|
| 1 | +## Overview of CProver Tools |
| 2 | + |
| 3 | +This document provides a brief overview of the various tools in |
| 4 | +the CProver project. The goal is as to provide a lightweight reference |
| 5 | +with links to detailed documentation on each of the tools. |
| 6 | + |
| 7 | +The tools in the CProver project are as follows: |
| 8 | +- [cbmc](#cbmc) |
| 9 | +- [goto-analyzer](#goto-analyzer) |
| 10 | +- [goto-cc (goto-gcc, goto-ld)](#goto-cc) |
| 11 | +- [goto-diff](#goto-diff) |
| 12 | +- [goto-harness](#goto-harness) |
| 13 | +- [goto-instrument](#goto-instrument) |
| 14 | +- [janalyzer](#janalyzer) |
| 15 | +- [jbmc](#jbmc) |
| 16 | +- [jdiff](#jdiff) |
| 17 | +- [memory-analyzer](#memory-analyzer) |
| 18 | +- [smt2_solver](#smt2_solver) |
| 19 | +- [symtab2gb](#symtab2gb) |
| 20 | +- [Developer Utilities](#developer-utilities) |
| 21 | + - [java-unit](#java-unit) |
| 22 | + - [unit](#unit) |
| 23 | + - [others (converter, driver, file_converter, java-converter)](#others) |
| 24 | + |
| 25 | +The rest of this document provides a section on each of these tools in alphabetical order. |
| 26 | +Most links in this document are to the [CProver online documentation](http://cprover.diffblue.com/index.html). |
| 27 | + |
| 28 | + |
| 29 | +## cbmc |
| 30 | + |
| 31 | +The C Bounded Model Checker (`cbmc`) is the main tool used in the CProver suite. |
| 32 | +`cbmc` does the entire analysis from the source code through to the result, |
| 33 | +including generating traces. This includes invoking various sub-tools and |
| 34 | +modules. |
| 35 | + |
| 36 | +For details on usage of the `cbmc` tool see the following documentation |
| 37 | +- [Developer Tutorial](http://cprover.diffblue.com/tutorial.html) |
| 38 | +includes a very brief tutorial on many aspects of `cbmc` and other tools. |
| 39 | + |
| 40 | +For details on the architecture of the `cbmc` tool and how the analysis is performed |
| 41 | +see the following documents: |
| 42 | +- [CBMC Architecture](http://cprover.diffblue.com/cbmc-architecture.html) |
| 43 | +gives a high level overview of the `cbmc` architecture and data flow. |
| 44 | +- [Background Concepts](http://cprover.diffblue.com/background-concepts.html) |
| 45 | +overviews all the key concepts used in the `cbmc` analysis. |
| 46 | + |
| 47 | +For details on compiling, testing, contributing, and documentation related to |
| 48 | +development see: |
| 49 | +- [CProver Developer Documentation](http://cprover.diffblue.com/index.html) |
| 50 | + |
| 51 | + |
| 52 | +## goto-analyzer |
| 53 | + |
| 54 | +The `goto-analyzer` is a wrapper program around the |
| 55 | +[abstract interpretation](http://cprover.diffblue.com/background-concepts.html#abstract_interpretation_section) |
| 56 | +implementations. (For more detail on these implementations see |
| 57 | +[here](http://cprover.diffblue.com/group__analyses.html).) |
| 58 | +It is possible to configure which abstractions are used and what |
| 59 | +is done with the chosen abstractions (verification, display, |
| 60 | +simplification, etc.). The current best documentation is available |
| 61 | +[here](http://cprover.diffblue.com/goto__analyzer__parse__options_8h.html). |
| 62 | + |
| 63 | +Other documentation useful for this tool can be found: |
| 64 | +- [Analysis Information](http://cprover.diffblue.com/group__analyses.html) |
| 65 | + |
| 66 | +Details of all the options can be seen by running |
| 67 | +``` |
| 68 | +goto-analyzer --help |
| 69 | +``` |
| 70 | + |
| 71 | +## goto-cc |
| 72 | + |
| 73 | +This is a compiler designed to be able to be dropped in to an existing |
| 74 | +build process to replace the existing compiler. `goto-cc` is able to do |
| 75 | +normal compilation, but is designed to output goto programs (optionally |
| 76 | +in addition to the normal compiled program). Note that `goto-cc` is both |
| 77 | +the compiler and linker (`goto-gcc` and `goto-ld` are symbolic links to |
| 78 | +`goto-cc`, where the file name is used to ensure the program behaves |
| 79 | +according to the name, e.g. if called from `goto-gcc` then `goto-cc` |
| 80 | +will behave like `gcc`). The additional object code is used as the internal |
| 81 | +representation for `cbmc` and related tools. These can also be extracted and |
| 82 | +used themselves. |
| 83 | + |
| 84 | +Further information on `goto-cc` can be found: |
| 85 | +- [Developer Tutorial](http://cprover.diffblue.com/tutorial.html) with |
| 86 | +some very simple examples and notes. |
| 87 | +- [goto-cc](http://cprover.diffblue.com/group__goto-cc.html) information |
| 88 | +on the `goto-cc` compilers |
| 89 | +- [goto Programs](http://cprover.diffblue.com/group__goto-programs.html) |
| 90 | +for information on goto programs and how they are used. |
| 91 | + |
| 92 | +Note that `goto-cc` can emulate GCC, Visual Studio, and CodeWarrior |
| 93 | +compilers. |
| 94 | + |
| 95 | + |
| 96 | +## goto-diff |
| 97 | + |
| 98 | +Provides a variety of difference checks between two goto programs |
| 99 | +produced by `goto-cc` (essentially a `diff` tool for goto programs). |
| 100 | +This invokes some of the cbmc tools to convert the goto |
| 101 | +program and then determine which functions are added/removed/changed. |
| 102 | + |
| 103 | +Details of all the options can be seen by running |
| 104 | +``` |
| 105 | +goto-diff --help |
| 106 | +``` |
| 107 | +this includes both options for the difference, and options for the goto |
| 108 | +program instrumentation. |
| 109 | + |
| 110 | + |
| 111 | +## goto-harness |
| 112 | + |
| 113 | +This is a tool for creating a harness around a (part of a) goto program that |
| 114 | +can then be analysed (using the harness). Harnesses can be either function |
| 115 | +call environments, or memory snapshots. |
| 116 | + |
| 117 | +Documentation on `goto-harness` can be found |
| 118 | +[here](http://cprover.diffblue.com/md__home_travis_build_diffblue_cbmc_doc_architectural_goto-harness.html) |
| 119 | +including details and examples. |
| 120 | + |
| 121 | +Details of all the options can be seen by running |
| 122 | +``` |
| 123 | +goto-harness --help |
| 124 | +``` |
| 125 | + |
| 126 | + |
| 127 | +## goto-instrument |
| 128 | + |
| 129 | +This is a collection of tools for analysing and modifying goto programs |
| 130 | +(programs created with #goto-cc). Generally these take a goto program |
| 131 | +and output another goto program. |
| 132 | + |
| 133 | +Further examples and documentation can be found: |
| 134 | +- [goto-instrument](http://cprover.diffblue.com/group__goto-instrument.html) |
| 135 | +has an overview of `goto-instrument` and a small tutorial example. |
| 136 | +- [Developer Tutorial](http://cprover.diffblue.com/tutorial.html) has high |
| 137 | +level overview and some example commands for `goto-instrument`. |
| 138 | + |
| 139 | + |
| 140 | +## janalyzer |
| 141 | + |
| 142 | +This provides a way to access and invoke various forms of analysis on |
| 143 | +Java programs. This is a fork of [goto-analyzer](#goto-analyzer) with |
| 144 | +a Java Virtual Machine front end. |
| 145 | + |
| 146 | +Documentation useful for this tool can be found: |
| 147 | +- [Analysis Information](http://cprover.diffblue.com/group__analyses.html) |
| 148 | + |
| 149 | +Details of all the options can be seen by running |
| 150 | +``` |
| 151 | +janalyzer --help |
| 152 | +``` |
| 153 | + |
| 154 | + |
| 155 | +## jbmc |
| 156 | + |
| 157 | +This is the main analysis engine the performs the analysis |
| 158 | +of Java files using bounded model checking. This is a |
| 159 | +version of the `cbmc` tool that checks Java programs |
| 160 | +(more documentation for `cbmc` is available and much of |
| 161 | +it applies to `jbmc` since they use many of the same back |
| 162 | +end utilities). |
| 163 | + |
| 164 | +Note that the `jbmc` tool follows `java` conventions so that |
| 165 | +programs can be analyzed in the same way you would run them |
| 166 | +using the `java` executable. There also many additional |
| 167 | +options to support nondeterministic initialisation of variable |
| 168 | +size arrays, data structures and strings, control how to assert |
| 169 | +on exceptions etc. |
| 170 | + |
| 171 | +For some light information on usage of the jbmc tool see the following documentation |
| 172 | +- [JBMC homepage](https://www.cprover.org/jbmc/) includes some |
| 173 | +simple examples and information. |
| 174 | + |
| 175 | +For details on how analysis is performed in the `cbmc` and |
| 176 | +`jbmc` tools see see the following documents: |
| 177 | +- [CBMC Architecture](http://cprover.diffblue.com/cbmc-architecture.html) |
| 178 | +gives a high level overview of the `cbmc` architecture and data flow that *should also apply to* `jbmc`. |
| 179 | +- [Background Concepts](http://cprover.diffblue.com/background-concepts.html) |
| 180 | +overviews all the key concepts used in the `jbmc` analysis. |
| 181 | + |
| 182 | +For details on compiling, testing, contributing, and documentation related to development see: |
| 183 | +- [CProver Development Documentation](http://cprover.diffblue.com/index.html) |
| 184 | + |
| 185 | + |
| 186 | +## jdiff |
| 187 | + |
| 188 | +Provides a variety of difference checks between two goto programs (produced |
| 189 | +by `goto-cc`). This invokes some of the `cbmc`/`jbmc` tools to convert the goto |
| 190 | +program and then determine which functions are added/removed/changed. |
| 191 | +This is a clone of `goto-diff` for Java programs and is essentially |
| 192 | +a `diff` for goto programs generated from Java code. |
| 193 | + |
| 194 | +Details of all the options can be seen by running |
| 195 | +``` |
| 196 | +jdiff --help |
| 197 | +``` |
| 198 | +this includes both options for the difference, and options for the goto |
| 199 | +program instrumentation. |
| 200 | + |
| 201 | + |
| 202 | +## memory-analyzer |
| 203 | + |
| 204 | +This is a wrapper program that provides a front end to `gdb` that adds some |
| 205 | +useful features related to the other goto utilities. In particular |
| 206 | +`memory-analyzer` can run a compiled binary using `gdb` and then (at the |
| 207 | +right point) create a harness from the current program state for use with |
| 208 | +`goto-harness`. |
| 209 | + |
| 210 | +Note that to use `memory-analyzer` the program must be compiled with |
| 211 | +`goto-cc`. To make best use of `memory-analyzer` and `gdb` you should |
| 212 | +compile with the `-g` option. |
| 213 | + |
| 214 | +For further documentation and examples see |
| 215 | +[here](http://cprover.diffblue.com/md__home_travis_build_diffblue_cbmc_doc_architectural_memory-analyzer.html). |
| 216 | + |
| 217 | + |
| 218 | +## smt2_solver |
| 219 | + |
| 220 | +This is an (Satisfiability Modulo Theories) SMT solver that |
| 221 | +parses SMT-LIB 2 format files and uses CProver's internal bit-blasting |
| 222 | +solver (see [solvers](http://cprover.diffblue.com/group__solvers.html)) |
| 223 | +to resolve queries. |
| 224 | + |
| 225 | +## symtab2gb |
| 226 | + |
| 227 | +This utility is to compile a cbmc symbols table (in JSON format) into a goto binary. |
| 228 | +This is to support integration of external language frontends |
| 229 | +(e.g. [Ada using GNAT2GOTO](https://github.com/diffblue/gnat2goto/)). |
| 230 | +For usage run |
| 231 | +``` |
| 232 | +symtab2gb --help |
| 233 | +``` |
| 234 | + |
| 235 | + |
| 236 | +## Developer Utilities |
| 237 | + |
| 238 | +The utilities below are designed for developer use. |
| 239 | + |
| 240 | +### java-unit |
| 241 | + |
| 242 | +Runs Java unit tests. For more details use |
| 243 | +``` |
| 244 | +java-unit --help |
| 245 | +``` |
| 246 | +Default behaviour is to only show failed test cases. |
| 247 | + |
| 248 | + |
| 249 | +### unit |
| 250 | + |
| 251 | +Runs C unit tests. For more details use |
| 252 | +``` |
| 253 | +unit --help |
| 254 | +``` |
| 255 | +Default behaviour is to only show failed test cases. |
| 256 | + |
0 commit comments