KLEE

master branch

The 4th International KLEE Workshop on Symbolic Execution is coming!
Join us from 15–16 April 2024 in Lisbon!

Documentation

Learn How to Use KLEE

NOTE: This is the documentation for the version of KLEE in the master branch, which might differ from released KLEE. For documentation relevant to a particular KLEE release see the releases page.


If you have a question on using KLEE:

  1. Please first check the documentation below
  2. Then check the searchable mailing list archive
  3. If this still doesn’t answer your questions then:

Usage

  1. Intrinsics: Overview of the main KLEE intrinsic functions.
  2. KLEE Options: Overview of KLEE’s main command-line options.
  3. Generated Files: Overview of the main files generated by KLEE.
  4. Tools: Overview of the main auxiliary tools provided by KLEE.
  5. Solver Chain: Overview of the solver chain and related command-line arguments.
  6. Kleaver Options: Overview of Kleaver’s main command-line options.
  7. KQuery: The reference manual for the KQuery language, used for interacting with Kleaver.
  8. Coreutils Experiments: Some information about the Coreutils experiments presented in our KLEE OSDI’08 paper.

Tutorials

  1. First tutorial: Testing a small function.
  2. Second tutorial: Testing a simple regular expression library.
  3. Using a symbolic environment: Guide with examples on how to use the symbolic environment such as symbolic files and command-line arguments for the program under test.
  4. Testing Coreutils: In-depth description of how to use KLEE to test GNU Coreutils.

External Resources

We also recommend the following external resources. When using them, please take into account that they might be using old versions of KLEE.

  1. Symbolic execution with KLEE: A set of four instructional videos introducing KLEE, starting with how to get started with KLEE and ending with a demo that finds memory corruption bugs in real code.
  2. Solving a maze with KLEE: A nice explanation of how symbolic execution can be used to generate interesting program inputs. The example shows how to use KLEE to find all the solutions to a maze game.
  3. Keygenning with KLEE and Hex-Rays: A beginners explanation of using symbolic execution to solve a small binary’s pseudocode.
  4. Keygenning with KLEE: A more in-depth guide to using KLEE for key generation.
  5. How to generate tests automatically?: A basic introduction to symbolic execution with KLEE.
  6. Using KLEE to generate tests for binary search: A tutorial on using KLEE to test a binary search implementation).
  7. A Guide to KLEE LLVM Execution Engine Internals: A quick overview of KLEE’s internals and core classes in PoC||GTFO 0x18 (pp. 51).
  8. Testing Rust programs with KLEE: A collection of tools/libraries to support testing of Rust programs with KLEE.
  9. SAT/SMT by example: A comprehensive guide focusing on using SAT and SMT solvers, which includes lots of interesting examples involving KLEE.
  10. Measuring the coverage achieved by symbolic execution: A blog post that discusses the difference between the internal coverage reported by KLEE and the external coverage reported by a tool such as GCov.
  11. Binary symbolic execution with KLEE-Native: An extension of KLEE that analyses binaries by lifting them to LLVM IR
  12. SHA-3 Buffer Overflow: Finding a bug in a sha-3 implementation with KLEE