August 27th, 2024

KLEE Symbolic Execution Engine

KLEE is a symbolic virtual machine based on LLVM, enabling symbolic execution of bitcode with a POSIX/Linux emulation layer, allowing input replay on native and emulated environments for software testing.

Read original articleLink Icon
KLEE Symbolic Execution Engine

KLEE is a symbolic virtual machine that operates on LLVM compiler infrastructure, designed to execute LLVM bitcode modules while supporting symbolic values. Its architecture includes a core symbolic virtual machine engine and a POSIX/Linux emulation layer that utilizes uClibc. The symbolic virtual machine engine is tasked with executing the LLVM bitcode, while the emulation layer allows for parts of the operating system environment to be treated symbolically. Additionally, KLEE features a library that enables the replay of computed inputs on native code, as well as a more intricate system for replaying inputs generated within the POSIX/Linux emulation context. For further details, users can refer to the KLEE webpage.

- KLEE is built on LLVM and supports symbolic execution of bitcode.

- It includes a POSIX/Linux emulation layer for enhanced functionality.

- The system allows for replaying computed inputs on both native code and emulated environments.

- KLEE is useful for testing and analyzing software through symbolic execution.

Link Icon 5 comments
By @MaxBarraclough - 5 months
The project's webpage is a more helpful starting point than the repository: https://klee-se.org/
By @vidalee - 5 months
I discovered the Klee engine when reading The Ph.D. Grind by Philip Guo[1], it gives an idea of how its development was going at the time and this is also why I have difficulty appreciating the software, an interesting read if you want to get a feel of the academic world.

[1] https://archive.is/KAz4n

By @xanzi2048 - 5 months
Nowhere in the repo or the linked website does this explain what it does or why it's useful. What is this for?
By @e1gen-v - 5 months
I used this in my software testing class. It was really cool! Although interfacing with LLVM was not very fun, I feel like I could’ve spent a lot more time learning the innards of this tool instead of fighting with llvm and C++.
By @anonymousDan - 5 months
Is anyone actually using symbolic execution in industry these days? I personally like it but I feel like fuzzing has completely taken over in terms of academic research at least.