svf源码阅读笔记（一）

svf源码阅读笔记（一）

SVF/tools/Example/svf-ex.cpp

驱动程序

int main(int argc, char ** argv)
{

    int arg_num = 0;
    char **arg_value = new char*[argc];
    std::vector<std::string> moduleNameVec;
    SVFUtil::processArguments(argc, argv, arg_num, arg_value, moduleNameVec);
    cl::ParseCommandLineOptions(arg_num, arg_value,"Whole Program Points-to Analysis\n");
    
    if (Options::WriteAnder == "ir_annotator")
    {
        LLVMModuleSet::getLLVMModuleSet()->preProcessBCs(moduleNameVec);
    }

    SVFModule* svfModule = LLVMModuleSet::getLLVMModuleSet()->buildSVFModule(moduleNameVec);
    svfModule->buildSymbolTableInfo();

    /// 构建程序赋值图PAG(SVFIR)
    SVFIRBuilder builder;
    SVFIR* pag = builder.build(svfModule);

    /// 进行Andersen's指针分析
    Andersen* ander = AndersenWaveDiff::createAndersenWaveDiff(pag);

    /// 别名分析
    /// aliasQuery(ander,value1,value2);

    /// Print points-to information
    /// printPts(ander, value1);

    /// 构建调用图
    PTACallGraph* callgraph = ander->getPTACallGraph();

    /// 构建ICFG
    ICFG* icfg = pag->getICFG();

    /// 构建值流图Value-Flow Graph (VFG)
    VFG* vfg = new VFG(callgraph);

    ///构建稀疏值流图svfg Sparse value-flow graph (SVFG)
    SVFGBuilder svfBuilder(true);
    SVFG* svfg = svfBuilder.buildFullSVFG(ander);

    /// Collect uses of an LLVM Value
    /// traverseOnVFG(svfg, value);

    /// Collect all successor nodes on ICFG
    /// traverseOnICFG(icfg, value);

    // clean up memory
    delete vfg;
    delete svfg;
    AndersenWaveDiff::releaseAndersenWaveDiff();
    SVFIR::releaseSVFIR();

    LLVMModuleSet::getLLVMModuleSet()->dumpModulesToFile(".svf.bc");
    SVF::LLVMModuleSet::releaseLLVMModuleSet();

    llvm::llvm_shutdown();
    return 0;
}

对v1和v2进行别名分析

AliasResult aliasQuery(PointerAnalysis* pta, Value* v1, Value* v2){
	return pta->alias(v1,v2);
}

对val进行指针分析

std::string printPts(PointerAnalysis* pta, Value* val){

    std::string str;
    raw_string_ostream rawstr(str);

    NodeID pNodeId = pta->getPAG()->getValueNode(val);
    NodeBS& pts = pta->getPts(pNodeId);//获取Point-to sets
    for (NodeBS::iterator ii = pts.begin(), ie = pts.end();
            ii != ie; ii++) {
        rawstr << " " << *ii << " ";
        PAGNode* targetObj = pta->getPAG()->getPAGNode(*ii);//获取PTG中的node
        if(targetObj->hasValue()){
            rawstr << "(" <<*targetObj->getValue() << ")\t ";
        }
    }

    return rawstr.str();

}

查询val的def点以及use点

void collectUsesOnVFG(const SVFG* vfg, Value* val){
	PAG* pag = PAG::getPAG();

    PAGNode* pNode = pag->getPAGNode(pag->getValueNode(val));
    const VFGNode* vNode = vfg->getDefSVFGNode(pNode);//获取val的def点
    FIFOWorkList<const VFGNode*> worklist;//待处理队列
    std::set<const VFGNode*> visited;
    worklist.push(vNode);//等待第一次处理

    /// Traverse along VFG（沿着VFG（值流图）查找由该点流出的边(use点)）
    while(!worklist.empty()){
    	const VFGNode* vNode = worklist.pop();//取出一个进行处理
    	for(VFGNode::const_iterator it = vNode->OutEdgeBegin(), eit = vNode->OutEdgeEnd(); it!=eit; ++it) {//遍历该节点的所有流出边
            if(visited.find(vNode)==visited.end()){//没有被访问过
            	visited.insert(vNode);//将没有访问到的节点加入到访问队列
            	worklist.push(vNode);//递归的对该节点进行VFG遍历
            }
    	}
    }

    /// Collect all LLVM Values（对所有刚刚加入到visited中的节点进行操作（注释部分），也就是所有val的use的点）
    for(std::set<const VFGNode*>::const_iterator it = visited.begin(), eit = visited.end(); it!=eit; ++it){
    	const VFGNode* node = *it;
    	/// can only query VFGNode involving top-level pointers (starting with % or @ in LLVM IR)
    	/// PAGNode* pNode = vfg->getLHSTopLevPtr(node);
    	/// Value* val = pNode->getValue();
    }
}

根据控制流图查找一个ICFG（过程间分析）节点的所有后继节点

void traverseOnICFG(ICFG* icfg, const Instruction* inst)
{
    ICFGNode* iNode = icfg->getICFGNode(inst);
    FIFOWorkList<const ICFGNode*> worklist;
    Set<const ICFGNode*> visited;
    worklist.push(iNode);
/// Traverse along VFG
while (!worklist.empty())
{
    const ICFGNode* vNode = worklist.pop();
    for (ICFGNode::const_iterator it = vNode->OutEdgeBegin(), eit =
                vNode->OutEdgeEnd(); it != eit; ++it)
    {
        ICFGEdge* edge = *it;
        ICFGNode* succNode = edge->getDstNode();//获取这条调用边的目标节点
        if (visited.find(succNode) == visited.end())
        {
            visited.insert(succNode);
            worklist.push(succNode);
        }
    }
}

}