FRAMA-C(1)

📦
version 20220511-manganese · 4 versions
, in debian bookworm, ubuntu noble

FRAMA-C(1) — okay bestie, this is the manual page and it's a lot, but we're gonna get through it together 💖

🌸 NAME 🌸

  • frama-c[.byte] — a static analyzer for C programs 🧚
  • frama-c-gui[.byte] — the graphical interface of frama-c 🎀

🦋 SYNOPSIS 🦋

frama-c [ options ] files

💖 DESCRIPTION 💖

okay so frama-c is literally a whole suite of tools, and it's all about analyzing source code written in C. the way it does this is it gathers several analysis techniques together into one single collaborative framework. and the framework itself can be extended by additional plugins, which live in the $FRAMAC_PLUGIN directory. and if you wanna know what you actually have installed, just run

frama-c --plugins

and it will provide the full list of the plugins that are currently installed. slay 💅

frama-c-gui is the graphical user interface of frama-c, and the iconic part is that it features the same options as the command-line version. no cap.

frama-c.byte and frama-c-gui.byte are the OCaml bytecode versions of the command-line and graphical user interface respectively. iykyk.

by default, Frama-C recognizes .c files as C files needing pre-processing, and .i files as C files having been already pre-processed. some plugins may extend the list of recognized files (they're allowed, it's their moment ✨). pre-processing can be customized through the -cpp-command and -cpp-extra-args options.

✨ OPTIONS ✨

🎀 Syntax 🎀

options that take an additional parameter can also be written under the form

-option=param

and this form is mandatory when param starts with a dash (-). like, no wiggle room there fr fr.

most options that take no parameter have a corresponding

-no-option

option which has the opposite effect. cute, symmetric, obsessed.

💅 Help options 💅

  • -help — gives a short usage notice. quick little vibe check.
  • -kernel-help — prints the list of options recognized by Frama-C's kernel
  • -explain — prints a help message for each other option given on the command line
  • -verbose n — sets verbosity level. defaults to 1. setting it to 0 will output less progress messages. this level can also be set on a per-plugin basis, with option -plugin-verbose n. verbosity level of the kernel can be controlled with option -kernel-verbose n.
  • -debug n — sets debugging level. defaults to 0, meaning no debugging messages. this option has the same per-plugin (and kernel) specializations as -verbose.
  • -quiet — sets verbosity and debugging level to 0. the silent treatment, but consensual.

👑 Options controlling Frama-C's kernel 👑

  • -absolute-valid-range min-max — considers that all numerical addresses in the range min-max are valid. bounds are parsed as OCaml integer constants. by default, all numerical addresses are considered invalid.
  • -add-path p1[,p2[...,pn]] — adds directories p1 through pn to the list of directories in which plugins are searched.
  • -add-symbolic-path p1:n1[,p2:n2[...,pn:nn]] — replaces each path pi with the name ni when displaying file locations in messages.
  • [-no]-aggressive-merging — merges function definitions modulo renaming. defaults to no.
  • [-no]-allow-duplication — allows duplication of small blocks during normalization of tests and loops. otherwise, normalization uses labels and gotos. bigger blocks and blocks with non-trivial control flow are never duplicated. defaults to yes.
  • [-no]-annot — reads ACSL annotations. this is the default. annotations are pre-processed by default. use -no-pp-annot if you don't want to expand macros in annotations.
  • -autocomplete p1,...,pn — lists the options of plugins p1,...,pn in a format suitable for autocompletion scripts.
  • -big-ints-hex max — integers larger than max are displayed in hexadecimal (by default, all integers are displayed in decimal).
  • -check — performs integrity checks on the internal AST (for developers only). 🔧
  • [-no]-asm-contracts — generates contracts for assembly code written according to gcc's extended syntax. defaults to yes.
  • [-no]-asm-contracts-auto-validate — automatically marks contracts generated from asm as valid. defaults to no.
  • -c11 — enables (partial) C11 compatibility, e.g. typedef redefinitions. defaults to no.
  • [-no]-collapse-call-cast — allows implicit cast between the value returned by a function and the lvalue it is assigned to. otherwise, a temporary variable is used and the cast is made explicit. defaults to yes.
  • [-no]-constfold — folds all syntactically constant expressions in the code before analyses. defaults to no.
  • -const-readonly — variables with const qualifier must be actually constant. defaults to yes. the opposite option is -unsafe-writable.
  • [-no]-continue-annot-error — when analyzing an annotation, the default behavior (the -no version of this option) when a typechecking error occurs is to reject the source file, as is the case for typechecking errors within the C code. with this option on, the typechecker will only output a warning and discard the annotation, but type-checking will continue (errors in C code are still fatal, though).
Deprecated: use -kernel-warn-key annot-error instead.
  • -cpp-command cmd — uses cmd as the command to pre-process C files. defaults to the CPP environment variable or to
gcc -C -E -I.

if it is not set. if unset, the command is built as follows:

CPP -o

%1 and %2 can be used into the CPP string to mark the position of and respectively. note that this option is often better replaced by -cpp-extra-args.

  • -cpp-extra-args args — gives additional arguments to the pre-processor. pre-processing annotations is done in two separate pre-processing stages. the first one is a normal pass on the C code which retains macro definitions. these are then used in the second pass during which annotations are pre-processed. args are used only for the first pass, so that arguments that should not be used twice (such as additional include directives or macro definitions) must thus go there instead of -cpp-command.
  • -cpp-extra-args-per-file file1:args1,...,filen:argsn — like -cpp-extra-args, but the arguments only apply to the specified files.
  • [-no]-cpp-frama-c-compliant — indicates that the chosen preprocessor complies to some Frama-C requirements, such as accepting the same set of options as GNU cpp, and accepting architecture-specific options such as -m32/-m64. default values depend on the installed preprocessor at configure time. see also -pp-annot.
  • [-no]-autoload-plugins — when on, load all the dynamic plugins found in the search path (see -print-plugin-path for more information on the default search path). otherwise, only plugins requested by -load-module will be loaded. defaults to on.
  • -enums repr — choose the way the representation of enumerated types is determined. frama-c -enums help gives the list of available options. default is gcc-enums.
  • -float-digits n — when outputting floating-point numbers, display n digits. defaults to 12.
  • -float-flush-to-zero — floating point operations flush to zero.
  • -float-hex — display floats as hexadecimal.
  • -float-normal — display floats with the standard OCaml routine.
  • -float-relative — display float intervals as [ lower_bound++width ].
  • [-no]-frama-c-stdlib — adds -I$FRAMAC_SHARE/libc to the options given to the cpp command. if -cpp-frama-c-compliant is not false, also adds -nostdinc to prevent an inconsistent mix of system and Frama-C header files. defaults to yes.
  • -implicit-function-declaration action — warns or aborts when a function is called before it has been declared. action can be one of ignore, warn, or error. defaults to warn.
Deprecated: use -kernel-warn-key typing:implicit-function-declaration instead.
  • -initialized-padding-locals — implicit initialization of locals sets padding bits to 0. if false, padding bits are left uninitialized. defaults to yes.
  • -inline-calls f1,...,fn — syntactically inlines calls to functions f1,...,fn. use @inline to select all functions with attribute inline. recursive functions are inlined only at the first level. calls via function pointers are not inlined. ngl, pointer calls said "not today" 💀
  • -journal-disable — do not output a journal of the current session. see -journal-enable.
  • -journal-enable — on by default, dumps a journal of all the actions performed during the current Frama-C session in the form of an OCaml script that can be replayed with -load-script. the name of the script can be set with the -journal-name option.
  • -journal-name name — sets the name of the journal file (without the .ml extension). defaults to frama_c_journal.
  • -json-compilation-database path — use path as a JSON compilation database (see https://clang.llvm.org/docs/JSONCompilationDatabase.html for more information): each file preprocessed by Frama-C will include corresponding -I and -D flags according to the specifications in path. if path is a directory, use <path>/compile_commands.json. disabled by default.
  • [-no]-keep-comments — tries to preserve comments when pretty-printing the source code. defaults to no.
  • [-no]-keep-switch — when -simplify-cfg is set, keeps switch statements. defaults to no.
  • -keep-unused-specified-functions — see -remove-unused-specified-functions.
  • -keep-unused-types — see -remove-unused-types.
  • -kernel-log kind:file — copies log messages from the Frama-C's kernel to file. kind specifies which kinds of messages to be copied (e.g. w for warnings, e for errors, etc.). see -kernel-help for more details. can also be set on a per-plugin basis, with option -<plugin>-log.
  • -kernel-msg-key k1,...,kn — controls the emission of messages based on categories. use -kernel-msg-key help to get a list of available categories, and -kernel-msg-key="*" to control all categories. to disable a category, add a - before its name; to enable a category, simply add its name, with an optional + before it. for instance, -kernel-msg-key=-k1,k2 will disable messages from category k1 and enable those from category k2. can also be set on a per-plugin basis, with option -<plugin>-msg-key. note that each plugin has its own set of categories. 🌈
  • -kernel-warn-key k1=a1,...,kn=an — this is your warning vibe control panel 🎛️ for every warning category k, you pick an action a. Want the full tea? Run -kernel-warn-key help and it spills the whole list of categories plus whatever action they're currently rocking. The actions you can set per category are: active (aka warn), feedback, error, abort, once, feedback-once, err-once. If you just... don't give an action, it's the same as saying active. And bestie, you can also set warning categories per-plugin, using -<plugin>-warn-key. ✨
  • [-no]-lib-entry — says the entry point gets called while the program is already running. Which lowkey means you cannot assume global variables have their initial values — they've been through stuff 💀. Default is -no-lib-entry: the entry point is also where the program starts, so globals are fresh out the box with their initial values.
  • -load file — loads a previously saved state that's chillin' in file. 💾
  • -load-module SPEC — dynamically loads OCaml plug-ins, modules and scripts, no cap 🦋. Every SPEC can be an OCaml source or object file, with or without an extension, or a Findlib package. Loading order is preserved (periodt), and you can list extra dependencies in *.depend files.
  • -load-script SPEC — literally just an alias for -load-module. Same energy, different name 💅
  • -machdep machine — uses machine as the current machine-dependent configuration (sizes of the various integer types, endianness, that whole situation). Wanna know which machines are supported? -machdep help has you covered. Default is x86_64.
  • -main f — sets f as the entry point of the analysis. Defaults to main. By default it's treated as the starting point of the program under analysis. But if f is actually called mid-execution, use -lib-entry instead, okay? 👑
  • -obfuscate — prints an obfuscated version of the code (all the original identifiers get swapped for meaningless ones) and then exits. The correspondence table mapping original symbols to new ones is kept at the beginning of the result, so you're not just lost in the void 🌈
  • -ocode file — redirects pretty-printed code into file instead of standard output. ✨
  • [-no]-orig-name — during the normalization phase, some variables may get renamed when different variables with the same name can co-exist (think: a global variable and a formal parameter, awkward 😭). When this option is on, a message prints every time that happens. Defaults to no.
  • [-no]-pp-annot — pre-processes annotations. Heads up: this is currently only possible when you're using the gcc (or GNU cpp) pre-processor. The default is to pre-process annotations when the default pre-processor is identified as GNU or GNU-like. Also see -cpp-frama-c-compliant 👀
  • [-no]-print — pretty-prints the source code as normalized by CIL. Defaults to no.
  • -print-cpp-commands — outputs the preprocessing commands for all input files. 📜
  • -print-config-json — outputs extensive Frama-C configuration data in JSON format. Yes bestie, machine-readable 💖
  • [-no]-print-libc — expands #include directives in the pretty-printed CIL code for files in the Frama-C standard library. Defaults to no.
  • -print-libpath — outputs the directory where the Frama-C kernel library is installed. 📁
  • -print-path — alias of -print-share-path.
  • -print-plugin-path — outputs the directory where Frama-C searches its plugins (this can be overridden by the FRAMAC_PLUGIN variable and the -add-path option).
  • -print-share-path — outputs the directory where Frama-C stores its data (can be overridden by the FRAMAC_SHARE variable).
  • [-no]-remove-exn — transforms throw and try/catch statements into normal C functions. Defaults to no, unless the input source language has an exception mechanism — in which case, buckle up.
  • -remove-inlined f1,...,fn — removes inlined functions f1,...,fn from the AST. Those functions must have been given to -inline-calls. Note: this option does not check whether the given functions were fully inlined. So be careful, bestie 🙈
  • -remove-projects p1,...,pn — removes the given projects p1,...,pn. And @all_but_current removes all projects except the current one. Clean sweep 🧹
  • -remove-unused-specified-functions — keeps function prototypes that have an ACSL specification but aren't used in the code. This is the default. Functions carrying the attribute FRAMAC_BUILTIN are always kept, no exceptions 💅
  • -remove-unused-types — removes types and struct/union/enum declarations that aren't referenced anywhere else in the code. This is the default. Use -keep-unused-types to keep those definitions around instead.
  • -safe-arrays — for multidimensional arrays, or arrays that are fields inside structs, assumes all accesses must be in bound. This one's set by default. The opposite option is -unsafe-arrays.
  • -save file — saves Frama-C's state into file after the analyses have taken place. Snapshot era 📸
  • -session s — sets s as the directory in which session files are searched.
  • [-no]-set-project-as-default — the current project becomes the default one (and so future -then sequences get applied on it). Defaults to no.
  • [-no]-simplify-cfg — removes break, continue and switch statements before analyses. Defaults to no.
  • [-no]-simplify-trivial-loops — simplifies trivial loops, like do ... while (0) loops. Defaults to yes. 🌀
  • -then — allows you to compose analyses: a first run of Frama-C happens with the options before -then, and a second run happens with the options after -then, running on the current project from the first run. Multitasking queen 👑
  • -then-last — like -then, except the second group of actions is executed on the last project created by a program transformer.
  • -then-on prj — similar to -then, except the second run is performed in project prj. If no such project exists, Frama-C exits with an error. No prj, no party 💀
  • -then-replace — like -then-last, but it also removes the previous current project. Out with the old ✨
  • -time file — appends the user time and date into the given file when Frama-C exits. ⏰
  • -typecheck — forces typechecking of the source files. This option is only relevant if no further analysis is requested (since typechecking will implicitly happen before any analysis is launched anyway).
  • -ulevel n — syntactically unrolls loops n times before the analysis. Ngl this can be quite costly, and some plugins (e.g. Eva) offer more efficient ways to do the same thing — go read their respective manuals for that tea. You can also activate this on a per-loop basis via the loop pragma unroll directive. And a negative value for n will inhibit such pragmas. 😌
  • [-no]-ulevel-force — ignores UNROLL loop pragmas that disable unrolling.
  • [-no]-unicode — outputs ACSL formulas with UTF-8 characters. This is the default ✨. When you give -no-unicode, Frama-C uses the ASCII version instead. See the ACSL manual for the correspondence between the two.
  • -unsafe-arrays — see -safe-arrays.
  • [-no]-unspecified-access — checks that read/write accesses occurring in an unspecified order (per the C standard's notion of sequence points) are performed on separate locations. With -no-unspecified-access, it assumes that's always the case (which is the default).
  • -version — outputs the version string of Frama-C. 🏷️
  • -warn-decimal-float freq — warns when a floating-point constant can't be exactly represented (e.g. 0.1). freq can be one of none, once, or all.
Deprecated: use -kernel-warn-key parser:decimal-float=once (and variants) instead. The old way is giving retired icon, fr fr 🫶
  • [-no]-warn-invalid-pointer — generates alarms for invalid pointer arithmetic. Defaults to no.
  • [-no]-warn-left-shift-negative — generates alarms for signed left shifts on negative values. Defaults to yes.
  • [-no]-warn-right-shift-negative — generates alarms for signed right shifts on negative values. Defaults to no.
  • [-no]-warn-pointer-downcast — generates alarms when the downcast of a pointer may exceed the destination range. Defaults to yes.
  • [-no]-warn-signed-downcast — generates alarms when signed downcasts may exceed the destination range. Defaults to no.
  • [-no]-warn-signed-overflow — generates alarms for signed operations that overflow. Defaults to yes.
  • [-no]-warn-unsigned-downcast — generates alarms when unsigned downcasts may exceed the destination range. Defaults to no.
  • [-no]-warn-unsigned-overflow — generates alarms for unsigned operations that overflow. Defaults to no.
  • [-no]-warn-invalid-bool — generates alarms for reads of trap representations of _Bool lvalues. Defaults to yes. 🙈

🌸 Plugin-specific options 🌸

For each plugin, this command

frama-c -plugin-help

will give you the list of options that are specific to that plugin. Every plugin has its own lil personality, so go ask it directly 💅

💖 EXIT STATUS 💖

  • 0 — Successful execution. Slay ✨
  • 1 — Invalid user input. We've all been there 😭
  • 2 — User interruption (kill or equivalent). Okay bye then 👋
  • 3 — Unimplemented feature. Not yet, bestie 🥲
  • 4 5 6 — Internal error. Oh no 💀
  • 125 — Unknown error. The mystery era 🔮
Exit statuses greater than 2 can be considered a bug (or, for the case of exit status 3, a feature request) and may be reported on Frama-C's BTS — see below 👇

🌈 ENVIRONMENT VARIABLES 🌈

You can control where Frama-C looks for its files through the following variables. Set the vibes, set the paths 🫶

  • FRAMAC_LIB — the directory where the kernel's compiled interfaces are installed.
  • FRAMAC_PLUGIN — the directory where Frama-C can find standard plugins. If you want your plugins in several places, use -add-path instead.
  • FRAMAC_SHARE — the directory where Frama-C data (e.g. its version of the standard library) is installed.

👑 SEE ALSO 👑

And that's the whole page, bestie — this manual came from Frama-C's June 18, 2021 era, and it's filed under FRAMA-C(1) in section 1. Go forth, read your warnings, and stay iconic 💅💖

📦 where this page comes from