Context-Sensitive Relevancy Analysis for Efficient Symbolic Execution

Abstract

Abstract. Symbolic execution is a flexible and powerful, but computationally expensive technique to detect dynamic behaviors of a program. In this paper, we present a context-sensitive relevancy analysis algorithm based on weighted pushdown model checking, which pinpoints memory locations in the program where symbolic values can flow into. This information is then utilized by a code instrumenter to transform only relevant parts of the program with symbolic constructs, to help improve the efficiency of symbolic execution of Java programs. Our technique is evaluated on a generalized symbolic execution engine that is developed upon Java Path Finder with checking safety properties of Java applications. Our experiments indicate that this technique can effectively improve the performance of the symbolic execution engine with respect to the approach that blindly instruments the whole program.

Exploiting undefined behaviors for efficient symbolic execution

“…A prior static analysis of the program can be used to compute useful information to speed up subsequent dynamic symbolic execution. The computed information can be used to transform the program based on the relevancy of certain functions for symbolic execution [21] or dependence of modules within the program [5]. However, in these techniques the symbolic execution engine also needs to be modified in order to take advantage of the information computed by the prior static analysis.…”

Bridging the Gap Between GUI Functional System Testing and Functional System Logic Testing

“…In this technique, the declared type of each program variable is replaced with another type in the instrumented program so that variables in the instrumented software can store symbolic values. This technique [153] is used in existing symbolic execution systems such as Java Path Finder [167] and its adaptation Symbolic Pathfinder [168]; Juzi [169], the system used in context-sensitive analysis in which execution context is analyzed to check memory allocation and reduce computation [170]; and JFuzz [162].…”