You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+9-12Lines changed: 9 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,28 +7,25 @@
7
7
</div>
8
8
9
9
# `jingle`: SMT Modeling for `p-code`
10
-
`jingle`is a library that models (a fragment of) Ghidra's `p-code` in the language of SMT. It represents states of
11
-
the `p-code` Virtual Machine as expressions on the `QF_ABV` logic, and represents `p-code` operations as relations
12
-
between these states.
10
+
`jingle`provides SMT modeling Ghidra's `p-code`. It represents states of
11
+
the `p-code` Virtual Machine as expressions on the `QF_ABV` logic, and represents `p-code` operations as relations between these states. It additionally implements the Configurable
12
+
Program Analysis algorithm over pcode allowing for quickly implementing flexible custom analyses.
13
13
14
-
**ALPHA SOFTWARE: this software is fresh, largely untested, and subject to change. It is not yet using semantic versioning.**
14
+
**ALPHA SOFTWARE: this software is suitable for research usage but is not yet ready to be used in production.**
15
15
16
-
This repository contains a [Cargo Workspace](https://doc.rust-lang.org/book/ch14-03-cargo-workspaces.html) for two
16
+
This repository contains a [Cargo Workspace](https://doc.rust-lang.org/book/ch14-03-cargo-workspaces.html) for three
17
17
related crates:
18
18
19
19
*[`jingle_sleigh`](./jingle_sleigh): a Rust FFI in front of [Ghidra](https://github.com/NationalSecurityAgency/ghidra)'
20
20
s
21
21
code translator: `SLEIGH`. `SLEIGH` is written in C++ and can be
22
22
found [here](https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Features/Decompiler/src/decompile/cpp).
23
23
This crate contains a private internal low-level API to `SLEIGH` and exposes an idiomatic high-level API to consumers.
24
-
*[`jingle`](./jingle): a set of functions built on top of `jingle_sleigh` that defines an encoding of `p-code` operations
25
-
into SMT, using [z3.rs](https://github.com/prove-rs/z3.rs). `jingle` is currently
26
-
designed for providing formulas for use in decision procedures over individual program traces. As such, it does not yet
27
-
expose APIs for constructing or reasoning about control-flow graphs, though this is under development.
24
+
*[`jingle`](./jingle): defines SMT modeling of p-code states and operations using [z3.rs](https://github.com/prove-rs/z3.rs) as well as a small program analysis framework. `jingle` implements [Configurable Program Analysis](https://doi.org/10.1007/978-3-319-10575-8_16), allowing for flexible custom program analysis, as well as pre-built analyses for building SMT models of unwound p-code programs.
28
25
*[`jingle_python`](./jingle_python): a set of [pyo3](https://pyo3.rs) bindings for `jingle`. These bindings expose a
29
26
simple interface to both SLEIGH and our logical modeling of `p-code` in SMT. SMT formulae are exposed wrapped in
30
27
their "native" python z3 classes, allowing easy integration with other tools. These bindings are _especially_ raw and
31
-
subject to change.
28
+
subject to change and do not yet expose any of the program analysis APIs.
32
29
33
30
## Usage
34
31
@@ -49,13 +46,13 @@ The only thing ghidra is used for here is as a standardized folder layout for `s
49
46
You can install a simple CLI demonstrating jingle's modeling by running
50
47
51
48
```sh
52
-
cargo install --features bin jingle
49
+
cargo install --features bin jingle
53
50
```
54
51
55
52
If you are using the [CLI](./jingle),
56
53
then provide the path to ghidra as an argument in your first run.
57
54
58
-
The CLI produces disassembly, pcode, and SMT models for small hex-encoded instruction encodings.
55
+
The CLI produces disassembly, pcode, and SMT models for small hex-encoded instruction encodings. Note that the CLI uses an older version of `jingle`'s modeling that does not support arbitrary control flow.
0 commit comments