Can work on incomplete programs
- Make assumptions about missing code, or supply stubs
- Which integer variables contain file handles?
- Can pointer foo in function bar be passed to free()? If so, what paths in the call graph are involved?
- Field f of variable v has an incorrect value; where in the source might it have changed?
- Which functions modify the cur_veh field of map_manager_global?