Install KLEE

1. Install dependencies

$ sudo apt-get install build-essential curl libcap-dev git cmake libncurses5-dev python-minimal python-pip unzip

2. Install LLVM 3.4

Please refer to this cite.
Note:
- KLEE is currently tested on Linux x86-64, and might break on x86-32.
- If you build LLVM and Clang 3.4 from source DO NOT USE CMAKE TO BUILD IT. Use LLVM’s Autoconf/Makefile build system. Although KLEE’s CMake build system is independent of the build system used to build LLVM and Clang a bug in LLVM 3.4 means that if CMake is used to build LLVM then it will likely lead to RTTI related linking errors.

3. Install constraint solver(s)

Here we install STP as the constraint solver.

STP has a few external dependencies they are listed below as an install command for Ubuntu 14.04LTS.

$ sudo apt-get install cmake bison flex libboost-all-dev python perl zlib1g-dev$ git clone https://github.com/stp/minisat.git$ cd minisat$ mkdir build$ cd build//$ cmake -DSTATIC_BINARIES=ON -DCMAKE_INSTALL_PREFIX=/usr/ ../$ cmake ../$ make$ sudo make install$ cd ../../$ git clone https://github.com/stp/stp.git$ cd stp$ git checkout tags/2.1.2$ mkdir build$ cd build

Then,

• Shared STP libraries cause problems for KLEE, so we have to disable them (see this mailing list thread). The python interface requires shared libraries, so we have to disable that, too.

  $ cmake -DBUILD_SHARED_LIBS:BOOL=OFF -DENABLE_PYTHON_INTERFACE:BOOL=OFF ..

• But if you need STP shared libraries, you can run the following command:

  $ cmake .. 

Finally,

$ make$ sudo make install$ sudo vim /etc/security/limits.conf    add this line “ulimit -s unlimited” to the end of the file.$ source /etc/security/limits.conf$ cd ../..

4. (Optional) Build uclibc and the POSIX environment model:

By default, KLEE works on closed programs (programs that don’t use any external code such as C library functions). However, if you want to use KLEE to run real programs you will want to enable the KLEE POSIX runtime, which is built on top of the uClibc C library.

To build klee-uclibc run:

$ git clone https://github.com/klee/klee-uclibc.git  $ cd klee-uclibc  $ ./configure --make-llvm-lib  $ make -j2  $ cd .. 

NOTE: If you are on a different target (i.e., not i386 or x64), you will need to run make config and select the correct target. The defaults for the other uClibc configuration variables should be fine.

To tell KLEE to use klee-uclibc and use the POSIX runtime pass -DENABLE_POSIX_RUNTIME=ON and -DKLEE_UCLIBC_PATH=<KLEE_UCLIBC_SOURCE_DIR> to CMake when configuring KLEE in step 7 where <KLEE_UCLIBC_SOURCE_DIR> is the absolute path to the cloned klee-uclibc git repository.

5. (Optional) Install tcmalloc:

By default, KLEE uses malloc_info() to observe and to restrict its memory usage. Due to limitations of malloc_info(), the maximum limit is set to 2 GB. To support bigger limits, KLEE can use TCMalloc as an alternative allocator. It is thus necessary to install TCMalloc:

$ sudo apt-get install libtcmalloc-minimal4 libgoogle-perftools-dev

When configuring KLEE in step 7 pass -DENABLE_TCMALLOC=ON to CMake when configuring KLEE.

6. Get KLEE source

$ git clone https://github.com/klee/klee.git

7. Configure KLEE

KLEE must be built “out of source” so first make a binary build directory. You can create this where ever you like.

$ mkdir klee_build_dir

Now cd into the build directory and run CMake to configure KLEE where <KLEE_SRC_DIRECTORY> is the path to the KLEE git repository you cloned in step 6.

$ cd klee_build_dir$ cmake <CMAKE_OPTIONS> <KLEE_SRC_DIRECTORY>

<CMAKE_OPTIONS>are the configuration options. These are documented in README-CMake.md.

For example if KLEE was being built with STP, the POSIX runtime, klee-uclibc and testing then the command line would look something like this

cmake \  -DENABLE_SOLVER_STP=ON \  -DENABLE_POSIX_RUNTIME=ON \  -DENABLE_KLEE_UCLIBC=ON \  -DKLEE_UCLIBC_PATH=<KLEE_UCLIBC_SOURCE_DIR> \  -DGTEST_SRC_DIR=<GTEST_SOURCE_DIR> \  -DENABLE_SYSTEM_TESTS=ON \  -DENABLE_UNIT_TESTS=ON \  <KLEE_SRC_DIRECTORY>

Where <KLEE_UCLIBC_SOURCE_DIR> is the absolute path to the klee-uclibc source tree, <GTEST_SOURCE_DIR> is the absolute path to the Google Test source tree.

NOTE: If LLVM is not found or you need a particular version to be used, you can pass -DLLVM_CONFIG_BINARY=<LLVM_CONFIG_BINARY>
to CMake where <LLVM_CONFIG_BINARY> is the absolute path to the relevant llvm-config binary.
Similary KLEE needs a C and C++ compiler that can create LLVM bitcode that is compatible with the version of LLVM KLEE is using. If these are not detected automatically -DLLVMCC=<PATH_TO_CLANG>and -DLLVMCXX=<PATH_TO_CLANG++> can be passed to explicitly set these compilers where <PATH_TO_CLANG> is the absolute path to clang and <PATH_TO_CLANG++> is the absolute path to clang++.

Here, we run:

$ cmake \    -DENABLE_SOLVER_STP=ON \    -DENABLE_UNIT_TESTS=OFF \    -DENABLE_SYSTEM_TESTS=OFF \    -DLLVM_CONFIG_BINARY=/home/jeremy/Tools/llvm-3.4.2/build/bin/llvm-config \    -DLLVMCC=/home/jeremy/Tools/llvm-3.4.2/build/bin/clang \    -DLLVMCXX=/home/jeremy/Tools/llvm-3.4.2/build/bin/clang++ \     ../klee

Or if you installed uclibc, POSIX_runtime and tcmalloc, we run:

cmake -DENABLE_SOLVER_STP=ON -DENABLE_POSIX_RUNTIME=ON -DENABLE_KLEE_UCLIBC=ON -DKLEE_UCLIBC_PATH=/home/jeremy/Tools/klee-uclibc -DENABLE_TCMALLOC=ON -DLLVM_CONFIG_BINARY=/home/jeremy/Tools/llvm-3.4.2/build/bin/llvm-config -DLLVMCC=/home/jeremy/Tools/llvm-3.4.2/build/bin/clang -DLLVMCXX=/home/jeremy/Tools/llvm-3.4.2/build/bin/clang++ -DENABLE_UNIT_TESTS=OFF -DENABLE_SYSTEM_TESTS=OFF  ../klee

8. Build KLEE

From the klee_build_dir directory created in the previous step, run

$ make

9. Add to environment variable

$ vim ~/.bashrc    add the following two lines to the end of "~/.bashrc":      export PATH=/home/jeremy/Tools/klee_build_dir/bin:$PATH      export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/home/jeremy/Tools/klee_build_dir/lib$ source ~/.bashrc

* Now the command “klee” is available in the command line!*

Reference:

http://blog.csdn.net/haifeng_gu/article/details/72539861
http://klee.github.io/build-llvm34/
Building STP