Step $1$: finding our sinks:

memcpy$\_$refs $=[$

$($ref$.$function, ref.address$)$

for ref in bv$.$get$\_$code$\_$refs$($bv$.$symbols$[\text{'}\_$memcpy'$].$address$)$

$]$

dangerous$\_$calls $=[]$

for function, addr in memcpy$\_$refs:

call$\_$instr $=$ function.get$\_$low$\_$level$\_$il$\_$at$($addr$).$medium$\_$level$\_$il

if check$\_$memcpy$($call$\_$instr.ssa$\_$form$)$:

dangerous$\_$calls.append$(($addr$,$ call$\_$instr.address$))$

Step $2$: Eliminate sinks that we know aren$$t vulnerable

def check$\_$memcpy$($memcpy$\_$call$)$:

size$\_$param $=$ memcpy$\_$call.params$[2]$

if size$\_$param.operation $!=$ MediumLevelILOperation.MLIL$\_$VAR$\_$SSA:

return False

possible$\_$sizes $=$ size$\_$param.possible$\_$values

# Dataflow won't combine multiple possible values from

# shifted bytes, so any value we care about will be

# undetermined at this point. This might change in the future?

if possible$\_$sizes.type $!=$ RegisterValueType.UndeterminedValue:

return False

model $=$ ByteSwapModeler$($size$\_$param, bv$.$address$\_$size$)$

return model.is$\_$byte$\_$swap$()$

Step $3$: check variables the size depends on:

var$\_$def $=$ self.function.get$\_$ssa$\_$var$\_$definition$($self$.$var.src$)$

# Visit statements that our variable directly depends on

self.to$\_$visit.append$($var$\_$def$)$

while self.to$\_$visit:

idx $=$ self.to$\_$visit.pop$()$

if idx is not None:

self.visit$($self$.$function$[$idx$])$

Step $4$: Identify variables that might be a part byte swap:

def visit$\_$MLIL$\_$VAR$\_$SSA$($self$,$ expr$)$:

if expr.src not in self.visited:

var$\_$def $=$ expr.function.get$\_$ssa$\_$var$\_$definition$($expr$.$src$)$

if var$\_$def is not None:

self.to$\_$visit.append$($var$\_$def$)$

src $=$ create$\_$BitVec$($expr$.$src$,$ expr.size$)$

value$\_$range $=$ identify$\_$byte$($expr$,$ self.function$)$

if value$\_$range is not None:

self.solver.add$($

Or$($

src $==0,$

And$($src $=$ value$\_$range.step$)$

$)$

$)$

self.byte$\_$vars.add$($expr$.$src$)$

return src

Step $5$: Identify constraints on the size parameter:

for i$,$ branch in self.var.branch$\_$dependence.iteritems$()$:

for vr in self.function$[$i$].$vars$\_$read:

if vr in self.byte$\_$vars:

raise ModelIsConstrained$()$

vr$\_$def $=$ self.function.get$\_$ssa$\_$var$\_$definition$($vr$)$

if vr$\_$def is None:

continue

for vr$\_$vr in self.function$[$vr$\_$def$].$vars$\_$read:

if vr$\_$vr in self.byte$\_$vars:

raise ModelIsConstrained

Step $6$: Solve the model:

self.solver.add$($

Not$($

And$($

var $==$ ZeroExt$($

var.size$()-$ len$($ordering$)*8,$

Concat$(*$ordering$)$

$),$

reverse$\_$var $==$ ZeroExt$($

reverse$\_$var.size$()-$ reversed$\_$ordering.size$(),$

reversed$\_$ordering

$)$

$)$

$)$

$)$

if self.solver.check$()==$ unsat:

return True