Copying files between the host and the guest

The s2ecmd get and s2ecmd put commands allow transfering files between the guest virtual machine and the host during symbolic execution even when there is no network available. If you use s2e-env and stock VM images, these two utilities are already included in the guest VM.

s2ecmd get

In order to copy a file from the host to the guest VM, add the following command to the desired location in your

./s2ecmd get <filename>

<filename> specifies the file to copy from the host into the guest. Note that the filename argument to s2ecmd get must be specified relative to the HostFiles plugin base directory (see below).

If <filename> is an executable file that you want to run, you may use the following command:

./s2ecmd get <filename> && chmod +x ./<filename> && ./<filename>


To see a real example of how to use this command, have a look at the file generated by s2e-env. This script already contains several invocations of s2ecmd get, which copy the binary to analyze from the host to the guest VM, together with several other support files.

s2ecmd put

To copy a file fileName from the guest to the host, run the following command:

./s2ecmd put fileName

This uploads fileName in the guest to the s2e-last/outfiles directory on the host. This is useful, e.g., if a program that you are analyzing generates a core dump and you want to inspect it on your host.


The upload will fail if a file with the same name already exists in the outfiles directory.

Setting up the HostFiles Plugin

s2ecmd get and s2ecmd put require configuring the HostFiles plugin in the S2E configuration file (s2e-config.lua). The configuration looks as follows:

plugins = {


pluginsConfig.HostFiles = {
    baseDirs = {

    -- This option must be enabled for s2eput to work
    allowWrite = true,


If you use s2e-env, the basic configuration is already there. You do not have to modify it unless you need to access files that are stored outside of your project folder. Do not change the existing directory configuration (in particular guestfs folder paths).

The pluginsConfig.HostFiles.baseDirs configuration option specifies what directories on the host should be shared with the guest. The paths can be either absolute, relative, or empty. If an empty directory is specified the S2E output directory will be exported.

The pluginsConfig.HostFiles.allowWrite must be set to true for allowing writes to the base directories.