelRef]]:
solver.push()
solver.add(toZ3(a, env))
solver.add(z3.Not(toZ3(b, env)))
r = timer.solver_check(solver)
m = solver.model() if r == z3.sat else None
solver.pop()
return (r, m)
def main():
s = Solver()
X = Int('X')
Y = Int('Y')
Z = Int('Z')
# X, Y, Z: 1-9
s.add(*[And(cur >= 1, cur <= 9) for cur in (X, Y, Z)])
s.add(Distinct(X, Y, Z))
given_number = as_number(X, Y, Z)
reversed_number = as_number(Z, Y, X)
high_min_low = symbolic_max(given_number, reversed_number) - symbolic_min(
given_number, reversed_number)
high_min_low_rev = as_number(digit_at_pos(high_min_low, 0),
digit_at_pos(high_min_low, 1),
digit_at_pos(high_min_low, 2))
s.push()
# Check that it always holds/there is no counterexample:
total = high_min_low + high_min_low_rev
s.add(total != 1089)
res = s.check()
if res.r == -1:
print("unsat -> it holds. Example:")
s.pop()
s.add(total == 1089)
s.check()
mod = s.model()
print(f"given number: {mod.eval(given_number)}")
print(f"reversed: {mod.eval(reversed_number)}")
print(
f"highest - lowest: {mod.eval(high_min_low)}, reversed: {mod.eval(high_min_low_rev)}"
)
print(f"sums to: {mod.eval(total)}")
else:
print("sat.")
print(s.model())
def solve_z3(self):
print("[+] {}".format("Sovling using Z3\n"))
symbols = {e: Int(e) for e in self.elements}
# first we build a solver with the general constraints for sudoku puzzles:
s = Solver()
# assure that every cell holds a value of [1,9]
for symbol in symbols.values():
s.add(Or([symbol == int(i) for i in self.cols]))
# assure that every row covers every value:
for row in "ABCDEFGHI":
s.add(Distinct([symbols[row + col] for col in "123456789"]))
# assure that every column covers every value:
for col in "123456789":
s.add(Distinct([symbols[row + col] for row in "ABCDEFGHI"]))
# assure that every block covers every value:
for i in range(3):
for j in range(3):
s.add(
Distinct([
symbols["ABCDEFGHI"[m + i * 3] +
"123456789"[n + j * 3]] for m in range(3)
for n in range(3)
]))
# adding sum constraints if provided
if self.constraints is not None:
print("[+] {}\n{}".format("Applying constraints",
self.constraints))
sum_constr = self.get_constraints()
for c in sum_constr:
expr = []
for i in c[0]:
expr.append("symbols['" + i + "']")
s.add(eval("+".join(expr) + "==" + str(c[1])))
# now we put the assumptions of the given puzzle into the solver:
for elem, value in self.values.items():
if value in "123456789":
s.add(symbols[elem] == value)
if not s.check() == sat:
raise Exception("Unsolvable")
model = s.model()
values = {e: model.evaluate(s).as_string() for e, s in symbols.items()}
self.solution = values
def test_sort_duplicates(self):
lst_to_sort = [10, 9, 8, 7, 6, 10, 9, 8, 7, 6, 1]
sorted_variables, assertions = sort_bubble(lst_to_sort)
s = Solver()
s.add(assertions)
result = s.check()
solution = s.model()
sorted_integers = [solution[v].as_long() for v in sorted_variables]
self.assertEqual(result, sat)
self.assertEqual(sorted_integers, [1, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10])
def dd_solve_(dd, vr1s1, vr1s2, vr2s1, vr2s2, wavelength):
sol = Solver()
r1s1, r1s2, r2s1, r2s2 = Ints('r1s1 r1s2 r2s1 r2s2')
err = Real('err')
err1, err1, err3, err4 = Reals('err1 err2 err3 err4')
# sol.add(err > 0)
sol.add(r1s1 - r1s2 - r2s1 + r2s2 == dd)
sol.add(ToReal(r1s1)*wavelength + err1 > vr1s1)
sol.add(ToReal(r1s1)*wavelength - err1 < vr1s1)
sol.add(ToReal(r1s2)*wavelength + err2 > vr1s2)
sol.add(ToReal(r1s2)*wavelength - err2 < vr1s2)
sol.add(ToReal(r2s1)*wavelength + err3 > vr2s1)
sol.add(ToReal(r2s1)*wavelength - err3 < vr2s1)
sol.add(ToReal(r2s2)*wavelength + err4 > vr2s2)
sol.add(ToReal(r2s2)*wavelength - err4 < vr2s2)
if sol.check() != sat:
return None
def minimize():
# try to push the error lower, if possible
for mult in [0.5, 0.85]:
while sol.check() == sat:
sol.push()
sol.check()
err_bound = frac_to_float(sol.model()[err])
if err_bound < 0.2:
# not gonna do better than that...
return
sol.add(err < err_bound*mult)
sol.pop()
sol.check()
minimize()
return (
[sol.model()[r].as_long() for r in [r1s1, r1s2, r2s1, r2s2]],
frac_to_float(sol.model()[err])
)
def __init__(self, rand: random.Random, expr: z3.ExprRef,
solver: z3.Solver):
if not solver_is_sat(solver):
debug("Solver unexpectedly unsat; solver state:", solver.sexpr())
raise CrosshairInternal("Unexpected unsat from solver")
self.condition_value = solver.model().evaluate(expr,
model_completion=True)
self._stats_key = f"realize_{expr}" if z3.is_const(expr) else None
WorstResultNode.__init__(self, rand, expr == self.condition_value,
solver)
class MySolver(object):
def __init__(self):
self._solver = Solver()
# TODO: Initialize datatypes here
# TODO: Port the below functions to here as methods
def push(self):
"""Push solver state."""
self._solver.push()
def pop(self):
"""Pop solver state."""
self._solver.pop()
def add(self, assertion):
"""Add an assertion to the solver state.
Arguments:
assertion : Z3-friendly predicate or boolean
"""
return self._solver.add(assertion)
def model(self):
"""Return a model for the current solver state.
Returns:
: Z3 model. TODO: Modify this all so that it returns sets, etc.
"""
return self._solver.model()
def check(self):
"""Check satisfiability of current satisfiability state.
Returns:
: boolean -- True if sat, False if unsat
"""
# check() returns either unsat or sat
# sat.r is 1, unsat.r is -1
return self._solver.check().r > 0
@contextmanager
def context(self):
"""To do something in between a push and a pop, use a `with context()`."""
self.push()
yield
self.pop()
def quick_check(self, assertion):
"""Add an assertion only temporarily, and check sat."""
with self.context():
self.add(assertion)
return self.check()
def all_solutions_point2(solver: z3.Solver,
fillet_center) -> typing.List[Point2]:
solutions = []
x, y = fillet_center
while solver.check() == z3.sat:
m = solver.model()
solution = Point2(solution_as_float(m[x]), solution_as_float(m[y]))
solutions.append(solution)
solver.add((x - solution.x)**2 +
(y - solution.y)**2 > 10**(-PRECISION) * 100)
return solutions
def print_solution(problem):
print(problem)
print(z3.simplify(problem))
s = Solver()
s.add(problem)
if s.check() == z3.sat:
m = s.model()
print(m)
else:
print('unsat')
def test_sort_no_duplicates(self):
lst_to_sort = [10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0, -1, -2]
sorted_variables, assertions = sort_no_duplicates(lst_to_sort)
s = Solver()
s.add(assertions)
result = s.check()
solution = s.model()
sorted_integers = [solution[v].as_long() for v in sorted_variables]
self.assertEqual(result, sat)
self.assertEqual(sorted_integers,
[-2, -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10])
def get_model(constraints):
s = Solver()
s.set("timeout", 100000)
for constraint in constraints:
s.add(constraint)
result = s.check()
if result == sat:
return s.model()
elif result == unknown:
logging.info("Timeout encountered while solving expression using z3")
raise UnsatError
def test_concrete_calldata_calldatasize():
# Arrange
calldata = ConcreteCalldata(0, [1, 4, 7, 3, 7, 2, 9])
solver = Solver()
# Act
solver.check()
model = solver.model()
result = model.eval(calldata.calldatasize)
# Assert
assert result == 7
def solve(formula):
solver = Solver()
solver.add(formula)
# print(formula)
result = solver.check()
if str(result) == "sat":
m = solver.model()
if len(ST.alphabet) < 3 and ST.k < 3:
for v in ST.var_list:
print("{}: {}".format(v, m[v]))
elif str(result) == "unsat":
print("UNSAT")
def Password():
from z3 import Int, Solver
Buffer = Int('Buffer')
v9 = Int('v9')
v10 = Int('v10')
v11 = Int('v11')
v12 = Int('v12')
v13 = Int('v13')
v14 = Int('v14')
v15 = Int('v15')
v16 = Int('v16')
v17 = Int('v17')
s = Solver()
s.add(v14 + v15 == 205)
s.add(v13 + v16 == 201)
s.add(v11 + v14 + v15 == 314)
s.add(v13 + v16 + v12 + v17 == 367)
s.add(Buffer + v9 == 194)
s.add(v17 + v16 + v15 + v14 + v13 + v12 + v11 + v10 + v9 + Buffer == 923)
s.add(v16 == 85)
s.add(Buffer + v10 == 128)
s.add(v12 - v15 == -50)
s.add(v14 + v17 == 219)
return "Status : %s \nPassword = %s" % (
s.check(),
chr(s.model()[Buffer].as_long()) + chr(s.model()[v9].as_long()) +
chr(s.model()[v10].as_long()) + chr(s.model()[v11].as_long()) +
chr(s.model()[v12].as_long()) + chr(s.model()[v13].as_long()) +
chr(s.model()[v14].as_long()) + chr(s.model()[v15].as_long()) +
chr(s.model()[v16].as_long()) + chr(s.model()[v17].as_long()))
def get_model(constraints):
s = Solver()
s.set("timeout", 2000)
for constraint in constraints:
s.add(constraint)
if (s.check() == sat):
return s.model()
else:
raise UnsatError
def is_tautology(formula) :
"""Check whether the formula is a tautology, and give a counterexample
if it is not.
Parameters
----------
formula@Formula - The formula to be tested.
Returns
----------
check_res@bool - Whether the formula is a tautology.
counterexample@Model - None if the formula is a tautology, otherwise a
counterexample.
"""
s = Solver()
s.add(Not(formula))
if s.check() == unsat :
return True, None
return False, s.model()
def check_termination(trs, DEBUG=False):
# create the variables we're solving for
W = WeightFunction(trs.functions)
P = Precedence(trs.functions)
# create solver and constraints
solver = Solver()
if DEBUG: print("Solver created...")
# constraint 1: weight constraints
solver.assert_exprs(W[0] > 0)
for f, arity in trs.functions.items():
solver.assert_exprs(P[f] >= 0)
if arity == 0:
solver.assert_exprs(W[f] >= W[0])
elif arity == 1:
local_constraints = []
for g in trs.functions.keys():
local_constraints.append(P[f] >= P[g])
solver.assert_exprs(Implies(W[f] == 0, And(local_constraints)))
if DEBUG: print("Weight constraints asserted...")
# constraint 2: kbo constraint per rule
for lhs, rhs in trs.rules:
solver.assert_exprs(kbo(lhs, rhs, trs, W, P))
if DEBUG: print("Rule constraint asserted...")
if DEBUG:
for c in solver.assertions():
print(c.sexpr())
print("Starting z3...")
start_time = clock()
if solver.check() == unsat:
if DEBUG: print("Done - z3 ran for {} seconds.".format(clock() - start_time))
return None
else:
model = solver.model()
weights, precedence = {}, {}
for f in trs.functions.keys():
weights[f] = model[W[f]].as_long()
precedence[f] = model[P[f]].as_long()
weights[0] = model[W[0]].as_long()
if DEBUG: print("Done - z3 ran for {} seconds.".format(clock() - start_time))
return weights, precedence
def get_models(F):
result = []
s = Solver()
s.add(F)
while True:
if s.check() == sat:
m = s.model()
result.append(m)
# Create a new constraint the blocks the current model
block = []
for d in m:
# d is a declaration
if d.arity() > 0:
raise Z3Exception(
"uninterpreted functions are not suppported")
# create a constant from declaration
c = d()
if is_array(c) or c.sort().kind() == Z3_UNINTERPRETED_SORT:
raise Z3Exception(
"arrays and uninterpreted sorts are not supported")
block.append(c != m[d])
s.add(Or(block))
else:
return result
solver.add(IsKinase(MEK1))
solver.add(IsKinase(ERK1))
solver.add(IsKinase(RAF))
solver.add(Not(IsKinase(HRAS)))
solver.add(Phosphorylates(MEK1, ERK1))
solver.add(Phosphorylates(RAF, MEK1))
solver.add(IsActiveWhenPhosphorylated(MEK1))
solver.add(IsActiveWhenPhosphorylated(ERK1))
solver.add(IsActiveWhenPhosphorylated(SAF1))
### SOLVING THE MODEL
solver.check()
model = solver.model()
print model
### QUERIES
def is_valid(predicate):
solver.push()
solver.add(Not(predicate))
response = solver.check().r
solver.pop()
if response > 0:
return False
return True
def is_sat(predicate):
def Synthesize(spec, specInputPorts, specConn, circuits):
wellFormedConstraints = [Bool(True)]
for circuit in circuits:
wellFormedConstraints.append(circuit.GenerateWellFormednessConstraints())
wellFormedConstraints.append(GenerateCircuitSimilarityConstraints(circuits))
psiWfp = And(wellFormedConstraints)
psiConn = And([circuit.GenerateConnectionConstraints() for circuit in circuits])
#if logger.IsLogging(): print psiConn
examples = []
iterCounter = 0
synthSolver = Solver()
verifSolver = Solver()
synthSolver.assert_exprs(psiWfp)
synthSolver.assert_exprs(GenerateConstraintForExample(spec, specConn, circuits,
psiConn, {}, iterCounter))
while True:
iterCounter+=1
if logger.IsLogging(): print 'Attempting Synthesis...'
if synthSolver.check() == unsat:
if logger.IsLogging(): print 'Synth Failed!'
return False
model = synthSolver.model()
if logger.IsLogging(): print 'Synthesized program:\n'
if logger.IsLogging():
for circuit in circuits:
print circuit.funcName
print circuit.LValToProg(model)
print '\n'
verifConstraint = GenerateVerificationConstraint(spec, specConn,
circuits, psiConn, model)
verifSolver.push()
verifSolver.assert_exprs(verifConstraint)
if logger.IsLogging(): print 'Attempting Verification...'
#if logger.IsLogging(): print verifConstraint
#raw_input("waiting for keypress")
if (verifSolver.check() == unsat):
if logger.IsLogging(): print 'Verification succeeded!\n'
verifSolver.pop()
if logger.IsLogging(): print 'Took %d iterations to '\
'complete synthesis' % (iterCounter)
if logger.IsLogging(): print 'Final Circuits:\n'
printedCircuits = []
for circuit in circuits:
if not circuit.funcName in printedCircuits:
print circuit.GenerateCircuitExpression(model)
printedCircuits.append(circuit.funcName)
return True
if logger.IsLogging(): print 'Verification Failed!\n'
newExample = GetExampleFromInputModel(verifSolver.model(), specInputPorts)
verifSolver.pop()
examples.append(newExample)
synthConstraintForExample = GenerateConstraintForExample(spec, specConn,
circuits, psiConn, newExample, iterCounter)
synthSolver.assert_exprs(synthConstraintForExample)
if logger.IsLogging(): print 'Added Example %d:' % iterCounter
if logger.IsLogging(): print newExample
def synthesize_with_components(self, components, constraint, system):
# components maps unique comp_ids to component objects
# not one-to-one, but def. onto
# step 0: some useful values
card_I, N = len(self.synth_function.parameters), len(components)
# step 1: make some solvers
synth_solver = Solver()
verify_solver = Solver()
# step 2: initialize examples
S = []
# step 2b: create location variables and location constraints
initial_constraints = []
L = create_location_variables(components)
if system:
patterns = create_pattern_constraints(L, components, system)
initial_constraints.append(patterns)
wfp = create_wfp_constraint(L, N)
initial_constraints.append(wfp)
# step 3: looooooooop
while True:
# step 4: assert L constraint
synth_solver.assert_exprs(*initial_constraints)
# step 5: start the looooop
for i, X in enumerate(S):
I, O, T = [], [], []
for w in range(constraint.width):
# step 6: create I, O, T for synth at width i
I_w = create_input_variables(self.synth_function.parameters, i, w)
O_w = create_output_variables(self.synth_function.output, i, w)
T_w = create_temp_variables(components, i, w)
# step 7: assert library and connection constraints
lib = create_lib_constraint(T_w, I_w, components)
# for conn constraint, need map from component_id to l value
locations = create_location_map(O_w, T_w, L, N)
conn = create_conn_constraint(O_w, T_w, locations)
synth_solver.assert_exprs(lib, conn)
I += I_w
O += O_w
T += T_w
# step 8: once we've got all the I, O, we can assert the spec constraint
conn_spec, spec = create_spec_constraint(I, O, X, constraint)
synth_solver.assert_exprs(conn_spec, spec)
# get a model, or just bail
if synth_solver.check() == unsat:
if DEBUG: print("Failed to find a model.")
return None
model = synth_solver.model()
curr_l = [l._replace(value=model[l.value]) for l in L]
# step 9: need to verify the model we just found, so we'll construct verificatio constraint
I, O, T = [], [], []
for w in range(constraint.width):
# same as above, but we only have a single example
I_w = create_input_variables(self.synth_function.parameters, 0, w)
O_w = create_output_variables(self.synth_function.output, 0, w)
T_w = create_temp_variables(components, 0, w)
lib = create_lib_constraint(T_w, I_w, components)
locations = create_location_map(O_w, T_w, curr_l, N)
conn = create_conn_constraint(O_w, T_w, locations)
verify_solver.assert_exprs(lib, conn)
I += I_w
O += O_w
T += T_w
# now we need to create variables for X so we can check our spec
X = create_spec_variables(constraint, self.variables)
conn_spec, spec = create_spec_constraint(I, O, X, constraint)
verify_solver.assert_exprs(conn_spec, Not(spec))
# now we'll try and get a model of our exectution
if verify_solver.check() == unsat:
return curr_l
model = verify_solver.model()
example = [x._replace(value=model[x.value]) for x in X]
S.append(example)
if DEBUG:
print("Found bad solution: ", [l.value.sexpr() for l in curr_l])
# clear synthesizers and start anew
synth_solver.reset()
verify_solver.reset()
return None
def exploit(t):
target = lambda: remote(t['hostname'], t['port'], timeout=3)
try:
with target() as s:
n_inputs = int(s.recvline().strip())
for _ in range(n_inputs):
inp = s.recvline().strip()
c1, c2, c3 = solve_for(inp)
s.sendline('{} {} {}'.format(c1, c2, c3))
s.recvuntil("want?:")
s.send("2\n3\n19\n"+t['flag_id']+"\n16\n"+"A"*16+"\n0\n")
s.recvuntil("GameTime:")
v19_c, v20_c, x_c, v22_c, v23_c, y_c = map(int, s.recv().split(', '))
solv = Solver()
v18 = Int('v18')
v21 = Int('v21')
v19 = Int('v19')
solv.add(v19 == v19_c)
v20 = Int('v20')
solv.add(v20 == v20_c)
v22 = Int('v22')
solv.add(v22 == v22_c)
v23 = Int('v23')
solv.add(v23 == v23_c)
x = Int('x')
solv.add(x == x_c)
solv.add(x == v19*v18 + v20*v21)
y = Int('y')
solv.add(y == y_c)
solv.add(y == v22*v18 + v21*v23)
solv.check()
solv.model()
s.sendline(str(solv.model()[v18].as_long()))
s.sendline(str(solv.model()[v21].as_long()))
s.recvuntil("log:")
s.send("15\n:83xkHFchNObsWf\n")
s.recvuntil("):")
s.sendline("478175")
s.recvuntil("Name:")
magic = s.recvuntil(":")[:-1]
with target() as s:
n_inputs = int(s.recvline().strip())
for _ in range(n_inputs):
inp = s.recvline().strip()
c1, c2, c3 = solve_for(inp)
s.sendline('{} {} {}'.format(c1, c2, c3))
s.recvuntil("want?:")
s.send("2\n5\n19\n"+t['flag_id']+"\n16\n"+magic+"\n")
s.recvline()
flag = s.recvline().strip()
return flag
except:
return
class ACL22SMT(object):
class status:
def __init__(self, value):
self.value = value
def __str__(self):
if self.value is True:
return "QED"
elif self.value.__class__ == "msg".__class__:
return self.value
else:
raise Exception("unknown status?")
def isThm(self):
return self.value is True
class atom: # added my mrg, 21 May 2015
def __init__(self, string):
self.who_am_i = string.lower()
def __eq__(self, other):
return self.who_am_i == other.who_am_i
def __ne__(self, other):
return self.who_am_i != other.who_am_i
def __str__(self):
return self.who_am_i
def __init__(self, solver=0):
if solver != 0:
self.solver = solver
else:
self.solver = Solver()
self.nameNumber = 0
def newVar(self):
varName = "$" + str(self.nameNumber)
self.nameNumber = self.nameNumber + 1
return varName
def isBool(self, who):
return Bool(who)
def isInt(self, who):
return Int(who)
def isReal(self, who):
return Real(who)
def plus(self, *args):
return reduce(lambda x, y: x + y, args)
def times(self, *args):
return reduce(lambda x, y: x * y, args)
def reciprocal(self, x):
if type(x) is int:
return Q(1, x)
elif type(x) is float:
return 1.0 / x
else:
return 1.0 / x
def negate(self, x):
return -x
def lt(self, x, y):
return x < y
def equal(self, x, y):
return x == y
def notx(self, x):
return Not(x)
def implies(self, x, y):
return Implies(x, y)
def Qx(self, x, y):
return Q(x, y)
# type related functions
def integerp(self, x):
return sort(x) == IntSort()
def rationalp(self, x):
return sort(x) == RealSort()
def booleanp(self, x):
return sort(x) == BoolSort()
def ifx(self, condx, thenx, elsex):
return If(condx, thenx, elsex)
# usage prove(claim) or prove(hypotheses, conclusion)
def prove(self, hypotheses, conclusion=0):
if conclusion is 0:
claim = hypotheses
else:
claim = Implies(hypotheses, conclusion)
self.solver.push()
self.solver.add(Not(claim))
res = self.solver.check()
if res == unsat:
print "proved"
return self.status(True) # It's a theorem
elif res == sat:
print "counterexample"
m = self.solver.model()
print m
# return an counterexample??
return self.status(False)
else:
print "failed to prove"
r = self.status(False)
self.solver.pop()
return r
def __call__(self, project, test, dump):
logger.info('inferring specification for test \'{}\''.format(test))
environment = dict(os.environ)
if self.config['klee_max_forks'] is not None:
environment['ANGELIX_KLEE_MAX_FORKS'] = str(self.config['klee_max_forks'])
if self.config['klee_max_depth'] is not None:
environment['ANGELIX_KLEE_MAX_DEPTH'] = str(self.config['klee_max_depth'])
if self.config['klee_search'] is not None:
environment['ANGELIX_KLEE_SEARCH'] = self.config['klee_search']
if self.config['klee_timeout'] is not None:
environment['ANGELIX_KLEE_MAX_TIME'] = str(self.config['klee_timeout'])
if self.config['klee_solver_timeout'] is not None:
environment['ANGELIX_KLEE_MAX_SOLVER_TIME'] = str(self.config['klee_solver_timeout'])
if self.config['klee_debug']:
environment['ANGELIX_KLEE_DEBUG'] = 'YES'
if self.config['klee_ignore_errors']:
environment['KLEE_DISABLE_MEMORY_ERROR'] = 'YES'
if self.config['use_semfix_syn']:
environment['ANGELIX_USE_SEMFIX_SYN'] = 'YES'
environment['ANGELIX_KLEE_WORKDIR'] = project.dir
test_dir = self.get_test_dir(test)
shutil.rmtree(test_dir, ignore_errors='true')
klee_dir = join(test_dir, 'klee')
os.makedirs(klee_dir)
self.run_test(project, test, klee=True, env=environment)
# loading dump
# name -> value list
oracle = dict()
vars = os.listdir(dump)
for var in vars:
instances = os.listdir(join(dump, var))
for i in range(0, len(instances)):
if str(i) not in instances:
logger.error('corrupted dump for test \'{}\''.format(test))
raise InferenceError()
oracle[var] = []
for i in range(0, len(instances)):
file = join(dump, var, str(i))
with open(file) as f:
content = f.read()
oracle[var].append(content)
# solving path constraints
angelic_paths = []
solver = Solver()
smt_glob = join(project.dir, 'klee-out-0', '*.smt2')
smt_files = glob(smt_glob)
for smt in smt_files:
logger.info('solving path {}'.format(relpath(smt)))
try:
path = z3.parse_smt2_file(smt)
except:
logger.warning('failed to parse {}'.format(smt))
continue
variables = [str(var) for var in get_vars(path)
if str(var).startswith('int!')
or str(var).startswith('bool!')
or str(var).startswith('char!')
or str(var).startswith('reachable!')]
outputs, choices, constants, reachable, original_available = parse_variables(variables)
# name -> value list (parsed)
oracle_constraints = dict()
def str_to_int(s):
return int(s)
def str_to_bool(s):
if s == 'false':
return False
if s == 'true':
return True
raise InferenceError()
def str_to_char(s):
if len(s) != 1:
raise InferenceError()
return s[0]
dump_parser_by_type = dict()
dump_parser_by_type['int'] = str_to_int
dump_parser_by_type['bool'] = str_to_bool
dump_parser_by_type['char'] = str_to_char
def bool_to_bv32(b):
if b:
return BitVecVal(1, 32)
else:
return BitVecVal(0, 32)
def int_to_bv32(i):
return BitVecVal(i, 32)
to_bv32_converter_by_type = dict()
to_bv32_converter_by_type['bool'] = bool_to_bv32
to_bv32_converter_by_type['int'] = int_to_bv32
def bv32_to_bool(bv):
return bv.as_long() != 0
def bv32_to_int(bv):
l = bv.as_long()
if l >> 31 == 1: # negative
l -= 4294967296
return l
from_bv32_converter_by_type = dict()
from_bv32_converter_by_type['bool'] = bv32_to_bool
from_bv32_converter_by_type['int'] = bv32_to_int
matching_path = True
for expected_variable, expected_values in oracle.items():
if expected_variable == 'reachable':
expected_reachable = set(expected_values)
if not (expected_reachable == reachable):
logger.info('labels \'{}\' executed while {} required'.format(
list(reachable),
list(expected_reachable)))
matching_path = False
break
continue
if expected_variable not in outputs.keys():
outputs[expected_variable] = (None, 0) # unconstraint does not mean wrong
required_executions = len(expected_values)
actual_executions = outputs[expected_variable][1]
if required_executions != actual_executions:
logger.info('value \'{}\' executed {} times while {} required'.format(
expected_variable,
actual_executions,
required_executions))
matching_path = False
break
oracle_constraints[expected_variable] = []
for i in range(0, required_executions):
type = outputs[expected_variable][0]
try:
value = dump_parser_by_type[type](expected_values[i])
except:
logger.error('variable \'{}\' has incompatible type {}'.format(expected_variable,
type))
raise InferenceError()
oracle_constraints[expected_variable].append(value)
if not matching_path:
continue
solver.reset()
solver.add(path)
def array_to_bv32(array):
return Concat(Select(array, BitVecVal(3, 32)),
Select(array, BitVecVal(2, 32)),
Select(array, BitVecVal(1, 32)),
Select(array, BitVecVal(0, 32)))
def angelic_selector(expr, instance):
s = 'angelic!{}!{}!{}!{}!{}'.format(expr[0], expr[1], expr[2], expr[3], instance)
return BitVec(s, 32)
def original_selector(expr, instance):
s = 'original!{}!{}!{}!{}!{}'.format(expr[0], expr[1], expr[2], expr[3], instance)
return BitVec(s, 32)
def env_selector(expr, instance, name):
s = 'env!{}!{}!{}!{}!{}!{}'.format(name, expr[0], expr[1], expr[2], expr[3], instance)
return BitVec(s, 32)
for name, values in oracle_constraints.items():
type, _ = outputs[name]
for i, value in enumerate(values):
array = self.output_variable(type, name, i)
bv_value = to_bv32_converter_by_type[type](value)
solver.add(bv_value == array_to_bv32(array))
for (expr, item) in choices.items():
type, instances, env = item
for instance in range(0, instances):
selector = angelic_selector(expr, instance)
array = self.angelic_variable(type, expr, instance)
solver.add(selector == array_to_bv32(array))
selector = original_selector(expr, instance)
array = self.original_variable(type, expr, instance)
solver.add(selector == array_to_bv32(array))
for name in env:
selector = env_selector(expr, instance, name)
env_type = 'int' #FIXME
array = self.env_variable(env_type, expr, instance, name)
solver.add(selector == array_to_bv32(array))
result = solver.check()
if result != z3.sat:
logger.info('UNSAT')
continue
model = solver.model()
# store smt2 files
shutil.copy(smt, klee_dir)
# generate IO file
self.generate_IO_file(test, choices, oracle_constraints, outputs)
# expr -> (angelic * original * env) list
angelic_path = dict()
for (expr, item) in choices.items():
angelic_path[expr] = []
type, instances, env = item
for instance in range(0, instances):
bv_angelic = model[angelic_selector(expr, instance)]
angelic = from_bv32_converter_by_type[type](bv_angelic)
bv_original = model[original_selector(expr, instance)]
original = from_bv32_converter_by_type[type](bv_original)
if original_available:
logger.info('expression {}[{}]: angelic = {}, original = {}'.format(expr,
instance,
angelic,
original))
else:
logger.info('expression {}[{}]: angelic = {}'.format(expr,
instance,
angelic))
env_values = dict()
for name in env:
bv_env = model[env_selector(expr, instance, name)]
value = from_bv32_converter_by_type['int'](bv_env)
env_values[name] = value
if original_available:
angelic_path[expr].append((angelic, original, env_values))
else:
angelic_path[expr].append((angelic, None, env_values))
# TODO: add constants to angelic path
angelic_paths.append(angelic_path)
# update IO files
for smt in glob(join(klee_dir, '*.smt2')):
with open(smt) as f_smt:
for line in f_smt.readlines():
if re.search("declare-fun [a-z]+!output!", line):
output_var = line.split(' ')[1]
output_var_type = output_var.split('!')[0]
for io_file in glob(join(test_dir, '*.IO')):
if not output_var in open(io_file).read():
with open(io_file, "a") as f_io:
f_io.write("\n")
f_io.write("@output\n")
f_io.write('name {}\n'.format(output_var))
f_io.write('type {}\n'.format(output_var_type))
if self.config['max_angelic_paths'] is not None and \
len(angelic_paths) > self.config['max_angelic_paths']:
angelic_paths = self._reduce_angelic_forest(angelic_paths)
else:
logger.info('found {} angelic paths for test \'{}\''.format(len(angelic_paths), test))
return angelic_paths
q2x = p1[0]+t2*(p2[0]-p1[0])
q2y = p1[1]+t2*(p2[1]-p1[1])
q3x = p2[0]+t3*(p3[0]-p2[0])
q3y = p2[1]+t3*(p3[1]-p2[1])
q4x = p3[0]+t4*(p4[0]-p3[0])
q4y = p3[1]+t4*(p4[1]-p3[1])
solver = Solver()
solver.add(t1 >= 0, t2 >= 0, t3 >= 0, t4 >= 0)
solver.add(t1 <= 1, t2 <= 1, t3 <= 1, t4 <= 1)
def orthogonal(px, py, qx, qy, rx, ry):
return (px-qx)*(rx-qx)+(py-qy)*(ry-qy) == 0
solver.add(orthogonal(q1x, q1y, q2x, q2y, q3x, q3y))
solver.add(orthogonal(q2x, q2y, q3x, q4y, q4x, q4y))
solver.add(orthogonal(q3x, q3y, q4x, q4y, q1x, q1y))
solver.add(orthogonal(q4x, q4y, q1x, q1y, q2x, q2y))
solver.add((q2x-q1x)**2+(q2y-q1y)**2 == (q4x-q3x)**2+(q4y-q3y)**2)
solver.add((q3x-q2x)**2+(q3y-q2y)**2 == (q4x-q1x)**2+(q4y-q1y)**2)
solver.add()
solver.check()
print(solver.model())
from z3 import Solver, BitVec
s = Solver()
x = BitVec('x', 32)
s.add(x > 1337)
s.add(x*7 + 4 == 1337)
s.check()
print s.model()
from z3 import Real, Solver
s = Solver()
x = Real('x')
s.add((x * 3.0 + 18.0) == (x * 12.56637061435917))
print s.check()
print s.model()
print s.model()[x].as_decimal(10)
s = Solver()
s.add(dword_3 + dword_2 == 0x0C0DCDFCE)
s.add(dword_3 + dword_2 == 0x0C0DCDFCE)
s.add(dword_2 + dword_1 == 0x0D5D3DDDC)
s.add((dword_2 * 5) + (dword_1 * 3) == 0x404A7666)
s.add((dword_4 ^ dword_1) == 0x18030607)
s.add((dword_1 & dword_4) == 0x666C6970)
s.add(dword_2 * dword_5 == 0xB180902B)
s.add(dword_5 * dword_3 == 0x3E436B5F)
s.add(dword_5 + (dword_6 * 2) == 0x5C483831)
s.add((dword_6 & 0x70000000) == 0x70000000)
s.add(dword_6 / dword_7 == 1)
s.add(dword_6 % dword_7 == 0x0E000CEC)
s.add((dword_5 * 3) + (dword_8 * 2) == 0x3726EB17)
s.add((dword_8 * 7) + (dword_3 * 4) == 0x8B0B922D)
s.add((dword_8 * 3) + dword_4 == 0xB9CF9C91)
s.check()
m = s.model()
dword_map = {}
for d in m.decls():
dword_map[d.name()] = m[d].as_signed_long()
for key in sorted(dword_map):
print_dword(dword_map[key])
print ""
def __call__(self, project, test, dump, validation_project):
logger.info('inferring specification for test \'{}\''.format(test))
environment = dict(os.environ)
if self.config['klee_max_forks'] is not None:
environment['ANGELIX_KLEE_MAX_FORKS'] = str(self.config['klee_max_forks'])
if self.config['klee_max_depth'] is not None:
environment['ANGELIX_KLEE_MAX_DEPTH'] = str(self.config['klee_max_depth'])
if self.config['klee_search'] is not None:
environment['ANGELIX_KLEE_SEARCH'] = self.config['klee_search']
if self.config['klee_timeout'] is not None:
environment['ANGELIX_KLEE_MAX_TIME'] = str(self.config['klee_timeout'])
if self.config['klee_solver_timeout'] is not None:
environment['ANGELIX_KLEE_MAX_SOLVER_TIME'] = str(self.config['klee_solver_timeout'])
if self.config['klee_debug']:
environment['ANGELIX_KLEE_DEBUG'] = 'YES'
if self.config['klee_ignore_errors']:
environment['KLEE_DISABLE_MEMORY_ERROR'] = 'YES'
if self.config['use_semfix_syn']:
environment['ANGELIX_USE_SEMFIX_SYN'] = 'YES'
environment['ANGELIX_KLEE_WORKDIR'] = project.dir
klee_start_time = time.time()
self.run_test(project, test, klee=True, env=environment)
klee_end_time = time.time()
klee_elapsed = klee_end_time - klee_start_time
statistics.data['time']['klee'] += klee_elapsed
statistics.save()
logger.info('sleeping for 1 second...')
time.sleep(1)
smt_glob = join(project.dir, 'klee-out-0', '*.smt2')
smt_files = glob(smt_glob)
err_glob = join(project.dir, 'klee-out-0', '*.err')
err_files = glob(err_glob)
err_list = []
for err in err_files:
err_list.append(os.path.basename(err).split('.')[0])
non_error_smt_files = []
for smt in smt_files:
smt_id = os.path.basename(smt).split('.')[0]
if not smt_id in err_list:
non_error_smt_files.append(smt)
if not self.config['ignore_infer_errors']:
smt_files = non_error_smt_files
if len(smt_files) == 0 and len(err_list) == 0:
logger.warning('No paths explored')
raise NoSmtError()
if len(smt_files) == 0:
logger.warning('No non-error paths explored')
raise NoSmtError()
# loading dump
# name -> value list
oracle = dict()
vars = os.listdir(dump)
for var in vars:
instances = os.listdir(join(dump, var))
for i in range(0, len(instances)):
if str(i) not in instances:
logger.error('corrupted dump for test \'{}\''.format(test))
raise InferenceError()
oracle[var] = []
for i in range(0, len(instances)):
file = join(dump, var, str(i))
with open(file) as f:
content = f.read()
oracle[var].append(content)
# solving path constraints
inference_start_time = time.time()
angelic_paths = []
z3.set_param("timeout", self.config['path_solving_timeout'])
solver = Solver()
for smt in smt_files:
logger.info('solving path {}'.format(relpath(smt)))
try:
path = z3.parse_smt2_file(smt)
except:
logger.warning('failed to parse {}'.format(smt))
continue
variables = [str(var) for var in get_vars(path)
if str(var).startswith('int!')
or str(var).startswith('long!')
or str(var).startswith('bool!')
or str(var).startswith('char!')
or str(var).startswith('reachable!')]
try:
outputs, choices, constants, reachable, original_available = parse_variables(variables)
except:
continue
# name -> value list (parsed)
oracle_constraints = dict()
def str_to_int(s):
return int(s)
def str_to_long(s):
return int(s)
def str_to_bool(s):
if s == 'false':
return False
if s == 'true':
return True
raise InferenceError()
def str_to_char(s):
if len(s) != 1:
raise InferenceError()
return s[0]
dump_parser_by_type = dict()
dump_parser_by_type['int'] = str_to_int
dump_parser_by_type['long'] = str_to_long
dump_parser_by_type['bool'] = str_to_bool
dump_parser_by_type['char'] = str_to_char
def bool_to_bv(b):
if b:
return BitVecVal(1, 32)
else:
return BitVecVal(0, 32)
def int_to_bv(i):
return BitVecVal(i, 32)
def long_to_bv(i):
return BitVecVal(i, 64)
def char_to_bv(c):
return BitVecVal(ord(c), 32)
to_bv_converter_by_type = dict()
to_bv_converter_by_type['bool'] = bool_to_bv
to_bv_converter_by_type['int'] = int_to_bv
to_bv_converter_by_type['long'] = long_to_bv
to_bv_converter_by_type['char'] = char_to_bv
def bv_to_bool(bv):
return bv.as_long() != 0
def bv_to_int(bv):
l = bv.as_long()
if l >> 31 == 1: # negative
l -= pow(2, 32)
return l
def bv_to_long(bv):
l = bv.as_long()
if l >> 63 == 1: # negative
l -= pow(2, 64)
return l
def bv_to_char(bv):
l = bv.as_long()
return chr(l)
from_bv_converter_by_type = dict()
from_bv_converter_by_type['bool'] = bv_to_bool
from_bv_converter_by_type['int'] = bv_to_int
from_bv_converter_by_type['long'] = bv_to_long
from_bv_converter_by_type['char'] = bv_to_char
matching_path = True
for expected_variable, expected_values in oracle.items():
if expected_variable == 'reachable':
expected_reachable = set(expected_values)
if not (expected_reachable == reachable):
logger.info('labels \'{}\' executed while {} required'.format(
list(reachable),
list(expected_reachable)))
matching_path = False
break
continue
if expected_variable not in outputs.keys():
outputs[expected_variable] = (None, 0) # unconstraint does not mean wrong
required_executions = len(expected_values)
actual_executions = outputs[expected_variable][1]
if required_executions != actual_executions:
logger.info('value \'{}\' executed {} times while {} required'.format(
expected_variable,
actual_executions,
required_executions))
matching_path = False
break
oracle_constraints[expected_variable] = []
for i in range(0, required_executions):
type = outputs[expected_variable][0]
try:
value = dump_parser_by_type[type](expected_values[i])
except:
logger.error('variable \'{}\' has incompatible type {}'.format(expected_variable,
type))
raise InferenceError()
oracle_constraints[expected_variable].append(value)
if not matching_path:
continue
solver.reset()
solver.add(path)
def array_to_bv32(array):
return Concat(Select(array, BitVecVal(3, 32)),
Select(array, BitVecVal(2, 32)),
Select(array, BitVecVal(1, 32)),
Select(array, BitVecVal(0, 32)))
def array_to_bv64(array):
return Concat(Select(array, BitVecVal(7, 32)),
Select(array, BitVecVal(6, 32)),
Select(array, BitVecVal(5, 32)),
Select(array, BitVecVal(4, 32)),
Select(array, BitVecVal(3, 32)),
Select(array, BitVecVal(2, 32)),
Select(array, BitVecVal(1, 32)),
Select(array, BitVecVal(0, 32)))
def angelic_variable(type, expr, instance):
pattern = '{}!choice!{}!{}!{}!{}!{}!angelic'
s = pattern.format(type, expr[0], expr[1], expr[2], expr[3], instance)
return Array(s, BitVecSort(32), BitVecSort(8))
def original_variable(type, expr, instance):
pattern = '{}!choice!{}!{}!{}!{}!{}!original'
s = pattern.format(type, expr[0], expr[1], expr[2], expr[3], instance)
return Array(s, BitVecSort(32), BitVecSort(8))
def env_variable(expr, instance, name):
pattern = 'int!choice!{}!{}!{}!{}!{}!env!{}'
s = pattern.format(expr[0], expr[1], expr[2], expr[3], instance, name)
return Array(s, BitVecSort(32), BitVecSort(8))
def output_variable(type, name, instance):
s = '{}!output!{}!{}'.format(type, name, instance)
if type == 'long':
return Array(s, BitVecSort(32), BitVecSort(8))
else:
return Array(s, BitVecSort(32), BitVecSort(8))
def angelic_selector(expr, instance):
s = 'angelic!{}!{}!{}!{}!{}'.format(expr[0], expr[1], expr[2], expr[3], instance)
return BitVec(s, 32)
def original_selector(expr, instance):
s = 'original!{}!{}!{}!{}!{}'.format(expr[0], expr[1], expr[2], expr[3], instance)
return BitVec(s, 32)
def env_selector(expr, instance, name):
s = 'env!{}!{}!{}!{}!{}!{}'.format(name, expr[0], expr[1], expr[2], expr[3], instance)
return BitVec(s, 32)
for name, values in oracle_constraints.items():
type, _ = outputs[name]
for i, value in enumerate(values):
array = output_variable(type, name, i)
bv_value = to_bv_converter_by_type[type](value)
if type == 'long':
solver.add(bv_value == array_to_bv64(array))
else:
solver.add(bv_value == array_to_bv32(array))
for (expr, item) in choices.items():
type, instances, env = item
for instance in range(0, instances):
selector = angelic_selector(expr, instance)
array = angelic_variable(type, expr, instance)
solver.add(selector == array_to_bv32(array))
selector = original_selector(expr, instance)
array = original_variable(type, expr, instance)
solver.add(selector == array_to_bv32(array))
for name in env:
selector = env_selector(expr, instance, name)
array = env_variable(expr, instance, name)
solver.add(selector == array_to_bv32(array))
result = solver.check()
if result != z3.sat:
logger.info('UNSAT') # TODO: can be timeout
continue
model = solver.model()
# expr -> (angelic * original * env) list
angelic_path = dict()
if os.path.exists(self.load[test]):
shutil.rmtree(self.load[test])
os.mkdir(self.load[test])
for (expr, item) in choices.items():
angelic_path[expr] = []
type, instances, env = item
expr_str = '{}-{}-{}-{}'.format(expr[0], expr[1], expr[2], expr[3])
expression_dir = join(self.load[test], expr_str)
if not os.path.exists(expression_dir):
os.mkdir(expression_dir)
for instance in range(0, instances):
bv_angelic = model[angelic_selector(expr, instance)]
angelic = from_bv_converter_by_type[type](bv_angelic)
bv_original = model[original_selector(expr, instance)]
original = from_bv_converter_by_type[type](bv_original)
if original_available:
logger.info('expression {}[{}]: angelic = {}, original = {}'.format(expr,
instance,
angelic,
original))
else:
logger.info('expression {}[{}]: angelic = {}'.format(expr,
instance,
angelic))
env_values = dict()
for name in env:
bv_env = model[env_selector(expr, instance, name)]
value = from_bv_converter_by_type['int'](bv_env)
env_values[name] = value
if original_available:
angelic_path[expr].append((angelic, original, env_values))
else:
angelic_path[expr].append((angelic, None, env_values))
# Dump angelic path to dump folder
instance_file = join(expression_dir, str(instance))
with open(instance_file, 'w') as file:
if isinstance(angelic, bool):
if angelic:
file.write('1')
else:
file.write('0')
else:
file.write(str(angelic))
# Run Tester to validate the dumped values
validated = self.run_test(validation_project, test, load=self.load[test])
if validated:
angelic_paths.append(angelic_path)
else:
logger.info('spurious angelic path')
if self.config['synthesis_bool_only']:
angelic_paths = self._boolean_angelic_forest(angelic_paths)
if self.config['max_angelic_paths'] is not None and \
len(angelic_paths) > self.config['max_angelic_paths']:
angelic_paths = self._reduce_angelic_forest(angelic_paths)
else:
logger.info('found {} angelic paths for test \'{}\''.format(len(angelic_paths), test))
inference_end_time = time.time()
inference_elapsed = inference_end_time - inference_start_time
statistics.data['time']['inference'] += inference_elapsed
iter_stat = dict()
iter_stat['time'] = dict()
iter_stat['time']['klee'] = klee_elapsed
iter_stat['time']['inference'] = inference_elapsed
iter_stat['paths'] = dict()
iter_stat['paths']['explored'] = len(smt_files)
iter_stat['paths']['angelic'] = len(angelic_paths)
statistics.data['iterations']['klee'].append(iter_stat)
statistics.save()
return angelic_paths