{"id":50988383,"url":"https://github.com/AFx3/crema-static-analyzer","last_synced_at":"2026-07-07T22:00:33.460Z","repository":{"id":310671961,"uuid":"1005053046","full_name":"AFx3/crema-static-analyzer","owner":"AFx3","description":"Crema is a static analysis tool for Rust-C FFI. It detects memory errors (memory leak, double-free and use-after-free) in pure Rust code and Rust interacting with C code.","archived":false,"fork":false,"pushed_at":"2025-10-15T11:14:50.000Z","size":29769,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-10-15T21:10:54.485Z","etag":null,"topics":["ffi","memory-errors","rust","static-analysis","static-analyzer"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/AFx3.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-06-19T15:34:09.000Z","updated_at":"2025-08-21T14:41:59.000Z","dependencies_parsed_at":"2025-10-15T20:47:03.752Z","dependency_job_id":null,"html_url":"https://github.com/AFx3/crema-static-analyzer","commit_stats":null,"previous_names":["afx3/crema-static-analyzer"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/AFx3/crema-static-analyzer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AFx3%2Fcrema-static-analyzer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AFx3%2Fcrema-static-analyzer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AFx3%2Fcrema-static-analyzer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AFx3%2Fcrema-static-analyzer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/AFx3","download_url":"https://codeload.github.com/AFx3/crema-static-analyzer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AFx3%2Fcrema-static-analyzer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35243953,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-07T02:00:07.222Z","response_time":90,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ffi","memory-errors","rust","static-analysis","static-analyzer"],"created_at":"2026-06-19T23:00:38.172Z","updated_at":"2026-07-07T22:00:33.428Z","avatar_url":"https://github.com/AFx3.png","language":"Rust","funding_links":[],"categories":["Static Checkers"],"sub_categories":[],"readme":"\u003cimg src=\"./crema/img/crema_logo6.png\" alt=\"logo\"/\u003e\n\nCrema is a static analysis tool to detect memory errors in Rust programs using FFI and unsafe blocks. Specifically, it detects memory leaks, double frees, and use-after-frees in pure unsafe Rust code and Rust interacting with C.\nThe design and the implementation of Crema are described in the paper:\n\u003e\t[A. Franceschi, L. Galletta, P. Degano.Detecting Memory Errors in Rust Programs Including Unsafe Foreign Code](https://doi.org/10.1007/978-3-032-10444-1_11). 23rd International Conference on Software Engineering and Formal Methods (SEFM), 2025.\n\n# Crema highlights\n* Crema constructs an inter-procedural Control Flow Graph (ICFG) capturing the interactions between Rust and C functions. \n* To build such a graph, crema exploits Rust MIR and LLVM IR (for C representation).\n* The ICFG includes dummyCall and dummyRet nodes storing the association between the two different IRs.\n* The abstract domain tracks taint information related to heap management, focusing specifically on memory objects passed through FFI and their ownership. \n* For testing Crema, see REPLICATE_RESULTS.md \n* Crema is in a very early development stage, so note that currently the cargo target projects require a main.rs entry point.\n\n\n# Run with Docker\n### Step 0: install Docker (see online Docker installation guide)\n```bash\nopen https://docs.docker.com/get-started/get-docker/\n```\n### Step 1: get crema docker image\n```bash\ndocker pull andreafranceschi/crema-tool:latest\n```\n### Step 2: run crema docker image\n```bash\ndocker run -it andreafranceschi/crema-tool:latest bash\n```\n\n--------------------------------------------------------------------------------------------------------------------------\n\n# How to analyze project / prototype notes :\nCrema is in a very early development phase, so note that currently the cargo target projects require a main.rs entry point\n\n* From `crema` folder, run the tool specifying a cargo project as target\n```bash\ncargo run /\u003cpath_to_cargo_target_project\u003e\n``` \n\n* Or specify a custom entry point:\n```bash\ncargo run /\u003cpath_to_cargo_target_project\u003e -f \"\u003cyour::target_function::bb0\u003e\"\n``` \n--------------------------------------------------------------------------------------------------------------------------\n# Working directory\n\nThe working directory must be\n```bash\n/home/\u003cuser\u003e/.../\u003cpath_to_crema_static_analyzer\u003e/crema_static_analyzer\n```\n# Project structure/working directory content\n```bash\n. crema-static-analyzer         (whole project folder)\n├── crema                       (crema static analyzer)\n├── query_github_rust_prj       (script to get GitHub repositories)\n├── README.md                   (this file)\n├── REPLICATE_RESULTS.md        (instructions for replicating the results)\n├── MEMORY_ERRORS_DISCOVERED    (memory errors discovered, including Valgrind outputs)\n├── LICENSE                     (MIT license)\n├── SVF-example                 (SVF driver to interact with SVF)      \n├── CREMA_VS_FFI_CHECKER.md     (Crema and FFIChecker comparison on Rust-C FFI tests)\n├── SVF                         (SVF, NEED TO BE INSTALLED)   \n└── tests_and_target_repos      (test and target repositories)\n```\n\n\n## Env\nNote that you have to modify working environment variables by updating the shell config file e.g.: zsh\n```bash\nfind  ~/.zshrc\nvim /path/to/your/shell_config_file\n```\n### At the end of each repository configuration, your work environment should be as follows\n```bash\n#rustc\nexport RUSTC_SYSROOT=/home/\u003cuser\u003e/.../\u003cpath_to_crema_static_analyzer\u003e/crema_static_analyzer\n\nexport PATH=/opt/cmake/bin:$PATH\nexport PATH=/opt/cmake/bin:$PATH\n\n# Setting up the environment for SVF\nexport SVF_DIR=/home/\u003cuser\u003e/.../\u003cpath_to_crema_static_analyzer\u003e/crema_static_analyzer/SVF\nexport LLVM_DIR=/home/\u003cuser\u003e/.../\u003cpath_to_crema_static_analyzer\u003e/crema_static_analyzer/SVF/llvm-16.0.0.obj\nexport Z3_DIR=/home/\u003cuser\u003e/.../\u003cpath_to_crema_static_analyzer\u003e/crema_static_analyzer/SVF/z3.obj\n\n# Update PATH to include SVF binaries\nexport PATH=$SVF_DIR/Release-build/bin:$PATH\n\n# Update LD_LIBRARY_PATH for the dynamic linker to find SVF libraries\nexport LD_LIBRARY_PATH=$SVF_DIR/lib:$LLVM_DIR/lib:$Z3_DIR/lib:$LD_LIBRARY_PATH\n```\n----\n\n# Setup\n\n## 0. Clone this repository\n```bash\ngit clone https://github.com/AFx3/crema-static-analyzer\n```\n```bash\ncd crema-static-analyzer\n```\n## 1. Install SVF\nFollow the instructions at: https://github.com/svf-tools/SVF/wiki/Setup-Guide#getting-started\n\nCmake install:\n```bash\nsudo apt install cmake gcc g++ libtinfo5 libz-dev libzstd-dev zip wget libncurses5-dev ##(If running on Ubuntu 20.04)\n\ngit clone https://github.com/SVF-tools/SVF.git\ncd SVF\nsource ./build.sh\n```\n\nCheck ENV VAR (go to ENV step above)\n\n\nFollow the README.md file in the SVF-example folder for the configuration \n\nSET UP ENV VAR (go to ENV step above)\n\n\n### Install the Rust nightly compiler \n\n* After getting this repository, install the following version of the Rust nightly compiler and set up the Rust toolchain.\n\n* Version required\n```bash\nrustc version: 1.84.0-nightly (b19329a37 2024-11-21)\n```\n* From crema-static-analyzer directory\n* Install the required Rust nightly version:\n```bash\nrustup toolchain install nightly-2024-11-21\n```\n\n* Check if it has been correctly installed:\n```bash\nrustup show\n```\n\n* Set it up:\n```bash\nrustup override set nightly-2024-11-21\n```\n\n* Install Rust nightly tools:\n```bash\nrustup component add rust-src rustc-dev llvm-tools-preview\n```\n(if you find errors, lunch again utill it successfully downloads all the files)\n\n* Again, check now if it active the right version:\n```bash\nrustup show\n```\n\n\n* If you get in trouble, see: https://rust-lang.github.io/rustup/overrides.html\n\nYou can have different toolchains, but the one already specified must be active in the folder of `crema-static-analyzer`\nand you can see it with:\n\n```\nrustup show:\n\n--\u003e\n\nDefault host: x86_64-unknown-linux-gnu\nrustup home:  /home/af/.rustup\n\ninstalled toolchains\n--------------------\n\nstable-x86_64-unknown-linux-gnu\nnightly-2019-10-25-x86_64-unknown-linux-gnu\nnightly-2021-09-01-x86_64-unknown-linux-gnu\nnightly-2021-10-21-x86_64-unknown-linux-gnu\nnightly-2021-12-05-x86_64-unknown-linux-gnu\nnightly-x86_64-unknown-linux-gnu (default)\n1.63-x86_64-unknown-linux-gnu\n\nactive toolchain\n----------------\n\nnightly-x86_64-unknown-linux-gnu (default)\nrustc 1.84.0-nightly (b19329a37 2024-11-21) -----------------\n```\n\nCHECK ENV VAR has been correctly set (go to ENV step above)\n\n\n# Finally, Build and Run the tool\n\nYou must be in this project dir\n\n```bash\ncd crema\n```\n```bash\ncargo build\n```\n\nRun the tool\n```bash\ncargo run ./path_to_cargo_project_to_be_analyzed\n```\n\nYou can run the tool specifying a custom entry point with -f:\n```bash\ncargo run ./path_to_cargo_project_to_be_analyzed -f -f \"\u003crust::function_name::bb\u003c0,1,..n\u003e\"\n```\n## User can see if the tool is correctly installed by looking at RELICATE_RESULTS.md\n\n# MIR SUPPORTED:\n```\n1.86.0-nightly\n```\n------------------------------------------------------------------------------\n# Future work\n* Improve target cargo projects dependency handling\n* Include more MIR statements in the analysis\n* Improve interprocedural support\n* Including pointer/alias analysis modules\n* Consider other languages by FFIs \n* Consider also heap allocations from C and deallocations in Rust\n------------------------------------------------------------------------------\n\n# Contributions are welcome!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FAFx3%2Fcrema-static-analyzer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FAFx3%2Fcrema-static-analyzer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FAFx3%2Fcrema-static-analyzer/lists"}