|
From: Loi L. <loi...@gm...> - 2013-10-29 02:27:43
|
I think I should send it to user list. Sorry for my mistake.
On Tue, Oct 29, 2013 at 1:34 AM, Loi Luu <loi...@gm...> wrote:
> Hi,
>
> I have a C program and I want to track all branch conditions which belong
> to an execution path corresponding to a concrete input. For example,
> consider a simple program:
>
> #include <stdio.h>
> #include <string.h>
> int test(char* a) {
> if (strcmp(a, "123") == 0)
> return 0;
>
> if (strcmp(a, "123") < 0)
> return -1;
> else
> return 1;
> }
>
> int main() {
> char* a;
> return test (a);
> }
>
> With a = "1234", the program return 1 and the corresponding path condition
> is strcmp(a, "123") > 0. I want to collect strcmp, "123" and value of this
> operator (1). I first thought about working with some C parser but seems
> like its not that simple. To get the values of parameters we have to deal
> with pointer analysis or external library call, which I don't know how to
> solve.
>
> Then I made several searches and come to valgrind. I read around the
> documentation and tool description. It's so expressive that valgrind
> supports many useful tools. I'm thinking to use *Callgrind *to solve my
> problem, but I'm not sure whether its a right choice. Could you please give
> me some suggestion? Is this a possible approach and how can I process this
> way?
>
> Thank you,
>
> --
> Loi, Luu The (Mr.)
> RA at Security Lab, SoC, NUS
>
--
Loi, Luu The (Mr.)
RA at Security Lab, SoC, NUS
|