SVF-tools/SVF
SVF
SVF is an open-source static program analysis framework and points-to analysis library that tracks memory references, variable aliases, and data dependencies across whole programs. The platform translates compiled intermediate code formats into unified internal representations, constructing constraint graphs, call graphs, and control-flow graphs to model interprocedural execution behavior and memory state.
The framework incorporates specialized engines for flow-sensitive, flow-insensitive, and context-sensitive pointer analysis alongside sparse value-flow graph generation. It features memory layout modeling, static single assignment conversions for address-taken variables, and points-to set deduplication primitives designed to conserve system memory during large-scale program evaluations. Performance optimization utilities cache calculation results and short-circuit redundant computations through indirect identifiers, while parallel execution capabilities distribute analysis workloads across multiple threads.
The software supports comprehensive static analysis tasks including software vulnerability detection, memory safety error identification, information flow tracking, and multithreaded program analysis. Users can generate detailed metrics, export graph visualizations in standard formats, and query program dependence information using custom driver scripts. The library can be compiled from source or deployed within containerized environments.
Features
- Pointer Analysis Executors - Executes pointer analysis algorithms on source code to compute points-to relations across programs.
- Source Pointer Trackers - Calculates memory pointer relationships across programs using sensitive algorithms to trace data flow.
- Static Code Analysis - Analyzes source code and intermediate representations to compute points-to information, build program graphs, and inspect dependencies.
- Static Analysis Frameworks - An open-source static analysis framework that computes pointer points-to information, call graphs, and value-flow graphs for source code.
- Vulnerability Detection - Identifies security flaws, memory leaks, and unsafe operations by tracking data flows from sources to sensitive sinks.
- Static Call Graph Generators - Constructs visual diagrams of function call relationships to illustrate interprocedural control flow.
- Points-To Analysis Engines - A pointer analysis library that tracks memory references and variable aliases across whole programs using flow- and context-sensitive algorithms.
- Points-To Calculators - Performs flow-insensitive or flow-sensitive analysis to determine memory locations referenced by pointers.
- Program Graph Constructions - Transforms program instructions into constraint graphs where nodes represent pointers and edges represent dependencies.
- Constraint Graph Solvers - Builds constraint graphs for inclusion-based pointer analysis by iteratively resolving and adding copy edges.
- Customizable Solvers - Determines points-to relationships using customizable data structures and algorithms such as flow-sensitive solvers.
- Intermediate Representation Translation - Converts source code into language-independent intermediate formats and builds internal code graphs.
- Interprocedural Pointer Analysis - Investigates memory pointer relationships, alias sets, and points-to relations using flow-insensitive and flow-sensitive solvers.
- Pointer Relationship Mappers - Transforms source code into constraint graphs and solvers to compute points-to information.
- Constraint Graph Solvers - Computes inclusion-based points-to relations by iteratively resolving copy edges over large constraint networks until reaching a fixed point.
- Software Vulnerability Detectors - Identifies source-sink related programming errors and memory safety issues using abstract execution techniques.
- Control-Flow Graph Generation - Builds interprocedural control flow graphs that map out execution paths and basic block transitions.
- Value-Flow Graph Generators - A compiler-based tool that constructs sparse value-flow representations and control flow graphs to detect bugs, memory leaks, and information flows.
- Sparse Value-Flow Graph Generations - Builds directed graphs capturing definition-use chains for top-level pointers and address-taken objects.
- Value-Flow Graph Generations - Constructs interprocedural sparse value-flow graphs capturing definition-use chains for pointers and memory objects.
- Sparse Value-Flow Graph Constructions - Builds directed graphs capturing precise data dependencies and variable modifications to enable scalable interprocedural taint and security tracking.
- Static Analysis - Examines source code to compute points-to relations, data dependencies, and value flows across whole programs.
- Flow-Sensitive Analysis - Performs static points-to analysis on source code using versioned staged techniques to track pointer values accurately.
- Intermediate Representation Analysis - Processes compiled intermediate representation files as input to execute static analysis passes.
- Interprocedural Control Flow Mappings - Constructs connected function call boundaries and basic block transition paths to model whole-program execution behavior.
- Memory - Converts address-taken variables and indirect memory accesses into explicit definition-use chains using inserted use and change functions.
- Memory SSA Form Constructions - Annotates indirect memory accesses with explicit definition and use functions to convert address-taken variables into static single assignment form.
- Custom Pointer Analysis Builders - Constructs flow- and field-insensitive inclusion-based pointer analyses with concise driver programs.
- Memory Layout and Allocation Modelings - Parses source code to construct symbol tables and abstract memory objects capturing structure fields, array strides, and allocation sites.
- Sensitive Data Flow Detection - Traces data movement from designated source points to sensitive sink targets using value-flow graph representations.
- Value-Flow Mappers - Builds interprocedural side-effect annotations and alias sets using points-to results to track variable modification.
- Analysis Graph Exporters - Generates analysis graphs including call graphs and value-flow graphs in standard formats for external rendering.
- Program Visualizations and Metrics - Generates graph representations such as call graphs and value-flow graphs alongside performance and memory statistics.
- Memory Error Detection - Identifies memory leaks, double frees, and other unsafe memory operations through static program analysis.
- Program Dependence Query Engines - Inspects points-to relationships and program dependence information programmatically using custom driver scripts.
- Code Structure Visualizations - Produces call graphs and control flow graphs to visualize program structure and data dependencies.
