Lackwit (O’Callahan & Jackson)
Code-oriented tool that exploits type inference
Answers queries about C programs
- e.g., “locate all potential assignments to this field”
- Accounts for aliasing, calls through function pointers, type casts
Efficient
- e.g., answers queries about a Linux kernel (157KLOC) in under 10 minutes on a PC