Symbiotic: Synergy of Instrumentation, Slicing, and Symbolic Execution

Abstract

We introduce a novel technique for finding real errors in programs. The technique is based on a synergy of three well-known methods: metacompilation, slicing, and symbolic execution. More precisely, we instrument a given program with a code that tracks runs of state machines representing various kinds of errors. Next we slice the program to reduce its size without affecting runs of state machines. And then we symbolically execute the sliced program. Depending on the kind of symbolic execution, the technique can be applied as a stand-alone bug finding technique, or to weed out some false positives from an output of another bug-finding tool. We provide several examples demonstrating the practical applicability of our technique.

Conditional Quantitative Program Analysis

“…We made minor modifications to invoke a model counter [36] to count computed intervals. ALPACA uses the CIVL symbolic executor for C programs [67]; it also enabled us to use a portfolio of 9 different analyzers that participated in the SV-COMP'19 competition for the synthesis of conditioning intervals, namely: CBMC [68], CPA-BAM-BnB [69], CPA-Seq [70], ESBMC-incr [71], PeSCo [72], Symbiotic [73], UltimateAutomizer [74], UltimateTaipan [75], and VeriAbs [76].…”

Symbiotic 5: Boosted Instrumentation

“…For many years, our attention has been focused mainly on slicing [2,6,8]. Only in 2016, we implemented a configurable instrumentation that enabled Symbiotic to check memory safety or, in general, any safety property.…”

Symbiotic 2: More Precise Slicing

“…Both Symbiotic [6] and Symbiotic 2 implement our verification approach proposed earlier [4]. The approach combines three standard techniques, namely code instrumentation, program slicing [7], and symbolic execution [3].…”