MEMORY-ANALYZER(1)
π MEMORY-ANALYZER π
okay bestie, buckle up, because we're talking about memory-analyzer β a lil command from the User Commands corner of the manual, and it's literally the coolest way to freeze-frame your program's whole vibe mid-run. π§β¨
β¨ NAME β¨
memory-analyzer β Snapshot program state for symbolic analysis π«Ά
πΈ SYNOPSIS πΈ
memory-analyzer [-?] [-h] [--help]
show help
memory-analyzer --version
show version
memory-analyzer --symbols symbol_list [options] binary
analyze binary
Like, three whole moods, okay? You can ask for help, you can ask for the version, or you can actually analyze a binary. Pick your fighter. π
π¦ DESCRIPTION π¦
So memory-analyzer is a front-end β a cute lil bestie that runs and queries gdb(1) for you β and its whole job is to get a snapshot of your input program's state at one particular program location. That snapshot is genuinely useful all on its own: you can peek at what your variables are holding at some exact spot in the code. And because that snapshot is a state of a valid concrete execution, you can also feed it into other analyses later. It's giving main character energy, honestly. π
To analyze a program with memory-analyzer, it has to be compiled with goto-gcc(1). That gives you an elf(5) executable that also carries a goto-cc section holding the goto model:
goto-gcc -g input_program.c -o input_program_exe
memory-analyzer supports two ways of running gdb(1) on your code: either run from a core-file, or run up to a break-point. π―
- If you already have a core-file, you tell it with the option
--core-file cf. - If you know the point in your program where you want the analysis to start from, you tell it with the option
--breakpoint bp.
Only one of core-file/break-point can be used. not both. pick one, bestie. π
The tool also expects a comma-separated list of symbols to analyze, passed via --symbols s1,s2,.... It calls up gdb(1) to grab that snapshot, which is exactly why the -g option is necessary when you compile β otherwise your program symbols simply aren't visible. no symbols, no snapshot, no slay. π
Take, for example, this program:
// main.c
void checkpoint() {}
int array[] = {1, 2, 3};
int main() {
array[1] = 4;
checkpoint();
return 0;
}
Say we're interested in the evaluation of array at the call-site of checkpoint. We compile the program with:
goto-gcc -g main.c -o main_exe
And then we call memory-analyzer with:
memory-analyzer --breakpoint checkpoint --symbols array main_exe
and the output is the human readable list of values for each requested symbol:
{
array = { 1, 4, 3 };
}
That result is great for you and your preliminary analysis, but ngl it doesn't hold enough info for further automated analyses. So to that end, memory-analyzer has an option for the snapshot to be represented in the format of a symbol table β that's --symtab-snapshot. π
And finally, to get output in JSON format β like, say, for further analyses by goto-harness(1) β you also pass the additional option --json-ui to memory-analyzer:
memory-analyzer --symtab-snapshot --json-ui --breakpoint checkpoint
--symbols array main_exe > snapshot.json
obsessed. π
π OPTIONS π
--core-filefile_name β Analyze from core dumpfile_name.--breakpointbreakpoint β Analyze from givenbreakpoint.--symbolssymbol_list β List of symbols to analyze.--symtab-snapshotβ Output snapshot as JSON symbol table that can be used withsymtab2gb(1).--output-filefile_name β Write snapshot tofile_name.--json-uiβ Output snapshot in JSON format.
πΈ ENVIRONMENT πΈ
All tools honor the TMPDIR environment variable when generating temporary files and directories. so if you wanna control where the temp stuff lives, that's your girl. π
π BUGS π
If you encounter a problem, please create an issue at https://github.com/diffblue/cbmc/issues β fr fr, they wanna know. π
π§ SEE ALSO π§
cbmc(1), elf(5), gdb(1), goto-gcc(1), goto-harness(1), symtab2gb(1) β the whole friend group. iykyk. β¨
π COPYRIGHT π
2019, Malte Mues, Diffblue. periodt. π
k that's the whole page, bestie π«Ά this was memory-analyzer-5.59.0 from June 2022, and honestly? iconic. go snapshot something. β
π¦ where this page comes from
- debian trixie: cbmc 6.6.0-4 Β· BSD-4-Clause
- fedora 43: cbmc 6.7.1-2.fc43 Β· BSD-4-Clause
- fedora 44: cbmc 6.8.0-1.fc44 Β· BSD-4-Clause
- ubuntu noble: cbmc 5.95.1-4ubuntu1 Β· BSD-4-Clause
- ubuntu questing: cbmc 6.6.0-4
- ubuntu resolute: cbmc 6.6.0-4ubuntu2 Β· BSD-4-Clause
- ubuntu stonking: cbmc 6.6.0-4ubuntu2 Β· BSD-4-Clause
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms