Skip to content
Frank Busse edited this page Dec 7, 2022 · 26 revisions

Quick Start

Set Up Environment

Set up the SVF environment variables to point to the release version executables of SVF

cd $SVF_HOME
. ./setup.sh

Set up the environment variables for the debug version executables of SVF (make sure you have built the debug version of SVF)

cd $SVF_HOME
. ./setup.sh debug

After the build process, the executables are generated in $SVF_HOME/Release+Asserts ($SVF_HOME/Debug+Asserts)

Run whole program analysis engine (wpa)

Run Andersen’s Pointer Analysis

wpa -ander example.bc

Run Andersen’s Pointer Analysis and generate whole-program value-flow graph

wpa -ander -svfg example.bc

Run Flow-Sensitive Pointer Analysis

wpa -fspta example.bc

Analysis Outputs

Dump Graphs

You can dump various graphs used in the analysis in the dot format. You can use any graph visualization tools (e.g., zgrviewer) to view these graphs.

Dump Callgraph

wpa -ander -dump-callgraph example.bc 
wpa -fspta -dump-callgraph example.bc 

Dump PAG (program assignment graph)

wpa -ander -dump-pag example.bc 

Dump Constraint Graph

wpa -ander -dump-constraint-graph example.bc 

Dump Value-Flow Graph

wpa -ander -svfg -dump-vfg example.bc 

Dump Memory SSA

wpa -ander -svfg -dump-mssa example.bc 

Print statistics

wpa -ander -stat example.bc
wpa -fspta -stat example.bc

Output after analyzing 181.mcf from CPU2000 using Andersen's analysis:

****CallGraph SCC Stat****
################ (program : )###############
-------------------------------------------------------
TotalNode           40
TotalEdge           83
TotalCycle          1
NodeInCycle         1
MaxNodeInCycle      1
#######################################################

****Andersen Pointer Analysis Statistics****
################ (program : )###############
TotalPointers       4114
TotalObjects        244
TotalFieldObjects   294
MaxStructSize       28
TotalEdges          4686
FunctionObjs        40
GlobalObjs          9
HeapObjs            6
StackObjs           187
FIObjNum            0
FSObjNum            242
VarStructObj        2
VarArrayObj         3
ConstStructObj      0
ConstArrayObj       0
NonPtrObj           121
AddrsNum            273
LoadsNum            935
StoresNum           305
CopysNum            289
GepsNum             492
CallsNum            47
ReturnsNum          2
IndCallSites        0
LocalVarInRecur     6
BitCastNumber       38
BBWith2Succ         177
BBWith3Succ         1
-------------------------------------------------------
CollapseTime        0
TotalTime           0.25
SCCDetectTime       0.102
SCCMergeTime        0.025
LoadStoreTime       0.013
CopyGepTime         0.094
UpdateCGTime        0
AvgPtsSetSize       0.581672
AvgTopLvlPtsSize    1.20069
CGNodeNum           4306
PointsToConstPtr    0
PointsToBlkPtr      0
TotalPointers       4114
TotalObjects        538
TotalEdges          2992
AddrsNum            244
LoadsNum            908
StoresNum           272
CopysNum            1320
GepsNum             492
AddrProcessed       273
LoadProcessed       957
StoreProcessed      330
CopyProcessed       9296
GepProcessed        3936
Pointers            4098
DYFieldPtrs         16
MemObjects          244
DYFieldObjs         294
MaxPtsSetSize       3
Iterations          8
IndCallSites        0
IndEdgeSolved       0
NumOfSCCDetect      8
TotalCycleNum       27
TotalPWCCycleNum    0
NodesInCycles       184
MaxNodesInSCC       47

Output after analyzing 181.mcf from CPU2000 using the Flow-sensitive analysis:

****Memory SSA Statistics****
################ (program : )###############
-------------------------------------------------------
TotalMSSATime       0.056
GenRegionTime       0.033
GenMUCHITime        0.016
InsertPHITime       0.005
SSARenameTime       0
AverageRegSize      1.34
MaxRegSize          8
MemRegions          150
FunEntryChi         250
FunRetMu            250
CSChiNode           63
CSMuNode            118
LoadMuNode          906
StoreChiNode        294
MSSAPhi             282
FunHasEntryChi      26
FunHasRetMu         26
CSHasChi            22
CSHasMu             30
LoadHasMu           935
StoreHasChi         305
BBHasMSSAPhi        96
#######################################################

****SVFG Statistics****
################ (program : )###############
-------------------------------------------------------
TotalTime           0.087
ConnDirEdgeTime     0.004
ConnIndEdgeTime     0.009
TLNodeTime          0.003
ATNodeTime          0.002
OptTime             0.011
AvgWeight           1.13971
MSSAPhi             135
TotalNode           2577
FormalIn            88
FormalOut           0
FormalParam         0
FormalRet           0
ActualIn            0
ActualOut           18
ActualParam         0
ActualRet           0
Addr                273
Copy                289
Gep                 492
Store               305
Load                935
PHI                 41
TotalEdge           4415
DirectEdge          2375
IndirectEdge        2040
IndCallEdge         272
IndRetEdge          114
DirectCallEdge      47
DirectRetEdge       2
AvgInDegree         1
AvgOutDegree        1
MaxInDegree         7
MaxOutDegree        63
AvgIndInDeg         1
AvgIndOutDeg        4
MaxIndInDeg         7
MaxIndOutDeg        57
#######################################################

****CallGraph SCC Stat****
################ (program : )###############
-------------------------------------------------------
TotalNode           40
TotalEdge           83
TotalCycle          1
NodeInCycle         1
MaxNodeInCycle      1
CalRetPairInCycle   2
#######################################################

****Flow-Sensitive Pointer Analysis Statistics****
################ (program : )###############
TotalPointers       4114
TotalObjects        244
TotalFieldObjects   294
MaxStructSize       28
TotalEdges          4686
FunctionObjs        40
GlobalObjs          9
HeapObjs            6
StackObjs           187
FIObjNum            0
FSObjNum            242
VarStructObj        2
VarArrayObj         3
ConstStructObj      0
ConstArrayObj       0
NonPtrObj           121
AddrsNum            273
LoadsNum            935
StoresNum           305
CopysNum            289
GepsNum             492
CallsNum            47
ReturnsNum          2
IndCallSites        0
LocalVarInRecur     6
BitCastNumber       38
BBWith2Succ         177
BBWith3Succ         1
-------------------------------------------------------
SolveTime           0.054
SCCTime             0.01
ProcessTime         0.023
PropagationTime     0.007
DirectPropaTime     0.001
IndirectPropaTime   0.004
UpdateTime          0.001
AddrTime            0
CopyGepTime         0.008
LoadTime            0.006
StoreTime           0
UpdateCGTime        0
AvgPtsSize          1.18989
AvgTopLvlPtsSize    1.11001
AvgAddrTakenVarPts  1.1
AvgINPtsSize        1.29249
AvgOUTPtsSize       1.26568
AverageSCCSize      11.4902
TotalTime           0.065
PointsToConstPtr    0
PointsToBlkPtr      0
StrongUpdates       218
SNodesHaveIN        1213
SNodesHaveOUT       253
FI_SNodesHaveIN     68
FI_SNodesHaveOUT    0
FO_SNodesHaveIN     0
FO_SNodesHaveOUT    0
AI_SNodesHaveIN     0
AI_SNodesHaveOUT    0
AO_SNodesHaveIN     18
AO_SNodesHaveOUT    0
LD_SNodesHaveIN     831
LD_SNodesHaveOUT    0
ST_SNodesHaveIN     175
ST_SNodesHaveOUT    253
PHI_SNodesHaveIN    121
PHI_SNodesHaveOUT   0
VarHaveIN           1371
VarHaveOUT          271
VarHaveIN_FI        98
VarHaveOUT_FI       0
VarHaveIN_FO        0
VarHaveOUT_FO       0
VarHaveIN_AI        0
VarHaveOUT_AI       0
VarHaveIN_AO        39
VarHaveOUT_AO       0
VarHaveIN_LD        866
VarHaveOUT_LD       0
VarHaveIN_ST        193
VarHaveOUT_ST       271
VarHaveIN_PHI       175
VarHaveOUT_PHI      0
MaxPtsSize          3
MaxTopLvlPtsSize    3
MaxINPtsSize        3
MaxOUTPtsSize       3
NumOfAddrTakenVar   310
MaxAddrTakenVarPts  3
ProcessedAddr       273
ProcessedCopy       643
ProcessedGep        1018
ProcessedLoad       2513
ProcessedStore      954
ProcessedPhi        91
ProcessedAParam     0
ProcessedFRet       0
ProcessedMSSANode   570
NumOfNodesInSCC     586
MaxSCCSize          199
NumOfSCC            51
TotalPointers       4114
TotalObjects        538
StoresNum           305
CopysNum            289
Pointers            4098
DYFieldPtrs         16
MemObjects          244
DYFieldObjs         294
Iterations          1
IndEdgeSolved       0
#######################################################

Print Points-to Results

wpa -ander -print-pts example.bc
wpa -fspta -print-pts example.bc
Clone this wiki locally