def load_system(file_path):
sys, prop = loadsystem.parse(file_path)
sys.init_sims(plt_lib=None, psim_args=None)
# useful to talk about the parameterization of ci without talking about
# delta_t
prop.delta_t = sys.delta_t
#step_sim = simsys.get_step_simulator(
# sys.controller_sim,
# sys.plant_sim,
# sys.delta_t)
#trace = sim(py_x, t0, tf, py_u, pvt);
#system_sim = simsys.get_system_simulator(step_sim, sys.delta_t, sys.num_dims)
system_sim = simsys.get_system_simulator(sys)
# simstate encapsulates pvt, s, d,
def one_shot_sim(x, t0, tf, w, simstate=None):
if t0 != 0:
raise err.Fatal('t0 must be 0!')
else:
# TODO: construct numpy arrays in loadsystem
# This will require changing code into quite afew
# places...carefull!
s = np.array(prop.initial_controller_state)
d = np.array(prop.initial_discrete_state)
pvt = np.zeros(1)
ci_array = w
return system_sim(x, s, d, pvt, t0, tf, ci_array)
return one_shot_sim, prop
def load_system(file_path):
sys, prop = loadsystem.parse(file_path)
sys.init_sims(plt_lib=None, psim_args=None)
# useful to talk about the parameterization of ci without talking about
# delta_t
prop.delta_t = sys.delta_t
#step_sim = simsys.get_step_simulator(
# sys.controller_sim,
# sys.plant_sim,
# sys.delta_t)
#trace = sim(py_x, t0, tf, py_u, pvt);
#system_sim = simsys.get_system_simulator(step_sim, sys.delta_t, sys.num_dims)
system_sim = simsys.get_system_simulator(sys)
# simstate encapsulates pvt, s, d,
def one_shot_sim(x, t0, tf, w, simstate=None):
if t0 != 0:
raise err.Fatal('t0 must be 0!')
else:
# TODO: construct numpy arrays in loadsystem
# This will require changing code into quite afew
# places...carefull!
s = np.array(prop.initial_controller_state)
d = np.array(prop.initial_discrete_state)
pvt = np.zeros(1)
ci_array = w
return system_sim(x, s, d, pvt, t0, tf, ci_array)
return one_shot_sim, prop
def main():
logger.info('execution begins')
LIST_OF_SYEMX_ENGINES = ['klee', 'pathcrawler']
LIST_OF_CONTROLLER_REPRS = ['smt2', 'trace']
LIST_OF_TRACE_STRUCTS = ['list', 'tree']
LIST_OF_REFINEMENTS = ['init', 'trace']
usage = '%(prog)s <filename>'
parser = argparse.ArgumentParser(description='S3CAM', usage=usage)
parser.add_argument('-f',
'--filename',
default=None,
metavar='file_path.tst')
#parser.add_argument('--run-benchmarks', action="store_true", default=False,
# help='run pacakged benchmarks')
parser.add_argument('-s',
'--simulate',
type=int,
metavar='num-sims',
help='simulate')
parser.add_argument('-c',
'--ss-concrete',
action="store_true",
help='scatter & simulate')
parser.add_argument(
'--ss-concolic',
action="store_true",
help='scatter & simulate with concolic execution using KLEE')
parser.add_argument('-x',
'--ss-symex',
type=str,
metavar='engine',
choices=LIST_OF_SYEMX_ENGINES,
help='SS + SymEx with static paths')
parser.add_argument('-r',
'--cntrl-rep',
type=str,
metavar='repr',
choices=LIST_OF_CONTROLLER_REPRS,
help='Controller Representation')
parser.add_argument('-p',
'--plot',
action='store_true',
help='enable plotting')
parser.add_argument('--dump',
action='store_true',
help='dump trace in mat file')
parser.add_argument('--seed',
type=int,
metavar='seed_value',
help='seed for the random generator')
# TAG:MSH
parser.add_argument('--meng',
type=str,
metavar='engine_name',
help='Shared Matlab Engine name')
parser.add_argument('-t',
'--trace-struct',
type=str,
metavar='struct',
default='tree',
choices=LIST_OF_TRACE_STRUCTS,
help='structure for cntrl-rep')
parser.add_argument('--refine',
type=str,
metavar='method',
default='init',
choices=LIST_OF_REFINEMENTS,
help='Refinement method')
parser.add_argument('-o',
'--output',
type=str,
default='vio.log',
help='violation log')
# argcomplete.autocomplete(parser)
args = parser.parse_args()
#print(args)
if args.filename is None:
print('No file to test. Please use --help')
exit()
print('No arguments passed. Loading list of packaged benchmarks!')
example_list = egl.get_example_list()
print('select from a list of examples')
for (idx, example) in enumerate(example_list):
print('({}) {}'.format(idx, example_list[idx]['description']))
i = int(raw_input())
filename = example_list[i]['filename']
path = example_list[i]['path']
filepath = fp.construct_path(filename, path)
else:
filepath = args.filename
if args.seed is not None:
np.random.seed(args.seed)
# TODO:
# dynamicall generate an opt class to mimic the same defined in
# loadsystem.py
# switch this to a reg class later.
Options = type('Options', (), {})
opts = Options()
if args.simulate is not None:
opts.MODE = 'simulate'
opts.num_sim_samples = args.simulate
elif args.ss_concrete:
opts.MODE = 'falsify'
opts.METHOD = 'concrete'
elif args.ss_concolic:
opts.MODE = 'falsify'
opts.METHOD = 'concolic'
print('removed concolic (KLEE)')
exit(0)
elif args.ss_symex is not None:
opts.MODE = 'falsify'
opts.METHOD = 'symbolic'
opts.symbolic_analyzer = args.ss_symex
#if opts.symbolic_analyzer not in LIST_OF_SYEMX_ENGINES:
# raise err.Fatal('unknown symbolic analyses engine requested.')
if args.cntrl_rep is None:
raise err.Fatal('controller representation must be provided')
else:
opts.cntrl_rep = args.cntrl_rep
opts.trace_struct = args.trace_struct
else:
raise err.Fatal('no options passed. Check usage.')
opts.plot = args.plot
opts.dump_trace = args.dump
opts.refine = args.refine
opts.op_fname = args.output
opts.sys_path = filepath
sys, prop = loadsystem.parse(filepath)
# TAG:MSH
matlab_engine = args.meng
sys.init_sims(plt, psim_args=matlab_engine)
if opts.plot:
pass
#import matplotlib
# Force GTK3 backend. By default GTK2 gets loaded and conflicts with
# graph-tool
#matplotlib.use('GTK3Agg')
#global plt
#import matplotlib.pyplot as plt
sanity_check_input(sys, prop, opts)
run_secam(sys, prop, opts)
def main():
logger.info('execution begins')
usage = '%(prog)s <filename>'
parser = argparse.ArgumentParser(description='CPFuzz', usage=usage)
parser.add_argument('-f',
'--filename',
default=None,
metavar='file_path.tst')
# uniform random fuzz
parser.add_argument('-s',
'--simulate',
type=int,
metavar='num-sims',
help='simulate')
# todo: fuzz using robust value
parser.add_argument('-x',
'--robust',
type=int,
metavar='num-sims',
help='using mtl robust value')
parser.add_argument('-p',
'--plot',
action='store_true',
help='enable plotting')
parser.add_argument('--dump',
action='store_true',
help='dump trace in mat file')
parser.add_argument('--seed',
type=int,
metavar='seed_value',
help='seed for the random generator')
args = parser.parse_args()
if args.filename is None:
print('No file to test. Please use --help')
exit()
else:
filepath = args.filename
if args.seed is not None:
np.random.seed(args.seed)
Options = type('Options', (), {})
opts = Options()
opts.plot = args.plot
sys, prop = loadsystem.parse(filepath)
# if not os.path.exists(sys.path+"/fuzz-target"):
create_harness(sys, prop)
print("harness generated")
create_corpus(sys, prop)
# try:
# thread.start_new_thread( setup_plant, (sys,prop) )
# except:
# print("Error: unable to start thread")
num_segments = prop.num_segments
num_dims = sys.num_dims
if (prop.ci.h - prop.ci.l > 0).any():
cmd = 'afl-fuzz -P ' + filepath + ' -m none -i seed_corpus -o out -- ' + sys.path + '/fuzz-target %d %d %d %d %d %d' % (
num_segments, num_dims.ci, num_dims.si, num_dims.sf, num_dims.x,
num_dims.u)
else:
cmd = 'afl-fuzz -P ' + filepath + ' -m none -i seed_corpus -o out -- ' + sys.path + '/fuzz-target %d %d %d %d %d %d' % (
num_segments, 0, num_dims.si, num_dims.sf, num_dims.x, num_dims.u)
f = open('fuzz.sh', 'w')
f.write('#!/bin/sh\n' + cmd)
f.close()
setup_plant(sys, prop)
def main():
logger.info('execution begins')
LIST_OF_SYEMX_ENGINES = ['klee', 'pathcrawler']
LIST_OF_CONTROLLER_REPRS = ['smt2', 'trace']
LIST_OF_TRACE_STRUCTS = ['list', 'tree']
LIST_OF_REFINEMENTS = ['init', 'trace', 'model-dft', 'model-dmt',
'model-dct', 'model-rel']
LIST_OF_GRAPH_LIBS = ['nx', 'gt', 'g']
LIST_OF_PLOT_LIBS = ['mp', 'pg']
parser = argparse.ArgumentParser(
description='S3CAM',
usage='%(prog)s <filename>',
formatter_class=argparse.ArgumentDefaultsHelpFormatter)
parser.add_argument('-f', '--filename', default=None, metavar='file_path.tst')
#parser.add_argument('--run-benchmarks', action="store_true", default=False,
# help='run pacakged benchmarks')
parser.add_argument('-s', '--simulate', type=int, metavar='num-sims',
help='simulate')
parser.add_argument('-c', '--ss-concrete', action="store_true",
help='scatter & simulate')
parser.add_argument('-cn', '--ss-concrete-no-controller', action="store_true",
help='scatter & simulate')
parser.add_argument('--ss-concolic', action="store_true",
help='scatter & simulate with concolic execution using KLEE')
parser.add_argument('-x', '--ss-symex', type=str, choices=LIST_OF_SYEMX_ENGINES,
help='SS + SymEx with static paths')
parser.add_argument('-r', '--cntrl-rep', type=str, choices=LIST_OF_CONTROLLER_REPRS,
help='Controller Representation')
# parser.add_argument('-p', '--plot', action='store_true',
# help='enable plotting')
parser.add_argument('--dump', action='store_true',
help='dump trace in mat file')
parser.add_argument('--seed', type=int, metavar='integer_seed_value',
help='seed for the random generator')
# TAG:MSH
parser.add_argument('--meng', type=str, metavar='engine_name',
help='Shared Matlab Engine name')
parser.add_argument('-t', '--trace-struct', type=str, default='tree',
choices=LIST_OF_TRACE_STRUCTS, help='structure for cntrl-rep')
parser.add_argument('--refine', type=str, default='init',
choices=LIST_OF_REFINEMENTS, help='Refinement method')
parser.add_argument('--incl-error', action='store_true',
help='Include errors in model for bmc')
parser.add_argument('-o', '--output', type=str, default='vio.log',
help='violation log')
parser.add_argument('-g', '--graph-lib', type=str, default='nx',
choices=LIST_OF_GRAPH_LIBS, help='graph library')
parser.add_argument('-p', '--plot', type=str, nargs='?',
default=None, const='mp',
choices=LIST_OF_PLOT_LIBS, help='plot library')
parser.add_argument('--plots', type=plotting.plot_opts_parse, default='',
nargs='+', help='plots x vs y: t-x1 x0-x1')
parser.add_argument('--max-paths', type=int, default=100,
help='max number of paths to use for refinement')
# TODO: remove this before thigns get too fancy.
# Add a simple package interface so benchmarks/tests can be
# written as python files and can call s3cam using an API
parser.add_argument('--pvt-init-data', type=str, default=None,
help='will set pvt_init_data in the supplied .tst file')
# TODO: This error can be computed against the cell sizes?
parser.add_argument('--max-model-error', type=float, default=float('inf'),
help='split cells till model error (over a single step) <= max-error')
parser.add_argument('--plot-opts', type=str, default=(),
nargs='+', help='additional lib specific plotting opts')
parser.add_argument('--prop-check', action='store_true',
help='Check violations by analyze the entire '
'trace, instead of relying only on x(t_end).')
parser.add_argument('--bmc-engine', type=str,
choices=["sal","s3camsmt"],
default="s3camsmt",
help='Choose the bmc engine')
# argcomplete.autocomplete(parser)
args = parser.parse_args()
#print(args)
if args.filename is None:
print('No file to test. Please use --help')
exit()
else:
filepath = args.filename
if args.seed is not None:
np.random.seed(args.seed)
# TODO:
# dynamicall generate an opt class to mimic the same defined in
# loadsystem.py
# switch this to a reg class later.
Options = type('Options', (), {})
opts = Options()
if args.simulate is not None:
opts.MODE = 'simulate'
opts.num_sim_samples = args.simulate
elif args.ss_concrete:
opts.MODE = 'falsify'
opts.METHOD = 'concrete'
elif args.ss_concrete_no_controller:
opts.MODE = 'falsify'
opts.METHOD = 'concrete_no_controller'
elif args.ss_concolic:
opts.MODE = 'falsify'
opts.METHOD = 'concolic'
print('removed concolic (KLEE)')
exit(0)
elif args.ss_symex is not None:
opts.MODE = 'falsify'
opts.METHOD = 'symbolic'
opts.symbolic_analyzer = args.ss_symex
#if opts.symbolic_analyzer not in LIST_OF_SYEMX_ENGINES:
# raise err.Fatal('unknown symbolic analyses engine requested.')
if args.cntrl_rep is None:
raise err.Fatal('controller representation must be provided')
else:
opts.cntrl_rep = args.cntrl_rep
opts.trace_struct = args.trace_struct
else:
raise err.Fatal('no options passed. Check usage.')
#opts.plot = args.plot
opts.dump_trace = args.dump
opts.refine = args.refine
opts.op_fname = args.output
opts.sys_path = filepath
opts.graph_lib = args.graph_lib
opts.max_paths = args.max_paths
opts.max_model_error = args.max_model_error
opts.plotting = plotting.factory(args.plot, *args.plot_opts)
opts.plots = args.plots
opts.model_err = args.incl_error
opts.bmc_engine = args.bmc_engine
sys, prop = loadsystem.parse(filepath, args.pvt_init_data)
if args.prop_check:
opts.property_checker = properties.PropertyChecker(prop.final_cons)
else:
opts.property_checker = properties.PropertyCheckerNeverDetects()
# TAG:MSH
matlab_engine = args.meng
sys.init_sims(opts.plotting, opts.property_checker, psim_args=matlab_engine)
sanity_check_input(sys, prop, opts)
run_secam(sys, prop, opts)
