Regular Property Guided Dynamic Symbolic Execution

Zhang, Yufeng; Chen, Zhenbang; Wang, Ji; Dong, Wei; Liu, Zhiming

doi:10.1109/icse.2015.80

Cited by 36 publications

(15 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In order to find exploitable bugs, Mayhem [25] instead gives priority to paths where memory accesses to symbolic addresses are identified or symbolic instruction pointers are detected. [118] proposes a novel method of dynamic symbolic execution to automatically find a program path satisfying a regular property, i.e., a property (such as file usage or memory safety) that can be represented by a Finite State Machine (FSM). Dynamic symbolic execution is guided by the FSM so that branches of an execution path that are most likely to satisfy the property are explored first.…”

Section: Path Selectionmentioning

confidence: 99%

A Survey of Symbolic Execution Techniques

et al. 2018

View full text Add to dashboard Cite

Many security and software testing applications require checking whether certain properties of a program hold for any possible usage scenario. For instance, a tool for identifying software vulnerabilities may need to rule out the existence of any backdoor to bypass a program's authentication. One approach would be to test the program using different, possibly random inputs. As the backdoor may only be hit for very specific program workloads, automated exploration of the space of possible inputs is of the essence. Symbolic execution provides an elegant solution to the problem, by systematically exploring many possible execution paths at the same time without necessarily requiring concrete inputs. Rather than taking on fully specified input values, the technique abstractly represents them as symbols, resorting to constraint solvers to construct actual instances that would cause property violations. Symbolic execution has been incubated in dozens of tools developed over the last four decades, leading to major practical breakthroughs in a number of prominent software reliability applications. The goal of this survey is to provide an overview of the main ideas, challenges, and solutions developed in the area, distilling them for a broad audience.If you are considering citing this survey, we would appreciate if you could use the following BibTeX entry: http://goo.gl/Hf5Fvc 0:2 R. Baldoni et al.

show abstract

Section: Path Selectionmentioning

confidence: 99%

A Survey of Symbolic Execution Techniques

et al. 2018

View full text Add to dashboard Cite

show abstract

“…There are various code-analysis related works that employ the finite state machines as the fundamental abstraction. The work by Zhang et al uses dynamic symbolic execution to guide the static analysis to explore program paths which have a specific class of properties [16]. These properties are called regular, and the most crucial aspect of them is that the decision problem of whether a program path satisfies given property can be formulated with an FSM.…”

Section: Related Workmentioning

confidence: 99%

A DSL for Resource Checking Using Finite State Automaton-Driven Symbolic Execution

Fülöp

Pataki

2020

Open Computer Science

View full text Add to dashboard Cite

Static analysis is an essential way to find code smells and bugs. It checks the source code without execution and no test cases are required, therefore its cost is lower than testing. Moreover, static analysis can help in software engineering comprehensively, since static analysis can be used for the validation of code conventions, for measuring software complexity and for executing code refactorings as well. Symbolic execution is a static analysis method where the variables (e.g. input data) are interpreted with symbolic values. Clang Static Analyzer is a powerful symbolic execution engine based on the Clang compiler infrastructure that can be used with C, C++ and Objective-C. Validation of resources’ usage (e.g. files, memory) requires finite state automata (FSA) for modeling the state of resource (e.g. locked or acquired resource). In this paper, we argue for an approach in which automata are in-use during symbolic execution. The generic automaton can be customized for different resources. We present our domain-specific language to define automata in terms of syntactic and semantic rules. We have developed a tool for this approach which parses the automaton and generates Clang Static Analyzer checker that can be used in the symbolic execution engine. We show an example automaton in our domain-specific language and the usage of generated checker.

show abstract

“…Symbolic backward execution [Chandra et al 2009;Dinges and Agha 2014] performs in the reverse direction of normal execution to identify an input instance to satisfy a given post-condition. Different path selection strategies are proposed for different analysis goals [Cadar et al 2008;Ma et al 2011;Zhang et al 2015]. Our worst-case input generation algorithm essentially performs symbolic execution with a depth-first path selection strategy, but utilizes typing derivations to prune the search space as well as guide the search.…”

Section: Related Workmentioning

confidence: 99%

Type-guided worst-case input generation

Wang

Hoffmann

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

This paper presents a novel technique for type-guided worst-case input generation for functional programs. The technique builds on automatic amortized resource analysis (AARA), a type-based technique for deriving symbolic bounds on the resource usage of functions. Worst-case input generation is performed by an algorithm that takes as input a function, its resource-annotated type derivation in AARA, and a skeleton that describes the shape and size of the input that is to be generated. If successful, the algorithm fills in integers, booleans, and data structures to produce a value of the shape given by the skeleton. The soundness theorem states that the generated value exhibits the highest cost among all arguments of the functions that have the shape of the skeleton. This cost corresponds exactly to the worst-case bound that is established by the type derivation. In this way, a successful completion of the algorithm proves that the bound is tight for inputs of the given shape. Correspondingly, a relative completeness theorem is proved to show that the algorithm succeeds if and only if the derived worst-case bound is tight. The theorem is relative because it depends on a decision procedure for constraint solving. The technical development is presented for a simple first-order language with linear resource bounds. However, the technique scales to and has been implemented for Resource Aware ML, an implementation of AARA for a fragment of OCaml with higher-order functions, user-defined data types, and types for polynomial bounds. Experiments demonstrate that the technique works effectively and can derive worst-case inputs with hundreds of integers for sorting algorithms, operations on search trees, and insertions into hash tables.

show abstract

Regular Property Guided Dynamic Symbolic Execution

Cited by 36 publications

References 40 publications

A Survey of Symbolic Execution Techniques

A Survey of Symbolic Execution Techniques

A DSL for Resource Checking Using Finite State Automaton-Driven Symbolic Execution

Type-guided worst-case input generation

Contact Info

Product

Resources

About