static-analysis

Taint analysis on LLVM IR identifies untrusted data paths by modeling source-sink relationships to detect security vulnerabilities. This framework supports user-defined taint analyses and built-in dataflow passes to uncover vulnerability paths.

Pointer aliasing analysis in LLVM uses flow-sensitive and context-sensitive techniques to approximate memory aliases. This skill leverages built-in Analysis APIs like AAManager to compose custom pointer analysis passes for code quality evaluation.

Yes, you can build data dependency graphs and perform program slicing using LLVM infrastructure. This skill provides dependency analysis capabilities through forward and backward may/must analyses to construct data dependency graphs for program slicing.

Yes, this framework supports interprocedural analysis and loop-aware optimizations. It leverages built-in LLVM analyses including DominatorTree and LoopInfo to compose custom passes for vulnerability detection across function boundaries.

Custom dataflow analyses require LLVM Analysis APIs including DominatorTree, LoopInfo, and AAManager. You need the LLVM infrastructure to compose these built-in analyses with user-defined taint and dependency passes for vulnerability detection.

Flow-sensitive pointer analysis is needed when alias relationships change throughout execution for precise vulnerability detection, while flow-insensitive analysis provides faster approximations. This skill supports both approaches along with context-sensitive analysis for security research.