Fjalar: A Dynamic Analysis Framework for C and C++ Programs

Fjalar is a framework that facilitates the construction of dynamic analysis tools for programs written in C and C++. It is often difficult to build robust and scalable dynamic analyses for C and C++ programs due to the lack of memory and type safety in these languages. For instance, the run time system does not keep track of array sizes or whether values have been initialized. Existing frameworks based on source-to-source transformation often suffer from scalability and robustness problems due to the difficulty of adding instrumentation source code to track memory usage and initialization. Frameworks that operate purely at the binary level cannot provide rich language-level information about data structures that are useful for many kinds of analyses. Fjalar combines aspects of both source- and binary-based approaches and allows tools built upon it to safely access rich information at both the language and machine levels during run time.

Fjalar can be used to build tools that dynamically instrument un-modified x86/Linux executables compiled with DWARF2 debugging information. The ability to operate on executables rather than source code places less burden on the tool's users, because there is no need to deal with complex configuration and Makefile options to determine which source files to instrument. It also achieves greater scalability by not having to deal with the difficulties of parsing and instrumenting complex C and C++ source code constructs. Fjalar has been tested to work on executables of programs on the order of 1 million lines of code, including gcc, xemacs, Apache, and CTAS. However, because Fjalar is built upon the Valgrind binary instrumentation framework, it shares many of Valgrind's limitations. In particular, Fjalar can only work on x86 and x86-64 executables on the Linux platform, and imposes around a 100X slowdown while executing the instrumented program.


Here are some services that Fjalar provides to tools built upon it:


Fjalar is implemented in C as a plug-in tool for the Valgrind dynamic binary instrumentation framework. It uses Valgrind to instrument the target program's executable with statements to pause execution at certain points. It uses the Valgrind Memcheck tool to ensure memory safety during the analysis by providing an indication of which memory locations hold allocated and/or initialized values. It obtains language-level information by parsing debugging information in the DWARF2 format using the Readelf program from the GNU Binutils collection.


Download Fjalar 1.4 (4.8 MB) - Newest version includes improvements for handling C++ and multi-threaded programs. AMD64 support has also been improved. Archive contains source code for Valgrind, Fjalar, and a basic tool built upon Fjalar (Released Oct 05, 2009)

Older versions:

View the Fjalar Programmer's Manual for documentation related to implementing Fjalar tools.

These two header files comprise the interface between Fjalar and its tools and also serve as documentation: fjalar_include.h and fjalar_tool.h

Fjalar is also distributed as part of the Kvasir and DynComp tools within the Daikon distribution. This is an example of using Fjalar to build two moderately-sized tools.


Applications of Fjalar

We have used Fjalar to build two dynamic analysis tools.

Kvasir Value Profiling Tool

Kvasir traverses through data structures at run time and outputs their values to a trace file. The main role of Kvasir is to serve as a C/C++ front end for the Daikon dynamic invariant detector. Kvasir provides Daikon with value traces, and Daikon infers likely invariants over the data structures observed in those traces.

DynComp Dynamic Abstract Type Inference Tool

DynComp computes which variables are likely to be used in a related manner by the programmer. It infers a finer set of types for variables called abstract types such that all variables that belong to the same abstract type have held values that interacted at some point during execution (i.e., via arithmetic or comparisons). This finer type information is useful for program understanding, bug finding, debugging, abstraction violation detection, and aiding other program analysis tools.

Ongoing and Future Work

Related projects


Please send bug reports and feature requests to

About the name

Fjalar is the name of a dwarf in Norse mythology. This name was inspired both by the DWARF debugging information format and by the name of the Valgrind framework. Valgrind is the name of a legendary gate from Norse mythology.

Philip Guo <pgbovine (@) alum (.) mit (.) edu>
Last modified on October 6th, 2009