STARSProgram.cpp

/* STARSProgram.cpp: Base class
 * Copyright 2015 by Zephyr Software LLC 
 */

#include <cstring>

#include "interfaces/STARSTypes.h"
#include "interfaces/SMPDBInterface.h"
// #include "interfaces/abstract/all.h"
#include "base/SMPDataFlowAnalysis.h"

using namespace std;

// Data initialization
bool STARS_Program_t::OpenFiles(void) {
	string ZSTAlarmFileName(this->GetRootFileName());
	string AlarmFileSuffix(".alarms");
	ZSTAlarmFileName += AlarmFileSuffix;
	string XrefsFileName(this->GetRootFileName());
	string XrefsFileSuffix(".STARSxrefs");
	XrefsFileName += XrefsFileSuffix;
	string CallRetFileName(this->GetRootFileName());
	string CallRetFileSuffix(".STARScallreturn");
	CallRetFileName += CallRetFileSuffix;
#if ZST_EMIT_SPARK_ADA_TRANSLATION
	string SPARKSourceFileName(this->GetRootFileName());
	string SPARKSourceFileSuffix(".ZSTSPARK.adb");
	SPARKSourceFileName += SPARKSourceFileSuffix;
	string SPARKHeaderFileName(this->GetRootFileName());
	string SPARKHeaderFileSuffix(".ZSTSPARK.ads");
	SPARKHeaderFileName += SPARKHeaderFileSuffix;
#endif

	this->STARS_XrefsFile = SMP_fopen(XrefsFileName.c_str(), "w");
	if (NULL == this->STARS_XrefsFile) {
		SMP_msg("FATAL ERROR: Cannot open STARS code xrefs file %s\n", XrefsFileName.c_str());
		return false;
	}

	this->STARS_CallReturnFile = SMP_fopen(CallRetFileName.c_str(), "w");
	if (NULL == this->STARS_CallReturnFile) {
		SMP_msg("FATAL ERROR: Cannot open STARS calls and returns info file %s\n", CallRetFileName.c_str());
		(void)SMP_fclose(this->STARS_XrefsFile);
		return false;
	}

	this->ZST_AlarmFile = SMP_fopen(ZSTAlarmFileName.c_str(), "w");
	if (NULL == this->ZST_AlarmFile) {
		SMP_msg("FATAL ERROR: Cannot open security alarms file %s\n", ZSTAlarmFileName.c_str());
		SMP_fclose(this->STARS_XrefsFile);
		SMP_fclose(this->STARS_CallReturnFile);
		return false;
	}

#if ZST_EMIT_SPARK_ADA_TRANSLATION
	this->ZST_SPARKSourceFile = SMP_fopen(SPARKSourceFileName.c_str(), "w");
	if (NULL == this->ZST_SPARKSourceFile) {
		SMP_msg("FATAL ERROR: Cannot open SPARK-Ada source output file %s\n", SPARKSourceFileName.c_str());
		SMP_fclose(this->STARS_XrefsFile);
		SMP_fclose(this->STARS_CallReturnFile);
		SMP_fclose(this->ZST_AlarmFile);
		return false;
	}
	this->ZST_SPARKHeaderFile = SMP_fopen(SPARKHeaderFileName.c_str(), "w");
	if (NULL == this->ZST_SPARKHeaderFile) {
		SMP_msg("FATAL ERROR: Cannot open SPARK-Ada header output file %s\n", SPARKHeaderFileName.c_str());
		SMP_fclose(this->STARS_XrefsFile);
		SMP_fclose(this->STARS_CallReturnFile);
		SMP_fclose(this->ZST_AlarmFile);
		SMP_fclose(this->ZST_SPARKSourceFile);
		return false;
	}
#endif
	return true;
} // end of STARS_Program_t::OpenFiles()

void STARS_Program_t::CloseFiles(void) {
#if ZST_EMIT_SPARK_ADA_TRANSLATION
	(void) SMP_fclose(this->ZST_SPARKSourceFile);
	(void) SMP_fclose(this->ZST_SPARKHeaderFile);
#endif
	(void) SMP_fclose(this->ZST_AlarmFile);
	(void) SMP_fclose(this->STARS_CallReturnFile);
	(void) SMP_fclose(this->STARS_XrefsFile);
	return;
} // end of STARS_Program_t::CloseFiles()

void STARS_Program_t::InitData(void) {
	this->CurrentFileNumber = 0;
	this->ZST_AlarmFile = NULL;
	this->STARS_CallReturnFile = NULL;
	this->STARS_XrefsFile = NULL;

	// Initialize global counters for statistics-gathering purposes.
	STARS_SPARK_IndentCount = 1;
	UnusedStructCount = 0;
	UnusedIntCount = 0;
	DeadMetadataCount = 0;
	LiveMetadataCount = 0;
	ResolvedIndirectJumpCount = 0;
	UnresolvedIndirectJumpCount = 0;
	ConstantDEFCount = 0;
	AlwaysTakenBranchCount = 0;
	NeverTakenBranchCount = 0;
	SubwordRegCount = 0;
	SubwordMemCount = 0;
	SubwordAddressRegCount = 0;
	SPARKOperandCount = 0;
#if SMP_COUNT_MEMORY_ALLOCATIONS
	SMPInstCount = 0;
	SMPBlockCount = 0;
	SMPDefUseChainCount = 0;
	SMPFuncCount = 0;
	SMPGlobalVarCount = 0;
	SMPLocalVarCount = 0;
	SMPInstBytes = 0;
	SMPDefUseChainBytes = 0;
#endif
#if SMP_MEASURE_NUMERIC_ANNOTATIONS
	NumericAnnotationsCount12 = 0;
	NumericAnnotationsCount3 = 0;
	TruncationAnnotationsCount = 0;
	SignednessWithoutTruncationCount = 0;
	LeaInstOverflowCount = 0;
	WidthDoublingTruncationCount = 0;
	BenignOverflowInstCount = 0;
	BenignOverflowDefCount = 0;
	SuppressStackPtrOverflowCount = 0;
	SuppressLiveFlagsOverflowCount = 0;
	LiveMultiplyBitsCount = 0;
	BenignTruncationCount = 0;
	SuppressTruncationRegPiecesAllUsed = 0;
	SuppressSignednessOnTruncation = 0;
#endif
#if STARS_SCCP_GATHER_STATISTICS
	SCCPFuncsWithArgWriteCount = 0;
	SCCPFuncsWithConstantArgWriteCount = 0;
	SCCPOutgoingArgWriteCount = 0;
	SCCPConstantOutgoingArgWriteCount = 0;
#endif
	STARS_MaxBlockCount = 0;

	(void) memset(this->OptCount, 0, sizeof(this->OptCount));
	(void) memset(this->AnnotationCount, 0, sizeof(this->AnnotationCount));
	this->STARS_PerformReducedAnalysis = false;
	this->DataReferentID = 1;
	this->STARS_TotalCodeSize = 0;

	this->InitOptCategory();
	this->InitStackAlteration();
	this->InitDFACategory();
	this->InitTypeCategory();
	this->InitSMPDefsFlags();
	this->InitSMPUsesFlags();
	this->InitLibFuncFGInfoMaps();
	InitIntegerErrorCallSinkMap();
	InitUnsignedArgPositionMap();
	InitTaintWarningArgPositionMap();
	InitPointerArgPositionMap();

	return;
} // end of STARS_Program_t::InitData()

// These two constants should agree with their counterparts in ZST-policy.c.
#define ZST_MAX_FILE_NAME_LEN 1024
#define ZST_MAX_CALL_NAME_LEN 64

// Convert a call type string from the policy file, such as "FILECALLS", to the
//  corresponding ZST_SysCallType, such as ZST_FILE_CALL.
ZST_SysCallType STARS_Program_t::ConvertStringToCallType(char *Str2) {
	ZST_SysCallType ReturnVal;
	if (0 == strcmp("PRIVILEGECALLS", Str2)) {
		ReturnVal = ZST_HIGHPRIVILEGE_CALL;
	}
	else if (0 == strcmp("FILECALLS", Str2)) {
		ReturnVal = ZST_FILE_CALL;
	}
	else if (0 == strcmp("NETWORKCALLS", Str2)) {
		ReturnVal = ZST_NETWORK_CALL;
	}
	else {
		ReturnVal = ZST_UNMONITORED_CALL;
	}
	return ReturnVal;
} // end of STARS_Program_t::ConvertStringToCallType()

// Convert a policy string from the policy file, such as "DISALLOW", to
//  the corresponding ZST_Policy value, such as ZST_DISALLOW.
ZST_Policy STARS_Program_t::ConvertStringToPolicy(char *Str3) {
	ZST_Policy ReturnVal;
	if (0 == strcmp("DISALLOW", Str3)) {
		ReturnVal = ZST_DISALLOW;
	}
	else if (0 == strcmp("WHITELIST", Str3)) {
		ReturnVal = ZST_WHITELIST;
	}
	else if (0 == strcmp("BLACKLIST", Str3)) {
		ReturnVal = ZST_BLACKLIST;
	}
	else { // error handling precedes calls to this function
		ReturnVal = ZST_ALLOWALL;
	}
	return ReturnVal;
} // end of STARS_Program_t::ConvertStringToPolicy()

// Given a function name, return its Zephyr Security Toolkit call type.
ZST_SysCallType STARS_Program_t::GetCallTypeFromFuncName(string SysCallName) const {
	ZST_SysCallType ReturnVal;
	map<string, ZST_SysCallType>::const_iterator FindIter = this->ZST_FuncTypeMap.find(SysCallName);
	if (FindIter == this->ZST_FuncTypeMap.end()) { // not found; might not even be system call
		ReturnVal = ZST_UNMONITORED_CALL;
	}
	else {
		ReturnVal = FindIter->second;
	}
	return ReturnVal;
} // end of GetCallTypeFromFuncName()

// Get the user-specified security policy for the given call type.
ZST_Policy STARS_Program_t::GetPolicyFromCallType(ZST_SysCallType CallType) const {
	ZST_Policy ReturnVal;
	map<ZST_SysCallType, ZST_Policy>::const_iterator FindIter = ZST_TypePolicyMap.find(CallType);
	if (FindIter == ZST_TypePolicyMap.end()) {
		// Policy not found; default to ALLOW_ALL
		ReturnVal = ZST_ALLOWALL;
	}
	else {
		ReturnVal = FindIter->second;
	}
	return ReturnVal;
} // end of STARS_Program_t::GetPolicyFromCallType()

// Given a call type and called function name, is it on the location whitelist
//  for that call type?
// NOTE: HANDLE CASE IN WHICH WHITELISTED LOCATION IS A PREFIX, TERMINATING in a slash.
bool STARS_Program_t::IsLocationWhitelisted(ZST_SysCallType CallType, string LocationName) const {
	set<string>::const_iterator FindIter;
	bool ReturnVal;

	if (CallType == ZST_FILE_CALL) {
		FindIter = ZST_FileLocWhitelist.find(LocationName);
		ReturnVal = (FindIter != ZST_FileLocWhitelist.end());
	}
	else if (CallType == ZST_NETWORK_CALL) {
		FindIter = ZST_NetworkLocWhitelist.find(LocationName);
		ReturnVal = (FindIter != ZST_NetworkLocWhitelist.end());
	}
	else { // should not be here
		ReturnVal = false;
	}
	return ReturnVal;
} // end of STARS_Program_t::IsLocationWhitelisted()

// Given a call type and called function name, is it on the location blacklist
//  for that call type?
// NOTE: HANDLE CASE IN WHICH BLACKLISTED LOCATION IS A PREFIX, TERMINATING in a slash.
bool STARS_Program_t::IsLocationBlacklisted(ZST_SysCallType CallType, string LocationName) const {
	set<string>::const_iterator FindIter;
	bool ReturnVal;

	if (CallType == ZST_FILE_CALL) {
		FindIter = ZST_FileLocBlacklist.find(LocationName);
		ReturnVal = (FindIter != ZST_FileLocBlacklist.end());
	}
	else if (CallType == ZST_NETWORK_CALL) {
		FindIter = ZST_NetworkLocBlacklist.find(LocationName);
		ReturnVal = (FindIter != ZST_NetworkLocBlacklist.end());
	}
	else { // should not be here
		ReturnVal = false;
	}
	return ReturnVal;
} // end of STARS_Program_t::IsLocationBlacklisted()

// Given a called function name, does it produce only benign numeric errors when
//  its returned values are used in arithmetic? (i.e. it is a trusted input)
bool STARS_Program_t::IsNumericSafeSystemCall(string CallName) const {
	set<string>::const_iterator FindIter = ZST_SystemCallNumericWhitelist.find(CallName);
	bool ReturnVal = (FindIter != ZST_SystemCallNumericWhitelist.end());
	return ReturnVal;
}

// Utility functions to print code xrefs to STARS_XrefsFile
void STARS_Program_t::PrintCodeToCodeXref(STARS_ea_t FromAddr, STARS_ea_t ToAddr, std::size_t InstrSize) {
	SMP_fprintf(this->GetXrefsFile(), "%10lx %6zu INSTR XREF IBT FROMIB %10lx \n",
		(unsigned long) ToAddr, InstrSize, (unsigned long) FromAddr);
	return;
}

void STARS_Program_t::PrintDataToCodeXref(STARS_ea_t FromDataAddr, STARS_ea_t ToCodeAddr, std::size_t InstrSize) {
	SMP_fprintf(this->GetXrefsFile(), "%10lx %6zu INSTR XREF IBT FROMDATA %10lx \n",
		(unsigned long) ToCodeAddr, InstrSize, (unsigned long) FromDataAddr);
	return;
}

// Read the foo.exe.policy file to initialize our security policies for system calls.
void STARS_Program_t::ZST_InitPolicies(void) {
	string ZSTPolicyFileName(this->GetRootFileName());
	string PolicyFileSuffix(".policy");
	ZSTPolicyFileName += PolicyFileSuffix;
	FILE *PolicyFile = SMP_fopen(ZSTPolicyFileName.c_str(), "r");
	char Str1[ZST_MAX_CALL_NAME_LEN], Str2[ZST_MAX_CALL_NAME_LEN], Str3[ZST_MAX_FILE_NAME_LEN];

	string SafeSystemCall1("gettimeofday");
	this->ZST_SystemCallNumericWhitelist.insert(SafeSystemCall1);

	if (NULL != PolicyFile) {
		while (!SMP_feof(PolicyFile)) {
			int ItemsRead = SMP_fscanf(PolicyFile, "%63s %63s %1023s", Str1, Str2, Str3);
			if (3 != ItemsRead) {
				SMP_msg("ERROR: Line in %s had %d items instead of the required 3; line ignored.\n", ZSTPolicyFileName.c_str(), ItemsRead);
			}
			else {
				string ThirdStr(Str3);
				pair<set<string>::iterator, bool> SetInsertResult;
				if (0 == strcmp(Str1, "SECURITYPOLICY")) {
					ZST_SysCallType TempCallType = ConvertStringToCallType(Str2);
					ZST_Policy TempPolicy = ConvertStringToPolicy(Str3);
					pair<map<ZST_SysCallType, ZST_Policy>::iterator, bool> InsertResult;
					pair<ZST_SysCallType, ZST_Policy> TempPair(TempCallType, TempPolicy);
					InsertResult = this->ZST_TypePolicyMap.insert(TempPair);
					if (!(InsertResult.second)) {
						SMP_msg("ERROR: Could not insert security policy %s for %s. Possible duplicate or conflicting policies.\n",
							Str3, Str2);
					}
				}
				else if (0 == strcmp(Str1, "FILELOCATION")) {
					if (0 == strcmp(Str2, "WHITELIST")) {
						SetInsertResult = this->ZST_FileLocWhitelist.insert(ThirdStr);
						if (!(SetInsertResult.second)) {
							SMP_msg("WARNING: Duplicate file whitelist location %s ignored.\n", Str3);
						}
					}
					else if (0 == strcmp(Str2, "BLACKLIST")) {
						SetInsertResult = this->ZST_FileLocBlacklist.insert(ThirdStr);
						if (!(SetInsertResult.second)) {
							SMP_msg("WARNING: Duplicate file blacklist location %s ignored.\n", Str3);
						}
					}
					else {
						SMP_msg("ERROR: Unknown second field value in policy line: %s %s %s ; ignored\n", Str1, Str2, Str3);
					}
				}
				else if (0 == strcmp(Str1, "NETWORKLOCATION")) {
					if (0 == strcmp(Str2, "WHITELIST")) {
						SetInsertResult = this->ZST_NetworkLocWhitelist.insert(ThirdStr);
						if (!(SetInsertResult.second)) {
							SMP_msg("WARNING: Duplicate network whitelist location %s ignored.\n", Str3);
						}
					}
					else if (0 == strcmp(Str2, "BLACKLIST")) {
						SetInsertResult = this->ZST_NetworkLocBlacklist.insert(ThirdStr);
						if (!(SetInsertResult.second)) {
							SMP_msg("WARNING: Duplicate network blacklist location %s ignored.\n", Str3);
						}
					}
					else {
						SMP_msg("ERROR: Unknown second field value in policy line: %s %s %s ; ignored\n", Str1, Str2, Str3);
					}
				}
				else {
					SMP_msg("ERROR: Unknown first field value in policy line: %s %s %s ; ignored\n", Str1, Str2, Str3);
				}
			}
		}
		if (0 == SMP_fclose(PolicyFile)) {
			SMP_msg("Policy file %s successfully closed; all policies recorded.\n", ZSTPolicyFileName.c_str());
		}
		else {
			SMP_msg("ERROR: fclose failed on policy file %s. However, policies should be in effect.\n", ZSTPolicyFileName.c_str());
		}
		// Now, initialize the system call name maps.
		pair<map<string, ZST_SysCallType>::iterator, bool> FuncInsertResult;
		// Do all the high privilege calls first.
		string SysFuncName("putenv");
		pair<string, ZST_SysCallType> FuncNamePolicyPair(SysFuncName, ZST_HIGHPRIVILEGE_CALL);
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("setenv");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("setegid");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("seteuid");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("setgid");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("setpgid");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("setregid");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("setreuid");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("setuid");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("execl");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("execv");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("execle");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("execve");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("execlp");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("execvp");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("system");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);

		// Now do all the file operation calls.
		FuncNamePolicyPair.second = ZST_FILE_CALL;
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("chdir");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("chmod");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("chown");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("creat");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("creat64");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("fopen");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("freopen");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("open");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("open64");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("mknod");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("remove");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("rmdir");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("unlink");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);

		// Finally, handle all the network connection calls.
		FuncNamePolicyPair.second = ZST_NETWORK_CALL;
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("socket");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("socketpair");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("pipe");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("bind");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("listen");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("accept");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
		FuncNamePolicyPair.first.clear();
		FuncNamePolicyPair.first.append("connect");
		FuncInsertResult = this->ZST_FuncTypeMap.insert(FuncNamePolicyPair);
		assert(FuncInsertResult.second);
	}
	else {
		SMP_msg("WARNING: No policy file %s found. System call policies not in effect.\n", ZSTPolicyFileName.c_str());
	}
	return;
} // end of STARS_Program_t::ZST_InitPolicies()

// Initialize the OptCategory[] array to define how we emit optimizing annotations.
void STARS_Program_t::InitOptCategory(void) {
	// Default category is 0, no optimization without knowing context.
	(void)memset(OptCategory, 0, sizeof(OptCategory));
	// Category 1 instructions never need updating of their memory
	//  metadata by the Memory Monitor SDT. Currently, this is because
	//  these instructions only have effects on registers we do not maintain
	//  metadata for, such as the EIP and the FLAGS, e.g. jumps, compares,
	//  or because they are no-ops, including machine-dependent no-op idioms.
	//  Effects on floating-point regs are always NUMERIC and can be put into
	//  categury 1 because mmStrata knows these registers are NUMERIC and does
	//  not keep a metadata map for them.
	// Category 2 instructions always have a result type of 'n' (number).
	// Category 3 instructions have a result type of 'n' (number)
	//  whenever the second source operand is an operand of type 'n'.
	//  NOTE: MOV is only current example, and this will take some thought if 
	//   other examples arise.
	// Category 4 instructions have a result type identical to the 1st source operand type.
	//  NOTE: This is currently set for single-operand instructions such as
	//   INC, DEC. As a result, these are treated pretty much as if
	//   they were category 1 instructions, as there is no metadata update,
	//   unless the operand is a memory operand (i.e. mem or [reg]).
	//   If new instructions are added to this category that are not single
	//   operand and do require some updating, the category should be split.
	// Category 5 instructions have a result type identical to the 1st source operand
	//  type whenever the 2nd source operand is an operand of type 'n'.
	//  If the destination is memory, metadata still needs to be checked; if
	//  not, no metadata check is needed, so it becomes category 1.
	// Category 6 instructions always have a result type of 'p' (pointer).
	// Category 7 instructions are category 2 instructions with two destinations,
	//  such as multiply and divide instructions that affect EDX:EAX. There are
	//  forms of these instructions that only have one destination, so they have
	//  to be distinguished via the operand info.
	// Category 8 instructions implicitly write a numeric value to EDX:EAX, but
	//  EDX and EAX are not listed as operands. RDTSC, RDPMC, RDMSR, and other
	//  instructions that copy machine registers into EDX:EAX are category 8.
	// Category 9 instructions are floating point instructions that either
	//  have a memory destination (treat as category 0) or a FP reg destination
	//  (treat as category 1).
	// Category 10 instructions are the same as category 8, but also write
	//  to register ECX in addition to EDX:EAX.

	// NOTE: The Memory Monitor SDT needs just three categories, corresponding
	//  to categories 0, 1, and all others. For all categories > 1, the
	//  annotation should tell the SDT exactly how to update its metadata.
	//  For example, a division instruction will write type 'n' (NUM) as
	//  the metadata for result registers EDX:EAX. So, the annotation should
	//  list 'n', EDX, EAX, and a terminator of ZZ. CWD (convert word to
	//  doubleword) should have a list of 'n', EAX, ZZ.

	OptCategory[STARS_NN_null] = 0;            // Unknown Operation
	OptCategory[STARS_NN_aaa] = 2;                 // ASCII Adjust after Addition
	OptCategory[STARS_NN_aad] = 2;                 // ASCII Adjust AX before Division
	OptCategory[STARS_NN_aam] = 2;                 // ASCII Adjust AX after Multiply
	OptCategory[STARS_NN_aas] = 2;                 // ASCII Adjust AL after Subtraction
	OptCategory[STARS_NN_adc] = 5;                 // Add with Carry
	OptCategory[STARS_NN_add] = 5;                 // Add
	OptCategory[STARS_NN_and] = 0;                 // Logical AND
	OptCategory[STARS_NN_arpl] = 1;                // Adjust RPL Field of Selector
	OptCategory[STARS_NN_bound] = 1;               // Check Array Index Against Bounds
	OptCategory[STARS_NN_bsf] = 2;                 // Bit Scan Forward
	OptCategory[STARS_NN_bsr] = 2;                 // Bit Scan Reverse
	OptCategory[STARS_NN_bt] = 0;                  // Bit Test
	OptCategory[STARS_NN_btc] = 0;                 // Bit Test and Complement
	OptCategory[STARS_NN_btr] = 0;                 // Bit Test and Reset
	OptCategory[STARS_NN_bts] = 0;                 // Bit Test and Set
	OptCategory[STARS_NN_call] = 1;                // Call Procedure
	OptCategory[STARS_NN_callfi] = 1;              // Indirect Call Far Procedure
	OptCategory[STARS_NN_callni] = 1;              // Indirect Call Near Procedure
	OptCategory[STARS_NN_cbw] = 2;                 // AL -> AX (with sign)            ** No ops?
	OptCategory[STARS_NN_cwde] = 2;                // AX -> EAX (with sign)           **
	OptCategory[STARS_NN_cdqe] = 2;                // EAX -> RAX (with sign)          **
	OptCategory[STARS_NN_clc] = 1;                 // Clear Carry Flag
	OptCategory[STARS_NN_cld] = 1;                 // Clear Direction Flag
	OptCategory[STARS_NN_cli] = 1;                 // Clear Interrupt Flag
	OptCategory[STARS_NN_clts] = 1;                // Clear Task-Switched Flag in CR0
	OptCategory[STARS_NN_cmc] = 1;                 // Complement Carry Flag
	OptCategory[STARS_NN_cmp] = 1;                 // Compare Two Operands
	OptCategory[STARS_NN_cmps] = 1;                // Compare Strings
	OptCategory[STARS_NN_cwd] = 2;                 // AX -> DX:AX (with sign)
	OptCategory[STARS_NN_cdq] = 2;                 // EAX -> EDX:EAX (with sign)
	OptCategory[STARS_NN_cqo] = 2;                 // RAX -> RDX:RAX (with sign)
	OptCategory[STARS_NN_daa] = 2;                 // Decimal Adjust AL after Addition
	OptCategory[STARS_NN_das] = 2;                 // Decimal Adjust AL after Subtraction
	OptCategory[STARS_NN_dec] = 4;                 // Decrement by 1
	OptCategory[STARS_NN_div] = 7;                 // Unsigned Divide
	OptCategory[STARS_NN_enterw] = 0;              // Make Stack Frame for Procedure Parameters  **
	OptCategory[STARS_NN_enter] = 0;               // Make Stack Frame for Procedure Parameters  **
	OptCategory[STARS_NN_enterd] = 0;              // Make Stack Frame for Procedure Parameters  **
	OptCategory[STARS_NN_enterq] = 0;              // Make Stack Frame for Procedure Parameters  **
	OptCategory[STARS_NN_hlt] = 0;                 // Halt
	OptCategory[STARS_NN_idiv] = 7;                // Signed Divide
	OptCategory[STARS_NN_imul] = 7;                // Signed Multiply
	OptCategory[STARS_NN_in] = 0;                  // Input from Port                         **
	OptCategory[STARS_NN_inc] = 4;                 // Increment by 1
	OptCategory[STARS_NN_ins] = 2;                 // Input Byte(s) from Port to String       **
	OptCategory[STARS_NN_int] = 0;                 // Call to Interrupt Procedure
	OptCategory[STARS_NN_into] = 0;                // Call to Interrupt Procedure if Overflow Flag = 1
	OptCategory[STARS_NN_int3] = 0;                // Trap to Debugger
	OptCategory[STARS_NN_iretw] = 0;               // Interrupt Return
	OptCategory[STARS_NN_iret] = 0;                // Interrupt Return
	OptCategory[STARS_NN_iretd] = 0;               // Interrupt Return (use32)
	OptCategory[STARS_NN_iretq] = 0;               // Interrupt Return (use64)
	OptCategory[STARS_NN_ja] = 1;                  // Jump if Above (CF=0 & ZF=0)
	OptCategory[STARS_NN_jae] = 1;                 // Jump if Above or Equal (CF=0)
	OptCategory[STARS_NN_jb] = 1;                  // Jump if Below (CF=1)
	OptCategory[STARS_NN_jbe] = 1;                 // Jump if Below or Equal (CF=1 | ZF=1)
	OptCategory[STARS_NN_jc] = 1;                  // Jump if Carry (CF=1)
	OptCategory[STARS_NN_jcxz] = 1;                // Jump if CX is 0
	OptCategory[STARS_NN_jecxz] = 1;               // Jump if ECX is 0
	OptCategory[STARS_NN_jrcxz] = 1;               // Jump if RCX is 0
	OptCategory[STARS_NN_je] = 1;                  // Jump if Equal (ZF=1)
	OptCategory[STARS_NN_jg] = 1;                  // Jump if Greater (ZF=0 & SF=OF)
	OptCategory[STARS_NN_jge] = 1;                 // Jump if Greater or Equal (SF=OF)
	OptCategory[STARS_NN_jl] = 1;                  // Jump if Less (SF!=OF)
	OptCategory[STARS_NN_jle] = 1;                 // Jump if Less or Equal (ZF=1 | SF!=OF)
	OptCategory[STARS_NN_jna] = 1;                 // Jump if Not Above (CF=1 | ZF=1)
	OptCategory[STARS_NN_jnae] = 1;                // Jump if Not Above or Equal (CF=1)
	OptCategory[STARS_NN_jnb] = 1;                 // Jump if Not Below (CF=0)
	OptCategory[STARS_NN_jnbe] = 1;                // Jump if Not Below or Equal (CF=0 & ZF=0)
	OptCategory[STARS_NN_jnc] = 1;                 // Jump if Not Carry (CF=0)
	OptCategory[STARS_NN_jne] = 1;                 // Jump if Not Equal (ZF=0)
	OptCategory[STARS_NN_jng] = 1;                 // Jump if Not Greater (ZF=1 | SF!=OF)
	OptCategory[STARS_NN_jnge] = 1;                // Jump if Not Greater or Equal (SF!=OF)
	OptCategory[STARS_NN_jnl] = 1;                 // Jump if Not Less (SF=OF)
	OptCategory[STARS_NN_jnle] = 1;                // Jump if Not Less or Equal (ZF=0 & SF=OF)
	OptCategory[STARS_NN_jno] = 1;                 // Jump if Not Overflow (OF=0)
	OptCategory[STARS_NN_jnp] = 1;                 // Jump if Not Parity (PF=0)
	OptCategory[STARS_NN_jns] = 1;                 // Jump if Not Sign (SF=0)
	OptCategory[STARS_NN_jnz] = 1;                 // Jump if Not Zero (ZF=0)
	OptCategory[STARS_NN_jo] = 1;                  // Jump if Overflow (OF=1)
	OptCategory[STARS_NN_jp] = 1;                  // Jump if Parity (PF=1)
	OptCategory[STARS_NN_jpe] = 1;                 // Jump if Parity Even (PF=1)
	OptCategory[STARS_NN_jpo] = 1;                 // Jump if Parity Odd  (PF=0)
	OptCategory[STARS_NN_js] = 1;                  // Jump if Sign (SF=1)
	OptCategory[STARS_NN_jz] = 1;                  // Jump if Zero (ZF=1)
	OptCategory[STARS_NN_jmp] = 1;                 // Jump
	OptCategory[STARS_NN_jmpfi] = 1;               // Indirect Far Jump
	OptCategory[STARS_NN_jmpni] = 1;               // Indirect Near Jump
	OptCategory[STARS_NN_jmpshort] = 1;            // Jump Short (not used)
	OptCategory[STARS_NN_lahf] = 2;                // Load Flags into AH Register
	OptCategory[STARS_NN_lar] = 2;                 // Load Access Rights Byte
	OptCategory[STARS_NN_lea] = 0;                 // Load Effective Address           **
	OptCategory[STARS_NN_leavew] = 0;              // High Level Procedure Exit        **
	OptCategory[STARS_NN_leave] = 0;               // High Level Procedure Exit        **
	OptCategory[STARS_NN_leaved] = 0;              // High Level Procedure Exit        **
	OptCategory[STARS_NN_leaveq] = 0;              // High Level Procedure Exit        **
	OptCategory[STARS_NN_lgdt] = 0;                // Load Global Descriptor Table Register
	OptCategory[STARS_NN_lidt] = 0;                // Load Interrupt Descriptor Table Register
	OptCategory[STARS_NN_lgs] = 6;                 // Load Full Pointer to GS:xx
	OptCategory[STARS_NN_lss] = 6;                 // Load Full Pointer to SS:xx
	OptCategory[STARS_NN_lds] = 6;                 // Load Full Pointer to DS:xx
	OptCategory[STARS_NN_les] = 6;                 // Load Full Pointer to ES:xx
	OptCategory[STARS_NN_lfs] = 6;                 // Load Full Pointer to FS:xx
	OptCategory[STARS_NN_lldt] = 0;                // Load Local Descriptor Table Register
	OptCategory[STARS_NN_lmsw] = 1;                // Load Machine Status Word
	OptCategory[STARS_NN_lock] = 1;                // Assert LOCK# Signal Prefix
	OptCategory[STARS_NN_lods] = 0;                // Load String
	OptCategory[STARS_NN_loopw] = 1;               // Loop while ECX != 0
	OptCategory[STARS_NN_loop] = 1;                // Loop while CX != 0
	OptCategory[STARS_NN_loopd] = 1;               // Loop while ECX != 0
	OptCategory[STARS_NN_loopq] = 1;               // Loop while RCX != 0
	OptCategory[STARS_NN_loopwe] = 1;              // Loop while CX != 0 and ZF=1
	OptCategory[STARS_NN_loope] = 1;               // Loop while rCX != 0 and ZF=1
	OptCategory[STARS_NN_loopde] = 1;              // Loop while ECX != 0 and ZF=1
	OptCategory[STARS_NN_loopqe] = 1;              // Loop while RCX != 0 and ZF=1
	OptCategory[STARS_NN_loopwne] = 1;             // Loop while CX != 0 and ZF=0
	OptCategory[STARS_NN_loopne] = 1;              // Loop while rCX != 0 and ZF=0
	OptCategory[STARS_NN_loopdne] = 1;             // Loop while ECX != 0 and ZF=0
	OptCategory[STARS_NN_loopqne] = 1;             // Loop while RCX != 0 and ZF=0
	OptCategory[STARS_NN_lsl] = 6;                 // Load Segment Limit
	OptCategory[STARS_NN_ltr] = 1;                 // Load Task Register
	OptCategory[STARS_NN_mov] = 3;                 // Move Data
	OptCategory[STARS_NN_movsp] = 3;               // Move to/from Special Registers
	OptCategory[STARS_NN_movs] = 0;                // Move Byte(s) from String to String
	OptCategory[STARS_NN_movsx] = 3;               // Move with Sign-Extend
	OptCategory[STARS_NN_movzx] = 3;               // Move with Zero-Extend
	OptCategory[STARS_NN_mul] = 7;                 // Unsigned Multiplication of AL or AX
	OptCategory[STARS_NN_neg] = 2;                 // Two's Complement Negation   !!!!****!!!! Change this when mmStrata handles NEGATEDPTR type.
	OptCategory[STARS_NN_nop] = 1;                 // No Operation
	OptCategory[STARS_NN_not] = 2;                 // One's Complement Negation
	OptCategory[STARS_NN_or] = 0;                  // Logical Inclusive OR
	OptCategory[STARS_NN_out] = 0;                 // Output to Port
	OptCategory[STARS_NN_outs] = 0;                // Output Byte(s) to Port
	OptCategory[STARS_NN_pop] = 0;                 // Pop a word from the Stack
	OptCategory[STARS_NN_popaw] = 0;               // Pop all General Registers
	OptCategory[STARS_NN_popa] = 0;                // Pop all General Registers
	OptCategory[STARS_NN_popad] = 0;               // Pop all General Registers (use32)
	OptCategory[STARS_NN_popaq] = 0;               // Pop all General Registers (use64)
	OptCategory[STARS_NN_popfw] = 1;               // Pop Stack into Flags Register         **
	OptCategory[STARS_NN_popf] = 1;                // Pop Stack into Flags Register         **
	OptCategory[STARS_NN_popfd] = 1;               // Pop Stack into Eflags Register        **
	OptCategory[STARS_NN_popfq] = 1;               // Pop Stack into Rflags Register        **
	OptCategory[STARS_NN_push] = 0;                // Push Operand onto the Stack
	OptCategory[STARS_NN_pushaw] = 0;              // Push all General Registers
	OptCategory[STARS_NN_pusha] = 0;               // Push all General Registers
	OptCategory[STARS_NN_pushad] = 0;              // Push all General Registers (use32)
	OptCategory[STARS_NN_pushaq] = 0;              // Push all General Registers (use64)
	OptCategory[STARS_NN_pushfw] = 0;              // Push Flags Register onto the Stack
	OptCategory[STARS_NN_pushf] = 0;               // Push Flags Register onto the Stack
	OptCategory[STARS_NN_pushfd] = 0;              // Push Flags Register onto the Stack (use32)
	OptCategory[STARS_NN_pushfq] = 0;              // Push Flags Register onto the Stack (use64)
	OptCategory[STARS_NN_rcl] = 2;                 // Rotate Through Carry Left
	OptCategory[STARS_NN_rcr] = 2;                 // Rotate Through Carry Right
	OptCategory[STARS_NN_rol] = 2;                 // Rotate Left
	OptCategory[STARS_NN_ror] = 2;                 // Rotate Right
	OptCategory[STARS_NN_rep] = 0;                 // Repeat String Operation
	OptCategory[STARS_NN_repe] = 0;                // Repeat String Operation while ZF=1
	OptCategory[STARS_NN_repne] = 0;               // Repeat String Operation while ZF=0
	OptCategory[STARS_NN_retn] = 0;                // Return Near from Procedure
	OptCategory[STARS_NN_retf] = 0;                // Return Far from Procedure
	OptCategory[STARS_NN_sahf] = 1;                // Store AH into Flags Register
	OptCategory[STARS_NN_sal] = 2;                 // Shift Arithmetic Left
	OptCategory[STARS_NN_sar] = 2;                 // Shift Arithmetic Right
	OptCategory[STARS_NN_shl] = 2;                 // Shift Logical Left
	OptCategory[STARS_NN_shr] = 2;                 // Shift Logical Right
	OptCategory[STARS_NN_sbb] = 5;                 // Integer Subtraction with Borrow
	OptCategory[STARS_NN_scas] = 1;                // Compare String
	OptCategory[STARS_NN_seta] = 2;                // Set Byte if Above (CF=0 & ZF=0)
	OptCategory[STARS_NN_setae] = 2;               // Set Byte if Above or Equal (CF=0)
	OptCategory[STARS_NN_setb] = 2;                // Set Byte if Below (CF=1)
	OptCategory[STARS_NN_setbe] = 2;               // Set Byte if Below or Equal (CF=1 | ZF=1)
	OptCategory[STARS_NN_setc] = 2;                // Set Byte if Carry (CF=1)
	OptCategory[STARS_NN_sete] = 2;                // Set Byte if Equal (ZF=1)
	OptCategory[STARS_NN_setg] = 2;                // Set Byte if Greater (ZF=0 & SF=OF)
	OptCategory[STARS_NN_setge] = 2;               // Set Byte if Greater or Equal (SF=OF)
	OptCategory[STARS_NN_setl] = 2;                // Set Byte if Less (SF!=OF)
	OptCategory[STARS_NN_setle] = 2;               // Set Byte if Less or Equal (ZF=1 | SF!=OF)
	OptCategory[STARS_NN_setna] = 2;               // Set Byte if Not Above (CF=1 | ZF=1)
	OptCategory[STARS_NN_setnae] = 2;              // Set Byte if Not Above or Equal (CF=1)
	OptCategory[STARS_NN_setnb] = 2;               // Set Byte if Not Below (CF=0)
	OptCategory[STARS_NN_setnbe] = 2;              // Set Byte if Not Below or Equal (CF=0 & ZF=0)
	OptCategory[STARS_NN_setnc] = 2;               // Set Byte if Not Carry (CF=0)
	OptCategory[STARS_NN_setne] = 2;               // Set Byte if Not Equal (ZF=0)
	OptCategory[STARS_NN_setng] = 2;               // Set Byte if Not Greater (ZF=1 | SF!=OF)
	OptCategory[STARS_NN_setnge] = 2;              // Set Byte if Not Greater or Equal (SF!=OF)
	OptCategory[STARS_NN_setnl] = 2;               // Set Byte if Not Less (SF=OF)
	OptCategory[STARS_NN_setnle] = 2;              // Set Byte if Not Less or Equal (ZF=0 & SF=OF)
	OptCategory[STARS_NN_setno] = 2;               // Set Byte if Not Overflow (OF=0)
	OptCategory[STARS_NN_setnp] = 2;               // Set Byte if Not Parity (PF=0)
	OptCategory[STARS_NN_setns] = 2;               // Set Byte if Not Sign (SF=0)
	OptCategory[STARS_NN_setnz] = 2;               // Set Byte if Not Zero (ZF=0)
	OptCategory[STARS_NN_seto] = 2;                // Set Byte if Overflow (OF=1)
	OptCategory[STARS_NN_setp] = 2;                // Set Byte if Parity (PF=1)
	OptCategory[STARS_NN_setpe] = 2;               // Set Byte if Parity Even (PF=1)
	OptCategory[STARS_NN_setpo] = 2;               // Set Byte if Parity Odd  (PF=0)
	OptCategory[STARS_NN_sets] = 2;                // Set Byte if Sign (SF=1)
	OptCategory[STARS_NN_setz] = 2;                // Set Byte if Zero (ZF=1)
	OptCategory[STARS_NN_sgdt] = 0;                // Store Global Descriptor Table Register
	OptCategory[STARS_NN_sidt] = 0;                // Store Interrupt Descriptor Table Register
	OptCategory[STARS_NN_shld] = 2;                // Double Precision Shift Left
	OptCategory[STARS_NN_shrd] = 2;                // Double Precision Shift Right
	OptCategory[STARS_NN_sldt] = 6;                // Store Local Descriptor Table Register
	OptCategory[STARS_NN_smsw] = 2;                // Store Machine Status Word
	OptCategory[STARS_NN_stc] = 1;                 // Set Carry Flag
	OptCategory[STARS_NN_std] = 1;                 // Set Direction Flag
	OptCategory[STARS_NN_sti] = 1;                 // Set Interrupt Flag
	OptCategory[STARS_NN_stos] = 0;                // Store String
	OptCategory[STARS_NN_str] = 6;                 // Store Task Register
	OptCategory[STARS_NN_sub] = 5;                 // Integer Subtraction
	OptCategory[STARS_NN_test] = 1;                // Logical Compare
	OptCategory[STARS_NN_verr] = 1;                // Verify a Segment for Reading
	OptCategory[STARS_NN_verw] = 1;                // Verify a Segment for Writing
	OptCategory[STARS_NN_wait] = 1;                // Wait until BUSY# Pin is Inactive (HIGH)
	OptCategory[STARS_NN_xchg] = 0;                // Exchange Register/Memory with Register
	OptCategory[STARS_NN_xlat] = 0;                // Table Lookup Translation
	OptCategory[STARS_NN_xor] = 2;                 // Logical Exclusive OR

	//
	//      486 instructions
	//

	OptCategory[STARS_NN_cmpxchg] = 0;             // Compare and Exchange
	OptCategory[STARS_NN_bswap] = 2;               // Swap bytes in register
	OptCategory[STARS_NN_xadd] = 0;                // t<-dest; dest<-src+dest; src<-t
	OptCategory[STARS_NN_invd] = 1;                // Invalidate Data Cache
	OptCategory[STARS_NN_wbinvd] = 1;              // Invalidate Data Cache (write changes)
	OptCategory[STARS_NN_invlpg] = 1;              // Invalidate TLB entry

	//
	//      Pentium instructions
	//

	OptCategory[STARS_NN_rdmsr] = 8;               // Read Machine Status Register
	OptCategory[STARS_NN_wrmsr] = 1;               // Write Machine Status Register
	OptCategory[STARS_NN_cpuid] = 8;               // Get CPU ID
	OptCategory[STARS_NN_cmpxchg8b] = 0;           // Compare and Exchange Eight Bytes
	OptCategory[STARS_NN_rdtsc] = 8;               // Read Time Stamp Counter
	OptCategory[STARS_NN_rsm] = 1;                 // Resume from System Management Mode

	//
	//      Pentium Pro instructions
	//

	OptCategory[STARS_NN_cmova] = 0;               // Move if Above (CF=0 & ZF=0)
	OptCategory[STARS_NN_cmovb] = 0;               // Move if Below (CF=1)
	OptCategory[STARS_NN_cmovbe] = 0;              // Move if Below or Equal (CF=1 | ZF=1)
	OptCategory[STARS_NN_cmovg] = 0;               // Move if Greater (ZF=0 & SF=OF)
	OptCategory[STARS_NN_cmovge] = 0;              // Move if Greater or Equal (SF=OF)
	OptCategory[STARS_NN_cmovl] = 0;               // Move if Less (SF!=OF)
	OptCategory[STARS_NN_cmovle] = 0;              // Move if Less or Equal (ZF=1 | SF!=OF)
	OptCategory[STARS_NN_cmovnb] = 0;              // Move if Not Below (CF=0)
	OptCategory[STARS_NN_cmovno] = 0;              // Move if Not Overflow (OF=0)
	OptCategory[STARS_NN_cmovnp] = 0;              // Move if Not Parity (PF=0)
	OptCategory[STARS_NN_cmovns] = 0;              // Move if Not Sign (SF=0)
	OptCategory[STARS_NN_cmovnz] = 0;              // Move if Not Zero (ZF=0)
	OptCategory[STARS_NN_cmovo] = 0;               // Move if Overflow (OF=1)
	OptCategory[STARS_NN_cmovp] = 0;               // Move if Parity (PF=1)
	OptCategory[STARS_NN_cmovs] = 0;               // Move if Sign (SF=1)
	OptCategory[STARS_NN_cmovz] = 0;               // Move if Zero (ZF=1)
	OptCategory[STARS_NN_fcmovb] = 1;              // Floating Move if Below          
	OptCategory[STARS_NN_fcmove] = 1;              // Floating Move if Equal          
	OptCategory[STARS_NN_fcmovbe] = 1;             // Floating Move if Below or Equal 
	OptCategory[STARS_NN_fcmovu] = 1;              // Floating Move if Unordered      
	OptCategory[STARS_NN_fcmovnb] = 1;             // Floating Move if Not Below      
	OptCategory[STARS_NN_fcmovne] = 1;             // Floating Move if Not Equal      
	OptCategory[STARS_NN_fcmovnbe] = 1;            // Floating Move if Not Below or Equal
	OptCategory[STARS_NN_fcmovnu] = 1;             // Floating Move if Not Unordered     
	OptCategory[STARS_NN_fcomi] = 1;               // FP Compare, result in EFLAGS
	OptCategory[STARS_NN_fucomi] = 1;              // FP Unordered Compare, result in EFLAGS
	OptCategory[STARS_NN_fcomip] = 1;              // FP Compare, result in EFLAGS, pop stack
	OptCategory[STARS_NN_fucomip] = 1;             // FP Unordered Compare, result in EFLAGS, pop stack
	OptCategory[STARS_NN_rdpmc] = 8;               // Read Performance Monitor Counter

	//
	//      FPP instructions
	//

	OptCategory[STARS_NN_fld] = 1;                 // Load Real             ** Infer src is 'n'
	OptCategory[STARS_NN_fst] = 9;                 // Store Real            
	OptCategory[STARS_NN_fstp] = 9;                // Store Real and Pop   
	OptCategory[STARS_NN_fxch] = 1;                // Exchange Registers
	OptCategory[STARS_NN_fild] = 1;                // Load Integer          ** Infer src is 'n'
	OptCategory[STARS_NN_fist] = 0;                // Store Integer
	OptCategory[STARS_NN_fistp] = 0;               // Store Integer and Pop
	OptCategory[STARS_NN_fbld] = 1;                // Load BCD
	OptCategory[STARS_NN_fbstp] = 0;               // Store BCD and Pop
	OptCategory[STARS_NN_fadd] = 1;                // Add Real
	OptCategory[STARS_NN_faddp] = 1;               // Add Real and Pop
	OptCategory[STARS_NN_fiadd] = 1;               // Add Integer
	OptCategory[STARS_NN_fsub] = 1;                // Subtract Real
	OptCategory[STARS_NN_fsubp] = 1;               // Subtract Real and Pop
	OptCategory[STARS_NN_fisub] = 1;               // Subtract Integer
	OptCategory[STARS_NN_fsubr] = 1;               // Subtract Real Reversed
	OptCategory[STARS_NN_fsubrp] = 1;              // Subtract Real Reversed and Pop
	OptCategory[STARS_NN_fisubr] = 1;              // Subtract Integer Reversed
	OptCategory[STARS_NN_fmul] = 1;                // Multiply Real
	OptCategory[STARS_NN_fmulp] = 1;               // Multiply Real and Pop
	OptCategory[STARS_NN_fimul] = 1;               // Multiply Integer
	OptCategory[STARS_NN_fdiv] = 1;                // Divide Real
	OptCategory[STARS_NN_fdivp] = 1;               // Divide Real and Pop
	OptCategory[STARS_NN_fidiv] = 1;               // Divide Integer
	OptCategory[STARS_NN_fdivr] = 1;               // Divide Real Reversed
	OptCategory[STARS_NN_fdivrp] = 1;              // Divide Real Reversed and Pop
	OptCategory[STARS_NN_fidivr] = 1;              // Divide Integer Reversed
	OptCategory[STARS_NN_fsqrt] = 1;               // Square Root
	OptCategory[STARS_NN_fscale] = 1;              // Scale:  st(0) <- st(0) * 2^st(1)
	OptCategory[STARS_NN_fprem] = 1;               // Partial Remainder
	OptCategory[STARS_NN_frndint] = 1;             // Round to Integer
	OptCategory[STARS_NN_fxtract] = 1;             // Extract exponent and significand
	OptCategory[STARS_NN_fabs] = 1;                // Absolute value
	OptCategory[STARS_NN_fchs] = 1;                // Change Sign
	OptCategory[STARS_NN_fcom] = 1;                // Compare Real
	OptCategory[STARS_NN_fcomp] = 1;               // Compare Real and Pop
	OptCategory[STARS_NN_fcompp] = 1;              // Compare Real and Pop Twice
	OptCategory[STARS_NN_ficom] = 1;               // Compare Integer
	OptCategory[STARS_NN_ficomp] = 1;              // Compare Integer and Pop
	OptCategory[STARS_NN_ftst] = 1;                // Test
	OptCategory[STARS_NN_fxam] = 1;                // Examine
	OptCategory[STARS_NN_fptan] = 1;               // Partial tangent
	OptCategory[STARS_NN_fpatan] = 1;              // Partial arctangent
	OptCategory[STARS_NN_f2xm1] = 1;               // 2^x - 1
	OptCategory[STARS_NN_fyl2x] = 1;               // Y * lg2(X)
	OptCategory[STARS_NN_fyl2xp1] = 1;             // Y * lg2(X+1)
	OptCategory[STARS_NN_fldz] = 1;                // Load +0.0
	OptCategory[STARS_NN_fld1] = 1;                // Load +1.0
	OptCategory[STARS_NN_fldpi] = 1;               // Load PI=3.14...
	OptCategory[STARS_NN_fldl2t] = 1;              // Load lg2(10)
	OptCategory[STARS_NN_fldl2e] = 1;              // Load lg2(e)
	OptCategory[STARS_NN_fldlg2] = 1;              // Load lg10(2)
	OptCategory[STARS_NN_fldln2] = 1;              // Load ln(2)
	OptCategory[STARS_NN_finit] = 1;               // Initialize Processor
	OptCategory[STARS_NN_fninit] = 1;              // Initialize Processor (no wait)
	OptCategory[STARS_NN_fsetpm] = 1;              // Set Protected Mode
	OptCategory[STARS_NN_fldcw] = 1;               // Load Control Word
	OptCategory[STARS_NN_fstcw] = 0;               // Store Control Word
	OptCategory[STARS_NN_fnstcw] = 0;              // Store Control Word (no wait)
	OptCategory[STARS_NN_fstsw] = 2;               // Store Status Word to memory or AX
	OptCategory[STARS_NN_fnstsw] = 2;              // Store Status Word (no wait) to memory or AX
	OptCategory[STARS_NN_fclex] = 1;               // Clear Exceptions
	OptCategory[STARS_NN_fnclex] = 1;              // Clear Exceptions (no wait)
	OptCategory[STARS_NN_fstenv] = 0;              // Store Environment
	OptCategory[STARS_NN_fnstenv] = 0;             // Store Environment (no wait)
	OptCategory[STARS_NN_fldenv] = 1;              // Load Environment
	OptCategory[STARS_NN_fsave] = 0;               // Save State
	OptCategory[STARS_NN_fnsave] = 0;              // Save State (no wait)
	OptCategory[STARS_NN_frstor] = 1;              // Restore State    **  infer src is 'n'
	OptCategory[STARS_NN_fincstp] = 1;             // Increment Stack Pointer
	OptCategory[STARS_NN_fdecstp] = 1;             // Decrement Stack Pointer
	OptCategory[STARS_NN_ffree] = 1;               // Free Register
	OptCategory[STARS_NN_fnop] = 1;                // No Operation
	OptCategory[STARS_NN_feni] = 1;                // (8087 only)
	OptCategory[STARS_NN_fneni] = 1;               // (no wait) (8087 only)
	OptCategory[STARS_NN_fdisi] = 1;               // (8087 only)
	OptCategory[STARS_NN_fndisi] = 1;              // (no wait) (8087 only)

	//
	//      80387 instructions
	//

	OptCategory[STARS_NN_fprem1] = 1;              // Partial Remainder ( < half )
	OptCategory[STARS_NN_fsincos] = 1;             // t<-cos(st); st<-sin(st); push t
	OptCategory[STARS_NN_fsin] = 1;                // Sine
	OptCategory[STARS_NN_fcos] = 1;                // Cosine
	OptCategory[STARS_NN_fucom] = 1;               // Compare Unordered Real
	OptCategory[STARS_NN_fucomp] = 1;              // Compare Unordered Real and Pop
	OptCategory[STARS_NN_fucompp] = 1;             // Compare Unordered Real and Pop Twice

	//
	//      Instructions added 28.02.96
	//

	OptCategory[STARS_NN_setalc] = 2;              // Set AL to Carry Flag     **
	OptCategory[STARS_NN_svdc] = 0;                // Save Register and Descriptor
	OptCategory[STARS_NN_rsdc] = 0;                // Restore Register and Descriptor
	OptCategory[STARS_NN_svldt] = 0;               // Save LDTR and Descriptor
	OptCategory[STARS_NN_rsldt] = 0;               // Restore LDTR and Descriptor
	OptCategory[STARS_NN_svts] = 1;                // Save TR and Descriptor
	OptCategory[STARS_NN_rsts] = 1;                // Restore TR and Descriptor
	OptCategory[STARS_NN_icebp] = 1;               // ICE Break Point
	OptCategory[STARS_NN_loadall] = 0;             // Load the entire CPU state from ES:EDI

	//
	//      MMX instructions
	//

	OptCategory[STARS_NN_emms] = 1;                // Empty MMX state
	OptCategory[STARS_NN_movd] = 9;                // Move 32 bits
	OptCategory[STARS_NN_movq] = 9;                // Move 64 bits
	OptCategory[STARS_NN_packsswb] = 1;            // Pack with Signed Saturation (Word->Byte)
	OptCategory[STARS_NN_packssdw] = 1;            // Pack with Signed Saturation (Dword->Word)
	OptCategory[STARS_NN_packuswb] = 1;            // Pack with Unsigned Saturation (Word->Byte)
	OptCategory[STARS_NN_paddb] = 1;               // Packed Add Byte
	OptCategory[STARS_NN_paddw] = 1;               // Packed Add Word
	OptCategory[STARS_NN_paddd] = 1;               // Packed Add Dword
	OptCategory[STARS_NN_paddsb] = 1;              // Packed Add with Saturation (Byte)
	OptCategory[STARS_NN_paddsw] = 1;              // Packed Add with Saturation (Word)
	OptCategory[STARS_NN_paddusb] = 1;             // Packed Add Unsigned with Saturation (Byte)
	OptCategory[STARS_NN_paddusw] = 1;             // Packed Add Unsigned with Saturation (Word)
	OptCategory[STARS_NN_pand] = 1;                // Bitwise Logical And
	OptCategory[STARS_NN_pandn] = 1;               // Bitwise Logical And Not
	OptCategory[STARS_NN_pcmpeqb] = 1;             // Packed Compare for Equal (Byte)
	OptCategory[STARS_NN_pcmpeqw] = 1;             // Packed Compare for Equal (Word)
	OptCategory[STARS_NN_pcmpeqd] = 1;             // Packed Compare for Equal (Dword)
	OptCategory[STARS_NN_pcmpgtb] = 1;             // Packed Compare for Greater Than (Byte)
	OptCategory[STARS_NN_pcmpgtw] = 1;             // Packed Compare for Greater Than (Word)
	OptCategory[STARS_NN_pcmpgtd] = 1;             // Packed Compare for Greater Than (Dword)
	OptCategory[STARS_NN_pmaddwd] = 1;             // Packed Multiply and Add
	OptCategory[STARS_NN_pmulhw] = 1;              // Packed Multiply High
	OptCategory[STARS_NN_pmullw] = 1;              // Packed Multiply Low
	OptCategory[STARS_NN_por] = 1;                 // Bitwise Logical Or
	OptCategory[STARS_NN_psllw] = 1;               // Packed Shift Left Logical (Word)
	OptCategory[STARS_NN_pslld] = 1;               // Packed Shift Left Logical (Dword)
	OptCategory[STARS_NN_psllq] = 1;               // Packed Shift Left Logical (Qword)
	OptCategory[STARS_NN_psraw] = 1;               // Packed Shift Right Arithmetic (Word)
	OptCategory[STARS_NN_psrad] = 1;               // Packed Shift Right Arithmetic (Dword)
	OptCategory[STARS_NN_psrlw] = 1;               // Packed Shift Right Logical (Word)
	OptCategory[STARS_NN_psrld] = 1;               // Packed Shift Right Logical (Dword)
	OptCategory[STARS_NN_psrlq] = 1;               // Packed Shift Right Logical (Qword)