def prepare(val, signext=False, size=SIZE) -> z3.BitVecRef: if z3.is_bv(val): szdiff = size - val.size() if szdiff > 0: if signext: result = z3.SignExt(szdiff, val) else: result = z3.ZeroExt(szdiff, val) elif szdiff < 0: result = z3.Extract(size - 1, 0, val) else: result = val elif type(val) == int: result = z3.BitVecVal(val, size) elif z3.is_int(val): result = z3.Int2BV(val, size) elif z3.is_fp(val): # changing up this logic to align with r2ghidra impl result = z3.fpToIEEEBV(val) #result = val else: result = z3.BitVecVal(val, size) #return z3.simplify(result) return result
def prepare(val, signext=False, size=SIZE) -> z3.BitVecRef: if z3.is_bv(val): szdiff = size-val.size() if szdiff == 0: result = val elif szdiff > 0: if signext: result = z3.SignExt(szdiff, val) else: result = z3.ZeroExt(szdiff, val) elif szdiff < 0: result = z3.Extract(size-1, 0, val) elif isinstance(val, int): result = z3.BitVecVal(val, size) elif z3.is_int(val): result = z3.Int2BV(val, size) elif z3.is_fp(val): result = z3.fpToIEEEBV(val) else: result = z3.BitVecVal(val, size) if not z3.is_bv_value(result): return z3.simplify(result) else: return result
def _(src, tgt, v): w = z3.fpToIEEEBV(v) i = z3.If(z3.Or(z3.fpIsZero(v), z3.fpIsSubnormal(v)), z3.BitVecVal(0,1), z3.BitVecVal(1,1)) return z3.Concat(z3.Extract(78,63,w), i, z3.Extract(62,0,w))
def _(src, tgt, v): w = z3.fpToIEEEBV(v) i = z3.If(z3.Or(z3.fpIsZero(v), z3.fpIsSubnormal(v)), z3.BitVecVal(0,1), z3.BitVecVal(1,1)) return z3.Concat(z3.Extract(78,63,w), i, z3.Extract(62,0,w))
def get_bv_str(self): bv_str = bin(int(str(z3.simplify(z3.fpToIEEEBV(self.z3_ds))))) assert bv_str[0:2] == '0b', bv_str[0:2] + ' vs ' + '0b' bv_str = bv_str[2:] while len(bv_str) < self.ne + self.ns: bv_str = '0' + bv_str return bv_str
def pack_f32(n: f32): if utils.is_all_real(n): float_bytes = struct.pack('<f', n) return [float_bytes for float_byte in float_bytes] f32_bv = z3.fpToIEEEBV(n) return [ z3.Extract(7, 0, f32_bv), z3.Extract(15, 8, f32_bv), z3.Extract(23, 16, f32_bv), z3.Extract(31, 24, f32_bv) ]
def pack_f64(n: f64): if utils.is_all_real(n): double_bytes = struct.pack('<d', n) return [double_byte for double_byte in double_bytes] f64_bv = z3.fpToIEEEBV(n) return [ z3.Extract(7, 0, f64_bv), z3.Extract(15, 8, f64_bv), z3.Extract(23, 16, f64_bv), z3.Extract(31, 24, f64_bv), z3.Extract(39, 32, f64_bv), z3.Extract(47, 40, f64_bv), z3.Extract(55, 48, f64_bv), z3.Extract(63, 56, f64_bv) ]
def _op_raw_fpToIEEEBV(self, x): return z3.fpToIEEEBV(x, ctx=self._context)
import z3 # We do float16 because it lets the solver run much faster. These results # should generalize to fp32 and fp64, and you can verify this by changing the # value of FLOAT_TY (and then waiting a while). FLOAT_TY = z3.Float16 a = z3.FP("a", FLOAT_TY()) b = z3.FP("b", FLOAT_TY()) c = z3.FP("c", FLOAT_TY()) s = z3.Solver() # C must be a power of 2, i.e. significand bits must all be 0. s.add(z3.Extract(FLOAT_TY().sbits() - 1, 0, z3.fpToIEEEBV(c)) == 0) for rm in [z3.RTZ(), z3.RNE()]: z3.set_default_rounding_mode(rm) before = a * c + b * c after = (a + b) * c # Check that before == after, allowing that 0 == -0. s.add( z3.Not( z3.Or( before == after, # z3.And(z3.fpIsZero(before), z3.fpIsZero(after))))) for x in [ (a * c),
def _(src, tgt, v): return z3.fpToIEEEBV(v)
def f642i64(f: f64) -> i64: if utils.is_all_real(f): return struct.unpack('<q', struct.pack('<d', f))[0] return z3.fpToIEEEBV(f, z3.Float64())
def f322i32(f: f32) -> i32: if utils.is_all_real(f): return struct.unpack('<i', struct.pack('<f', f))[0] return z3.fpToIEEEBV(f, z3.Float32())
def _op_raw_fpToIEEEBV(self, x): return z3.fpToIEEEBV(x, ctx=self._context)
def _(src, tgt, v): return z3.fpToIEEEBV(v)
def do_F2I(op, stack, state): val, = pop_values(stack, state) stack.append(z3.fpToIEEEBV(val))
from __future__ import print_function import z3 # We do float16 because it lets the solver run much faster. These results # should generalize to fp32 and fp64, and you can verify this by changing the # value of FLOAT_TY (and then waiting a while). FLOAT_TY = z3.Float16 a = z3.FP("a", FLOAT_TY()) b = z3.FP("b", FLOAT_TY()) c = z3.FP("c", FLOAT_TY()) s = z3.Solver() # C must be a power of 2, i.e. significand bits must all be 0. s.add(z3.Extract(FLOAT_TY().sbits() - 1, 0, z3.fpToIEEEBV(c)) == 0) for rm in [z3.RTZ(), z3.RNE()]: z3.set_default_rounding_mode(rm) before = a * c + b * c after = (a + b) * c # Check that before == after, allowing that 0 == -0. s.add( z3.Not( z3.Or( before == after, # z3.And(z3.fpIsZero(before), z3.fpIsZero(after))))) for x in [ (a * c),
def interp(tree, lookup, z3_mode): """Evaluate the arithmetic expression. Pass a tree as a Lark `Tree` object for the parsed expression. For `lookup`, provide a function for mapping variable names to values. """ op = tree.data if op in ('add', 'sub', 'mul', 'div', 'shl', 'shr'): # Binary operators. lhs = interp(tree.children[0], lookup, z3_mode) rhs = interp(tree.children[1], lookup, z3_mode) if op == 'add': return lhs + rhs elif op == 'sub': return lhs - rhs elif op == 'mul': return lhs * rhs elif op == 'div': return lhs / rhs elif op == 'shl': return lhs << rhs elif op == 'shr': return lhs >> rhs elif op == 'neg': # Negation. sub = interp(tree.children[0], lookup, z3_mode) return -sub elif op == 'int': # Literal number. if z3_mode: return z3.BitVecVal(int(tree.children[0]), 32) else: return int(tree.children[0]) elif op == 'float': # Literal number. if z3_mode: return z3.BitVecVal(float(tree.children[0]), 32) else: return float(tree.children[0]) elif op == 'var': # Variable lookup. return lookup(tree.children[0]) elif op == 'if': # Conditional. cond = interp(tree.children[0], lookup, z3_mode) true = interp(tree.children[1], lookup, z3_mode) false = interp(tree.children[2], lookup, z3_mode) return (cond != 0) * true + (cond == 0) * false elif op == "intcast": child = interp(tree.children[0], lookup, z3_mode) if z3_mode: return z3.BV2Int(child) else: return int(child) elif op == "floatcast": child = interp(tree.children[0], lookup, z3_mode) if z3_mode: return z3.fpBVToFP(child, z3.Float32()) else: return float(child) elif op == "int2bv": child = interp(tree.children[0], lookup, z3_mode) if z3_mode: return z3.Int2BV(child, 32) else: return child elif op == "float2bv": child = interp(tree.children[0], lookup, z3_mode) if z3_mode: return z3.fpToIEEEBV(child) else: return child