Symbiotic 8: Beyond Symbolic Execution

Abstract

Symbiotic 8 extends the traditional combination of static analyses, instrumentation, program slicing, and symbolic execution with one substantial novelty, namely a technique mixing symbolic execution with k-induction. This technique can prove the correctness of programs with possibly unbounded loops, which cannot be done by classic symbolic execution. Symbiotic 8 delivers also several other improvements. In particular, we have modified our fork of the symbolic executor Klee to support the comparison of symbolic pointers. Further, we have tuned the shape analysis tool Predator (integrated already in Symbiotic 7) to perform better on llvm bitcode. We have also developed a light-weight analysis of relations between variables that can prove the absence of out-of-bound accesses to arrays.

Eunomia: Enabling User-Specified Fine-Grained Search in Symbolically Executing WebAssembly Binaries

“…One of the key problems is the path explosion problem. To this end, different approaches have been proposed to reduce the searching spaces of paths [4,6,10,14,15,20,30,31,40,48,50,51,56,64,70,71]. However, current heuristics, no matter designed manually or learned by machine-learning techniques, are only effective for specific tasks and require substantial human work if migrated to other tasks.…”

Review of Software Model-Checking Techniques for Dealing with Error Detection in Program Codes

“…It uses a combination of program slicing and symbolic execution to check for memory safety, concurrency bugs, and other types of bugs. Symbiotic was proposed by [45] and has been shown to be effective in finding bugs in large C and C++ codebases. 5) SymDIVINE: SymDIVINE is a tool for the verification of distributed software systems.…”

“…Here are a few of them: 2) Scalability: Symbolic model checking can handle large and complex software systems with many possible execution paths and inputs. It can also handle programs with dynamic memory allocation and recursion, which are difficult to test with traditional methods [45].…”

Fast Computation of Strong Control Dependencies

“…We implemented our algorithms for the computation of NTSCD, DOD, and the NTSCD and DOD closure in C++ on top of the LLVM [25] infrastructure. The implementation is a part of the library for program analysis and slicing called DG [6], which is used for example in the verification and test generation tool Symbiotic [7]. We also implemented the original Ranganath et al's algorithms for NTSCD and DOD, the fixed versions of these algorithms from Subsects.…”