<commit_before>drcfg
=====

Constructs a CFG of the target program, without source. For motivation, see this [blog
post](https://tpiazza.me/posts/2016-11-04-dynamorio_cfg.html). This plugin implements the
following:

- intercepts conditional branch instructions (`cbr's`)
- intercepts control transfer instructions (`cti's`)
- dumps output in json format

# Usage

```
$ drrun -c ./libcfg.so -- ../test/call.out
{
  "branches": [
    <snip>
    {
      "address": 4194497,
      "targets": [
        4194500
      ]
    },
    <snip>
  ]
}
```

Options for `drcfg` are shown below:

```
-racy                [ false]  Perform racy hashtable insertion
-only_from_app       [ false]  Only count app, not lib, instructions
```

# How to Build

```
$ mkdir -p build && cd build
$ cmake .. -DDynamoRIO_DIR=<path/to/dr/cmake/>
$ make -j4
```

# TODO

Listed in relative order of importance

- [x] Implement cache flushing as per `cbr.c`, to remove instrumentation once a branch has
      or has not been taken. This will hopefully speed up applications considerably.
- [ ] We currently lock on all accesses to the hashtable, but instead we could construct
      a hashtable per thread to reduce lock contention if there exists any in a noticeable
      form. We would only have to lock on `event_thread_exit` to combine hashtables.
      
   Currently the only workaround for slow *singlethreaded* execution is to specify
   `-racy` as an argument to the client.
- [x] Optionally intercept only branches in main module (i.e. `-only_from_app`)
- [ ] Dump json to a file
- [ ] Optionally dump YAML
- [ ] Optionally instrument return cti's
<commit_msg>Adds program options to README<commit_after>drcfg
=====

Constructs a CFG of the target program, without source. For motivation, see this [blog
post](https://tpiazza.me/posts/2016-11-04-dynamorio_cfg.html). This plugin implements the
following:

- intercepts conditional branch instructions (`cbr's`)
- intercepts control transfer instructions (`cti's`)
- dumps output in json format

# Usage

```
$ drrun -c ./libcfg.so -- ../test/call.out
{
  "branches": [
    <snip>
    {
      "address": 4194497,
      "targets": [
        4194500
      ]
    },
    <snip>
  ]
}
```

Options for `drcfg` are shown below:

```
 -no_cbr              [ false]  Don't count conditional branch instructions
 -no_cti              [ false]  Don't count control transfer instructions
 -racy                [ false]  Perform racy hashtable insertion
 -only_from_app       [ false]  Only count app, not lib, instructions
```

# How to Build

```
$ mkdir -p build && cd build
$ cmake .. -DDynamoRIO_DIR=<path/to/dr/cmake/>
$ make -j4
```

# TODO

Listed in relative order of importance

- [x] Implement cache flushing as per `cbr.c`, to remove instrumentation once a branch has
      or has not been taken. This will hopefully speed up applications considerably.
- [ ] We currently lock on all accesses to the hashtable, but instead we could construct
      a hashtable per thread to reduce lock contention if there exists any in a noticeable
      form. We would only have to lock on `event_thread_exit` to combine hashtables.
      
   Currently the only workaround for slow *singlethreaded* execution is to specify
   `-racy` as an argument to the client.
- [x] Optionally intercept only branches in main module (i.e. `-only_from_app`)
- [ ] Dump json to a file
- [ ] Optionally dump YAML
- [ ] Optionally instrument return cti's

{'fraction_non_alphanumeric': 0.09898697539797395, 'fraction_numerical': 0.013314037626628075, 'mean_word_length': 3.0326721120186697, 'pattern_counts': {'":': 6, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4680673', 'n_tokens_mistral': 1126, 'n_tokens_neox': 1030, 'n_words': 406}