Hi all, I am working around array using a plugin to the analyzer. And I face a problem here, I would like to be able to build a transformed representation of an element of the array from its subscript representation to its address representation (vice versa). To image what I'm saying, I'm looking for a way to pass from 't[(int)index]' to '&t + index * sizeof(element)', and from '&t + offset' to 't[offset / sizeof(element)]'. From now, I'll use: - "subscript form" for the 't[index]' representation. - "address form" for the '&t + offset' representation. I tried to do it manually: - only using the analyzer API (using /ana::region_model_manager::get_or_create_binop/) to get the corresponding /svalue/ (i.e. address form) of a subscript form. - by first building the /tree/ in address form using GIMPLE API (/fold_buildn/) and using analyzer API (/ana::region_model::get_rvalue/) to get its corresponding /svalue./ I managed to do it from the /tree/ in the subscript form, except that I can't use it to check if this /svalue/ is tracked within the current /sm_state_map/ because it's hash would be different than from the one potentially within the map, although they are semantically equivalent. Is there by any chance an API within the analyzer which allow to go over the live svalues? Cheers, -- Pierrick