demo/icfg.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "6fc16360f757b53f",
   "metadata": {
    "collapsed": false
   },
   "source": [
    "## PySVF tutorial: ICFG (Interprocedural Control-Flow Graph)\n",
    "\n",
    "### Introduction\n",
    "\n",
    "In this Jupyter Notebook, we will explore the use of the SVF (Static Value-Flow) tool for static analysis of LLVM bitcode, focusing on the Interprocedural Control-Flow Graph (ICFG). The `pysvf` library provides functionality to analyze bitcode files and extract valuable insights from the ICFG. This notebook will guide you through the process of setting up the environment, using the ICFG-related functions, and analyzing the resulting data structures.\n",
    "\n",
    "### Significance\n",
    "\n",
    "- **Control Flow Analysis**: ICFG provides a comprehensive framework for analyzing the control flow within a program. It helps in understanding the execution paths and the flow of control between different functions, which is essential for optimizing compilers and detecting potential vulnerabilities.\n",
    "- **Interprocedural Analysis**: One of the primary applications of ICFG is in interprocedural analysis, where it helps in determining the control flow across function boundaries, providing a more holistic view of the program's behavior.\n",
    "- **Optimization and Refactoring**: By providing insights into the control flow, ICFG aids in optimizing code and refactoring it for better performance and maintainability.\n",
    "\n",
    "### Functionality\n",
    "\n",
    "- **Representation of Functions and Control Flow**: In ICFG, functions are represented as nodes, and control flow between them is represented as edges. This graph-based representation allows for efficient traversal and analysis of the program's structure.\n",
    "- **Interprocedural Control Flow**: ICFG supports interprocedural control flow analysis, meaning it can analyze the flow of control across function boundaries, providing a more comprehensive view of the program's execution.\n",
    "- **Integration with LLVM**: ICFG is designed to work seamlessly with LLVM bitcode, making it a powerful tool for analyzing programs written in languages supported by LLVM.\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "a14e2a8674132dc7",
   "metadata": {
    "ExecuteTime": {
     "end_time": "2025-03-30T08:22:20.793636Z",
     "start_time": "2025-03-30T08:22:20.244560Z"
    },
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "*********General Stats***************\n",
      "################ (program : demo.ll)###############\n",
      "AddrsNum            21\n",
      "BBWith2Succ         1\n",
      "BBWith3Succ         0\n",
      "CallsNum            3\n",
      "ConstArrayObj       0\n",
      "ConstStructObj      0\n",
      "ConstantObj         14\n",
      "CopysNum            2\n",
      "FIObjNum            13\n",
      "FSObjNum            9\n",
      "FunctionObjs        5\n",
      "GepsNum             10\n",
      "GlobalObjs          1\n",
      "HeapObjs            1\n",
      "IndCallSites        0\n",
      "LoadsNum            3\n",
      "MaxStructSize       0\n",
      "NonPtrObj           22\n",
      "ReturnsNum          1\n",
      "StackObjs           2\n",
      "StoresNum           7\n",
      "TotalCallSite       4\n",
      "TotalFieldObjects   2\n",
      "TotalObjects        25\n",
      "TotalPTASVFStmts    22\n",
      "TotalPointers       70\n",
      "TotalSVFStmts       56\n",
      "VarArrayObj         1\n",
      "VarStructObj        0\n",
      "----------------Time and memory stats--------------------\n",
      "LLVMIRTime          0.01\n",
      "SVFIRTime           0.014\n",
      "SymbolTableTime     0.002\n",
      "#######################################################\n",
      "\n",
      "*********PTACallGraph Stats (Andersen analysis)***************\n",
      "################ (program : demo.ll)###############\n",
      "----------------Numbers stats----------------------------\n",
      "CalRetPairInCycle   0\n",
      "MaxNodeInCycle      0\n",
      "NodeInCycle         0\n",
      "TotalCycle          0\n",
      "TotalEdge           4\n",
      "TotalNode           5\n",
      "#######################################################\n",
      "\n",
      "*********Andersen Pointer Analysis Stats***************\n",
      "################ (program : demo.ll)###############\n",
      "----------------Time and memory stats--------------------\n",
      "AvgIn/OutAddrEdge   0.25\n",
      "AvgIn/OutCopyEdge   0.4375\n",
      "AvgIn/OutEdge       0.75\n",
      "AvgIn/OutLoadEdge   0.03125\n",
      "AvgIn/OutStoreEdge  0.03125\n",
      "AvgPtsSetSize       0.2\n",
      "AvgTopLvlPtsSize    0.95\n",
      "CollapseTime        0\n",
      "CopyGepTime         0\n",
      "LoadStoreTime       0\n",
      "MemoryUsageVmrss    0\n",
      "MemoryUsageVmsize   0\n",
      "SCCDetectTime       0\n",
      "SCCMergeTime        0\n",
      "TotalTime           0.001\n",
      "UpdateCGTime        0\n",
      "----------------Numbers stats----------------------------\n",
      "AddrProcessed       8\n",
      "CopyProcessed       1\n",
      "DummyFieldPtrs      2\n",
      "FieldObjs           2\n",
      "GepProcessed        10\n",
      "IndCallSites        0\n",
      "IndEdgeSolved       0\n",
      "LoadProcessed       1\n",
      "LocalVarInRecur     0\n",
      "MaxInAddrEdge       1\n",
      "MaxInCopyEdge       1\n",
      "MaxInLoadEdge       1\n",
      "MaxInStoreEdge      1\n",
      "MaxNodesInSCC       0\n",
      "MaxOutAddrEdge      1\n",
      "MaxOutCopyEdge      5\n",
      "MaxOutLoadEdge      1\n",
      "MaxOutStoreEdge     1\n",
      "MaxPtsSetSize       1\n",
      "MemObjects          25\n",
      "NodesInCycles       0\n",
      "NullPointer         0\n",
      "NumOfAddrs          8\n",
      "NumOfCGEdge         16\n",
      "NumOfCGNode         40\n",
      "NumOfCopys          4\n",
      "NumOfFieldExpand    0\n",
      "NumOfGeps           10\n",
      "NumOfLoads          1\n",
      "NumOfSCCDetect      2\n",
      "NumOfSFRs           0\n",
      "NumOfStores         1\n",
      "NumOfValidNode      32\n",
      "NumOfValidObjNode   10\n",
      "Pointers            70\n",
      "PointsToBlkPtr      0\n",
      "PointsToConstPtr    0\n",
      "SolveIterations     2\n",
      "StoreProcessed      1\n",
      "TotalCycleNum       0\n",
      "TotalObjects        25\n",
      "TotalPWCCycleNum    0\n",
      "TotalPointers       70\n",
      "#######################################################\n",
      "\n",
      "****Persistent Points-To Cache Statistics: Andersen's analysis bitvector****\n",
      "################ (program : demo.ll)###############\n",
      "UniquePointsToSets       11\n",
      "TotalUnions              19\n",
      "PropertyUnions           19\n",
      "UniqueUnions             0\n",
      "LookupUnions             0\n",
      "PreemptiveUnions         0\n",
      "TotalComplements         78\n",
      "PropertyComplements      78\n",
      "UniqueComplements        0\n",
      "LookupComplements        0\n",
      "PreemptiveComplements    0\n",
      "TotalIntersections       2\n",
      "PropertyIntersections    2\n",
      "UniqueIntersections      0\n",
      "LookupIntersections      0\n",
      "PreemptiveIntersections  0\n",
      "#######################################################\n"
     ]
    }
   ],
   "source": [
    "# Install the pysvf library\n",
    "# You might need to run this command in your terminal or use a Jupyter magic command\n",
    "# !pip install pysvf\n",
    "\n",
    "# Import necessary libraries\n",
    "import pysvf\n",
    "\n",
    "# Load the LLVM bitcode file\n",
    "bitcode_file = \"demo.ll\"\n",
    "\n",
    "# Get the pag(SVFIR) from the bitcode file\n",
    "pysvf.buildSVFModule(bitcode_file)\n",
    "svfir = pysvf.getPAG()\n",
    "\n",
    "# Get the control flow graph (CFG) from the pag\n",
    "cfg = svfir.getICFG()\n",
    "\n",
    "# Dump the ICFG to a file, the output file will be named \"demo.icfg.dot\"\n",
    "cfg.dump(\"demo.icfg\")\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "aa6d78918c205871",
   "metadata": {
    "collapsed": false
   },
   "source": [
    "Then we can traverse the ICFG to analyze the control flow between functions and perform various analyses on the program's structure.\n",
    "\n",
    "### Basic Operations on ICFG\n",
    "\n",
    "#### ICFG Class\n",
    "- **APIs**\n",
    "  ```python\n",
    "  def getNodes(self) -> List[ICFGNode]: ... # Get the list of ICFG nodes\n",
    "  def getGNode(self, id: int) -> ICFGNode: ... # Get the ICFG node by id\n",
    "  def getGlobalICFGNode(self) -> ICFGNode: ... # Get the global ICFG node\n",
    "  def dump(self, file: str) -> None: ... # Dump the ICFG to a file\n",
    "  ```\n",
    "\n",
    "#### ICFGNode Class\n",
    "- **APIs**\n",
    "  ```python\n",
    "  def toString(self) -> str: ... # Get the string representation of the ICFG node\n",
    "  def getId(self) -> int: ... # Get the id of the ICFG node\n",
    "  def getFun(self) -> SVFFunction: ... # Get the function that the ICFG node belongs to\n",
    "  def getBB(self) -> SVFBasicBlock: ... # Get the basic block that the ICFG node belongs to\n",
    "  def getSVFStmts(self) -> List[SVFStmt]: ... # Get the SVF statements associated with the ICFG node\n",
    "  def asFunEntry(self) -> FunEntryICFGNode: ... # Downcast to FunEntryICFGNode\n",
    "  def asFunExit(self) -> FunExitICFGNode: ... # Downcast to FunExitICFGNode\n",
    "  def asCall(self) -> CallICFGNode: ... # Downcast to CallICFGNode\n",
    "  def asRet(self) -> RetICFGNode: ... # Downcast to RetICFGNode\n",
    "  def isFunEntry(self) -> bool: ... # Check if the ICFG node is a function entry node\n",
    "  def isFunExit(self) -> bool: ... # Check if the ICFG node is a function exit node\n",
    "  def isCall(self) -> bool: ... # Check if the ICFG node is a function call node\n",
    "  def isRet(self) -> bool: ... # Check if the ICFG node is a function return node\n",
    "  def getOutEdges(self) -> List[ICFGEdge]: ... # Get the out edges of the ICFG node\n",
    "  def getInEdges(self) -> List[ICFGEdge]: ... # Get the in edges of the ICFG node\n",
    "  ```\n",
    "\n",
    "###  ICFGEdge Class\n",
    "- **APIs**\n",
    "  ```python\n",
    "  def toString(self) -> str: ... # Get the string representation of the ICFG edge\n",
    "  def isCFGEdge(self) -> bool: ... # Check if the edge is a CFG edge\n",
    "  def isCallCFGEdge(self) -> bool: ... # Check if the edge is a call CFG edge\n",
    "  def isRetCFGEdge(self) -> bool: ... # Check if the edge is a return CFG edge\n",
    "  def isIntraCFGEdge(self) -> bool: ... # Check if the edge is an intra CFG edge\n",
    "  def getSrcNode(self) -> ICFGNode: ... # Get the source node of the edge\n",
    "  def getDstNode(self) -> ICFGNode: ... # Get the destination node of the edge\n",
    "  def asIntraCFGEdge(self) -> IntraCFGEdge: ... # Downcast to IntraCFGEdge\n",
    "  def asCallCFGEdge(self) -> CallCFGEdge: ... # Downcast to CallCFGEdge\n",
    "  def asRetCFGEdge(self) -> RetCFGEdge: ... # Downcast to RetCFGEdge\n",
    "  ```\n",
    "\n",
    "Then, we can use these APIs to traverse the ICFG and perform various analyses on the control flow between functions.\n",
    "\n",
    "- Traverse the ICFG nodes and print their information\n",
    "- Get a certain node by its ID (e.g. Global ICFG node)\n",
    "- Get the SVFStmt associated with a certain node\n",
    "- Downcast the ICFGNode/Edge to a specific type (e.g. CallICFGNode)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "f374919610ff5f0a",
   "metadata": {
    "ExecuteTime": {
     "end_time": "2025-03-30T08:22:24.033029Z",
     "start_time": "2025-03-30T08:22:24.014398Z"
    },
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "GlobalICFGNode0\n",
      "CopyStmt: [Var1 <-- Var0]\t\n",
      "ConstNullPtrValVar ID: 0\n",
      " ptr null { constant data }\n",
      "AddrStmt: [Var5 <-- Var6]\t\n",
      "ConstIntValVar ID: 5\n",
      " i8 37 { constant data }\n",
      "AddrStmt: [Var7 <-- Var8]\t\n",
      "ConstIntValVar ID: 7\n",
      " i8 100 { constant data }\n",
      "AddrStmt: [Var9 <-- Var10]\t\n",
      "ConstIntValVar ID: 9\n",
      " i8 10 { constant data }\n",
      "AddrStmt: [Var11 <-- Var12]\t\n",
      "ConstIntValVar ID: 11\n",
      " i8 0 { constant data }\n",
      "AddrStmt: [Var48 <-- Var49]\t\n",
      "ConstIntValVar ID: 48\n",
      " i32 3 { constant data }\n",
      "AddrStmt: [Var45 <-- Var46]\t\n",
      "ConstIntValVar ID: 45\n",
      " i64 1 { constant data }\n",
      "AddrStmt: [Var42 <-- Var43]\t\n",
      "ConstIntValVar ID: 42\n",
      " i32 5 { constant data }\n",
      "AddrStmt: [Var39 <-- Var40]\t\n",
      "ConstIntValVar ID: 39\n",
      " i64 0 { constant data }\n",
      "AddrStmt: [Var55 <-- Var56]\t\n",
      "ConstIntValVar ID: 55\n",
      " i32 1 { constant data }\n",
      "AddrStmt: [Var21 <-- Var22]\t\n",
      "ConstIntValVar ID: 21\n",
      " i32 0 { constant data }\n",
      "AddrStmt: [Var60 <-- Var61]\t\n",
      "ConstIntValVar ID: 60\n",
      " i1 false { constant data }\n",
      "AddrStmt: [Var36 <-- Var37]\t\n",
      "ConstIntValVar ID: 36\n",
      " i64 8 { constant data }\n",
      "AddrStmt: [Var62 <-- Var63]\t\n",
      "ConstIntValVar ID: 62\n",
      " i1 true { constant data }\n",
      "AddrStmt: [Var4 <-- Var13]\t\n",
      "GlobalValVar ID: 4\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }\n",
      "GepStmt: [Var86 <-- Var4]\t\n",
      "GlobalValVar ID: 4\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }\n",
      "StoreStmt: [Var86 <-- Var5]\t\n",
      "ConstIntValVar ID: 5\n",
      " i8 37 { constant data }\n",
      "GepStmt: [Var87 <-- Var4]\t\n",
      "GlobalValVar ID: 4\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }\n",
      "StoreStmt: [Var87 <-- Var7]\t\n",
      "ConstIntValVar ID: 7\n",
      " i8 100 { constant data }\n",
      "GepStmt: [Var88 <-- Var4]\t\n",
      "GlobalValVar ID: 4\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }\n",
      "StoreStmt: [Var88 <-- Var9]\t\n",
      "ConstIntValVar ID: 9\n",
      " i8 10 { constant data }\n",
      "GepStmt: [Var89 <-- Var4]\t\n",
      "GlobalValVar ID: 4\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }\n",
      "StoreStmt: [Var89 <-- Var11]\t\n",
      "ConstIntValVar ID: 11\n",
      " i8 0 { constant data }\n",
      "AddrStmt: [Var14 <-- Var15]\t\n",
      "FunValVar ID: 14\n",
      "add_or_sub\n",
      "AddrStmt: [Var31 <-- Var32]\t\n",
      "FunValVar ID: 31\n",
      "main\n",
      "AddrStmt: [Var67 <-- Var68]\t\n",
      "FunValVar ID: 67\n",
      "__memcpy_chk\n",
      "AddrStmt: [Var64 <-- Var65]\t\n",
      "FunValVar ID: 64\n",
      "llvm.objectsize.i64.p0\n",
      "AddrStmt: [Var70 <-- Var71]\t\n",
      "FunValVar ID: 70\n",
      "printf\n",
      "\n",
      "FunEntryICFGNode1 {fun: add_or_sub}\n",
      "\n",
      "FunExitICFGNode2 {fun: add_or_sub}\n",
      "PhiStmt: [Var16 <-- ([Var29, ICFGNode12],)]\t\n",
      "ValVar ID: 30\n",
      "   ret i32 %result.0 \n",
      "\n",
      "FunEntryICFGNode3 {fun: main}\n",
      "\n",
      "FunExitICFGNode4 {fun: main}\n",
      "PhiStmt: [Var33 <-- ([Var21, ICFGNode31],)]\t\n",
      "ValVar ID: 72\n",
      "   ret i32 0 \n",
      "\n",
      "IntraICFGNode5 {fun: add_or_sub}\n",
      "CmpStmt: [Var20 <-- (Var19 predicate33 Var21)]\t\n",
      "ValVar ID: 20\n",
      "   %tobool = icmp ne i32 %flag, 0 \n",
      "\n",
      "IntraICFGNode6 {fun: add_or_sub}\n",
      "BranchStmt: [Condition Var20]\n",
      "Successor 0 ICFGNode7   Successor 1 ICFGNode8   \n",
      "ValVar ID: 23\n",
      "   br i1 %tobool, label %if.then, label %if.else \n",
      "\n",
      "IntraICFGNode7 {fun: add_or_sub}\n",
      "BinaryOPStmt: [Var24 <-- (Var17 opcode13 Var18)]\t\n",
      "ValVar ID: 24\n",
      "   %add = add nsw i32 %a, %b \n",
      "\n",
      "IntraICFGNode8 {fun: add_or_sub}\n",
      "BinaryOPStmt: [Var27 <-- (Var17 opcode15 Var18)]\t\n",
      "ValVar ID: 27\n",
      "   %sub = sub nsw i32 %a, %b \n",
      "\n",
      "IntraICFGNode9 {fun: add_or_sub}\n",
      "BranchStmt: [ Unconditional branch]\n",
      "Successor 0 ICFGNode11   \n",
      "ValVar ID: 25\n",
      "   br label %if.end \n",
      "\n",
      "IntraICFGNode10 {fun: add_or_sub}\n",
      "BranchStmt: [ Unconditional branch]\n",
      "Successor 0 ICFGNode11   \n",
      "ValVar ID: 28\n",
      "   br label %if.end \n",
      "\n",
      "IntraICFGNode11 {fun: add_or_sub}\n",
      "PhiStmt: [Var29 <-- ([Var24, ICFGNode9],[Var27, ICFGNode10],)]\t\n",
      "ValVar ID: 29\n",
      "   %result.0 = phi i32 [ %add, %if.then ], [ %sub, %if.else ] \n",
      "\n",
      "IntraICFGNode12 {fun: add_or_sub}\n",
      "   ret i32 %result.0 \n",
      "\n",
      "IntraICFGNode13 {fun: main}\n",
      "AddrStmt: [Var34 <-- Var35]\t\n",
      "ValVar ID: 34\n",
      "   %0 = alloca i8, i64 8, align 8 \n",
      "\n",
      "IntraICFGNode14 {fun: main}\n",
      "GepStmt: [Var38 <-- Var34]\t\n",
      "ValVar ID: 38\n",
      "   %arrayidx = getelementptr inbounds i32, ptr %0, i64 0 \n",
      "\n",
      "IntraICFGNode15 {fun: main}\n",
      "StoreStmt: [Var38 <-- Var42]\t\n",
      "ValVar ID: 41\n",
      "   store i32 5, ptr %arrayidx, align 4 \n",
      "\n",
      "IntraICFGNode16 {fun: main}\n",
      "GepStmt: [Var44 <-- Var34]\t\n",
      "ValVar ID: 44\n",
      "   %arrayidx1 = getelementptr inbounds i32, ptr %0, i64 1 \n",
      "\n",
      "IntraICFGNode17 {fun: main}\n",
      "StoreStmt: [Var44 <-- Var48]\t\n",
      "ValVar ID: 47\n",
      "   store i32 3, ptr %arrayidx1, align 4 \n",
      "\n",
      "IntraICFGNode18 {fun: main}\n",
      "GepStmt: [Var50 <-- Var34]\t\n",
      "ValVar ID: 50\n",
      "   %arrayidx2 = getelementptr inbounds i32, ptr %0, i64 0 \n",
      "\n",
      "IntraICFGNode19 {fun: main}\n",
      "LoadStmt: [Var51 <-- Var50]\t\n",
      "ValVar ID: 51\n",
      "   %1 = load i32, ptr %arrayidx2, align 4 \n",
      "\n",
      "IntraICFGNode20 {fun: main}\n",
      "GepStmt: [Var52 <-- Var34]\t\n",
      "ValVar ID: 52\n",
      "   %arrayidx3 = getelementptr inbounds i32, ptr %0, i64 1 \n",
      "\n",
      "IntraICFGNode21 {fun: main}\n",
      "LoadStmt: [Var53 <-- Var52]\t\n",
      "ValVar ID: 53\n",
      "   %2 = load i32, ptr %arrayidx3, align 4 \n",
      "\n",
      "CallICFGNode22 {fun: main}\n",
      "CallPE: [Var17 <-- Var51]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var18 <-- Var53]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var19 <-- Var55]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "\n",
      "RetICFGNode23 {fun: main}\n",
      "RetPE: [Var54 <-- Var16]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "\n",
      "IntraICFGNode24 {fun: main}\n",
      "AddrStmt: [Var57 <-- Var58]\t\n",
      "ValVar ID: 57\n",
      "   %3 = alloca i8, i64 8, align 8 \n",
      "\n",
      "CallICFGNode25 {fun: main}\n",
      "   %4 = call i64 @llvm.objectsize.i64.p0(ptr %3, i1 false, i1 true, i1 false) CallICFGNode: \n",
      "\n",
      "RetICFGNode26 {fun: main}\n",
      "   %4 = call i64 @llvm.objectsize.i64.p0(ptr %3, i1 false, i1 true, i1 false) RetICFGNode: \n",
      "\n",
      "CallICFGNode27 {fun: main}\n",
      "GepStmt: [Var90 <-- Var57]\t\n",
      "ValVar ID: 66\n",
      "   %call4 = call ptr @__memcpy_chk(ptr noundef %3, ptr noundef %0, i64 noundef 8, i64 noundef %4) #4 \n",
      "GepStmt: [Var91 <-- Var34]\t\n",
      "ValVar ID: 66\n",
      "   %call4 = call ptr @__memcpy_chk(ptr noundef %3, ptr noundef %0, i64 noundef 8, i64 noundef %4) #4 \n",
      "LoadStmt: [Var92 <-- Var91]\t\n",
      "ValVar ID: 66\n",
      "   %call4 = call ptr @__memcpy_chk(ptr noundef %3, ptr noundef %0, i64 noundef 8, i64 noundef %4) #4 \n",
      "StoreStmt: [Var90 <-- Var92]\t\n",
      "ValVar ID: 66\n",
      "   %call4 = call ptr @__memcpy_chk(ptr noundef %3, ptr noundef %0, i64 noundef 8, i64 noundef %4) #4 \n",
      "CopyStmt: [Var66 <-- Var57]\t\n",
      "ValVar ID: 66\n",
      "   %call4 = call ptr @__memcpy_chk(ptr noundef %3, ptr noundef %0, i64 noundef 8, i64 noundef %4) #4 \n",
      "\n",
      "RetICFGNode28 {fun: main}\n",
      "   %call4 = call ptr @__memcpy_chk(ptr noundef %3, ptr noundef %0, i64 noundef 8, i64 noundef %4) #4 RetICFGNode: \n",
      "\n",
      "CallICFGNode29 {fun: main}\n",
      "   %call5 = call i32 (ptr, ...) @printf(ptr noundef @.str, i32 noundef %call) CallICFGNode: \n",
      "\n",
      "RetICFGNode30 {fun: main}\n",
      "   %call5 = call i32 (ptr, ...) @printf(ptr noundef @.str, i32 noundef %call) RetICFGNode: \n",
      "\n",
      "IntraICFGNode31 {fun: main}\n",
      "   ret i32 0 \n"
     ]
    }
   ],
   "source": [
    "for node in cfg.getNodes():\n",
    "    print(node)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "10ca8f4ba03308ce",
   "metadata": {
    "collapsed": false
   },
   "source": [
    "From the output above, we can see the list of ICFG nodes in the program, along with their unique identifiers and function names. This information provides insights into the structure of the program and the control flow between different functions. And we can also dump the ICFG to a file and visualize it using graph visualization tools like Graphviz.\n",
    "\n",
    "#### Visualizing the ICFG\n",
    "\n",
    "To visualize the ICFG, we can use the `graphviz` library to generate a graphical representation of the control flow between functions. The `dump` function of the ICFG class generates a DOT file that can be rendered using Graphviz.\n",
    "\n",
    "![Alt text](icfgdot.png)\n",
    "\n",
    "\n",
    "### Exploring the ICFG\n",
    "\n",
    "Now that we have loaded the ICFG and visualized it, we can explore the control flow between functions and perform various analyses on the program's structure. We can analyze the call graph, identify function dependencies, and detect potential issues in the control flow.\n",
    "\n",
    "#### ICFGNode\n",
    "\n",
    "ICFGNode represents a node in the Interprocedural Control-Flow Graph (ICFG) and provides information about the function associated with the node, its successors, and predecessors. ICFGNode has several subtypes, such as CallICFGNode, RetICFGNode, and IntraICFGNode, FunEntryICFGNode, FunExitICFGNode which represent different kinds of control flow edges between functions.\n",
    "\n",
    "If you want to use apis in subclass, you need to downcast the ICFGNode to the specific type.\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "b22902185c9bf9c5",
   "metadata": {
    "ExecuteTime": {
     "end_time": "2025-03-30T08:22:27.845115Z",
     "start_time": "2025-03-30T08:22:27.841643Z"
    },
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "FunObjVar ID: 15 (base object)\n",
      "add_or_sub\n",
      "CallICFGNode22 {fun: main}\n",
      "CallPE: [Var17 <-- Var51]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var18 <-- Var53]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var19 <-- Var55]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "\n",
      "FunObjVar ID: 65 (base object)\n",
      "llvm.objectsize.i64.p0\n",
      "CallICFGNode25 {fun: main}\n",
      "   %4 = call i64 @llvm.objectsize.i64.p0(ptr %3, i1 false, i1 true, i1 false) CallICFGNode: \n",
      "\n",
      "FunObjVar ID: 68 (base object)\n",
      "__memcpy_chk\n",
      "CallICFGNode27 {fun: main}\n",
      "GepStmt: [Var90 <-- Var57]\t\n",
      "ValVar ID: 66\n",
      "   %call4 = call ptr @__memcpy_chk(ptr noundef %3, ptr noundef %0, i64 noundef 8, i64 noundef %4) #4 \n",
      "GepStmt: [Var91 <-- Var34]\t\n",
      "ValVar ID: 66\n",
      "   %call4 = call ptr @__memcpy_chk(ptr noundef %3, ptr noundef %0, i64 noundef 8, i64 noundef %4) #4 \n",
      "LoadStmt: [Var92 <-- Var91]\t\n",
      "ValVar ID: 66\n",
      "   %call4 = call ptr @__memcpy_chk(ptr noundef %3, ptr noundef %0, i64 noundef 8, i64 noundef %4) #4 \n",
      "StoreStmt: [Var90 <-- Var92]\t\n",
      "ValVar ID: 66\n",
      "   %call4 = call ptr @__memcpy_chk(ptr noundef %3, ptr noundef %0, i64 noundef 8, i64 noundef %4) #4 \n",
      "CopyStmt: [Var66 <-- Var57]\t\n",
      "ValVar ID: 66\n",
      "   %call4 = call ptr @__memcpy_chk(ptr noundef %3, ptr noundef %0, i64 noundef 8, i64 noundef %4) #4 \n",
      "\n",
      "FunObjVar ID: 71 (base object)\n",
      "printf\n",
      "CallICFGNode29 {fun: main}\n",
      "   %call5 = call i32 (ptr, ...) @printf(ptr noundef @.str, i32 noundef %call) CallICFGNode: \n"
     ]
    }
   ],
   "source": [
    "for node in cfg.getNodes():\n",
    "    if isinstance(node, pysvf.CallICFGNode):\n",
    "        call_node = node.asCall()\n",
    "        print(call_node.getCalledFunction()) # This function can only be called on CallICFGNode, which can get the called function obj var\n",
    "    elif isinstance(node, pysvf.RetICFGNode):\n",
    "        ret_node = node.asRet()\n",
    "        print(ret_node.getCallICFGNode()) # This function can only be called on RetICFGNode,which can get the corresponding call node \n",
    "    elif isinstance(node, pysvf.FunEntryICFGNode):\n",
    "        funentry_node = node.asFunEntry()\n",
    "    elif isinstance(node, pysvf.FunExitICFGNode):\n",
    "        funexit_node = node.asFunExit()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The above code snippet demonstrates how to downcast an ICFGEdge to a specific subtype and access the associated information. By analyzing the ICFG nodes and edges, we can gain insights into the control flow between functions and identify potential issues in the program's structure.\n",
    "\n",
    "### SVF Statements (SVFStmt) under ICFGNode\n",
    "\n",
    "Each ICFGNode is associated with a set of SVF statements that represent the program's behavior at that point. By analyzing these SVF statements, we can understand the data flow and value propagation within the program, which is essential for optimizing compilers and detecting potential vulnerabilities.\n",
    "\n",
    "We have following SVF statements:\n",
    "\n",
    "| Class Name       | Method Name                          | Description                                      |\n",
    "|------------------|--------------------------------------|--------------------------------------------------|\n",
    "| `SVFStmt`        | `toString`                           | Get the string representation of the SVF statement |\n",
    "|                  | `getEdgeId`                          | Get the ID of the SVF statement                  |\n",
    "|                  | `getICFGNode`                        | Get the ICFG node that the SVF statement belongs to |\n",
    "|                  | `getValue`                           | Get the value of the SVF statement               |\n",
    "|                  | `getBB`                              | Get the basic block that the SVF statement belongs to |\n",
    "|                  | `isAddrStmt`                         | Check if the SVF statement is an address statement |\n",
    "|                  | `isCopyStmt`                         | Check if the SVF statement is a copy statement   |\n",
    "|                  | `isStoreStmt`                        | Check if the SVF statement is a store statement  |\n",
    "|                  | `isLoadStmt`                         | Check if the SVF statement is a load statement   |\n",
    "|                  | `isCallPE`                           | Check if the SVF statement is a call PE          |\n",
    "|                  | `isRetPE`                            | Check if the SVF statement is a return PE        |\n",
    "|                  | `isGepStmt`                          | Check if the SVF statement is a GEP statement    |\n",
    "|                  | `isPhiStmt`                          | Check if the SVF statement is a phi statement    |\n",
    "|                  | `isSelectStmt`                       | Check if the SVF statement is a select statement |\n",
    "|                  | `isCmpStmt`                          | Check if the SVF statement is a compare statement |\n",
    "|                  | `isBinaryOpStmt`                     | Check if the SVF statement is a binary operation statement |\n",
    "|                  | `isUnaryOpStmt`                      | Check if the SVF statement is a unary operation statement |\n",
    "|                  | `isBranchStmt`                       | Check if the SVF statement is a branch statement |\n",
    "|                  | `asAddrStmt`                         | Downcast the SVF statement to an address statement |\n",
    "|                  | `asCopyStmt`                         | Downcast the SVF statement to a copy statement   |\n",
    "|                  | `asStoreStmt`                        | Downcast the SVF statement to a store statement  |\n",
    "|                  | `asLoadStmt`                         | Downcast the SVF statement to a load statement   |\n",
    "|                  | `asCallPE`                           | Downcast the SVF statement to a call PE          |\n",
    "|                  | `asRetPE`                            | Downcast the SVF statement to a return PE        |\n",
    "|                  | `asGepStmt`                          | Downcast the SVF statement to a GEP statement    |\n",
    "|                  | `asPhiStmt`                          | Downcast the SVF statement to a phi statement    |\n",
    "|                  | `asSelectStmt`                       | Downcast the SVF statement to a select statement |\n",
    "|                  | `asCmpStmt`                          | Downcast the SVF statement to a compare statement |\n",
    "|                  | `asBinaryOpStmt`                     | Downcast the SVF statement to a binary operation statement |\n",
    "|                  | `asUnaryOpStmt`                      | Downcast the SVF statement to a unary operation statement |\n",
    "|                  | `asBranchStmt`                       | Downcast the SVF statement to a branch statement |\n",
    "| `AddrStmt`       | `getLHSVar`                          | Get the LHS variable of the address statement    |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the address statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the address statement    |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the address statement |\n",
    "|                  | `getArrSize`                         | Get the array size of the address statement      |\n",
    "| `CopyStmt`       | `getLHSVar`                          | Get the LHS variable of the copy statement       |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the copy statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the copy statement       |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the copy statement |\n",
    "| `StoreStmt`      | `getLHSVar`                          | Get the LHS variable of the store statement      |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the store statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the store statement      |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the store statement |\n",
    "| `LoadStmt`       | `getLHSVar`                          | Get the LHS variable of the load statement       |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the load statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the load statement       |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the load statement |\n",
    "| `CallPE`         | `getCallSite`                        | Get the call site                                |\n",
    "|                  | `getLHSVar`                          | Get the LHS variable of the call PE              |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the call PE    |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the call PE              |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the call PE    |\n",
    "|                  | `getFunEntryICFGNode`                | Get the function entry ICFG node                 |\n",
    "| `RetPE`          | `getCallSite`                        | Get the call site                                |\n",
    "|                  | `getLHSVar`                          | Get the LHS variable of the return PE            |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the return PE  |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the return PE            |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the return PE  |\n",
    "|                  | `getFunExitICFGNode`                 | Get the function exit ICFG node                  |\n",
    "| `GepStmt`        | `getLHSVar`                          | Get the LHS variable of the GEP statement        |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the GEP statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the GEP statement        |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the GEP statement |\n",
    "|                  | `isConstantOffset`                   | Check if the GEP statement has a constant offset |\n",
    "|                  | `getConstantOffset`                  | Get the constant offset                          |\n",
    "|                  | `getConstantByteOffset`              | Get the constant byte offset                     |\n",
    "|                  | `getConstantStructFldIdx`            | Get the constant struct field index              |\n",
    "|                  | `getOffsetVarAndGepTypePairVec`      | Get the offset variable and GEP type pair vector |\n",
    "|                  | `getSrcPointeeType`                  | Get the source pointee type                      |\n",
    "| `PhiStmt`        | `getRes`                             | Get the result variable                          |\n",
    "|                  | `getResId`                           | Get the ID of the result variable                |\n",
    "|                  | `getOpVar`                           | Get the operand variable                         |\n",
    "|                  | `getOpICFGNode`                      | Get the operand ICFG node                        |\n",
    "|                  | `getOpVarNum`                        | Get the number of operand variables              |\n",
    "| `CmpStmt`        | `getPredicate`                       | Get the predicate                                |\n",
    "|                  | `getRes`                             | Get the result variable                          |\n",
    "|                  | `getResId`                           | Get the ID of the result variable                |\n",
    "|                  | `getOpVar`                           | Get the operand variable                         |\n",
    "|                  | `getOpVarNum`                        | Get the number of operands of the compare statement |\n",
    "| `BinaryOPStmt`   | `getOpcode`                          | Get the opcode                                   |\n",
    "|                  | `getRes`                             | Get the result variable                          |\n",
    "|                  | `getResId`                           | Get the ID of the result variable                |\n",
    "|                  | `getOpVar`                           | Get the operand variable                         |\n",
    "| `UnaryOPStmt`    | `getOp`                              | Get the opcode                                   |\n",
    "|                  | `getRes`                             | Get the result variable                          |\n",
    "|                  | `getResVar`                          | Get the result variable                          |\n",
    "|                  | `getResId`                           | Get the ID of the result variable                |\n",
    "|                  | `getOpVar`                           | Get the operand variable                         |\n",
    "|                  | `getOpVarId`                         | Get the ID of the operand variable               |\n",
    "| `BranchStmt`     | `getSuccessors`                      | Get the successors of the branch statement       |\n",
    "|                  | `getNumSuccessors`                   | Get the number of successors                     |\n",
    "|                  | `isConditional`                      | Check if the branch statement is conditional     |\n",
    "|                  | `isUnconditional`                    | Check if the branch statement is unconditional   |\n",
    "|                  | `getCondition`                       | Get the condition variable                       |\n",
    "|                  | `getBranchInst`                      | Get the branch instruction                       |\n",
    "\n",
    "From the other document [SVFIR](SVFIR.ipynb) (PAG), we know the definitions of these SVF statements. We can use these SVF statements to analyze the data flow and value propagation within the program, which is essential for optimizing compilers and detecting potential vulnerabilities.\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "0274f106",
   "metadata": {},
   "source": [
    " structure.\n",
    "\n",
    "### SVF Statements (SVFStmt) under ICFGNode\n",
    "\n",
    "Each ICFGNode is associated with a set of SVF statements that represent the program's behavior at that point. By analyzing these SVF statements, we can understand the data flow and value propagation within the program, which is essential for optimizing compilers and detecting potential vulnerabilities.\n",
    "\n",
    "We have following SVF statements:\n",
    "\n",
    "| Class Name       | Method Name                          | Description                                      |\n",
    "|------------------|--------------------------------------|--------------------------------------------------|\n",
    "| `SVFStmt`        | `toString`                           | Get the string representation of the SVF statement |\n",
    "|                  | `getEdgeId`                          | Get the ID of the SVF statement                  |\n",
    "|                  | `getICFGNode`                        | Get the ICFG node that the SVF statement belongs to |\n",
    "|                  | `getValue`                           | Get the value of the SVF statement               |\n",
    "|                  | `getBB`                              | Get the basic block that the SVF statement belongs to |\n",
    "|                  | `isAddrStmt`                         | Check if the SVF statement is an address statement |\n",
    "|                  | `isCopyStmt`                         | Check if the SVF statement is a copy statement   |\n",
    "|                  | `isStoreStmt`                        | Check if the SVF statement is a store statement  |\n",
    "|                  | `isLoadStmt`                         | Check if the SVF statement is a load statement   |\n",
    "|                  | `isCallPE`                           | Check if the SVF statement is a call PE          |\n",
    "|                  | `isRetPE`                            | Check if the SVF statement is a return PE        |\n",
    "|                  | `isGepStmt`                          | Check if the SVF statement is a GEP statement    |\n",
    "|                  | `isPhiStmt`                          | Check if the SVF statement is a phi statement    |\n",
    "|                  | `isSelectStmt`                       | Check if the SVF statement is a select statement |\n",
    "|                  | `isCmpStmt`                          | Check if the SVF statement is a compare statement |\n",
    "|                  | `isBinaryOpStmt`                     | Check if the SVF statement is a binary operation statement |\n",
    "|                  | `isUnaryOpStmt`                      | Check if the SVF statement is a unary operation statement |\n",
    "|                  | `isBranchStmt`                       | Check if the SVF statement is a branch statement |\n",
    "|                  | `asAddrStmt`                         | Downcast the SVF statement to an address statement |\n",
    "|                  | `asCopyStmt`                         | Downcast the SVF statement to a copy statement   |\n",
    "|                  | `asStoreStmt`                        | Downcast the SVF statement to a store statement  |\n",
    "|                  | `asLoadStmt`                         | Downcast the SVF statement to a load statement   |\n",
    "|                  | `asCallPE`                           | Downcast the SVF statement to a call PE          |\n",
    "|                  | `asRetPE`                            | Downcast the SVF statement to a return PE        |\n",
    "|                  | `asGepStmt`                          | Downcast the SVF statement to a GEP statement    |\n",
    "|                  | `asPhiStmt`                          | Downcast the SVF statement to a phi statement    |\n",
    "|                  | `asSelectStmt`                       | Downcast the SVF statement to a select statement |\n",
    "|                  | `asCmpStmt`                          | Downcast the SVF statement to a compare statement |\n",
    "|                  | `asBinaryOpStmt`                     | Downcast the SVF statement to a binary operation statement |\n",
    "|                  | `asUnaryOpStmt`                      | Downcast the SVF statement to a unary operation statement |\n",
    "|                  | `asBranchStmt`                       | Downcast the SVF statement to a branch statement |\n",
    "| `AddrStmt`       | `getLHSVar`                          | Get the LHS variable of the address statement    |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the address statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the address statement    |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the address statement |\n",
    "|                  | `getArrSize`                         | Get the array size of the address statement      |\n",
    "| `CopyStmt`       | `getLHSVar`                          | Get the LHS variable of the copy statement       |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the copy statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the copy statement       |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the copy statement |\n",
    "| `StoreStmt`      | `getLHSVar`                          | Get the LHS variable of the store statement      |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the store statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the store statement      |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the store statement |\n",
    "| `LoadStmt`       | `getLHSVar`                          | Get the LHS variable of the load statement       |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the load statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the load statement       |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the load statement |\n",
    "| `CallPE`         | `getCallSite`                        | Get the call site                                |\n",
    "|                  | `getLHSVar`                          | Get the LHS variable of the call PE              |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the call PE    |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the call PE              |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the call PE    |\n",
    "|                  | `getFunEntryICFGNode`                | Get the function entry ICFG node                 |\n",
    "| `RetPE`          | `getCallSite`                        | Get the call site                                |\n",
    "|                  | `getLHSVar`                          | Get the LHS variable of the return PE            |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the return PE  |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the return PE            |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the return PE  |\n",
    "|                  | `getFunExitICFGNode`                 | Get the function exit ICFG node                  |\n",
    "| `GepStmt`        | `getLHSVar`                          | Get the LHS variable of the GEP statement        |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the GEP statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the GEP statement        |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the GEP statement |\n",
    "|                  | `isConstantOffset`                   | Check if the GEP statement has a constant offset |\n",
    "|                  | `getConstantOffset`                  | Get the constant offset                          |\n",
    "|                  | `getConstantByteOffset`              | Get the constant byte offset                     |\n",
    "|                  | `getConstantStructFldIdx`            | Get the constant struct field index              |\n",
    "|                  | `getOffsetVarAndGepTypePairVec`      | Get the offset variable and GEP type pair vector |\n",
    "|                  | `getSrcPointeeType`                  | Get the source pointee type                      |\n",
    "| `PhiStmt`        | `getRes`                             | Get the result variable                          |\n",
    "|                  | `getResId`                           | Get the ID of the result variable                |\n",
    "|                  | `getOpVar`                           | Get the operand variable                         |\n",
    "|                  | `getOpICFGNode`                      | Get the operand ICFG node                        |\n",
    "|                  | `getOpVarNum`                        | Get the number of operand variables              |\n",
    "| `CmpStmt`        | `getPredicate`                       | Get the predicate                                |\n",
    "|                  | `getRes`                             | Get the result variable                          |\n",
    "|                  | `getResId`                           | Get the ID of the result variable                |\n",
    "|                  | `getOpVar`                           | Get the operand variable                         |\n",
    "|                  | `getOpVarNum`                        | Get the number of operands of the compare statement |\n",
    "| `BinaryOPStmt`   | `getOpcode`                          | Get the opcode                                   |\n",
    "|                  | `getRes`                             | Get the result variable                          |\n",
    "|                  | `getResId`                           | Get the ID of the result variable                |\n",
    "|                  | `getOpVar`                           | Get the operand variable                         |\n",
    "| `UnaryOPStmt`    | `getOp`                              | Get the opcode                                   |\n",
    "|                  | `getRes`                             | Get the result variable                          |\n",
    "|                  | `getResVar`                          | Get the result variable                          |\n",
    "|                  | `getResId`                           | Get the ID of the result variable                |\n",
    "|                  | `getOpVar`                           | Get the operand variable                         |\n",
    "|                  | `getOpVarId`                         | Get the ID of the operand variable               |\n",
    "| `BranchStmt`     | `getSuccessors`                      | Get the successors of the branch statement       |\n",
    "|                  | `getNumSuccessors`                   | Get the number of successors                     |\n",
    "|                  | `isConditional`                      | Check if the branch statement is conditional     |\n",
    "|                  | `isUnconditional`                    | Check if the branch statement is unconditional   |\n",
    "|                  | `getCondition`                       | Get the condition variable                       |\n",
    "|                  | `getBranchInst`                      | Get the branch instruction                       |\n",
    "\n",
    "From the other document [SVFIR](SVFIR.ipynb) (PAG), we know the definitions of these SVF statements. We can use these SVF statements to analyze the data flow and value propagation within the program, which is essential for optimizing compilers and detecting potential vulnerabilities.\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "384c66161134d1e4",
   "metadata": {
    "ExecuteTime": {
     "end_time": "2025-03-30T08:22:31.576356Z",
     "start_time": "2025-03-30T08:22:31.570984Z"
    },
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CallICFGNode22 {fun: main}\n",
      "CallPE: [Var17 <-- Var51]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var18 <-- Var53]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var19 <-- Var55]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "\n",
      "CallICFGNode22 {fun: main}\n",
      "CallPE: [Var17 <-- Var51]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var18 <-- Var53]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var19 <-- Var55]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n"
     ]
    }
   ],
   "source": [
    "for node in cfg.getNodes():\n",
    "    for edge in node.getOutEdges():\n",
    "        if isinstance(edge, pysvf.CallCFGEdge):\n",
    "            call_edge = edge.asCallCFGEdge()\n",
    "            print(call_edge.getCallSite()) # This function can only be called on CallICFGEdge, which can get the call icfg node corresponding to the call edge\n",
    "        elif isinstance(edge, pysvf.RetCFGEdge):\n",
    "            ret_edge = edge.asRetCFGEdge()\n",
    "            print(ret_edge.getCallSite()) # This function can only be called on RetICFGEdge, which can get the call icfg node corresponding to the return edge"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2005c168f7811d6d",
   "metadata": {
    "collapsed": false
   },
   "source": [
    "\n",
    "\n",
    "The above code snippet demonstrates how to downcast an ICFGEdge to a specific subtype and access the associated information. By analyzing the ICFG nodes and edges, we can gain insights into the control flow between functions and identify potential issues in the program's structure.\n",
    "\n",
    "### SVF Statements (SVFStmt) under ICFGNode\n",
    "\n",
    "Each ICFGNode is associated with a set of SVF statements that represent the program's behavior at that point. By analyzing these SVF statements, we can understand the data flow and value propagation within the program, which is essential for optimizing compilers and detecting potential vulnerabilities.\n",
    "\n",
    "We have following SVF statements:\n",
    "\n",
    "| Class Name       | Method Name                          | Description                                      |\n",
    "|------------------|--------------------------------------|--------------------------------------------------|\n",
    "| `SVFStmt`        | `toString`                           | Get the string representation of the SVF statement |\n",
    "|                  | `getEdgeId`                          | Get the ID of the SVF statement                  |\n",
    "|                  | `getICFGNode`                        | Get the ICFG node that the SVF statement belongs to |\n",
    "|                  | `getValue`                           | Get the value of the SVF statement               |\n",
    "|                  | `getBB`                              | Get the basic block that the SVF statement belongs to |\n",
    "|                  | `isAddrStmt`                         | Check if the SVF statement is an address statement |\n",
    "|                  | `isCopyStmt`                         | Check if the SVF statement is a copy statement   |\n",
    "|                  | `isStoreStmt`                        | Check if the SVF statement is a store statement  |\n",
    "|                  | `isLoadStmt`                         | Check if the SVF statement is a load statement   |\n",
    "|                  | `isCallPE`                           | Check if the SVF statement is a call PE          |\n",
    "|                  | `isRetPE`                            | Check if the SVF statement is a return PE        |\n",
    "|                  | `isGepStmt`                          | Check if the SVF statement is a GEP statement    |\n",
    "|                  | `isPhiStmt`                          | Check if the SVF statement is a phi statement    |\n",
    "|                  | `isSelectStmt`                       | Check if the SVF statement is a select statement |\n",
    "|                  | `isCmpStmt`                          | Check if the SVF statement is a compare statement |\n",
    "|                  | `isBinaryOpStmt`                     | Check if the SVF statement is a binary operation statement |\n",
    "|                  | `isUnaryOpStmt`                      | Check if the SVF statement is a unary operation statement |\n",
    "|                  | `isBranchStmt`                       | Check if the SVF statement is a branch statement |\n",
    "|                  | `asAddrStmt`                         | Downcast the SVF statement to an address statement |\n",
    "|                  | `asCopyStmt`                         | Downcast the SVF statement to a copy statement   |\n",
    "|                  | `asStoreStmt`                        | Downcast the SVF statement to a store statement  |\n",
    "|                  | `asLoadStmt`                         | Downcast the SVF statement to a load statement   |\n",
    "|                  | `asCallPE`                           | Downcast the SVF statement to a call PE          |\n",
    "|                  | `asRetPE`                            | Downcast the SVF statement to a return PE        |\n",
    "|                  | `asGepStmt`                          | Downcast the SVF statement to a GEP statement    |\n",
    "|                  | `asPhiStmt`                          | Downcast the SVF statement to a phi statement    |\n",
    "|                  | `asSelectStmt`                       | Downcast the SVF statement to a select statement |\n",
    "|                  | `asCmpStmt`                          | Downcast the SVF statement to a compare statement |\n",
    "|                  | `asBinaryOpStmt`                     | Downcast the SVF statement to a binary operation statement |\n",
    "|                  | `asUnaryOpStmt`                      | Downcast the SVF statement to a unary operation statement |\n",
    "|                  | `asBranchStmt`                       | Downcast the SVF statement to a branch statement |\n",
    "| `AddrStmt`       | `getLHSVar`                          | Get the LHS variable of the address statement    |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the address statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the address statement    |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the address statement |\n",
    "|                  | `getArrSize`                         | Get the array size of the address statement      |\n",
    "| `CopyStmt`       | `getLHSVar`                          | Get the LHS variable of the copy statement       |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the copy statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the copy statement       |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the copy statement |\n",
    "| `StoreStmt`      | `getLHSVar`                          | Get the LHS variable of the store statement      |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the store statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the store statement      |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the store statement |\n",
    "| `LoadStmt`       | `getLHSVar`                          | Get the LHS variable of the load statement       |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the load statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the load statement       |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the load statement |\n",
    "| `CallPE`         | `getCallSite`                        | Get the call site                                |\n",
    "|                  | `getLHSVar`                          | Get the LHS variable of the call PE              |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the call PE    |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the call PE              |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the call PE    |\n",
    "|                  | `getFunEntryICFGNode`                | Get the function entry ICFG node                 |\n",
    "| `RetPE`          | `getCallSite`                        | Get the call site                                |\n",
    "|                  | `getLHSVar`                          | Get the LHS variable of the return PE            |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the return PE  |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the return PE            |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the return PE  |\n",
    "|                  | `getFunExitICFGNode`                 | Get the function exit ICFG node                  |\n",
    "| `GepStmt`        | `getLHSVar`                          | Get the LHS variable of the GEP statement        |\n",
    "|                  | `getLHSVarID`                        | Get the ID of the LHS variable of the GEP statement |\n",
    "|                  | `getRHSVar`                          | Get the RHS variable of the GEP statement        |\n",
    "|                  | `getRHSVarID`                        | Get the ID of the RHS variable of the GEP statement |\n",
    "|                  | `isConstantOffset`                   | Check if the GEP statement has a constant offset |\n",
    "|                  | `getConstantOffset`                  | Get the constant offset                          |\n",
    "|                  | `getConstantByteOffset`              | Get the constant byte offset                     |\n",
    "|                  | `getConstantStructFldIdx`            | Get the constant struct field index              |\n",
    "|                  | `getOffsetVarAndGepTypePairVec`      | Get the offset variable and GEP type pair vector |\n",
    "|                  | `getSrcPointeeType`                  | Get the source pointee type                      |\n",
    "| `PhiStmt`        | `getRes`                             | Get the result variable                          |\n",
    "|                  | `getResId`                           | Get the ID of the result variable                |\n",
    "|                  | `getOpVar`                           | Get the operand variable                         |\n",
    "|                  | `getOpICFGNode`                      | Get the operand ICFG node                        |\n",
    "|                  | `getOpVarNum`                        | Get the number of operand variables              |\n",
    "| `CmpStmt`        | `getPredicate`                       | Get the predicate                                |\n",
    "|                  | `getRes`                             | Get the result variable                          |\n",
    "|                  | `getResId`                           | Get the ID of the result variable                |\n",
    "|                  | `getOpVar`                           | Get the operand variable                         |\n",
    "|                  | `getOpVarNum`                        | Get the number of operands of the compare statement |\n",
    "| `BinaryOPStmt`   | `getOpcode`                          | Get the opcode                                   |\n",
    "|                  | `getRes`                             | Get the result variable                          |\n",
    "|                  | `getResId`                           | Get the ID of the result variable                |\n",
    "|                  | `getOpVar`                           | Get the operand variable                         |\n",
    "| `UnaryOPStmt`    | `getOp`                              | Get the opcode                                   |\n",
    "|                  | `getRes`                             | Get the result variable                          |\n",
    "|                  | `getResVar`                          | Get the result variable                          |\n",
    "|                  | `getResId`                           | Get the ID of the result variable                |\n",
    "|                  | `getOpVar`                           | Get the operand variable                         |\n",
    "|                  | `getOpVarId`                         | Get the ID of the operand variable               |\n",
    "| `BranchStmt`     | `getSuccessors`                      | Get the successors of the branch statement       |\n",
    "|                  | `getNumSuccessors`                   | Get the number of successors                     |\n",
    "|                  | `isConditional`                      | Check if the branch statement is conditional     |\n",
    "|                  | `isUnconditional`                    | Check if the branch statement is unconditional   |\n",
    "|                  | `getCondition`                       | Get the condition variable                       |\n",
    "|                  | `getBranchInst`                      | Get the branch instruction                       |\n",
    "\n",
    "From the other document [SVFIR](SVFIR.ipynb) (PAG), we know the definitions of these SVF statements. We can use these SVF statements to analyze the data flow and value propagation within the program, which is essential for optimizing compilers and detecting potential vulnerabilities.\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "bb63a3b530e525a2",
   "metadata": {
    "ExecuteTime": {
     "end_time": "2025-03-30T08:24:17.794092Z",
     "start_time": "2025-03-30T08:24:17.789167Z"
    },
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "CopyStmt: lhs_var=DummyValVar ID: 1, rhs_var=ConstNullPtrValVar ID: 0\n",
      " ptr null { constant data }\n",
      "AddrStmt: lhs_var=ConstIntValVar ID: 5\n",
      " i8 37 { constant data }, rhs_var=ConstIntObjVar ID: 6\n",
      " i8 37 { constant data }\n",
      "AddrStmt: lhs_var=ConstIntValVar ID: 7\n",
      " i8 100 { constant data }, rhs_var=ConstIntObjVar ID: 8\n",
      " i8 100 { constant data }\n",
      "AddrStmt: lhs_var=ConstIntValVar ID: 9\n",
      " i8 10 { constant data }, rhs_var=ConstIntObjVar ID: 10\n",
      " i8 10 { constant data }\n",
      "AddrStmt: lhs_var=ConstIntValVar ID: 11\n",
      " i8 0 { constant data }, rhs_var=ConstIntObjVar ID: 12\n",
      " i8 0 { constant data }\n",
      "AddrStmt: lhs_var=ConstIntValVar ID: 48\n",
      " i32 3 { constant data }, rhs_var=ConstIntObjVar ID: 49\n",
      " i32 3 { constant data }\n",
      "AddrStmt: lhs_var=ConstIntValVar ID: 45\n",
      " i64 1 { constant data }, rhs_var=ConstIntObjVar ID: 46\n",
      " i64 1 { constant data }\n",
      "AddrStmt: lhs_var=ConstIntValVar ID: 42\n",
      " i32 5 { constant data }, rhs_var=ConstIntObjVar ID: 43\n",
      " i32 5 { constant data }\n",
      "AddrStmt: lhs_var=ConstIntValVar ID: 39\n",
      " i64 0 { constant data }, rhs_var=ConstIntObjVar ID: 40\n",
      " i64 0 { constant data }\n",
      "AddrStmt: lhs_var=ConstIntValVar ID: 55\n",
      " i32 1 { constant data }, rhs_var=ConstIntObjVar ID: 56\n",
      " i32 1 { constant data }\n",
      "AddrStmt: lhs_var=ConstIntValVar ID: 21\n",
      " i32 0 { constant data }, rhs_var=ConstIntObjVar ID: 22\n",
      " i32 0 { constant data }\n",
      "AddrStmt: lhs_var=ConstIntValVar ID: 60\n",
      " i1 false { constant data }, rhs_var=ConstIntObjVar ID: 61\n",
      " i1 false { constant data }\n",
      "AddrStmt: lhs_var=ConstIntValVar ID: 36\n",
      " i64 8 { constant data }, rhs_var=ConstIntObjVar ID: 37\n",
      " i64 8 { constant data }\n",
      "AddrStmt: lhs_var=ConstIntValVar ID: 62\n",
      " i1 true { constant data }, rhs_var=ConstIntObjVar ID: 63\n",
      " i1 true { constant data }\n",
      "AddrStmt: lhs_var=GlobalValVar ID: 4\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }, rhs_var=GlobalObjVar ID: 13\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }\n",
      "GepStmt: lhs_var=GepValVar ID: 86 with offset_0\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }, rhs_var=GlobalValVar ID: 4\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }\n",
      "StoreStmt: lhs_var=GepValVar ID: 86 with offset_0\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }, rhs_var=ConstIntValVar ID: 5\n",
      " i8 37 { constant data }\n",
      "GepStmt: lhs_var=GepValVar ID: 87 with offset_1\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }, rhs_var=GlobalValVar ID: 4\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }\n",
      "StoreStmt: lhs_var=GepValVar ID: 87 with offset_1\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }, rhs_var=ConstIntValVar ID: 7\n",
      " i8 100 { constant data }\n",
      "GepStmt: lhs_var=GepValVar ID: 88 with offset_2\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }, rhs_var=GlobalValVar ID: 4\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }\n",
      "StoreStmt: lhs_var=GepValVar ID: 88 with offset_2\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }, rhs_var=ConstIntValVar ID: 9\n",
      " i8 10 { constant data }\n",
      "GepStmt: lhs_var=GepValVar ID: 89 with offset_3\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }, rhs_var=GlobalValVar ID: 4\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }\n",
      "StoreStmt: lhs_var=GepValVar ID: 89 with offset_3\n",
      " @.str = private unnamed_addr constant [4 x i8] c\"%d\\0A\\00\", align 1 { Glob  }, rhs_var=ConstIntValVar ID: 11\n",
      " i8 0 { constant data }\n",
      "AddrStmt: lhs_var=FunValVar ID: 14\n",
      "add_or_sub, rhs_var=FunObjVar ID: 15 (base object)\n",
      "add_or_sub\n",
      "AddrStmt: lhs_var=FunValVar ID: 31\n",
      "main, rhs_var=FunObjVar ID: 32 (base object)\n",
      "main\n",
      "AddrStmt: lhs_var=FunValVar ID: 67\n",
      "__memcpy_chk, rhs_var=FunObjVar ID: 68 (base object)\n",
      "__memcpy_chk\n",
      "AddrStmt: lhs_var=FunValVar ID: 64\n",
      "llvm.objectsize.i64.p0, rhs_var=FunObjVar ID: 65 (base object)\n",
      "llvm.objectsize.i64.p0\n",
      "AddrStmt: lhs_var=FunValVar ID: 70\n",
      "printf, rhs_var=FunObjVar ID: 71 (base object)\n",
      "printf\n",
      "PhiStmt: res_var=RetValPN ID: 16 unique return node for function add_or_sub, op_var_num=1\n",
      "PhiStmt: res_var=RetValPN ID: 33 unique return node for function main, op_var_num=1\n",
      "CmpStmt: predicate=33, res=ValVar ID: 20\n",
      "   %tobool = icmp ne i32 %flag, 0 , op_var0=ArgValVar ID: 19\n",
      " i32 %flag { 2nd arg add_or_sub  }, op_var1=ConstIntValVar ID: 21\n",
      " i32 0 { constant data }\n",
      "BranchStmt: successors=[(<pysvf.pysvf.IntraICFGNode object at 0x107ca83f0>, 1), (<pysvf.pysvf.IntraICFGNode object at 0x107ca8d30>, 0)], condition=ValVar ID: 20\n",
      "   %tobool = icmp ne i32 %flag, 0 \n",
      "BinaryOPStmt: opcode=13, res=ValVar ID: 24\n",
      "   %add = add nsw i32 %a, %b , op_var_0=ArgValVar ID: 17\n",
      " i32 %a { 0th arg add_or_sub  }, op_var_1=ArgValVar ID: 18\n",
      " i32 %b { 1st arg add_or_sub  }\n",
      "BinaryOPStmt: opcode=15, res=ValVar ID: 27\n",
      "   %sub = sub nsw i32 %a, %b , op_var_0=ArgValVar ID: 17\n",
      " i32 %a { 0th arg add_or_sub  }, op_var_1=ArgValVar ID: 18\n",
      " i32 %b { 1st arg add_or_sub  }\n",
      "BranchStmt: successors=[(<pysvf.pysvf.IntraICFGNode object at 0x10810d870>, 1)], condition=ConstNullPtrValVar ID: 0\n",
      " ptr null { constant data }\n",
      "BranchStmt: successors=[(<pysvf.pysvf.IntraICFGNode object at 0x10810d870>, 1)], condition=ConstNullPtrValVar ID: 0\n",
      " ptr null { constant data }\n",
      "PhiStmt: res_var=ValVar ID: 29\n",
      "   %result.0 = phi i32 [ %add, %if.then ], [ %sub, %if.else ] , op_var_num=2\n",
      "AddrStmt: lhs_var=ValVar ID: 34\n",
      "   %0 = alloca i8, i64 8, align 8 , rhs_var=StackObjVar ID: 35\n",
      "   %0 = alloca i8, i64 8, align 8 \n",
      "GepStmt: lhs_var=ValVar ID: 38\n",
      "   %arrayidx = getelementptr inbounds i32, ptr %0, i64 0 , rhs_var=ValVar ID: 34\n",
      "   %0 = alloca i8, i64 8, align 8 \n",
      "StoreStmt: lhs_var=ValVar ID: 38\n",
      "   %arrayidx = getelementptr inbounds i32, ptr %0, i64 0 , rhs_var=ConstIntValVar ID: 42\n",
      " i32 5 { constant data }\n",
      "GepStmt: lhs_var=ValVar ID: 44\n",
      "   %arrayidx1 = getelementptr inbounds i32, ptr %0, i64 1 , rhs_var=ValVar ID: 34\n",
      "   %0 = alloca i8, i64 8, align 8 \n",
      "StoreStmt: lhs_var=ValVar ID: 44\n",
      "   %arrayidx1 = getelementptr inbounds i32, ptr %0, i64 1 , rhs_var=ConstIntValVar ID: 48\n",
      " i32 3 { constant data }\n",
      "GepStmt: lhs_var=ValVar ID: 50\n",
      "   %arrayidx2 = getelementptr inbounds i32, ptr %0, i64 0 , rhs_var=ValVar ID: 34\n",
      "   %0 = alloca i8, i64 8, align 8 \n",
      "LoadStmt: lhs_var=ValVar ID: 51\n",
      "   %1 = load i32, ptr %arrayidx2, align 4 , rhs_var=ValVar ID: 50\n",
      "   %arrayidx2 = getelementptr inbounds i32, ptr %0, i64 0 \n",
      "GepStmt: lhs_var=ValVar ID: 52\n",
      "   %arrayidx3 = getelementptr inbounds i32, ptr %0, i64 1 , rhs_var=ValVar ID: 34\n",
      "   %0 = alloca i8, i64 8, align 8 \n",
      "LoadStmt: lhs_var=ValVar ID: 53\n",
      "   %2 = load i32, ptr %arrayidx3, align 4 , rhs_var=ValVar ID: 52\n",
      "   %arrayidx3 = getelementptr inbounds i32, ptr %0, i64 1 \n",
      "CallPE: callsite=CallICFGNode22 {fun: main}\n",
      "CallPE: [Var17 <-- Var51]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var18 <-- Var53]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var19 <-- Var55]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      ", lhs_var=ArgValVar ID: 17\n",
      " i32 %a { 0th arg add_or_sub  }, rhs_var=ValVar ID: 51\n",
      "   %1 = load i32, ptr %arrayidx2, align 4 \n",
      "CallPE: callsite=CallICFGNode22 {fun: main}\n",
      "CallPE: [Var17 <-- Var51]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var18 <-- Var53]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var19 <-- Var55]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      ", lhs_var=ArgValVar ID: 18\n",
      " i32 %b { 1st arg add_or_sub  }, rhs_var=ValVar ID: 53\n",
      "   %2 = load i32, ptr %arrayidx3, align 4 \n",
      "CallPE: callsite=CallICFGNode22 {fun: main}\n",
      "CallPE: [Var17 <-- Var51]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var18 <-- Var53]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var19 <-- Var55]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      ", lhs_var=ArgValVar ID: 19\n",
      " i32 %flag { 2nd arg add_or_sub  }, rhs_var=ConstIntValVar ID: 55\n",
      " i32 1 { constant data }\n",
      "RetPE: callsite=CallICFGNode22 {fun: main}\n",
      "CallPE: [Var17 <-- Var51]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var18 <-- Var53]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      "CallPE: [Var19 <-- Var55]\t\n",
      "ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) \n",
      ", lhs_var=ValVar ID: 54\n",
      "   %call = call i32 @add_or_sub(i32 noundef %1, i32 noundef %2, i32 noundef 1) , rhs_var=RetValPN ID: 16 unique return node for function add_or_sub\n",
      "AddrStmt: lhs_var=ValVar ID: 57\n",
      "   %3 = alloca i8, i64 8, align 8 , rhs_var=StackObjVar ID: 58\n",
      "   %3 = alloca i8, i64 8, align 8 \n",
      "GepStmt: lhs_var=GepValVar ID: 90 with offset_0\n",
      "   %3 = alloca i8, i64 8, align 8 , rhs_var=ValVar ID: 57\n",
      "   %3 = alloca i8, i64 8, align 8 \n",
      "GepStmt: lhs_var=GepValVar ID: 91 with offset_0\n",
      "   %0 = alloca i8, i64 8, align 8 , rhs_var=ValVar ID: 34\n",
      "   %0 = alloca i8, i64 8, align 8 \n",
      "LoadStmt: lhs_var=DummyValVar ID: 92, rhs_var=GepValVar ID: 91 with offset_0\n",
      "   %0 = alloca i8, i64 8, align 8 \n",
      "StoreStmt: lhs_var=GepValVar ID: 90 with offset_0\n",
      "   %3 = alloca i8, i64 8, align 8 , rhs_var=DummyValVar ID: 92\n",
      "CopyStmt: lhs_var=ValVar ID: 66\n",
      "   %call4 = call ptr @__memcpy_chk(ptr noundef %3, ptr noundef %0, i64 noundef 8, i64 noundef %4) #4 , rhs_var=ValVar ID: 57\n",
      "   %3 = alloca i8, i64 8, align 8 \n"
     ]
    }
   ],
   "source": [
    "for node in cfg.getNodes():\n",
    "    for stmt in node.getSVFStmts():\n",
    "        if isinstance(stmt, pysvf.AddrStmt):\n",
    "            addr_stmt = stmt.asAddrStmt()\n",
    "            print(\"AddrStmt: lhs_var={}, rhs_var={}\".format(addr_stmt.getLHSVar(), addr_stmt.getRHSVar()))\n",
    "        elif isinstance(stmt, pysvf.CopyStmt):\n",
    "            copy_stmt = stmt.asCopyStmt()\n",
    "            print(\"CopyStmt: lhs_var={}, rhs_var={}\".format(copy_stmt.getLHSVar(), copy_stmt.getRHSVar()))\n",
    "        elif isinstance(stmt, pysvf.BinaryOPStmt):\n",
    "            binary_op_stmt = stmt.asBinaryOpStmt()\n",
    "            print(\"BinaryOPStmt: opcode={}, res={}, op_var_0={}, op_var_1={}\".format(binary_op_stmt.getOpcode(), binary_op_stmt.getRes(), binary_op_stmt.getOpVar(0), binary_op_stmt.getOpVar(1)))\n",
    "        elif isinstance(stmt, pysvf.BranchStmt):\n",
    "            branch_stmt = stmt.asBranchStmt()\n",
    "            print(\"BranchStmt: successors={}, condition={}\".format(branch_stmt.getSuccessors(), branch_stmt.getCondition()))\n",
    "        elif isinstance(stmt, pysvf.LoadStmt):\n",
    "            load_stmt = stmt.asLoadStmt()\n",
    "            print(\"LoadStmt: lhs_var={}, rhs_var={}\".format(load_stmt.getLHSVar(), load_stmt.getRHSVar()))\n",
    "        elif isinstance(stmt, pysvf.StoreStmt):\n",
    "            store_stmt = stmt.asStoreStmt()\n",
    "            print(\"StoreStmt: lhs_var={}, rhs_var={}\".format(store_stmt.getLHSVar(), store_stmt.getRHSVar()))\n",
    "        elif isinstance(stmt, pysvf.CallPE):\n",
    "            call_pe = stmt.asCallPE()\n",
    "            print(\"CallPE: callsite={}, lhs_var={}, rhs_var={}\".format(call_pe.getCallSite(), call_pe.getLHSVar(), call_pe.getRHSVar()))\n",
    "        elif isinstance(stmt, pysvf.RetPE):\n",
    "            ret_pe = stmt.asRetPE()\n",
    "            print(\"RetPE: callsite={}, lhs_var={}, rhs_var={}\".format(ret_pe.getCallSite(), ret_pe.getLHSVar(), ret_pe.getRHSVar()))\n",
    "        elif isinstance(stmt, pysvf.GepStmt):\n",
    "            gep_stmt = stmt.asGepStmt()\n",
    "            print(\"GepStmt: lhs_var={}, rhs_var={}\".format(gep_stmt.getLHSVar(), gep_stmt.getRHSVar()))\n",
    "        elif isinstance(stmt, pysvf.PhiStmt):\n",
    "            phi_stmt = stmt.asPhiStmt()\n",
    "            print(\"PhiStmt: res_var={}, op_var_num={}\".format(phi_stmt.getRes(), phi_stmt.getOpVarNum()))\n",
    "        elif isinstance(stmt, pysvf.CmpStmt):\n",
    "            cmp_stmt = stmt.asCmpStmt()\n",
    "            print(\"CmpStmt: predicate={}, res={}, op_var0={}, op_var1={}\".format(cmp_stmt.getPredicate(), cmp_stmt.getRes(), cmp_stmt.getOpVar(0), cmp_stmt.getOpVar(1)))\n",
    "        elif isinstance(stmt, pysvf.UnaryOPStmt):\n",
    "            unary_op_stmt = stmt.asUnaryOpStmt()\n",
    "            print(\"UnaryOPStmt: opcode={}, res={}, op_var={}\".format(unary_op_stmt.getOpcode(), unary_op_stmt.getRes(), unary_op_stmt.getOpVar()))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d5d9e07ed1f024c6",
   "metadata": {
    "collapsed": false
   },
   "source": [
    "The above code snippet demonstrates how to reach SVFStmts and SVFVars from ICFGNode. By analyzing these SVF statements, we can understand the data flow and value propagation within the program, which is essential for optimizing compilers and detecting potential vulnerabilities.\n",
    "\n",
    "### Summary\n",
    "\n",
    "In this tutorial, we explored the use of the SVF tool for static analysis of LLVM bitcode, focusing on the Interprocedural Control-Flow Graph (ICFG). We learned how to load the ICFG from a bitcode file, traverse the ICFG nodes and edges, and analyze the control flow between functions. By using the ICFG-related functions, we gained insights into the program's structure, control flow, and data flow, which are essential for optimizing compilers and detecting potential vulnerabilities."
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 2
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython2",
   "version": "2.7.6"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}