how to know pts graph of a variable at a pirticular statement

[NeyagapulaSiddhartha]

int main() {

int b;

int c;

int *a=&b;

int **s =&a;

  foo(&s);                      //s1

    if(*a>32){

      a = &c;

    }

}

Here I want to get the info that at s1 s->a->b
How to get this information?

IR for reference

define dso_local noundef i32 @main() #3 !dbg !813 {
%1 = alloca i32, align 4
%2 = alloca i32, align 4
%3 = alloca i32, align 4
%4 = alloca ptr, align 8
%5 = alloca ptr, align 8
store i32 0, ptr %1, align 4
call void @llvm.dbg.declare(metadata ptr %2, metadata !814, metadata !DIExpression()), !dbg !815
call void @llvm.dbg.declare(metadata ptr %3, metadata !816, metadata !DIExpression()), !dbg !817
call void @llvm.dbg.declare(metadata ptr %4, metadata !818, metadata !DIExpression()), !dbg !819
store ptr %2, ptr %4, align 8, !dbg !819
call void @llvm.dbg.declare(metadata ptr %5, metadata !820, metadata !DIExpression()), !dbg !821
store ptr %4, ptr %5, align 8, !dbg !821
%6 = call noundef ptr @_Z3fooPPPi(ptr noundef %5), !dbg !822
%7 = load ptr, ptr %4, align 8, !dbg !823
%8 = load i32, ptr %7, align 4, !dbg !825
%9 = icmp sgt i32 %8, 32, !dbg !826
br i1 %9, label %10, label %11, !dbg !827

10: ; preds = %0
store ptr %3, ptr %4, align 8, !dbg !828
br label %11, !dbg !830

11: ; preds = %10, %0
%12 = load i32, ptr %1, align 4, !dbg !831
ret i32 %12, !dbg !831
}

[yuleisui]

clang -g -fno-discard-value-names -c -emit-llvm example.c -o example.bc
wpa -ander -print-all-pts example.bc

It will print the points-to information for all variables of the bc (with debug info and variable names).

[NeyagapulaSiddhartha]

Thank you very much @yuleisui, but I wanted to access this information inside my pass, i want something like a mod ref info

at the call site foo(), and I want it to be context sensitive

[yuleisui]

You may wish to take a look at this method:

SVF/svf/lib/WPA/WPAPass.cpp

Line 157 in dd911f3

const PointsTo& WPAPass::getPts(NodeID var)

[NeyagapulaSiddhartha]

@yuleisui thankyou for the suggestion, I have tried the function getPts(NodeID var)

this gives for a given instruction what is it pointing to , But i want this information recurively i.e i want the whole points to chain

for example

int main() {
int b;
int c;
int *a=&b;
int **s =&a;
foo(s); //s1
if(*a>32){
a = &c;
}
}

for the above example , i have written a code to print for each line what does the specific variable points to

for(auto iter = ff->begin(), eiter = ff->end(); iter!= eiter; iter++)
{
const SVFBasicBlock * bb = *iter;
for(auto it = bb->begin(), eit = bb->end(); it!= eit; it++)
{
const SVFInstruction * inst = *it;
if(inst->getKind()==SVFValue::SVFValKind::SVFCall)
continue;
// outs()<<*inst<<"\n";
SVF::NodeID lval_Id = fsmpta->getPAG()->getValueNode(inst);

           outs()<<inst->toString()<<"        ";
                PointsTo pts = fsmpta->getPts(lval_Id);
                outs()<<" points to  { ";
                for(auto it = pts.begin(); it!= pts.end(); it++)
                {
                    PAGNode * objnode  = fsmpta->getPAG()->getGNode(*it);
                    outs()<<objnode->getValue()->toString()<<"\n";
                }
                outs()<<" }\n\n";
  }

}

sample Output

%1 = alloca i32, align 4 points to { %1 = alloca i32, align 4 }

%2 = alloca i32, align 4 { "ln": 14, "fl": "sample.cpp" } points to -> { %2 = alloca i32, align 4 { "ln": 14, "fl": "sample.cpp" } }

%3 = alloca i32, align 4 { "ln": 15, "fl": "sample.cpp" } points to -> { %3 = alloca i32, align 4 { "ln": 15, "fl": "sample.cpp" } }

%4 = alloca ptr, align 8 { "ln": 16, "fl": "sample.cpp" } points to -> { %4 = alloca ptr, align 8 { "ln": 16, "fl": "sample.cpp" } }

%5 = alloca ptr, align 8 { "ln": 17, "fl": "sample.cpp" } points to -> { %5 = alloca ptr, align 8 { "ln": 17, "fl": "sample.cpp" } }

store i32 0, ptr %1, align 4 points to { }

store ptr %2, ptr %4, align 8, !dbg !795 { "ln": 16, "cl": 6, "fl": "sample.cpp" } points to { }

store ptr %4, ptr %5, align 8, !dbg !798 { "ln": 17, "cl": 7, "fl": "sample.cpp" } points to { }

%6 = load ptr, ptr %5, align 8, !dbg !799 { "ln": 18, "cl": 7, "fl": "sample.cpp" } points to -> { %4 = alloca ptr, align 8 { "ln": 16, "fl": "sample.cpp" }
}

%7 = load ptr, ptr %4, align 8, !dbg !801 { "ln": 19, "cl": 9, "fl": "sample.cpp" } points to -> { %2 = alloca i32, align 4 { "ln": 14, "fl": "sample.cpp" }
}

As far as i have understood for each line/statement, we get the pts-to info for just the variable that is being used at that staement but not any other variable thats not being used there

suppose for the example mentioned

at statement s1 i get the info s->a but i am not getting the info that a->b , is there any why to get what a points-to at a statment where a is not being used ?

thankyou for the help ... :)