Using KLEE to derive call-graph(s) from test case(s)

97 Views Asked by At

Each generated test amounts to a path, and I'm interested in obtaining information on the functions called along each path, and from there obtain a call graph as the union of paths for all test.

This should render a subset of the complete call-graph, taking into account symbolic variables, assumptions etc.

Has anyone looked into this? (Maybe this is already possible, without altering the KLEE source code.)

Best regards Per Lindgren

0

There are 0 best solutions below