原文地址:http://ccadar.github.io/klee/Tutorial-1.html
int get_sign(int x) { if (x == 0) return 0; if (x < 0) return -1; else return 1; }You can find the entire code for this example in the source tree under examples/get_sign. A version of the source code can also be accessed here.
int main() { int a; klee_make_symbolic(&a, sizeof(a), "a"); return get_sign(a); }
KLEE: output directory = "klee-out-0" KLEE: done: total instructions = 51 KLEE: done: completed paths = 3 KLEE: done: generated tests = 3There are three paths through our simple function, one where a is 0, one where it is less than 0 and one where it is greater than 0. As expected, KLEE informs us that it explored three paths in the program and generated one test case for each path explored. The output of a KLEE execution is a directory (in our case klee-out-0) containing the test cases generated by KLEE. KLEE names the output directory klee-out-N where N is the lowest available number (so if we run KLEE again it will create a directory called klee-out-1), and also generates a symbolic link called klee-last to this directory for convenience:
$ ls klee-last/ assembly.ll run.istats test000002.ktest info run.stats test000003.ktest messages.txt test000001.ktest warnings.txtPlease click here if you would like an overview of the files generated by KLEE. In this tutorial, we only focus on the actual test files generated by KLEE.
$ ktest-tool --write-ints klee-last/test000001.ktest ktest file : 'klee-last/test000001.ktest' args : ['get_sign.o'] num objects: 1 object 0: name: 'a' object 0: size: 4 object 0: data: 1 $ ktest-tool --write-ints klee-last/test000002.ktest ... object 0: data: -2147483648 $ ktest-tool --write-ints klee-last/test000003.ktest ... object 0: data: 0In each test file, KLEE reports the arguments with which the program was invoked (in our case no arguments other than the program name itself), the number of symbolic objects on that path (only one in our case), the name of our symbolic object ('a') and its size (4). The actual test itself is represented by the value of our input: 1 for the first test, -2147483648 for the second and 0 for the last one. As expected, KLEE generated value 0, one negative value ( -2147483648), and one positive value ( 1). We can now run these values on a native version of our program, to exercise all paths through the code!
$ export LD_LIBRARY_PATH=path-to-klee-root/Release+Asserts/lib/:$LD_LIBRARY_PATH $ gcc -L path-to-klee-root/Release+Asserts/lib/ get_sign.c -lkleeRuntest $ KTEST_FILE=klee-last/test000001.ktest ./a.out $ echo $? 1 $ KTEST_FILE=klee-last/test000002.ktest ./a.out $ echo $? 255 $ KTEST_FILE=klee-last/test000003.ktest ./a.out $ echo $? 0As expected, our program returns 1 when running the first test case, 255 (-1 converted to a valid exit code value in the 0-255 range) when running the second one, and 0 when running the last one.