Examples
Each .sbl file demonstrates a different verification scenario — from classic concurrency (dining philosophers, MESI cache coherence, PoS consensus) to vulnerability classes in packet parsers, smart contracts, and protocol stacks.
vulnerable_server.sbl
CWE-190
CWE-787
CWE-416
Network packet parser that computes an allocation size, copies data, and frees on error. Integer overflow → undersized buffer → out-of-bounds write → use-after-free in the error path.
saple analyze examples/vulnerable_server.sbl \
--verbose
stack_buffer_overflow.sbl
CWE-121
CWE-787
x86-64 instruction chain where a loop copies user input into a stack frame without bounds checking. SAPLE finds the overflow and the return-address overwrite.
saple analyze examples/stack_buffer_overflow.sbl \
--verbose
network_protocol_stack.sbl
CWE-190
CWE-122
CWE-400
CWE-787
CWE-20
CWE-805
Multi-layer TCP/IP stack (Ethernet → IP → TCP → Application) with six classes of vulnerability: header underflow, fragment-reassembly overflow, SYN flood, heap overflow, malformed-frame acceptance, incorrect length.
saple analyze examples/network_protocol_stack.sbl \
--verbose
dining_philosophers.sbl
Deadlock
Liveness
The classic concurrency benchmark: 5 philosophers, 5 forks. Verifies noDeadlock, mutualExclusion, and progress.
saple analyze examples/dining_philosophers.sbl --verbose
token_contract.sbl
Reentrancy
CWE-190
Access
Race
Simplified ERC-20 token. Detects external-call reentrancy, unchecked mint overflow, unauthorized mint, and the approval double-spend race.
saple analyze examples/token_contract.sbl --verbose
cache_coherence.sbl
Data race
Stale read
Four-core MESI cache protocol. Detects concurrent writes without invalidation and stale reads of remotely-modified lines. Properties: coherence, exclusiveIsolation, liveness.
saple analyze examples/cache_coherence.sbl --verbose
consensus.sbl
PoS
Safety
Multi-node proof-of-stake consensus protocol with validator selection and block creation. Checks safety and liveness across configurations.
saple analyze examples/consensus.sbl --verbose
Rule extraction
Add --extract-rules to any of the above. SAPLE turns each finding into a reusable .sbl pattern, cross-validates it through the SMT solver, and stores it under patterns/generated/. On subsequent runs, those rules auto-load and apply to new files.
saple analyze examples/vulnerable_server.sbl \
--extract-rules --export rules.json \
--verbose