On 3/4/2021 9:59 AM, David Brown wrote:
> On 04/03/2021 15:51, olcott wrote:
>> If a software function:
>> (1) Simulates the execution of the machine language of another function.
>>
>> (2) Maintains an execution trace list of each machine state change
>> occurring as a result of the simulation of each machine instruction.
>>
>> (3) Examines this list after the execution of each machine instruction
>> for the purpose of detecting whether or not the Simulate() function is
>> being called in infinite recursion.
>>
>> (4) Stops simulating the program under test as soon as it detects that
>> Simulate is being called in infinite recursion.
>>
>
> You can't detect if a program has infinite recursion or not. (I.e., you
> can't detect if it will halt or not - the "infinite recursion" is just a
> distraction, as the problem is equivalent.)
Sure you can here is a concrete example:
#include <stdint.h>
#define u32 uint32_t
int Simulate(u32 P, u32 I)
{
((void(*)(u32))P)(I);
}
void H_Hat(u32 P)
{
Simulate(P, P);
}
int main()
{
Simulate((u32)H_Hat, (u32)H_Hat);
}
_Simulate()
[00000478](01) 55 push ebp
[00000479](02) 8bec mov ebp,esp
[0000047b](03) 8b450c mov eax,[ebp+0c]
[0000047e](01) 50 push eax
[0000047f](03) ff5508 call dword [ebp+08]
[00000482](03) 83c404 add esp,+04
[00000485](01) 5d pop ebp
[00000486](01) c3 ret
_H_Hat()
[00000868](01) 55 push ebp
[00000869](02) 8bec mov ebp,esp
[0000086b](03) 8b4508 mov eax,[ebp+08]
[0000086e](01) 50 push eax
[0000086f](03) 8b4d08 mov ecx,[ebp+08]
[00000872](01) 51 push ecx
[00000873](05) e800fcffff call 00000478
[00000878](03) 83c408 add esp,+08
[0000087b](01) 5d pop ebp
[0000087c](01) c3 ret
_main()
[00000888](01) 55 push ebp
[00000889](02) 8bec mov ebp,esp
[0000088b](05)
6868080000 push 00000868
[00000890](05)
6868080000 push 00000868
[00000895](05) e8defbffff call 00000478
[0000089a](03) 83c408 add esp,+08
[0000089d](02) 33c0 xor eax,eax
[0000089f](01) 5d pop ebp
[000008a0](01) c3 ret
Columns
(1) Sequence number
(2) Machine address of instruction
(3) Machine address of top of stack
(4) Value of top of stack after instruction executed
(5) Number of bytes of machine code
(6) Machine language bytes
(7) Assembly language text
(01)[00000888][00011194][00000000](01) 55 push ebp
(02)[00000889][00011194][00000000](02) 8bec mov ebp,esp
(03)[0000088b][00011190][00000868](05)
6868080000 push 00000868
(04)[00000890][0001118c][00000868](05)
6868080000 push 00000868
(05)[00000895][00011188][0000089a](05) e8defbffff call 00000478
Line (03) pushes second parameter to Simulate() machine address 0x868
Line (04) pushes first parameter to Simulate() machine address 0x868
Line (05) Calls Simulate(0x868, 0x868);
(06)[00000868][00011178][00011184](01) 55 push ebp
(07)[00000869][00011178][00011184](02) 8bec mov ebp,esp
(08)[0000086b][00011178][00011184](03) 8b4508 mov eax,[ebp+08]
(09)[0000086e][00011174][00000868](01) 50 push eax
(10)[0000086f][00011174][00000868](03) 8b4d08 mov ecx,[ebp+08]
(11)[00000872][00011170][00000868](01) 51 push ecx
(12)[00000873][0001116c][00000878](05) e800fcffff call 00000478
Line (09) pushes second parameter to Simulate() machine address 0x868
Line (11) pushes first parameter to Simulate() machine address 0x868
Line (12) Calls Simulate(0x868, 0x868);
(13)[00000868][0001115c][00011168](01) 55 push ebp
(14)[00000869][0001115c][00011168](02) 8bec mov ebp,esp
(15)[0000086b][0001115c][00011168](03) 8b4508 mov eax,[ebp+08]
(16)[0000086e][00011158][00000868](01) 50 push eax
(17)[0000086f][00011158][00000868](03) 8b4d08 mov ecx,[ebp+08]
(18)[00000872][00011154][00000868](01) 51 push ecx
(19)[00000873][00011150][00000878](05) e800fcffff call 00000478
Line (16) pushes second parameter to Simulate() machine address 0x868
Line (18) pushes first parameter to Simulate() machine address 0x868
Line (19) Calls Simulate(0x868, 0x868);
Now we have seen that Simulate() is invoked two times from the same
machine address of H_Hat() with the same data. We also know that
Simulate() either executes or emulates the machine language of its input
and nothing more. This seems to provide a sufficient basis for deciding
that H_Hat() is infinitely recursive, thus non-halting.