Skip to content

PySVF API

Jiawei Wang edited this page Jun 18, 2025 · 4 revisions

SVF-Python API Documentation

This document provides a complete API reference for the pysvf.pyi file in the SVF-Python project.

Table of Contents


Constants and Type Aliases

Name Type Description
BIN_DIR str Binary directory path
CURRENT_DIR str Current directory path
SVF_DIR str SVF directory path
LLVM_DIR str LLVM directory path
EXTAPI_BC_PATH str External API bytecode path
Z3_DIR str Z3 solver directory path
SVFFunction Any SVF function type alias
SVFValue Any SVF value type alias
SVFLLVMValue Any SVF LLVM value type alias
SVFLoop Any SVF loop type alias
SVFLoopInfo Any SVF loop info type alias
BranchInst Any Branch instruction type alias
MemObj Any Memory object type alias
OffsetVarAndGepTypePair Any Offset variable and GEP type pair alias

Global Functions

Function Name Parameters Return Type Description
run_tool tool_name: str, args: List[str] None Run the specified tool

Core Classes

ICFGNode

Base class for ICFG (Interprocedural Control Flow Graph) nodes.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
toString None str Get the string representation of the ICFG node
getId None int Get the ID of the ICFG node
getFun None SVFFunction Get the function that the ICFG node belongs to
getBB None SVFBasicBlock Get the basic block that the ICFG node belongs to
getSVFStmts None List[SVFStmt] Get the SVF statements associated with the ICFG node
asFunEntry None FunEntryICFGNode Downcast to FunEntryICFGNode
asFunExit None FunExitICFGNode Downcast to FunExitICFGNode
asCall None CallICFGNode Downcast to CallICFGNode
asRet None RetICFGNode Downcast to RetICFGNode
isFunEntry None bool Check if the ICFG node is a function entry node
isFunExit None bool Check if the ICFG node is a function exit node
isCall None bool Check if the ICFG node is a function call node
isRet None bool Check if the ICFG node is a function return node
getOutEdges None List[ICFGEdge] Get the out edges of the ICFG node
getInEdges None List[ICFGEdge] Get the in edges of the ICFG node

IntraICFGNode

Inherits from ICFGNode, represents intraprocedural ICFG nodes.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
isRetInst None bool Check if this is a return instruction

InterICFGNode

Inherits from ICFGNode, represents interprocedural ICFG nodes.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)

GlobalICFGNode

Inherits from ICFGNode, represents global ICFG nodes.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)

CallGraphNode

Call graph node class.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getFunction None SVFFunction Get the function of the call graph node
getId None int Get the ID of the call graph node
getName None str Get the name of the function
getInEdges None List[CallGraphEdge] Get incoming edges of this node
getOutEdges None List[CallGraphEdge] Get outgoing edges of this node
isReachableFromProgEntry None bool Check if this function is reachable from program entry
toString None str Get string representation of this node

CallGraphEdge

Call graph edge class.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getSrcNode None CallGraphNode Get the source node of the call graph edge
getDstNode None CallGraphNode Get the destination node of the call graph edge
getCallSiteID None int Get the call site ID
getSrcID None int Get source node ID
getDstID None int Get destination node ID
getDirectCalls None List[CallICFGNode] Get direct call ICFG nodes
getIndirectCalls None List[CallICFGNode] Get indirect call ICFG nodes
isDirectCallEdge None bool Check if this is a direct call edge
isIndirectCallEdge None bool Check if this is an indirect call edge
toString None str Get string representation

CallGraph

Call graph class.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getGNode id: int CallGraphNode Get the call graph node by ID
dump None None Dump the call graph to console
view None None View the call graph (opens visualization)
getCallGraphNodeByFunObj fun: FunObjVar CallGraphNode Get the call graph node for the given function
getCallGraphNodeByName name: str CallGraphNode Get the call graph node for the given function name
getCallGraphNodeById id: int CallGraphNode Get the call graph node by ID
getNodes None List[CallGraphNode] Get all nodes in this call graph
isReachableBetweenFunctions src: SVFFunction, dst: SVFFunction bool Check if there's a path between two functions

FunEntryICFGNode

Inherits from ICFGNode, represents function entry ICFG nodes.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getFormalParms None List[SVFVar] Get the formal parameters of the function
addFormalParm parm: SVFVar None Add a formal parameter to the function

FunExitICFGNode

Inherits from ICFGNode, represents function exit ICFG nodes.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getFormalRet None SVFVar Get the formal return value of the function
addFormalRet ret: SVFVar None Add a formal return value to the function

CallICFGNode

Inherits from ICFGNode, represents call ICFG nodes.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getCaller None FunEntryICFGNode Get the caller function
getCalledFunction None FunObjVar Get the called function
getActualParms None List[SVFVar] Get the actual parameters of the call
addActualParms parm: SVFVar None Add an actual parameter to the call
getArgument idx: int SVFVar Get the argument at the given index
isVarArg None bool Check if the call is a vararg call
isVirtualCall None bool Check if the call is a virtual call
getRetICFGNode None RetICFGNode Get the return ICFG node

RetICFGNode

Inherits from ICFGNode, represents return ICFG nodes.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getActualRet None SVFVar Get the actual return value
addActualRet ret: SVFVar None Add an actual return value
getCallICFGNode None CallICFGNode Get the call ICFG node

ICFGEdge

Base class for ICFG edges.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
toString None str Get the string representation of the ICFG edge
isCFGEdge None bool Check if the edge is a CFG edge
isCallCFGEdge None bool Check if the edge is a call CFG edge
isRetCFGEdge None bool Check if the edge is a return CFG edge
isIntraCFGEdge None bool Check if the edge is an intra CFG edge
getSrcNode None ICFGNode Get the source node of the edge
getDstNode None ICFGNode Get the destination node of the edge
asIntraCFGEdge None IntraCFGEdge Downcast to IntraCFGEdge
asCallCFGEdge None CallCFGEdge Downcast to CallCFGEdge
asRetCFGEdge None RetCFGEdge Downcast to RetCFGEdge

IntraCFGEdge

Inherits from ICFGEdge, represents intraprocedural CFG edges.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getCondition None SVFStmt Get the condition of the edge
getSuccessorCondValue None SVFValue Get the successor condition value

CallCFGEdge

Inherits from ICFGEdge, represents call CFG edges.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getCallSite None CallICFGNode Get the call site
getCallPEs None List[CallPE] Get the call PEs

RetCFGEdge

Inherits from ICFGEdge, represents return CFG edges.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getCallSite None CallICFGNode Get the call site
getRetPE None RetPE Get the return PE

SVFStmt

Base class for SVF statements.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
toString None str Get the string representation of the SVF statement
getEdgeId None int Get the ID of the SVF statement
getICFGNode None ICFGNode Get the ICFG node that the SVF statement belongs to
getValue None SVFValue Get the value of the SVF statement
getBB None SVFBasicBlock Get the basic block that the SVF statement belongs to
isAddrStmt None bool Check if the SVF statement is an address statement
isCopyStmt None bool Check if the SVF statement is a copy statement
isStoreStmt None bool Check if the SVF statement is a store statement
isLoadStmt None bool Check if the SVF statement is a load statement
isCallPE None bool Check if the SVF statement is a call PE
isRetPE None bool Check if the SVF statement is a return PE
isGepStmt None bool Check if the SVF statement is a GEP statement
isPhiStmt None bool Check if the SVF statement is a phi statement
isSelectStmt None bool Check if the SVF statement is a select statement
isCmpStmt None bool Check if the SVF statement is a compare statement
isBinaryOpStmt None bool Check if the SVF statement is a binary operation statement
isUnaryOpStmt None bool Check if the SVF statement is a unary operation statement
isBranchStmt None bool Check if the SVF statement is a branch statement
asAddrStmt None AddrStmt Downcast the SVF statement to an address statement
asCopyStmt None CopyStmt Downcast the SVF statement to a copy statement
asStoreStmt None StoreStmt Downcast the SVF statement to a store statement
asLoadStmt None LoadStmt Downcast the SVF statement to a load statement
asCallPE None CallPE Downcast the SVF statement to a call PE
asRetPE None RetPE Downcast the SVF statement to a return PE
asGepStmt None GepStmt Downcast the SVF statement to a GEP statement
asPhiStmt None PhiStmt Downcast the SVF statement to a phi statement
asSelectStmt None SelectStmt Downcast the SVF statement to a select statement
asCmpStmt None CmpStmt Downcast the SVF statement to a compare statement
asBinaryOpStmt None BinaryOPStmt Downcast the SVF statement to a binary operation statement
asUnaryOpStmt None UnaryOPStmt Downcast the SVF statement to a unary operation statement
asBranchStmt None BranchStmt Downcast the SVF statement to a branch statement

AssignStmt

Inherits from SVFStmt, represents assignment statements.

Method Name Parameters Return Type Description
getLHSVar None SVFVar Get the LHS variable of the assignment statement
getLHSVarID None int Get the ID of the LHS variable of the assignment statement
getRHSVar None SVFVar Get the RHS variable of the assignment statement
getRHSVarID None int Get the ID of the RHS variable of the assignment statement

AddrStmt

Inherits from AssignStmt, represents address statements.

Method Name Parameters Return Type Description
getArrSize None SVFValue Get the array size of the address statement

CopyStmt

Inherits from AssignStmt, represents copy statements.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getCopyKind None int Get the copy kind of the copy statement
isBitcast None bool Check if the copy statement is a bitcast
isInt2Ptr None bool Check if the copy statement is an int2ptr
isPtr2Int None bool Check if the copy statement is a ptr2int
isSext None bool Check if the copy statement is a sext
isZext None bool Check if the copy statement is a zext
isValueCopy None bool Check if the copy statement is a value copy

StoreStmt

Inherits from AssignStmt, represents store statements.

Method Name Parameters Return Type Description
(Inherits from AssignStmt) - - -

LoadStmt

Inherits from AssignStmt, represents load statements.

Method Name Parameters Return Type Description
(Inherits from AssignStmt) - - -

CallPE

Inherits from AssignStmt, represents call PE.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getCallSite None CallICFGNode Get the call site
getFunEntryICFGNode None FunEntryICFGNode Get the function entry ICFG node

RetPE

Inherits from AssignStmt, represents return PE.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getCallSite None CallICFGNode Get the call site
getFunExitICFGNode None FunExitICFGNode Get the function exit ICFG node

GepStmt

Inherits from AssignStmt, represents GEP (GetElementPtr) statements.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
isConstantOffset None bool Check if the GEP statement has a constant offset
getConstantOffset None int Get the constant offset
getConstantByteOffset None int Get the constant byte offset
getConstantStructFldIdx None int Get the constant struct field index
getOffsetVarAndGepTypePairVec None List[OffsetVarAndGepTypePair] Get the offset variable and GEP type pair vector
getSrcPointeeType None SVFType Get the source pointee type

MultiOpndStmt

Inherits from SVFStmt, represents multi-operand statements.

Method Name Parameters Return Type Description
getOpVar ID: int SVFVar Get the operand variable
getOpVarId None int Get the ID of the operand variable
getOpndVars None List[SVFVar] Get the operand variables
getRes None SVFVar Get the result variable
getResId None int Get the ID of the result variable
getOpVarNum None int Get the number of operand variables
__iter__ None Iterator[SVFVar] Iterate over the operand variables

PhiStmt

Inherits from MultiOpndStmt, represents phi statements.

Method Name Parameters Return Type Description
getOpICFGNode idx: int ICFGNode Get the operand ICFG node
isFunRetPhi None bool Check if the phi statement is a function return phi

SelectStmt

Inherits from MultiOpndStmt, represents select statements.

Method Name Parameters Return Type Description
getCondition None SVFVar Get the condition variable
getTrueValue None SVFVar Get the true value variable
getFalseValue None SVFVar Get the false value variable

CmpStmt

Inherits from MultiOpndStmt, represents compare statements.

Method Name Parameters Return Type Description
getPredicate None int Get the predicate

BinaryOPStmt

Inherits from MultiOpndStmt, represents binary operation statements.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getOpcode None int Get the opcode of the binary operation

UnaryOPStmt

Inherits from SVFStmt, represents unary operation statements.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getOp None int Get the opcode
getRes None SVFVar Get the result variable
getResVar None SVFVar Get the result variable
getResId None int Get the ID of the result variable
getOpVar None SVFVar Get the operand variable
getOpVarId None int Get the ID of the operand variable
getOpcode None int Get the opcode of the unary operation

BranchStmt

Inherits from SVFStmt, represents branch statements.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getSuccessors None List[ICFGNode] Get the successors of the branch statement
getNumSuccessors None int Get the number of successors
isConditional None bool Check if the branch statement is conditional
isUnconditional None bool Check if the branch statement is unconditional
getCondition None SVFVar Get the condition variable
getBranchInst None BranchInst Get the branch instruction

ICFG

ICFG (Interprocedural Control Flow Graph) class.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getNodes None List[ICFGNode] Get the nodes of the ICFG
getGNode id: int ICFGNode Get the ICFG node with the given ID
getGlobalICFGNode None ICFGNode Get the global ICFG node
dump file: str None Dump the ICFG to a file
__iter__ None Iterator[tuple[int, ICFGNode]] Iterate over the ICFG nodes
getFunEntryICFGNode fun: FunObjVar FunEntryICFGNode Get the function entry ICFG node for the given function

SVFVar

Base class for SVF variables.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getName None str Get the name of the SVF variable
getId None int Get the ID of the SVF variable
isPointer None bool Check if the SVF variable is a pointer
isConstDataOrAggDataButNotNullPtr None bool Check if the SVF variable is const data or agg data but not a null pointer
isIsolatedNode None bool Check if the SVF variable is an isolated node
getValueName None str Get the value name of the SVF variable
getFunction None SVFFunction Get the function that the SVF variable belongs to
ptrInUncalledFunction None bool Check if the pointer is in an uncalled function
isConstDataOrAggData None bool Check if the SVF variable is const data or agg data
toString None str Get the string representation of the SVF variable
isValVar None bool Check if the SVF variable is a ValVar
isObjVar None bool Check if the SVF variable is an ObjVar
isGepValVar None bool Check if the SVF variable is a GepValVar
isGepObjVar None bool Check if the SVF variable is a GepObjVar
isFunObjVar None bool Check if the SVF variable is a FunObjVar
isFunValVar None bool Check if the SVF variable is a FunValVar
isArgValVar None bool Check if the SVF variable is an ArgValVar
isRetValVar None bool Check if the SVF variable is a RetValPN
isDummyValVar None bool Check if the SVF variable is a DummyValVar
isDummyObjVar None bool Check if the SVF variable is a DummyObjVar
asValVar None ValVar Downcast the SVF variable to a ValVar
asObjVar None ObjVar Downcast the SVF variable to an ObjVar
asGepValVar None GepValVar Downcast the SVF variable to a GepValVar
asGepObjVar None GepObjVar Downcast the SVF variable to a GepObjVar
asFunObjVar None FunObjVar Downcast the SVF variable to a FunObjVar
asFunValVar None FunValVar Downcast the SVF variable to a FunValVar
asArgValVar None ArgValVar Downcast the SVF variable to an ArgValVar
asRetValVar None RetValPN Downcast the SVF variable to a RetValPN
asDummyValVar None DummyValVar Downcast the SVF variable to a DummyValVar
asDummyObjVar None DummyObjVar Downcast the SVF variable to a DummyObjVar
getInEdges None List[SVFStmt] Get incoming edges
getOutEdges None List[SVFStmt] Get outgoing edges

ValVar

Inherits from SVFVar, represents value variables.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getICFGNode None ICFGNode Get the ICFG node that the SVF variable belongs to
getValueName None str Get the value name of the SVF variable
getFunction None SVFFunction Get the function that the SVF variable belongs to
toString None str Get the string representation of the SVF variable
getType None SVFType Get the type of the SVF variable
isFunValVar None bool Check if the SVF variable is a FunValVar
asFunValVar None FunValVar Downcast the SVF variable to a FunValVar
isArgValVar None bool Check if the SVF variable is an ArgValVar
asArgValVar None ArgValVar Downcast the SVF variable to an ArgValVar
isGlobalValVar None bool Check if the SVF variable is a GlobalValVar
asGlobalValVar None GlobalValVar Downcast the SVF variable to a GlobalValVar
isConstAggValVar None bool Check if the SVF variable is a ConstAggValVar
asConstAggValVar None ConstAggValVar Downcast the SVF variable to a ConstAggValVar
isConstDataValVar None bool Check if the SVF variable is a ConstDataValVar
asConstDataValVar None ConstDataValVar Downcast the SVF variable to a ConstDataValVar
isConstFPValVar None bool Check if the SVF variable is a ConstFPValVar
asConstFPValVar None ConstFPValVar Downcast the SVF variable to a ConstFPValVar
isConstIntValVar None bool Check if the SVF variable is a ConstIntValVar
asConstIntValVar None ConstIntValVar Downcast the SVF variable to a ConstIntValVar
isConstNullPtrValVar None bool Check if the SVF variable is a ConstNullPtrValVar
asConstNullPtrValVar None ConstNullPtrValVar Downcast the SVF variable to a ConstNullPtrValVar
isBlackHoleValVar None bool Check if the SVF variable is a BlackHoleValVar
asBlackHoleValVar None BlackHoleValVar Downcast the SVF variable to a BlackHoleValVar
isGepValVar None bool Check if the SVF variable is a GepValVar
asGepValVar None GepValVar Downcast the SVF variable to a GepValVar
isRetValPN None bool Check if the SVF variable is a RetValPN
asRetValPN None RetValPN Downcast the SVF variable to a RetValPN
isVarArgValPN None bool Check if the SVF variable is a VarArgValPN
asVarArgValPN None VarArgValPN Downcast the SVF variable to a VarArgValPN
isDummyValVar None bool Check if the SVF variable is a DummyValVar
asDummyValVar None DummyValVar Downcast the SVF variable to a DummyValVar

ObjVar

Inherits from SVFVar, represents object variables.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getValueName None str Get the value name of the SVF variable
toString None str Get the string representation of the SVF variable
isObjVar node: SVFVar bool Check if the SVF variable is an ObjVar (static method)
asObjVar node: SVFVar ObjVar Downcast the SVF variable to an ObjVar (static method)
isBaseObjVar node: ObjVar bool Check if the SVF variable is a BaseObjVar (static method)
asBaseObjVar node: ObjVar BaseObjVar Downcast the SVF variable to a BaseObjVar (static method)
isGepObjVar node: ObjVar bool Check if the SVF variable is a GepObjVar (static method)
asGepObjVar node: ObjVar GepObjVar Downcast the SVF variable to a GepObjVar (static method)
isFunObjVar node: ObjVar bool Check if the SVF variable is a FunObjVar (static method)
asFunObjVar node: ObjVar FunObjVar Downcast the SVF variable to a FunObjVar (static method)
isConstAggObjVar None bool Check if this is a constant aggregate object variable
isConstDataObjVar None bool Check if this is a constant data object variable
isConstFPObjVar None bool Check if this is a constant floating point object variable
isConstIntObjVar None bool Check if this is a constant integer object variable
isConstNullPtrObjVar None bool Check if this is a constant null pointer object variable
isGlobalObjVar None bool Check if this is a global object variable
isHeapObjVar None bool Check if this is a heap object variable
isStackObjVar None bool Check if this is a stack object variable
asConstAggObjVar None ConstAggObjVar Cast to ConstAggObjVar if possible
asConstDataObjVar None ConstDataObjVar Cast to ConstDataObjVar if possible
asConstFPObjVar None ConstFPObjVar Cast to ConstFPObjVar if possible
asConstIntObjVar None ConstIntObjVar Cast to ConstIntObjVar if possible
asConstNullPtrObjVar None ConstNullPtrObjVar Cast to ConstNullPtrObjVar if possible
asGlobalObjVar None GlobalObjVar Cast to GlobalObjVar if possible
asHeapObjVar None HeapObjVar Cast to HeapObjVar if possible
asStackObjVar None StackObjVar Cast to StackObjVar if possible

ArgValVar

Inherits from ValVar, represents argument value variables.

Method Name Parameters Return Type Description
__init__ *args, **kwargs None Constructor (not intended for direct instantiation)
getFunction None SVFFunction Get the function that the SVF variable belongs to
getParent None SVFVar Get the parent of the SVF variable
getArgNo None int Get the argument number
isPointer None bool Check if the SVF variable is a pointer