pgarba / simba-

Port of MBA Solver SiMBA to C/C++

SiMBA++

   _____ __  ______  ___    __    __
  / __(_)  |/  / _ )/ _ |__/ /___/ /_
 _\ \/ / /|_/ / _  / __ /_  __/_  __/
/___/_/_/  /_/____/_/ |_|/_/   /_/v1.0
°°SiMBA ported to C/C++/LLVM ~pgarba~

SiMBA (Tool for the simplification of linear mixed Boolean-arithmetic expressions (MBAs)) ported to C/C++ with some enhancements and multithreading support.

• Able to directly work on LLVM IR!
• Compiles as standlone tool and plug-in for Clang/Opt

Ported from: https://github.com/DenuvoSoftwareSolutions/SiMBA

Multithreading

MBA evaluation and verification will be run in parallel, if the MBA has more than 3 variables.

Not supported in LLVM, as LLVM does not support multithreading!

Works with external simplifiers like SiMBA/GAMBA

Use an external simplfier like GAMBA to crunch non linear MBAs on LLVM IR!

General Options

  --mba=<mba>                    - MBA that will be verfied/simplified
  --mbadb=<mbadb>                - MBA database that will be verfied/simplified
  --ir=<ir>                      - LLVM Module that contains MBA functions that will be verfied/simplified
  --bitcount=<BitCount>          - Bitcount of the variables (Default 64)
  --checklinear                  - Check if MBA is a linear expresssion (Default true)
  --convert-to-llvm              - Converts the MBA database to LLVM
  --detect-simplify              - Search for MBAs in LLVM Module and try to simplify (Default false)
  --fastcheck                    - Verify MBA with random values (Default true)
  --prove                        - Prove with Z3 that the MBA is correct (Default false)
  --simplify-expected            - Simplify the expected value to match it (Default false)
  --ignore-expected              - Ignores the expected string (Default false)
  --stop=<stop>                  - Stop after N MBAs are solved (Default 0)
  --parallel                     - Evaluate/Check MBA expressions in parallel
  --optimize                     - Optimize LLVM IR before simplification (Default true)
  --external-simplifier          - Use SiMBA or GAMBA as simplifier instead of internal (Path to simplify.py/simplify_general.py)

Performance

All Tests are done on a MacBook Air M2 24GB

Comparison with HexRays Goomba

SiMBA++ on real world code as Clang/Clang++ plugin

simba-'s Issues

Build problem

5>LLVMParser.obj : error LNK2019: unresolved external symbol "bool __cdecl prove(class z3::expr)" (?prove@@YA_NVexpr@z3@@@Z) referenced in function "private: bool __cdecl LSiMBA::LLVMParser::verify(class llvm::SmallVectorImpl<struct LSiMBA::BFSEntry> &,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > &,class llvm::SmallVectorImpl<class llvm::Value *> &)" (?verify@LLVMParser@LSiMBA@@AEAA_NAEAV?$SmallVectorImpl@UBFSEntry@LSiMBA@@@llvm@@AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$SmallVectorImpl@PEAVValue@llvm@@@4@@Z)
6>SiMBA++.vcxproj -> Z:\SiMBA-\build\RelWithDebInfo\SiMBA++.exe
5>Simplifier.obj : error LNK2019: unresolved external symbol "bool __cdecl proveReplacement(class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > &,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > &,int,class std::vector<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > &)" (?proveReplacement@@YA_NAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0HAEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@2@@Z) referenced in function "private: bool __cdecl LSiMBA::Simplifier::verify_mba_unsat(class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > &,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > &)" (?verify_mba_unsat@Simplifier@LSiMBA@@AEAA_NAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z)
5>Z:\SiMBA-\build\RelWithDebInfo\SiMBAPass.dll : fatal error LNK1120: 2 unresolved externals
5>Done building project "SiMBAPass.vcxproj" -- FAILED.

What version of z3 you are using ?
llvm was compiled with LLVM_ENABLE_Z3_SOLVER=ON support and the z3 lib is linked.

Error on 64 bit BitWidth in LLVM

I've had an segmentation fault trying to run the tool for LLVM samples with a BitWidth of 64 bits, the error comes from the next line:

SiMBA-/LLVMParser.cpp

Line 161 in 21df900

uint64_t Modulus = pow(2, this->BitWidth);

The value Modulus will obtain a value of 0, since it is a uint64_t. The value will be passed as parameter in the next call:

SiMBA-/LLVMParser.cpp

Line 182 in 21df900

initResultVector(*F, ResultVector, Modulus, VNumber, RetTy);

Inside of initResultVector the value Modulus is used in the next line:

SiMBA-/LLVMParser.cpp

Line 104 in 21df900

ResultVector.push_back(v % Modulus);

And that generates a division by 0, causing a Segmentation Fault.

I have seen that in Simplifier class you use a modulus with a value of type int64_t, then the value of the call to pow will not generate a value of 0. Could be possible to change the Modulus variable from LLVMParser.cpp and the parameter of initResultVector from uint64_t to int64_t, for example like the next changes:

LLVMParser.h:

void initResultVector(llvm::Function &F, std::vector<int64_t> &ResultVector,
                        int64_t Modulus, int VNumber, llvm::Type *IntType);

LLVMParser.cpp:

int64_t Modulus = pow(2, this->BitWidth);

...

void LLVMParser::initResultVector(llvm::Function &F,
                                  std::vector<int64_t> &ResultVector,
                                  int64_t Modulus, int VNumber, Type *IntType) {

If that is a valid solution, let me know, and I will be happy to make a pull request.

The paper and the tool are amazing!

License

Would be nice if you could add a license to allow combining it in other open source projects!

SATURN

hi, my friend, where can I get SATURN source code, I want to learn.

WSL Linux build error

I used clion to compile wsl, but couldn't find the llvm headers.
#include "llvm/IR/Module.h" not found Module.h
For example, the llvm-version must be appended to the header
#include "llvm-15/llvm/IR/Module.h"

llvm include:/usr/lib/llvm-15/include
What should I do ?