(self,
                 cfg=None,
                 context_sensitivity_level=2,
                 start=None,
                 function_start=None,
                 interfunction_level=0,
                 initial_state=None,
                 avoid_runs=None,
                 remove_options=None,
                 timeout=None,
                 max_iterations_before_widening=8,
                 max_iterations=40,
                 widening_interval=3,
                 final_state_callback=None,
                 status_callback=None,
                 record_function_final_states=False
                 )
:param cfg: The control-flow graph to base this analysis on. If none is provided, we will
                    construct a CFGEmulated.
        :param context_sensitivity_level: The level of context-sensitivity of this VFG.
                                        It ranges from 0 to infinity. Default 2.
        :param function_start: The address of the function to analyze.
        :param interfunction_level: The level of interfunction-ness to be
        :param initial_state: A state to use as the initial one
        :param avoid_runs: A list of runs to avoid
        :param remove_options: State options to remove from the initial state. It only works when `initial_state` is
                                None
        :param int timeout:
:param cfg: The control-flow graph to base this analysis on. If none is provided, we will
                    construct a CFGEmulated.
        :param context_sensitivity_level: The level of context-sensitivity of this VFG.
                                        It ranges from 0 to infinity. Default 2.
        :param function_start: The address of the function to analyze.
        :param interfunction_level: The level of interfunction-ness to be
        :param initial_state: A state to use as the initial one
        :param avoid_runs: A list of runs to avoid
        :param remove_options: State options to remove from the initial state. It only works when `initial_state` is
                                None
        :param int timeout:
: param cfg : The control - flow graph to base this analysis on . If none is provided we will construct a CFGEmulated . : param context_sensitivity_level : The level of context - sensitivity of this VFG . It ranges from 0 to infinity . Default 2 . : param function_start : The address of the function to analyze . : param interfunction_level : The level of interfunction - ness to be : param initial_state : A state to use as the initial one : param avoid_runs : A list of runs to avoid : param remove_options : State options to remove from the initial state . It only works when initial_state is None : param int timeout :
def __init__(self,
                 cfg=None,
                 context_sensitivity_level=2,
                 start=None,
                 function_start=None,
                 interfunction_level=0,
                 initial_state=None,
                 avoid_runs=None,
                 remove_options=None,
                 timeout=None,
                 max_iterations_before_widening=8,
                 max_iterations=40,
                 widening_interval=3,
                 final_state_callback=None,
                 status_callback=None,
                 record_function_final_states=False
                 ):
        """
        :param cfg: The control-flow graph to base this analysis on. If none is provided, we will
                    construct a CFGEmulated.
        :param context_sensitivity_level: The level of context-sensitivity of this VFG.
                                        It ranges from 0 to infinity. Default 2.
        :param function_start: The address of the function to analyze.
        :param interfunction_level: The level of interfunction-ness to be
        :param initial_state: A state to use as the initial one
        :param avoid_runs: A list of runs to avoid
        :param remove_options: State options to remove from the initial state. It only works when `initial_state` is
                                None
        :param int timeout:
        """

        ForwardAnalysis.__init__(self, order_jobs=True, allow_merging=True, allow_widening=True,
                                 status_callback=status_callback
                                 )

        # Related CFG.
        # We can still perform analysis if you don't specify a CFG. But providing a CFG may give you better result.
        self._cfg = cfg

        # Where to start the analysis
        self._start = start if start is not None else self.project.entry
        self._function_start = function_start if function_start is not None else self._start

        # Other parameters
        self._avoid_runs = [ ] if avoid_runs is None else avoid_runs
        self._context_sensitivity_level = context_sensitivity_level
        self._interfunction_level = interfunction_level
        self._state_options_to_remove = set() if remove_options is None else remove_options
        self._timeout = timeout
        self._start_at_function = self._start == self._function_start

        self._initial_state = initial_state

        self._max_iterations_before_widening = max_iterations_before_widening
        self._max_iterations = max_iterations
        self._widening_interval = widening_interval

        self._final_state_callback = final_state_callback

        self._record_function_final_states = record_function_final_states

        self._nodes = {}            # all the vfg nodes, keyed on block IDs
        self._normal_states = { }   # Last available state for each program point without widening
        self._widened_states = { }  # States on which widening has occurred

        # Initial states of each function, which is context sensitive
        # It maps function key to its states
        self._function_initial_states = defaultdict(dict)
        # Final states of each function, right after `ret` is called. Also context sensitive.
        # even if a function may have multiple return sites, as long as they all return to the same place, there is
        # only one final state of that function.
        self._function_final_states = defaultdict(dict)

        # All final states are put in this list
        self.final_states = [ ]

        self._state_initialization_map = defaultdict(list)

        self._exit_targets = defaultdict(list) # A dict to log edges and the jumpkind between each basic block
        # A dict to record all blocks that returns to a specific address
        self._return_target_sources = defaultdict(list)

        self._pending_returns = {}

        self._thumb_addrs = set()   # set of all addresses that are code in thumb mode

        self._final_address = None  # Address of the very last instruction. The analysis is terminated there.

        self._function_merge_points = {}
        self._function_widening_points = {}
        self._function_node_addrs = {}  # sorted in reverse post-order

        self._mergeable_plugins = ('memory', 'registers')

        self._task_stack = [ ]

        self._tracing_times = defaultdict(int)

        # counters for debugging
        self._execution_counter = defaultdict(int)

        # Start analysis
        self._analyze()
def __init__ ( self , cfg = None , context_sensitivity_level = 2 , start = None , function_start = None , interfunction_level = 0 , initial_state = None , avoid_runs = None , remove_options = None , timeout = None , max_iterations_before_widening = 8 , max_iterations = 40 , widening_interval = 3 , final_state_callback = None , status_callback = None , record_function_final_states = False ) : ForwardAnalysis . __init__ ( self , order_jobs = True , allow_merging = True , allow_widening = True , status_callback = status_callback ) # Related CFG. # We can still perform analysis if you don't specify a CFG. But providing a CFG may give you better result. self . _cfg = cfg # Where to start the analysis self . _start = start if start is not None else self . project . entry self . _function_start = function_start if function_start is not None else self . _start # Other parameters self . _avoid_runs = [ ] if avoid_runs is None else avoid_runs self . _context_sensitivity_level = context_sensitivity_level self . _interfunction_level = interfunction_level self . _state_options_to_remove = set ( ) if remove_options is None else remove_options self . _timeout = timeout self . _start_at_function = self . _start == self . _function_start self . _initial_state = initial_state self . _max_iterations_before_widening = max_iterations_before_widening self . _max_iterations = max_iterations self . _widening_interval = widening_interval self . _final_state_callback = final_state_callback self . _record_function_final_states = record_function_final_states self . _nodes = { } # all the vfg nodes, keyed on block IDs self . _normal_states = { } # Last available state for each program point without widening self . _widened_states = { } # States on which widening has occurred # Initial states of each function, which is context sensitive # It maps function key to its states self . _function_initial_states = defaultdict ( dict ) # Final states of each function, right after `ret` is called. Also context sensitive. # even if a function may have multiple return sites, as long as they all return to the same place, there is # only one final state of that function. self . _function_final_states = defaultdict ( dict ) # All final states are put in this list self . final_states = [ ] self . _state_initialization_map = defaultdict ( list ) self . _exit_targets = defaultdict ( list ) # A dict to log edges and the jumpkind between each basic block # A dict to record all blocks that returns to a specific address self . _return_target_sources = defaultdict ( list ) self . _pending_returns = { } self . _thumb_addrs = set ( ) # set of all addresses that are code in thumb mode self . _final_address = None # Address of the very last instruction. The analysis is terminated there. self . _function_merge_points = { } self . _function_widening_points = { } self . _function_node_addrs = { } # sorted in reverse post-order self . _mergeable_plugins = ( 'memory' , 'registers' ) self . _task_stack = [ ] self . _tracing_times = defaultdict ( int ) # counters for debugging self . _execution_counter = defaultdict ( int ) # Start analysis self . _analyze ( )