SMT2 formulation of pointer objects

[mm95]

Hello,
I have a problem in logical formulation of programs with pointers via smt2 core of cbmc.
for example for below code

void ss2n(unsigned int s, unsigned char* c) {
   	c[0]=(unsigned char)(((s)>> 8)&0xff);
	c[1]=(unsigned char)(((s)    )&0xff);
        c += 2;
}


int main(){

unsigned char* s_1 =8;
*s_1 = '8';
ss2n(18, s_1);
assert(0);
return 1;
}

I have a function(ss2n) that gets a pointer and set some values in object related to this pointer.
I use cbmc 5.6 to get SMT2 formula and got below result (I erplaced define-fun with pair(declare-fun, assert))

(set-info :source "Generated by CBMC 5.6")
(set-option :produce-models true)
(set-logic QF_AUFBV)

(declare-fun |__CPROVER_dead_object#1| () (_ BitVec 64))
(assert (= |__CPROVER_dead_object#1| (_ bv0 64)))


(declare-fun |__CPROVER_deallocated#1| () (_ BitVec 64))
(assert (= |__CPROVER_deallocated#1| (_ bv0 64)))


(declare-fun |__CPROVER_malloc_is_new_array#1| () Bool)
(assert (= |__CPROVER_malloc_is_new_array#1| false))


(declare-fun |__CPROVER_malloc_object#1| () (_ BitVec 64))
(assert (= |__CPROVER_malloc_object#1| (_ bv0 64)))


(declare-fun |__CPROVER_malloc_size#1| () (_ BitVec 64))
(assert (= |__CPROVER_malloc_size#1| (_ bv0 64)))


(declare-fun |__CPROVER_memory_leak#1| () (_ BitVec 64))
(assert (= |__CPROVER_memory_leak#1| (_ bv0 64)))


(declare-fun |__CPROVER_next_thread_id#1| () (_ BitVec 64))
(assert (= |__CPROVER_next_thread_id#1| (_ bv0 64)))


(declare-fun |__CPROVER_pipe_count#1| () (_ BitVec 32))
(assert (= |__CPROVER_pipe_count#1| (_ bv0 32)))


(declare-fun |__CPROVER_rounding_mode!0#1| () (_ BitVec 32))
(assert (= |__CPROVER_rounding_mode!0#1| (_ bv0 32)))


(declare-fun |__CPROVER_thread_id!0#1| () (_ BitVec 64))
(assert (= |__CPROVER_thread_id!0#1| (_ bv0 64)))


(declare-fun array_of.0 () (Array (_ BitVec 64) (_ BitVec 1)))
(declare-fun |__CPROVER_threads_exited#1| () (Array (_ BitVec 64) (_ BitVec 1)))
(assert (= |__CPROVER_threads_exited#1| array_of.0))


(declare-fun |main::1::s_1!0@1#2| () (_ BitVec 64))
(assert (= |main::1::s_1!0@1#2| ((_ sign_extend 32) (_ bv8 32))))


(declare-fun |__CPROVER_memory#0| () (Array (_ BitVec 64) (_ BitVec 8)))
(declare-fun |__CPROVER_memory#1| () (Array (_ BitVec 64) (_ BitVec 8)))
(assert (= |__CPROVER_memory#1| (store |__CPROVER_memory#0| (_ bv8 64) (_ bv56 8))))


(declare-fun |ss2n::s!0@1#1| () (_ BitVec 32))
(assert (= |ss2n::s!0@1#1| (_ bv18 32)))


(declare-fun |ss2n::c!0@1#1| () (_ BitVec 64))
(assert (= |ss2n::c!0@1#1| ((_ sign_extend 32) (_ bv8 32))))


(declare-fun |__CPROVER_memory#2| () (Array (_ BitVec 64) (_ BitVec 8)))
(assert (= |__CPROVER_memory#2| (store |__CPROVER_memory#1| (_ bv8 64) (_ bv0 8))))


(declare-fun |__CPROVER_memory#3| () (Array (_ BitVec 64) (_ BitVec 8)))
(assert (= |__CPROVER_memory#3| (store |__CPROVER_memory#2| (_ bv9 64) (_ bv18 8))))


(declare-fun |ss2n::c!0@1#2| () (_ BitVec 64))
(assert (= |ss2n::c!0@1#2| (bvadd ((_ sign_extend 32) (_ bv8 32)) (_ bv2 64))))


(declare-fun |main::1::s_1!0@1#1| () (_ BitVec 64))
(declare-fun |B0| () Bool)
(assert (= |B0| (= |main::1::s_1!0@1#1| |main::1::s_1!0@1#1|)))

(check-sat)
...

Unfortunately, in smt2 formula generated via cbmc, I can not track the relation between objects and their pointers via pointers'name.In above formula, 2 bytes of object of 'c'(or in fact 's') are set but in formula, his is reflected as setting cprover_memory, however if I want to input this formula to an external solver, it is not understood automatically.
Is there any way to deal with this matter?

Thanks so much.

[tautschnig]

With apologies for replying more than 5 years later: your example sets the pointer (!) to 8, i.e., assumes there is some valid memory at address 8. CBMC accounts for this scenario by introducing an object called __CPROVER_memory (that represents all your system's memory) and will access that "object" at index 8. You don't actually have a named object in your program, so you couldn't possibly get that mapping.