Re: [DynInst_API:] Static Taint Analysis using Dyninst

[Xiaozhu Meng <xmeng@xxxxxxxxxxx>]

HiÂSazzadur,

Let me explain what's happening.

ÂÂÂ ac.convert(insn, b->start(), f, b, assignments);

The above line of code is causing us the problem. The second parameter of convert should be the address of the instruction you want to convert. In your code, you always provide the starting address of the basic block, not the address of the instruction.Â

If you change it to the corresponding address of the instruction, you should see that Dyninst correctly report it as a stack variable.Â

ÂÂÂÂÂ cout << "number of children of root AST node in sliced graph: " << pcExp->numChildren() << endl;

Here you try to print out the number of children in the AST of the given assignment. This is not equal to the number of nodes the given assignment points to in the slice graph. In your case, the instruction moves a constant value to a stack variable. The symbolic _expression_ will only have a single node representing the constant value. So, the number of children of root AST node is always zero.Â

What you want to do is to use the graph interface to traverse the slice graph. It is quite simple to do and please refer to the graph section of the dataflowAPI manual.

Please let me know that if you have further questions!

Thanks,

--Xiaozhu

Â