Leaf: An Instrumentation-based Dynamic Analysis Framework for Rust

2026-07-16

AI Summary

Rust lacks a general-purpose dynamic analysis framework capable of supporting diverse runtime analyses. This work proposes DMIR, the first natively Rust-based, event-driven dynamic analysis infrastructure, which captures MIR-level semantics through compiler instrumentation and, for the first time, integrates high-level language features—such as ownership, types, and the memory model—into dynamic analysis. Runtime behaviors are exposed as structured event streams, enabling rich semantic introspection. Leveraging DMIR, we implement three classes of analysis tools: concolic execution, Rust-specific checkers, and control-flow tracing, demonstrating its expressiveness and practicality while maintaining acceptable runtime overhead.

Abstract

This paper presents LEAF, an instrumentation-based dynamic analysis framework for Rust. Although Rust has grown rapidly in recent years, the landscape of program analysis tools for Rust is still in relatively early stages. One notable gap is the lack of a general-purpose dynamic analysis framework that can support different analysis tasks. LEAF aims to fill this gap by providing a Rust-native framework for analyzing Rust programs at runtime. Rust provides rich semantic information through its ownership model, type system, memory model, and compiler-level representation. Therefore, LEAF focuses on how to make this information available to dynamic analyses. In particular, LEAF captures MIR-level semantic information, augments it with runtime facts, and delivers it to analyses as an event stream through Dynamic MIR (DMIR), an event-driven programming interface. Through three substantial dynamic analyses -- a concolic executor, a Rust-specific sanitizer, and a control-flow tracer -- we demonstrate the practicality and expressiveness of LEAF. Our evaluation further shows that LEAF's compile-time and runtime overhead is meaningful but manageable.

Problem

• dynamic analysis
• Rust
• program analysis
• instrumentation
• MIR

Innovation

• dynamic analysis
• Rust
• MIR
• instrumentation
• ownership model