Symbolic execution engine for C/C++ program analysis and testing
Symbolic Execution Engine
klee
$ klee program.bc
$ klee --max-time=60 --max-solver-time=10 program.bc
$ klee -output-dir=klee-out program.bc