{"id":50988382,"url":"https://github.com/Rust-API/Rust-API-Bypass-Checker","last_synced_at":"2026-07-07T22:00:31.083Z","repository":{"id":345708625,"uuid":"1177667519","full_name":"Rust-API/Rust-API-Bypass-Checker","owner":"Rust-API","description":"A static analysis tool that identifies redundant safety checks in Rust programs to improve performance. By analyzing MIR (Mid-level Intermediate Representation), the tool detects where safe APIs can be safely replaced with their unchecked counterparts without compromising memory safety.","archived":false,"fork":false,"pushed_at":"2026-05-17T12:35:52.000Z","size":2209,"stargazers_count":64,"open_issues_count":0,"forks_count":5,"subscribers_count":6,"default_branch":"main","last_synced_at":"2026-05-17T14:38:53.189Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Rust-API.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-10T08:51:40.000Z","updated_at":"2026-05-17T11:32:35.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/Rust-API/Rust-API-Bypass-Checker","commit_stats":null,"previous_names":["rust-api/rust-api-bypass-checker"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Rust-API/Rust-API-Bypass-Checker","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Rust-API%2FRust-API-Bypass-Checker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Rust-API%2FRust-API-Bypass-Checker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Rust-API%2FRust-API-Bypass-Checker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Rust-API%2FRust-API-Bypass-Checker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Rust-API","download_url":"https://codeload.github.com/Rust-API/Rust-API-Bypass-Checker/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Rust-API%2FRust-API-Bypass-Checker/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35243953,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-07T02:00:07.222Z","response_time":90,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-19T23:00:38.172Z","updated_at":"2026-07-07T22:00:31.064Z","avatar_url":"https://github.com/Rust-API.png","language":"Rust","funding_links":[],"categories":["Static Checkers"],"sub_categories":[],"readme":"# Rust API Bypass Checker\n\nA conservative MIR-based checker for a small set of Rust safe/unsafe API counterparts.\n\nThe current implementation focuses on proving local numerical and pointer-nullness preconditions for selected standard-library calls and reporting replacement opportunities such as `slice.get(i)` to `slice.get_unchecked(i)` when the safety condition is provably satisfied from local MIR facts.\nA focused MIR-based static analysis artifact for detecting locally provable Rust safe-to-unsafe API replacement opportunities.\n\nThe checker reasons over local MIR facts such as integer intervals and pointer nullness to conservatively report cases where checked APIs, such as `slice.get(i)` or `split_at(mid)`, may be replaced by unchecked counterparts under provable preconditions.\n\n## What This Demo Claims\n\nThis repository is being maintained as a focused demo artifact, not as a whole-program optimizer.\n\nThe intended claim is narrow:\n\n\u003e For a known set of standard-library API pairs, the analyzer can prove selected call-site preconditions from local MIR facts and report replacement opportunities.\n\nThe demo does not claim:\n\n- whole-program optimization\n- whole-application speedup\n- complete alias analysis\n- full raw-pointer reasoning\n- semantic preservation for arbitrary Rust programs\n\nUnsupported calls and memory effects are conservatively downgraded to local unknown, and replacement candidates are suppressed when their proof would depend on those unknown facts.\n\n## Supported API Fragment\n\nThe analyzer is intentionally narrow.\n\n- The active numerical domain is `interval`.\n- Reasoning is local and MIR-based.\n- Default descent into ordinary callees is disabled.\n- Special handling is limited to a small whitelist of checked/unchecked API families.\n- Calls outside the supported fragment are downgraded to local unknown at call boundaries.\n\nThe primary demo matrix is:\n\n| API family | Required condition | Demo case |\n|---|---|---|\n| `checked_add` | result is within the integer type range | `tests/checked_add` |\n| `slice::get` / `get_mut` | `index \u003c slice.len()` | `tests/get` |\n| `slice::split_at` / `split_at_mut` | `mid \u003c= slice.len()` | `tests/split_at`, `tests/ring_buffer_split` |\n| `slice::swap` | `i \u003c slice.len() \u0026\u0026 j \u003c slice.len()` | `tests/swap` |\n| `ptr.as_ref()`, `ptr.as_mut()`, `NonNull::new(ptr)` | pointer is locally known non-null | internal nullness support |\n\nSee [DEMO_SCOPE.md](DEMO_SCOPE.md) for the detailed demo boundary and expected output shape.\n\n## Example\n\n```rust\nfn process_array(arr: \u0026[i32]) {\n    for i in 0..arr.len() {\n        // Redundant bounds check - loop condition guarantees i \u003c arr.len()\n        let value = arr.get(i).unwrap(); // Can optimize to arr[i] or arr.get_unchecked(i)\n        println!(\"Value is {}\", value);\n    }\n}\n```\n\nWithin its supported fragment, the checker aims to recognize that `i \u003c arr.len()` already holds and report the call as a replacement candidate for an unchecked variant. It reports diagnostics only; it does not rewrite source code automatically.\n\n## Repository Layout\n\n- `src/`: analyzer implementation and command-line drivers\n- `tests/`: small standalone demo crates used for focused experiments\n- `analysis-results/`: saved experiment outputs\n- `evaluation/`: scripts and notes for measurement runs\n- `API-counterprats/`: benchmark-oriented companion workspace\n- `unchecked_method_base/`: safe/unsafe counterpart inventory material\n\n## Requirements\n\n- Rust nightly `nightly-2025-01-10`\n- `rustc-dev`\n- `llvm-tools-preview`\n- system libraries for `gmp`, `mpfr`, and `z3`\n\nExample setup on Ubuntu:\n\n```sh\nrustup toolchain install nightly-2025-01-10\nrustup component add rustc-dev llvm-tools-preview --toolchain nightly-2025-01-10\nsudo apt-get install libgmp-dev libmpfr-dev libz3-dev\n```\n\nThe root crate pins its toolchain in [rust-toolchain.toml](rust-toolchain.toml). The benchmark workspace under `API-counterprats/` may use a different nightly for separate experiments.\n\n## Build\n\n```sh\ngit clone https://github.com/Rust-API/Rust-API-Bypass-Checker.git\ncd Rust-API-Bypass-Checker\nexport RUSTFLAGS=\"-Clink-args=-fuse-ld=lld\"\ncargo build\n$ git clone https://github.com/Rust-API/Rust-API-Bypass-Checker.git\n$ cd Rust-API-Bypass-Checker\n$ export RUSTFLAGS=\"-Clink-args=-fuse-ld=lld\"\n$ cargo build\n```\n\nThis builds the main analyzer binary `api-bypass` together with the `cargo-api-bypass` wrapper.\n\n## Usage\n\n### Direct Analyzer Binary\n\nThe most reproducible way to run the demo is to point `api-bypass` at one of the standalone source files in `tests/`.\n\n1. Inspect candidate entry functions:\n\n```sh\nmkdir -p target/demo-smoke\n./target/debug/api-bypass tests/get/src/main.rs --show_reachable_entries --emit=metadata --out-dir target/demo-smoke\n```\n\n2. Analyze a specific entry:\n\n```sh\n./target/debug/api-bypass tests/get/src/main.rs --entry_def_id_index 3 --emit=metadata --out-dir target/demo-smoke\n```\n\nUseful flags:\n\n- `--entry_def_id_index \u003cn\u003e`: analyze the selected DefId index\n- `--show_all_entries`: print all candidate entries discovered in the current crate\n- `--show_reachable_entries`: print reachable entry candidates from the current front-end scan\n- `--auto_analysis`: let the checker pick an entry automatically when supported\n- `--domain interval`: explicitly select the interval domain\n\n### Cargo Wrapper\n\nThe repository also provides a `cargo api-bypass` wrapper binary:\n\n```sh\ncargo run --bin cargo-api-bypass -- api-bypass --help\n```\n\nIts current interface is minimal and is mainly useful when experimenting with Cargo-driven entry flows.\n\n## Demo Smoke Commands\n\nThese commands match the current small demo crates and keep outputs isolated under `target/demo-smoke`:\n\n```sh\nmkdir -p target/demo-smoke\nenv RUST_LOG=warn ./target/debug/api-bypass tests/checked_add/src/main.rs --entry_def_id_index 3 --emit=metadata --out-dir target/demo-smoke\nenv RUST_LOG=warn ./target/debug/api-bypass tests/get/src/main.rs --entry_def_id_index 3 --emit=metadata --out-dir target/demo-smoke\nenv RUST_LOG=warn ./target/debug/api-bypass tests/split_at/src/main.rs --entry_def_id_index 3 --emit=metadata --out-dir target/demo-smoke\nenv RUST_LOG=warn ./target/debug/api-bypass tests/swap/src/main.rs --entry_def_id_index 3 --emit=metadata --out-dir target/demo-smoke\nenv RUST_LOG=warn ./target/debug/api-bypass tests/ring_buffer_split/src/main.rs --entry_def_id_index 3 --emit=metadata --out-dir target/demo-smoke\n```\n\nExpected current behavior:\n\n| Command target | Expected candidate output |\n|---|---|\n| `tests/checked_add` | one `integer.checked_add(rhs)` candidate |\n| `tests/get` | one `slice::get(index)` candidate |\n| `tests/split_at` | one `slice::split_at(mid)` candidate |\n| `tests/swap` | one `slice::swap(i, j)` candidate |\n| `tests/ring_buffer_split` | two `slice::split_at_mut(mid)` candidates, plus conservative call-boundary warnings in the loop body |\n\n## Result Semantics\n\nDiagnostics should be interpreted conservatively.\n\n- A supported diagnostic comes from the currently supported numerical or pointer-nullness fragment.\n- A call-boundary or unsupported diagnostic means the analyzer deliberately stopped and downgraded the result to unknown.\n- The absence of a diagnostic is not a global proof of safety.\n\nWhen a supported safe API call is proven to satisfy the corresponding unchecked precondition, the analyzer emits a replacement-candidate diagnostic shaped like:\n\n```text\n[Bypasser] Replacement candidate\n\nSafe API:\n  slice::split_at(mid)\n\nSuggested replacement:\n  unsafe { slice::split_at_unchecked(mid) }\n\nRequired condition:\n  mid \u003c= slice.len()\n\nAnalysis result:\n  proven from local MIR split-index facts\n```\n\n## Related Files\n\n- [DEMO_SCOPE.md](DEMO_SCOPE.md): demo boundary, output contract, and smoke commands\n- [E2E_CASE_STUDY_EXPERIMENTS.md](E2E_CASE_STUDY_EXPERIMENTS.md): experiment notes\n- [evaluation/README.md](evaluation/README.md): evaluation workflow\n- [API-counterprats/README.md](API-counterprats/README.md): benchmark companion workspace\n\n## License\n\nSee [LICENSE](LICENSE) and [licenses](licenses).\n\n## Acknowledgments\n\nBuilt upon:\n\n- [MirChecker](https://github.com/lizhuohua/rust-mir-checker)\n- [MIRAI](https://github.com/facebookexperimental/MIRAI)\n- [Crab](https://github.com/seahorn/crab)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FRust-API%2FRust-API-Bypass-Checker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FRust-API%2FRust-API-Bypass-Checker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FRust-API%2FRust-API-Bypass-Checker/lists"}