Difficulty in obtaining pointer IDs of memory objects corresponding to pointer variables

[theeshaan]

Hello,

I'm trying to write an extractor script that parses SVF's pointer-analysis output and presents it in a simple format that is of use to me. I require the pointer analysis to be flow- and context-sensitive. I am using the dvf tool for obtaining this output. However, I am facing some issues. The crux of the issue is that I am unable to find how to map variables to the memory objects that store them. A more detailed explanation is given below:

Suppose I have a code my_test.cpp:

extern void MUSTALIAS(void*,void*);

void func()
{
    int x, y;
    int* p = &x;
    int* q = &y;
    q = p;
    MUSTALIAS(p, q);
}

I compile this code using the commands:

clang++ -g -Xclang -disable-O0-optnone -fno-discard-value-names -emit-llvm -c my_test.cpp -o my_test.bc
opt -passes='early-cse' my_test.bc -o my_test.opt.bc

Then I invoke dvf as follows:

dvf -query=all -cpts -cxt -print-all-pts -print-pag -dump-callgraph -max-cxt=5 -flow-bg=10000 -cxt-bg=10000 my_test.opt.bc > my_test.pta

Now the file my_test.pta is what I pass to my extractor script (to parse and generate output in my desired format - a list of pointer variables with their respective pointee sets).

However, the issue I face is the following:

• I am unable to deduce from my understanding of SVF's dumped information that q points only to x (and not y). I know for a fact that SVF does know this though, because the MUSTALIAS check passes.
• When I try tracing the source code to understand how the MUSTALIAS is being invoked, I see that MUSTALIAS is actually passed arguments of two pointer IDs that are not of p and q, but of their memory objects (this is my understanding).
• DVF's output quite clearly contains the information that both these memory objects point only to x, but I'm limited by the fact that I can't figure out (in an automated manner) that these memory objects correspond to p and q.

I tried looking closely at the various forms of information that SVF provides (as dumps), but could not find a way to consistently map variables to their memory objects. Could you please let me know where I can find this information from?

Additionally, do you think I'm going about my goal the wrong way - should I add functions to the SVF source (to access SVF's data structures directly) rather than solely relying on a python script that goes over all of SVF's output formats and tries to deduce pointer->pointee_set relations?

[yuleisui]

Yes, the aliasing of two pointers (p and q) refers to whether their points-to sets, obtained via pta->getPts(ptrID), contain overlapping objects.

SVF uses an internal ID to represent each LLVM value. Each variable ID corresponds to an SVFVar (either SVFObjectVar or SVFValueVar). You may need to modify the SVF source code or create a small standalone file/project to dump all the relevant information, similar to this example: https://github.com/SVF-tools/SVF-example

I have just added several more accessible APIs in SVFIR.h (see below). Once you obtain the ID of a variable, you can use these APIs to retrieve the corresponding object from the points-to set of a pointer via pta->getPts(ptrID). To inspect the details of an SVFObjVar, including its associated LLVM value, call its ObjVar::toString() method.

The APIs in my recent commit:

6d3da81#diff-2a17ba318eb1992b1bd43de1c19c07eef847d2071802ee8f27f8d5a7e51323e5R131-R162

[theeshaan]

The example and the new APIs will definitely make my task easier.
Thank you very much for the prompt reply!

[theeshaan]

Sir, could you also kindly help me figure out how to obtain NodeIDs for all variables in a program?

For instance in such a case:

std::vector<std::string> moduleNameVec;
moduleNameVec =
    OptionBase::parseOptions(argc, argv, "Whole Program Points-to Analysis",
                             "[options] <input-bitcode...>");

LLVMModuleSet::buildSVFModule(moduleNameVec);

SVFIRBuilder builder;
SVFIR *pag = builder.build();

FlowSensitive* fspta = FlowSensitive::createFSWPA(pag);

PointerAnalysis *pta = fspta;

for(...)
    printPts(pta, node_id); // how to iterate over NodeIDs of all variables at this point?

At this stage, I would like to iterate over the NodeIDs corresponding to all variables in the program and print their points-to sets.

However, iterating over the nodes in pag appears to provide only top-level variables (e.g., ValVar, FunValVar, etc.). I would like to understand:

• What is the recommended way to obtain the NodeIDs for all relevant program variables?

• If the goal is to inspect all pointer-typed program variables (including locals, globals, temporaries, etc.), what is the appropriate traversal strategy over the PAG?

Any guidance would be greatly appreciated.

Thank you very much for your time and assistance.

[yuleisui]

You could use SVFIR::getSVFVarMap()