For example, KLEE works on LLVM bitcode.
Can we build symbolic execution directly on C source code?
Each LLVM IR contains only one simple operation, but one C statement could contains multiple operations. For example, a[i] = b[i];
could be split into:
addr = b + i; // getElementPtr instruction
tmp = *addr; // load instruction
addr1 = a + i; // getElementPtr instruction
*addr1 = tmp; // store instruction
So it's much more simple to process LLVM IR than source code for a symbolic executor.
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.