2

I want to do points-to anlysis in llvm IR. I want it to be path sensitive, which means that when I print out the result, I need append the condition for the "May" Points-to.

I plan to using symbolic execution to achieve this goal.

Are there any tools in llvm, or stand-alone tools to solve the symbolic equation.

Thank you!

Cactus
  • 27,075
  • 9
  • 69
  • 149
blankboy2011
  • 349
  • 1
  • 10

1 Answers1

2

Some pointers to get you started:

  1. The Scalar Evolution LLVM module is basically symbolic execution of arithmetic expressions (and taking loops into consideration).
  2. Klee is a full symbolic execution VM for LLVM IR.
Oak
  • 26,231
  • 8
  • 93
  • 152