Re: [klee-dev] How to distinguish klee's print of different execution paths

2021-09-09 Thread Cristian Cadar
Hi, you would need to modify the code associated with those klee_ intrinsics to also output state information (see https://github.com/klee/klee/blob/master/lib/Core/SpecialFunctionHandler.cpp). Best, Cristian On 01/09/2021 16:38, 樊雨鑫 wrote: Hi, I am new to Klee, use it to do program

Re: [klee-dev] Write to symbolic position

2021-09-09 Thread Cristian Cadar
Hi Weiqi, Note that such an assignment does not impose any constraints on the input, which is why you don't see them in the path constraints (otherwise a simple code snippet such as buf[1] = '9'; buf[2] = '0' would be considered infeasible). You might want to check the initial KLEE paper

Re: [klee-dev] Improving KLEE coverage

2021-09-09 Thread Cristian Cadar
Hi Vlad, It's difficult to say without seeing the full program, but it could be that KLEE is spending all its time in some other parts on the code. You can use klee-stats to understand how many states are in memory, how much time is spent in constraint solving etc., and kcachegrind to

Re: [klee-dev] Inquiry on path record and reply component of KLEE

2021-09-09 Thread Cristian Cadar
Hi Harper, As I mentioned on GitHub, the .path feature is currently unmaintained, but it would be great to revive it. Best, Cristian On 10/07/2021 15:24, Wei Chen wrote: Dear developers, Hi, I found there is a case that KLEE would generate the same .path files for different paths in

Re: [klee-dev] About the two methods of test replay.

2021-09-09 Thread Cristian Cadar
Hi Alex, I noticed this email went unanswered, hopefully the response is still useful. In short, we plan to maintain both replay methods. As you point out, the klee-replay tool only works when there are no klee_ intrinsics in the code. In this case, it is the preferred method, as it's