| | General Approach (Site not responding. Last check: 2007-11-07) |
 | | Given a known value as above and memory objects in a similar representation, it is possible to check whether a memory access will always be in a defined region for which the program has permission to read or write. |
 | | For example, most bitwise logical instructions yield a result of unknown because the simulator cannot create a linear function representation of their output given a linear function representation of their input. |
 | | This works in practice because most memory accesses are done through linear functions (scale-index-base, as seen in the x86 ISA), so the linear values tracked by the simulator contain enough information to reason about most memory addresses, while the other values used by a program aren't usually important for memory access safety. |
| www.usenix.org /event/usenix2000/freenix/full_papers/metzsafety/metzsafety_html/node3.html (501 words) |