Stack Overflow
Stack Overflow

Questions tagged [klee]

KLEE: Unassisted and Automatic Generation of High-Coverage, is a symbolic virtual machine built on top of the LLVM compiler infrastructure

KLEE is a symbolic execution tool, capable of automatically generating tests that achieve high coverage on a diverse set of complex and environmentally-intensive programs, KLEE could also be used as a bug finding too.

Home page

KLEE publication

57 questions
20
votes
2 answers

Limits of Klee (the LLVM program analysis tool)

http://klee.llvm.org/ is a program analysis tool that works by symbolic execution and constraint solving, finding possible inputs that will cause a program to crash, and outputting these as test cases. It's an extremely impressive piece of…
rwallace
  • 26,045
  • 30
  • 102
  • 195
7
votes
1 answer

How to force gcov to extract data, even when program is aborted

I'm using a test-generating tool called KLEE, that creates lots of tests for my C99-Code. Afterwards I run the tests and check line coverage with gcov. Gcov seems to update coverage data at the end of the run upon successful completion. However,…
Henning
  • 73
  • 1
  • 5
4
votes
0 answers

klee .bca files missing

I followed http://klee.llvm.org/GetStarted.html when installing Klee over my LLVM 2.9 (as required), meaning : Install dependencies DONE export C_INCLUDE_PATH=/usr/include/i386-linux-gnu/ DONE export CPLUS_INCLUDE_PATH/usr/include/i386-linux-gnu/…
user2022455
3
votes
0 answers

Using KLEE to derive call-graph(s) from test case(s)

Each generated test amounts to a path, and I'm interested in obtaining information on the functions called along each path, and from there obtain a call graph as the union of paths for all test. This should render a subset of the complete…
user3434838
  • 31
  • 1
3
votes
0 answers

How to translate intrinsics to a legacy architecture?

I want to run klee on a performance optimized code, that uses various instruction set extensions, like sse2, sse4.1. Unfortunately llvm-3.4 interpreter does not support them: LLVM ERROR: Code generator does not support intrinsic function…
Necto
  • 2,454
  • 1
  • 17
  • 40
3
votes
1 answer

KLEE WARNINGS and no inputs generated

I am new in KLEE. I had installed klee, followed the instructions correctly. if i run program from tutorial: int get_sign(int x) { if (x == 0) return 0; if (x < 0) return -1; else return 1; } int main() { int a; klee_make_symbolic(&a,…
Urmas Repinski
  • 109
  • 1
  • 6
3
votes
3 answers

KLEE for C++ code that uses pthreads

I am a beginner trying to use KLEE. I am using the KLEE self contained package to on a C++ program that uses pthreads. I have generated a .o file and used KLEE with the following option klee --libc=uclibc --posix-runtime test.o But i see i get…
Dimurali
  • 31
  • 3
2
votes
0 answers

How to find path conditions in KLEE? Ideally, how to find path conditions of longest/shortest paths

I am in my dock container exploring the toy "get_sign.c" program that KLEE comes with. I want to explore the different paths of the symbolic calculation executed when I do: clang -I ../../include -emit-llvm -c -g get_sign.c I can see the values the…
Mike
  • 317
  • 3
  • 12
2
votes
0 answers

Main Function not Found in the Bitcode file generated by compiling haskell with LLVM

I want to run klee on the .bc file generated by compiling haskell file with ghc frontend and llvm backend. I have following code in my haskell hello.hs file: main = putStrLn "Hello World!" I compile hello.hs with ghc using following command ghc…
user7235699
  • 411
  • 2
  • 13
2
votes
0 answers

LLVM: How to use LoopInfoPass and ScalarEvolutionPass in CallGraphSCC-Pass?

I want to use LoopInfoPass in the runOnSCC() method of a pass derived from CallGraphSCC-Pass. More specifically, I want to judge whether a basicblock is in a loop or not in the runOnSCC() method. So, the code should be like: LoopInfo &lf =…
Justme0
  • 95
  • 10
2
votes
0 answers

How does KLEE model memory?

http://www.doc.ic.ac.uk/~dsl11/klee-doxygen/overview.html I'm trying to model memory for binaries and so I would like to see how KLEE handles it. However, I am having trouble understanding the explanation from the overview. Can I get an easier…
drum
  • 4,403
  • 6
  • 45
  • 76
2
votes
1 answer

Error while running cloud9 "error: ld terminated with signal 11"

I am trying to run the cloud9 application on ubuntu. However make command is giving me error llvm[2]: Linking Release+Asserts executable klee (without symbols) collect2: error: ld terminated with signal 11 [Segmentation fault], core dumped make[2]:…
user2805242
  • 135
  • 1
  • 11
2
votes
1 answer

run using KLEE error

I am new to Klee, so I started to make the tutorials. If for compilation I use: llvm-gcc --emit-llvm -c -g get_sign.c and then I try to run using klee get_sign.o I get the error : KLEE: ERROR: error loading program 'get_sign.o': Invalid…
Alex
  • 311
  • 3
  • 16
2
votes
1 answer

klee with loops strange behaviour with similar code

I have a question about how is working KLEE (symbolic execution tool) in case of loops with symbolic parameters: int loop(int data) { int i, result=0; for (i=0;i
user1753101
  • 21
  • 2
1
vote
0 answers

LLVM interate over the content of a structure accessed through pointer in KLEE code

I am quite new to LLVM and KLEE and I am trying to understand whether it is possible to access the content of a structure that is referred to by a pointer. The code I am working on is quite long and complicated, but the problem is the following: In…
fabCic
  • 11
  • 1
1
2 3 4