LLVM IR code coverage and OS call taint

[chadbrewbaker]

I'm not sure if this is out of scope for this project, but what is the state of tooling for LLVM IR code coverage? Also, how hard would it be to propagate the taint of operating system calls to infer Haskell style IO types?

[pdschubert]

I am not exactly sure what you mean by IR code coverage? As the data-flow solvers are implemented in a generic way and a concrete analysis implements an interface, Phasar is able to analyze the complete LLVM IR instruction set.
Writing a taint analysis is one of the easiest analyses you can implement using Phasar's IFDS or IDE solver. One problem one might run into is dealing with imprecise points-to information. Currently we are querying and combining LLVM's points-to information but these are not too precise. We are now extending our tooling to make use of the much more precise points-to information that the SVF pointer analysis framework provides. We are currently testing that feature and it will be available soon.

[ttllyy111]

Whether provided SVF pointer analysis framework？ And whethe supports context-sensitive symbolic execution? Thanks!