Predator Hunting Party (Competition Contribution)

Abstract

This paper introduces PredatorHP (Predator Hunting Party), a program verifier built on top of the Predator shape analyser, and discusses its participation in the SV-COMP'15 software verification competition. Predator is a sound shape analyser dealing with C programs with lists implemented via low-level pointer operations. PredatorHP uses Predator to prove programs safe while at the same time using several bounded versions of Predator for bug hunting. The Underlying Verification ApproachAt the heart of PredatorHP there is the Predator shape analyser [2]. The main aim of Predator is sound shape analysis of sequential, non-recursive C programs that use lowlevel pointer operations for working efficiently with various kinds of linked lists. Predator supports many advanced uses of pointer arithmetics, address alignment, and block operations common in highly optimized system code, such as operating system kernels, drivers, memory allocators, and the like.Predator is based on abstract interpretation with the abstract domain of symbolic memory graphs (SMGs) [2]. In a nutshell, SMGs consist of two kinds of nodesnamely, individual memory regions and uninterrupted list segments-and two kinds of edges, in particular, the so-called has-value and points-to edges. SMGs were inspired by separation logic with higher-order list predicates but with an added support for lowlevel memory operations. Moreover, all the needed algorithms for dealing with SMGs (symbolic execution of program statements, the join operator, widening in the form of abstraction, entailment checking) were newly designed to be as efficient as possible by leveraging the graph structure of SMGs. The most essential role is played by the join operator: both abstraction and entailment checking are built on top of it. Predator supports inter-procedural analysis by means of function summaries.Recently, a new extension of Predator was implemented [1]. It uses the Predator kernel for transforming programs with list containers implemented by low-level pointer operations into equivalent programs with high-level container operations, which can be useful, e.g., for code understanding, easier verification, parallelisation, optimisation, etc.

Verification Artifacts in Cooperative Verification: Survey and Unifying Component Framework

“…CPAchecker [26] won the competition on software verification 2013 (SV-COMP'13, [7]) using a sequential combination [97] that started with explicit-state model checking for up to 100 s and then switched to a predicate analysis [27]. and PredatorHP [77], which start several different strategies simultaneously and take the result from the approach that terminates first.…”

PredatorHP Revamped (Not Only) for Interval-Sized Memory Regions and Memory Reallocation (Competition Contribution)

“…Recursive programs are, however, analysed up to a given call depth only. PredatorHP, i.e., the Predator Hunting Party [3,4], whose flow of control is shown on the right, is implemented as a Python script, and used to increase the efficiency and precision of the analysis. Namely, PredatorHP runs the base Predator verifier in parallel with several Predator hunters that do not use the list-segment abstraction, do not join semantically different SMGs, nor use function summaries with matching of call parameters based on SMG entailment.…”

Verification Artifacts in Cooperative Verification: Survey and Unifying Component Framework

“…Parallel Combinations. Examples of parallel combinations are the verifiers Ufo [47] and PredatorHP [62], which start several different strategies simultaneously and take the result from the approach that terminates first.…”