Mamba

Static Analysis Framework for LLVM IR programs

Mamba detects vulnerabilities across C, C++, Rust, Solana and Objective‑C by transforming LLVM IR into fast Datalog facts evaluated with Soufflé.

View on GitHub

Core Features

Full‑Program Graphs

Generates call graphs, CFG and ICFG for precise whole‑program understanding.

Datalog Fact Export

Outputs lightweight facts in SQLite ready for Soufflé rule execution.

Custom Rules

Write expressive Datalog rules to uncover memory‑safety bugs and logic flaws.

Rust Performance

Built in Rust for speed, safety and seamless integration into security pipelines.

Analysis Overview

Call Graph

Captures inter-function edges with synthetic nodes for external entry/exit.

View algorithm

Alias / Points‑to

Inclusion‑based Andersen analysis with lazy cycle detection for scalability.

View algorithm

CFG

Tracks intra‑function control paths and loops via back‑edge detection.

View algorithm

ICFG

Tracks inter‑function control paths and loops via back‑edge detection.

View algorithm

Dominator Trees

Uses Lengauer–Tarjan to answer must‑execute queries quickly.

View algorithm

Data‑Flow Solver

Work‑list engine supports liveness, reaching definitions, available & busy expr.

View algorithm

Memory SSA

Turns the entire program memory into an SSA variable.

View algorithm

Technology

Mamba is implemented in Rust, parses LLVM bitcode directly, stores IR facts in SQLite, and evaluates Datalog rules with the blazing‑fast Soufflé engine, delivering whole‑program insights in seconds, even on massive codebases.

Rust + LLVM

Zero‑cost abstractions and memory‑safe core analysis.

SQLite Fact Store

Portable database of IR facts for offline queries or AI pipelines.

Soufflé Rules

Declarative queries run orders‑of‑magnitude faster than imperative scans.