TracerX: Dynamic Symbolic Execution with Interpolation (Competition Contribution)

Abstract

Dynamic Symbolic Execution (DSE) is an important method for testing of programs. An important system on DSE is KLEE [1] which inputs a C/C++ program annotated with symbolic variables, compiles it into LLVM, and then emulates the execution paths of LLVM using a specified backtracking strategy. The major challenge in symbolic execution is path explosion. The method of abstraction learning [7] has been used to address this. The key step here is the computation of an interpolant to represent the learned abstraction. TracerX, our tool, is built on top of KLEE and it implements and utilizes abstraction learning. The core feature in abstraction learning is subsumption of paths whose traversals are deemed to no longer be necessary due to similarity with already-traversed paths. Despite the overhead of computing interpolants, the pruning of the symbolic execution tree that interpolants provide often brings significant overall benefits. In particular, TracerX can fully explore many programs that would be impossible for any non-pruning system like KLEE to do so.

Exhaustive Branch Coverage with TreeFrog

“…As a result, [7] proposes using interpolants in concolic test generation, but for depth-first path coverage and not branch coverage and by eagerly exploring subtrees in parallel with concolic generation. TracerX [6] extends this work with more sophisticated interpolants and is implemented as an extension of dynamic symbolic execution instead of a concolic test generator. In these papers, the interpolant expresses conditions for feasible coverage of at least one assertion violation or runtime error in the subtree.…”

WBS: Weighted Backtracking Strategy for Symbolic Testing of Embedded Software

“…TABLE 1 shows the list of benchmark programs that we used in our experiments and the results obtained. We used the benchmark programs which are used by other symbolic execution tools [11] [12] [1]. As we are concentrating on embedded software, apart from available benchmarks, we have converted a set of single task programmable logic control programs [13] into its equivalent C program.…”