Frama-c slice : choosing an entry to get pragma ctrl - frama-c

Question

I'm having a problem getting a CTRL slice.
I'm trying to analyze OpenSSL by running this:
the code is like below
int dtls1_process_heartbeat(SSL *s)
{
unsigned char *p = &s->s3->rrec.data[0], *pl;
unsigned short hbtype;
unsigned int payload;
unsigned int padding = 16; /* Use minimum padding */
/* Read type and payload length first */
hbtype = *p++;
n2s(p, payload);
pl = p;
if (s->msg_callback)
s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
&s->s3->rrec.data[0], s->s3->rrec.length,
s, s->msg_callback_arg);
if (hbtype == TLS1_HB_REQUEST)
{
unsigned char *buffer, *bp;
int r;
/* Allocate memory for the response, size is 1 byte
* message type, plus 2 bytes payload length, plus
* payload, plus padding
*/
buffer = OPENSSL_malloc(1 + 2 + payload + padding);
bp = buffer;
/* Enter response type, length and copy payload */
*bp++ = TLS1_HB_RESPONSE;
s2n(payload, bp);
/*# slice pragma stmt; */
memcpy(bp, pl, payload);
bp += payload;
/* Random padding */
RAND_pseudo_bytes(bp, padding);
r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
if (r >= 0 && s->msg_callback)
s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
buffer, 3 + payload + padding,
s, s->msg_callback_arg);
OPENSSL_free(buffer);
if (r < 0)
return r;
}
else if (hbtype == TLS1_HB_RESPONSE)
{
unsigned int seq;
/* We only send sequence numbers (2 bytes unsigned int),
* and 16 random bytes, so we just try to read the
* sequence number */
n2s(pl, seq);
if (payload == 18 && seq == s->tlsext_hb_seq)
{
dtls1_stop_timer(s);
s->tlsext_hb_seq++;
s->tlsext_hb_pending = 0;
}
}
return 0;
}
`
frama-c ./ssl/d1_both.c -main dtls1_process_heartbeat -slice-calls memcpy -cpp-command "gcc -C -E -I ./include/ -I ./" -then-on 'Slicing export' -print
That produced nothing, so I then tried this: want to get a backforward slicing
frama-c ./ssl/d1_both.c -main dtls1_process_heartbeat -slice-pragma dtls1_process_heartbeat -cpp-command "gcc -C -E -I ./include/ -I ./" -then-on 'Slicing export' -print
But I still get nothing like that
void dtls1_process_heartbeat(void);
void dtls1_process_heartbeat(void)
{
return;
}
How can I get a slice like that?
function A (){
…
memcpy()
...
}
function B (){
…
…
...
}
function C (){
…
memcpy()
...
}
I want to capture everything to do with memcpy(), so I want to keep A and C, but not B.
How should I choose an entry point? How do I choose the pragma?
I hope I've stated my question clearly; it's had me confused for days.

Answer 1

First, notice that Frama-C Fluorine is an obsolete version. It has been released more than 3 years ago. Some slicing-related bugs have been fixed in the meantine. Please upgrade to a newer version, preferably Aluminium.
Second, the documentation for option -slicing-value is
select the result of left-values v1,...,vn at the
end of the function given as entry point (addresses are
evaluated at the beginning of the function given as entry
point)
It is unlikely to do what you want. Did you try option -slice-calls, more precisely -slice-calls memcpy ?
Also, keep in mind that B will be kept in the slice if it computes a value that is later used within a call to memcpy.