Fix bug affecting -finish-on-target-match

Because of a mistake with if-statement delimiting, it had accidentally
been disabled when -target-guidance was not enabled.
A few little improvements to the influence code

Switch back to the old XOR algorithm, since I realized the new one
may not always work well.
Take measurements even when a value is concrete. We could do more
optimization of this case but it shouldn't be excluded completely.
Fix some signedness/overflow issues in the binary search.
Fix cut-and-paste mistake in mem_val_as_string

Load type should depend on the type, not always be byte.
Add a buffer-overflow detection example

Modified from our ISSTA'11 paper
Another round of fixes for VEX version compatibility

YMM registers on x64 don't exist in old versions. VECRET and BBPTR
are new. needsBBP went away. x86 HWCAP checking is stricter, indicating
I'd misunderstood the comments about MMXEXT. Up to VEX r2797.
Fix zero_region sanity check for 32-bit OCaml

The old upper bound wrapped on 32-bit OCaml's 31-bit ints, causing it
to always fail even on sane values. Make the value a bit smaller
(512MB from 1024MB) while we're at it.
Further fix related to VEX_HWCAPS_X86_MMXEXT

Actually the flag is pretty new, so it was probably only today
that I was misread the comment.
Tweak binary search for 64-bit case

The binary search used in influence estimation was broken for 64-bit
values, since it was implicitly taking advantage of having extra bits.
Rewrite the way we choose the midpoint, and an assertion, so it doesn't
immediately fail (the old code had an infinite loop). Still only
lightly tested, though.
Cache the last satisfying assignment on a path

Original title "Implemented the saving of satisfying assignments
to reduce queries"; edited by SMcC to avoid spurious white
space changes.
Add -git-version option

To easily check which GIT revision a binary was built from.
For instance to double check that your binary has a particular
bug fix. The output would look nicer if we had proper version
numbers; for now it will just be a hex revision plus a possible
"-dirty".
No-op implementation of fsync().
Memoize formula analysis routines

This avoids an asymptotic blowup if the formulas have a lot of shared
subterms.
Introduce a "map_expr_temp" in the formula manager to encode this
kind of traversal and caching.
Add flushes to some more tracing printf()s, which makes it easier
to see where FuzzBALL is spending its time when it's slow.
Add a -target-string-file option

Like -target-string, but it reads the target data directly from a file,
which works better with binary data.
Avoid divide by zero in guidance heuristic
Add a new experimental kind of target guidance

Currently enabled with -target-guidance 2.0. Unconditional, but
limited to states that are the best we've even encountered.
Add GIT-based STP compilation instructions

Keeping the SVN ones for the moment, since the GIT version is less
stable now and doesn't have any must-have bug fixes.
Disable tables of size 1

This corner case was triggering a near-infinite loop. Also add a sanity
check iteration limit to simplify_fp, which wasn't the problem this time
but could also easily loop if there are other problems with
simplification.
Replaced occurrences of "or" with "||".

"or" is deprecated as of OCaml 4.01.
Implemented caching of satisfying assignments.

Pointers to every satisfying assignment the query engine produces
are stored in a global cache, and pointers to every satisfying
assignment that satisfies the current path are stored in a
working cache. Before a query is made, the assignments in the
working cache are checked against the path condition for a
satisfying value. If a satisfying assignment is found, the query
is not carried out.
Fix minor typo in INSTALL