Deriving abstract transfer functions for analyzing embedded software

Abstract

This paper addresses the problem of creating abstract transfer functions supporting dataflow analyses. Writing these functions by hand is problematic: transfer functions are difficult to understand, difficult to make precise, and difficult to debug. Bugs in transfer functions are particularly serious since they defeat the soundness of any program analysis running on top of them. Furthermore, implementing transfer functions by hand is wasteful because the resulting code is often difficult to reuse in new analyzers and to analyze new languages. We have developed algorithms and tools for deriving transfer functions for the bitwise and unsigned interval abstract domains. The interval domain is standard; in the bitwise domain, values are vectors of three-valued bits. For both domains, important challenges are to derive transfer functions that are sound in the presence of integer overflow, and to derive precise transfer functions for operations whose semantics are a mismatch for the domain (i.e., bit-vector operations in the interval domain and arithmetic operations in the bitwise domain). We can derive transfer functions, and execute them, in time linear in the bitwidth of the operands. These functions are maximally precise in most cases. Our generated transfer functions are parameterized by a bitwidth and are independent of the language being analyzed, and also of the language in which the analyzer is written. Currently, we generate interval and bitwise transfer functions in C and OCaml for analyzing C source code, ARM object code, and AVR object code. We evaluate our derived functions by using them in an interprocedural dataflow analyzer.

Signedness-Agnostic Program Analysis: Precise Integer Bounds for Low-Level Code

“…Simon and King [8] show how to make polyhedral analysis wrapping-aware without incurring a high additional cost. Regehr and Duongsaa [6] perform bounds analysis in a wrapping-aware manner, dealing also with bit-wise operations, but as their analysis uses conventional intervals, it is not able to maintain the precision offered by wrapped intervals.…”

Abstract Interpretation over Non-lattice Abstract Domains

“…One approach to handling machine arithmetic is to select a fixed wrapping point on the number circle, and represent values as intervals in the range Öv min , v max ×. For example, Regehr and Duongsaa [13] perform bounds analysis in a sound, wrapping-aware manner (dealing also with bit-wise operations) but as their analysis uses conventional intervals, precision is lost when sets of values cross the selected wrapping point.…”

Automated synthesis of symbolic instruction encodings from I/O samples

“…Moreover, the BDD encodings are often too large (several Kbs) to satisfy our conciseness requirement, which is imperative in our context to allow for bit-precise symbolic execution of long program execution traces as is needed for whitebox fuzzing [6]. In follow-up work, [18] develops another technique that assumes a structural constraint on the function being synthesized (analogous to template-based synthesis) and scales to larger instructions. However, the synthesized functions are again for certain abstract domains.…”