{"id":47158757,"url":"https://github.com/staticafi/symbiotic","last_synced_at":"2026-03-13T02:37:31.585Z","repository":{"id":25215272,"uuid":"28639394","full_name":"staticafi/symbiotic","owner":"staticafi","description":"Symbiotic is a tool for finding bugs in computer programs based on instrumentation, program slicing and KLEE","archived":false,"fork":false,"pushed_at":"2026-01-13T08:59:44.000Z","size":2079,"stargazers_count":333,"open_issues_count":52,"forks_count":59,"subscribers_count":9,"default_branch":"main","last_synced_at":"2026-01-13T21:48:15.523Z","etag":null,"topics":["instrumentation","klee","llvm","llvm-ir","program-slicing","program-verification","slice","slicing","software-verification","symbolic-execution","verification","verification-toolchain"],"latest_commit_sha":null,"homepage":"http://staticafi.github.io/symbiotic/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"google/guava","license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/staticafi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2014-12-30T17:33:06.000Z","updated_at":"2025-12-24T21:01:34.000Z","dependencies_parsed_at":"2023-01-14T02:20:21.911Z","dependency_job_id":"ee8a7b3d-dd67-43c9-a763-0d6b7b85330c","html_url":"https://github.com/staticafi/symbiotic","commit_stats":null,"previous_names":["mchalupa/symbiotic"],"tags_count":22,"template":false,"template_full_name":null,"purl":"pkg:github/staticafi/symbiotic","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staticafi%2Fsymbiotic","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staticafi%2Fsymbiotic/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staticafi%2Fsymbiotic/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staticafi%2Fsymbiotic/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/staticafi","download_url":"https://codeload.github.com/staticafi/symbiotic/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staticafi%2Fsymbiotic/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30456101,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-13T02:22:12.178Z","status":"ssl_error","status_checked_at":"2026-03-13T02:06:49.475Z","response_time":60,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["instrumentation","klee","llvm","llvm-ir","program-slicing","program-verification","slice","slicing","software-verification","symbolic-execution","verification","verification-toolchain"],"created_at":"2026-03-13T02:37:30.911Z","updated_at":"2026-03-13T02:37:31.564Z","avatar_url":"https://github.com/staticafi.png","language":"Python","readme":"\n[![Build - Linux CI](https://github.com/staticafi/symbiotic/actions/workflows/linux.yml/badge.svg)](https://github.com/staticafi/symbiotic/actions/workflows/linux.yml)\n\nSymbiotic is an open-source framework for program analysis integrating\ninstrumentation, static program slicing and various program analysis tools.\nSymbiotic is highly modular and most of its components are self-standing\nprograms or LLVM passes that have their own repositories at\nhttps://github.com/staticafi.\n\n## Getting started\n\n### Downloading Symbiotic\n\nTarballs with Symbiotic distribution can be downloaded from\nhttps://github.com/staticafi/symbiotic/releases. The latest release is the [fixed version of Symbiotic archive that competed in SV-COMP 21](https://github.com/staticafi/symbiotic/releases/tag/svcomp21).\nAlternatively, you can download archives used in [SV-COMP 2021](https://gitlab.com/sosy-lab/sv-comp/archives-2021/-/blob/master/2021/symbiotic.zip)\n(compiled on Ubuntu 20) or [SV-COMP 2020](https://gitlab.com/sosy-lab/sv-comp/archives-2020/-/blob/master/2020/symbiotic.zip) (compiled on Ubuntu 18).\n\nAfter unpacking, Symbiotic should be ready to go.\n\n### Docker image\n\nWARNING: is not up-to-date.\n\nYou can use also the docker image, but we do not keep them up to date:\n\n```\ndocker pull mchalupa/symbiotic\ndocker run -ti mchalupa/symbiotic\n```\n\n### Building Symbiotic from Sources\n\nFirst of all you must clone the repository:\n\n```\n$ git clone https://github.com/staticafi/symbiotic\n```\n\nRun `build.sh` or `system-build.sh` script to compile Symbiotic:\n\n```\n$ cd symbiotic\n$ ./build.sh -j2\n```\nThe difference betwee `build.sh` and `system-build.sh` is that\n`system-build.sh` will try to build only the components of Symbiotic, using the\nsystem's packages.  `build.sh`, on the other hand, tries to build also the most\nof the missing dependencies, including LLVM, z3, etc.\n\nThe scripts should complain about missing dependencies if any. You can try using\n`scripts/install-system-dependencies.sh` script to install the main\ndependencies (or at least check the names of packages). If the build script\ncontinues to complain, you must install the dependencies manually.\n\nPossible options for the `build.sh` script include:\n  - `build-type=TYPE` (TYPE one of `Release`, `Debug`)\n  - `llvm-version=VERSION` (the default `VERSION` is `10.0.1`,\n     other versions are rather experimental)\n  - `with-llvm=`, `with-llvm-src=`, `with-llvm-dir=`\n     This set of options orders the script to use already built external LLVM\n     (the build script will build LLVM otherwise if it has not been built\n     already in this folder)\n  - `no-llvm` Do not try building LLVM\n\nThere are many other options, but they are not properly documented (check the\nscript). Actually, the whole build script should be rather a guidance of what\nis needed and how to build the components, but is not guaranteed to work on any\nsystem.\n\nAs you can see from the example, you can pass also arguments for make, e.g.\n`-j2`, to the build script.  If you need to specify paths to header files or\nlibraries, you can do it by passing `CFLAGS`, `CPPFLAGS`, and/or `LDFLAGS`\nenvironment variables either by exporting them beforehand, or by passing them\non the command line similarly to make options (e.g. ./build.sh `CFLAGS='-g'`)\n\nIf everything goes well, Symbiotic components are built and should be usable\nright from the build directories (see the next section for more details).\nAlso, the components are installed to the `install/` directory that can be\npacked or copied wherever you need (you can use ./build.sh `archive` to create\na .zip file or `full-archive` to create .zip file including system libraries\nlike libc with the build script).\nThe `install/` directory is under `git` control, so you can see the differences\nbetween versions or manually create an archive using `git archive` command.\n\nWhen building on mac, you may need to build LLVM with shared libraries\n(modify the build script) or use `with-llvm-*` switch with your LLVM build.\n\n### Running Symbiotic\n\nYou can run Symbiotic directly from the root directory:\n```\nscripts/symbiotic \u003cOPTIONS\u003e file.c\n```\nIf you run symbiotic from the `scripts/` directory, it uses the components\ndirectly from the build directories, any changes to the components should\ntake effect in this mode.\n\nAlternatively, you can run Symbiotic also from the `install/` directory:\n```\n$ install/bin/symbiotic \u003cOPTIONS\u003e file.c\n```\n\nIn this mode, Symbiotic uses the components from the `install/` directory.\n\n### Troubleshooting\n\nIn the case that something went wrong, try running Symbiotic with `--debug=all`\nswitch.  When the source code does not contain everything to compile\n(i.e. it includes some headers), you can use `CFLAGS` and `CPPFLAGS`\nenvironment variables to pass additional options to the compiler (clang).\nEither export them before running Symbiotic, or on one line:\n\n```\nCPPFLAGS='-I /lib/gcc/include' scripts/symbiotic file.c\n```\n\nYou can also use `--cppflags` switch that works exactly the same as environment\nvariables.  If the program is split into more files, you can give Symbiotic all\nthe files.  At least one of them must contain the `main` function.\n\n```\nscripts/symbiotic main.c additional_definitions.c lib.c\n```\n\nUse `--help` switch to see all available options.\n\n### Example\n\nLet's see how you can use Symbiotic to find an error in the following program `test1.c`:\n\n```C\n#include \u003cassert.h\u003e\n#define N 10\n\nextern int __VERIFIER_nondet_int(void);\n\nint main( ) {\n  int a[N];\n  for (int i = 0; i \u003c N; ++i) {\n\t  a[i] = __VERIFIER_nondet_int();\n  }\n\n  int swapped = 1;\n  while (swapped) {\n    swapped = 0;\n    for (int i = 1; i \u003c N; ++i) {\n      if ( a[i - 1] \u003c a[i] ) {\n        int t = a[i];\n        a[i] = a[i - 1];\n        a[i-1] = t;\n        swapped = 1;\n      }\n    }\n  }\n\n  for (int x = 0 ; x \u003c N ; x++ ) {\n    for (int y = x+1 ; y \u003c N ; y++ ) {\n      assert(a[x] \u003c= a[y]);\n    }\n  }\n  return 0;\n}\n```\n\nRunning `scripts/symbiotic --exit-on-error test1.c` should produce an output similar to the following.\nThe `--exit-on-error` option ensures that we stop after the first error is found, otherwise the computation\nwould run for much longer.\n\n```\n7.0.0-dev-llvm-9.0.1-symbiotic:5a52b0ca-dg:e89761ff-sbt-slicer:fff6245c-sbt-instrumentation:2f9be629-klee:e643b135\nINFO: Optimizations time: 0.028319835662841797\nINFO: Starting slicing\nINFO: Total slicing time: 0.0068209171295166016\nINFO: Optimizations time: 0.027271509170532227\nINFO: After-slicing optimizations and transformations time: 2.288818359375e-05\nINFO: Starting verification\nb'KLEE: WARNING: undefined reference to function: klee_make_nondet'\nb'KLEE: ERROR: /home/marek/src/symbiotic/test1.c:27: ASSERTION FAIL: a[x] \u003c= a[y]'\nb'KLEE: NOTE: now ignoring this error at this location'\nINFO: Verification time: 12.27576208114624\n\n --- Error trace ---\n\nError: ASSERTION FAIL: a[x] \u003c= a[y]\nFile: /home/marek/src/symbiotic/test1.c\nLine: 27\nassembly.ll line: 172\nStack:\n\t#000000172 in main () at /home/marek/src/symbiotic/test1.c:27\n\n --- Sequence of non-deterministic values [function:file:line:col] ---\n\n__VERIFIER_nondet_int:test1.c:9:11 := len 4 bytes, [4 times 0x0] (i32: 0)\n__VERIFIER_nondet_int:test1.c:9:11 := len 4 bytes, [3 times 0x0|0x80] (i32: -2147483648)\n__VERIFIER_nondet_int:test1.c:9:11 := len 4 bytes, [3 times 0x0|0x80] (i32: -2147483648)\n__VERIFIER_nondet_int:test1.c:9:11 := len 4 bytes, [3 times 0x0|0x80] (i32: -2147483648)\n__VERIFIER_nondet_int:test1.c:9:11 := len 4 bytes, [3 times 0x0|0x80] (i32: -2147483648)\n__VERIFIER_nondet_int:test1.c:9:11 := len 4 bytes, [3 times 0x0|0x80] (i32: -2147483648)\n__VERIFIER_nondet_int:test1.c:9:11 := len 4 bytes, [3 times 0x0|0x80] (i32: -2147483648)\n__VERIFIER_nondet_int:test1.c:9:11 := len 4 bytes, [3 times 0x0|0x80] (i32: -2147483648)\n__VERIFIER_nondet_int:test1.c:9:11 := len 4 bytes, [3 times 0x0|0x80] (i32: -2147483648)\n__VERIFIER_nondet_int:test1.c:9:11 := len 4 bytes, [3 times 0x0|0x80] (i32: -2147483648)\n\n --- ----------- ---\nError found.\nINFO: Total time elapsed: 12.659614086151123\n```\n\nIn some cases, Symbiotic is able to generate also an executable witness.\nYou must use `--executable-witness` switch. Then, you should see a message\nlike this in the output:\n\n```\nGenerating executable witness to : /home/marek/src/symbiotic/witness.exe\n```\n\nIf you run the binary, it follows the found error path:\n```\n$ ./witness.exe\nwitness.exe: /home/marek/src/symbiotic/tests/test1-false-unreach-call.c:27: int main(): Assertion `a[x] \u003c= a[y]' failed.\n[1]    18810 abort (core dumped)  ./witness.exe\n```\n\nThe binary is compiled with the `-g` option, so you can load it into a debugger.\n\n\nIn the default mode, Symbiotic looks for assertion violations.\nIf you want to look for e.g., errors in memory manipulations, use `--prp`\nswitch. For example, say you have a file `test2.c` with this contents:\n\n```C\nextern void __VERIFIER_error() __attribute__ ((__noreturn__));\n\nstruct list {\n int n;\n struct list *next;\n};\n\nint i = 1;\n\nstruct list* append(struct list *l, int n)\n{\n struct list *new_el;\n\n new_el = malloc(8);\n new_el-\u003en = n;\n new_el-\u003enext = l;\n\n return new_el;\n}\n\nint main(void)\n{\n struct list *l,m;\n l = \u0026m;\n l-\u003enext = 0;\n l-\u003en = 0;\n\n l = append(l, 1);\n l = append(l, 2);\n\n if (l-\u003enext-\u003enext-\u003en == 0)\n   __VERIFIER_error();\n return 0;\n}\n```\n\nIf you run `scripts/symbiotic --prp=memsafety test2.c`,\nyou should get an output similar to the following:\n\n```\n7.0.0-dev-llvm-9.0.1-symbiotic:5a52b0ca-dg:e89761ff-sbt-slicer:fff6245c-sbt-instrumentation:2f9be629-klee:e643b135\nINFO: Starting instrumentation\nwrapper: `which slllvm` failed with error code 1\n\nINFO: Instrumentation time: 0.04639697074890137\nINFO: Optimizations time: 0.02850055694580078\nINFO: Starting slicing\nINFO: Total slicing time: 0.00681614875793457\nINFO: Optimizations time: 0.02629995346069336\nINFO: After-slicing optimizations and transformations time: 2.7894973754882812e-05\nINFO: Starting verification\nb'KLEE: WARNING ONCE: Alignment of memory from call \"malloc\" is not modelled. Using alignment of 8.'\nb'KLEE: ERROR: /home/marek/src/symbiotic/test2_false-valid-deref.c:16: memory error: out of bound pointer'\nb'KLEE: NOTE: now ignoring this error at this location'\nINFO: Verification time: 0.029797792434692383\n\n --- Error trace ---\n\nError: memory error: out of bound pointer\nFile: /home/marek/src/symbiotic/test2_false-valid-deref.c\nLine: 16\nassembly.ll line: 31\nStack:\n\t#000000031 in append (=94514011128176, =1) at /home/marek/src/symbiotic/test2_false-valid-deref.c:16\n\t#100000064 in main () at /home/marek/src/symbiotic/test2_false-valid-deref.c:28\nInfo:\n\taddress: 26:94514011726424\n\tpointing to: object at 94514011726416 of size 8\n\t\tMO15[8] allocated at append():  %7 = call i8* @malloc(i64 8), !dbg !23\n\n --- Sequence of non-deterministic values [function:file:line:col] ---\n\n\n --- ----------- ---\nError found.\nINFO: Total time elapsed: 0.6174993515014648\n```\n\nIf you would omit the `--prp=memsafety` switch, you would see that Symbiotic\nreports no error. However, the output mentions some memory errors.\nThis means that Symbiotic hit an error but different one that it should look for.\nNote that the difference is not only in parsing the output.\nSince Symbiotic slices the program w.r.t\nerror-sites, it may remove some errors that are not related to the particular\nerror that we looked for. So the fact that Symbiotic found an invalid\ndereference even though it did not look for that is just a lucky\ncoincidence and may not be true for other programs.\n\n### Verification backends\n\nBy default, Symbiotic runs KLEE to analyze the program.\nHowever, it can use many other tools for the analysis. Here is the list\nof supported tools (some of them are integrated rather experimentally\nand may not work seamlessly):\n\n|tool        | switch               |\n|------------|----------------------|\n|KLEE        | `--target=klee`      |\n|CPAchecker  | `--target=cpachecker`|\n|DIVINE      | `--target=divine`    |\n|CBMC        | `--target=cbmc`      |\n|SMACK       | `--target=smack`     |\n|SeaHorn     | `--target=seahorn`   |\n|Nidhugg     | `--target=nidhugg`   |\n|IKOS        | `--target=ikos`      |\n|UAutomizer  | `--target=ultimate`  |\n\n### CC mode\n\nSymbiotic can also just output the transformed bitcode or generate C code\nfrom the transformed bitcode. ...TBD...\n\n### Symbiotic Components\n\nComponents of Symbiotic can be found at https://github.com/staticafi with the\nonly exception of `dg` library that is currently at https://github.com/mchalupa/dg.\nAll software used in Symbiotic are open-source projects and are licensed under various\nopen-source licenses (mostly MIT license,\nand University of Illinois Open Source license)\n\n## Contact\n\nFor more information send an e-mail to \u003cstatica@fi.muni.cz\u003e.\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstaticafi%2Fsymbiotic","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstaticafi%2Fsymbiotic","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstaticafi%2Fsymbiotic/lists"}