Symbolic + Tracing
Symbolic state and tracers are used to reason about register/memory values and resolve control-flow in optimized routines and lifters.
symbolic::context
symbolic::context is the register-state store used internally by symbolic_vm. Access it through vm.register_state rather than constructing it directly.
vtil::symbolic_vm vm;
// Read / inspect the internal context state.
auto value = vm.register_state.read(REG_SP);
auto known = vm.register_state.known_mask(REG_SP);symbolic_vm
vtil::symbolic_vm vm;
vm.is_lazy = true;
auto sp_val = vm.read_register(REG_SP);
vm.write_register(REG_SP, sp_val);
// To reset: reassign a fresh instance.
vm = vtil::symbolic_vm{};tracer and cached_tracer
vtil::cached_tracer tr;
auto t0 = bb->tmp(64);
vtil::symbolic::variable lookup{ t0, bb->end() };
auto block_expr = tr.trace(lookup);
auto routine_expr = tr.rtrace(lookup);
tr.flush(bb);This is the same tracer family used by NativeLifters recursive-descent branch exploration.