A Survey of Symbolic Execution Techniques

Baldoni, Roberto; Coppa, Emilio; D’Elia, Daniele Cono; Demetrescu, Camil; Finocchi, Irene

doi:10.1145/3182657

Cited by 417 publications

(233 citation statements)

References 123 publications

Supporting

Mentioning

227

Contrasting

Unclassified

Order By: Relevance

“…Our focus is on providing representative examples of orthogonal choices in the design space of memory models. For a more exhaustive overview of symbolic execution tools and their underlying ideas, we refer the reader to a recent survey [1].…”

Section: Contributionsmentioning

confidence: 99%

“…A = ARRAY()) or an array expression with one or more nested STORE expressions (e.g. A = STORE(STORE(ARRAY(), 0, 10), 1,20)).…”

Section: Memory Object Reasoningmentioning

confidence: 99%

“…Symbolic execution is a technique for program property verification largely employed in the software testing and security domains [1]. By taking on symbolic rather than concrete input values, multiple execution paths can be explored at once, with each path describing the program's behaviour for a well-defined class of inputs.…”

Section: Introductionmentioning

confidence: 99%

“…§ § For instance, the array expression v = SELECT(STORE(STORE(ARRAY(size=2), 0, 1), 1, 2),˛x), where˛x is a symbolic input, is converted into the following replay sequence: bv = MemSight(size=2); bv.store(0, 1); bv.store(1,2); v = bv.load(˛x).© 2019 John Wiley & Sons, Ltd. Softw. Test.…”

mentioning

confidence: 99%

See 3 more Smart Citations

Memory models in symbolic execution: key ideas and new thoughts

Borzacchiello

Coppa

D’Elia

et al. 2019

Software Testing Verif & Rel

Self Cite

View full text Add to dashboard Cite

Symbolic execution is a popular program analysis technique that allows seeking for bugs by reasoning over multiple alternative execution states at once. As the number of states to explore may grow exponentially, a symbolic executor may quickly run out of space. For instance, a memory access to a symbolic address may potentially reference the entire address space, leading to a combinatorial explosion of the possible resulting execution states. To cope with this issue, state-of-the-art executors either concretize symbolic addresses that span memory intervals larger than some threshold or rely on advanced capabilities of modern satisfiability modulo theories solvers. Unfortunately, concretization may result in missing interesting execution states, for example, where a bug arises, while offloading the entire problem to constraint solvers can lead to very large query times. In this article, we first contribute to systematizing knowledge about memory models for symbolic execution, discussing how four mainstream symbolic executors deal with symbolic addresses. We then introduce MEMSIGHT, a new approach to symbolic memory that reduces the need for concretization: rather than mapping address instances to data as previous approaches do, our technique maps symbolic address expressions to data, maintaining the possible alternative states resulting from the memory referenced by a symbolic address in a compact, implicit form. Experiments on prominent programs show that MEMSIGHT, which we implemented in both ANGR and KLEE, enables the exploration of states that are unreachable for memory models that perform concretization and provides a performance level comparable with memory models relying on advanced solver theories. MEMORY MODELS IN SYMBOLIC EXECUTION: KEY IDEAS AND NEW THOUGHTS3 of 35 used in the context of state-of-the-art symbolic executors. A crucial design goal for our approach is that it should be general enough not only to support bug detection but also to be valuable in application contexts where users are interested in possible consequences of these bugs, for example, understanding how they can be exploited.Our approach, which we call MEMSIGHT, natively accounts for merging [3,4], a mainstream performance enabler in symbolic executors. We integrated MEMSIGHT into the state-of-the-art symbolic executors ANGR [5] and KLEE [6]: an experimental evaluation shows that MEMSIGHT allows for broader state exploration on prominent benchmarks analysed with ANGR, while it provides valuable run-time speedups when symbolically executing real-world programs under KLEE.A preliminary version [7] of this work appeared in the Proceedings of the 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE 2017), where we introduced the main idea behind MEMSIGHT (Section 3) and presented a preliminary experimental evaluation related to MEMSIGHT when integrated into ANGR (Section 5.2.2). ‡ For our example to be meaningful, we assume that b resides in memory rather than in a CPU register. § In SMT-LIB [9], the theories of...

show abstract

Section: Contributionsmentioning

confidence: 99%

“…A = ARRAY()) or an array expression with one or more nested STORE expressions (e.g. A = STORE(STORE(ARRAY(), 0, 10), 1,20)).…”

Section: Memory Object Reasoningmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

Memory models in symbolic execution: key ideas and new thoughts

Borzacchiello

Coppa

D’Elia

et al. 2019

Software Testing Verif & Rel

Self Cite

View full text Add to dashboard Cite

show abstract

“…These can be categorized as concolic testers, where the construction of the path condition follows an actual execution of the program. Surveys of symbolic execution are in [10], [28].…”

Section: Related Workmentioning

confidence: 99%

Benchmarking Symbolic Execution Using Constraint Problems - Initial Results

Verma

Yap

2019

2019 IEEE 31st International Conference on Tools With Artificial Intelligence (ICTAI)

View full text Add to dashboard Cite

Symbolic execution is a powerful technique for bug finding and program testing. It is successful in finding bugs in real-world code. The core reasoning techniques use constraint solving, path exploration, and search, which are also the same techniques used in solving combinatorial problems, e.g., finitedomain constraint satisfaction problems (CSPs). We propose CSP instances as more challenging benchmarks to evaluate the effectiveness of the core techniques in symbolic execution. We transform CSP benchmarks into C programs suitable for testing the reasoning capabilities of symbolic execution tools. From a single CSP P, we transform P depending on transformation choice into different C programs. Preliminary testing with the KLEE, Tracer-X, and LLBMC tools show substantial runtime differences from transformation and solver choice. Our C benchmarks are effective in showing the limitations of existing symbolic execution tools. The motivation for this work is we believe that benchmarks of this form can spur the development and engineering of improved core reasoning in symbolic execution engines.

show abstract

Static Detection of File Access Control Vulnerabilities on Windows System

Lü

Wang

et al. 2020

Concurrency and Computation

View full text Add to dashboard Cite

Summary Traditional applications have been developed for decades. Most of the security research around them have focused on the detection of memory corruption vulnerabilities, such as buffer overflow, double fetch, and integer overflow. On the contrary, logic bugs, a kind of flaws caused by unreasonable application logic, attract much less attention. Files are the most common media for programs to persist their data in the system. As the file owners, programs are responsible for protecting their files from malicious users' tampering by leveraging access control mechanisms. However, if a program configures their access control mechanisms in wrong ways and causes evil users to bypass security checks to access files, there exists a file access control vulnerability. As a branch of logic flaws, file access control vulnerabilities are less popular with researchers. Thus, to mitigate the harm of the file access control vulnerabilities on Windows system, our team conducted first‐step research on them. We first classified file access control bugs into two types and codified some bug patterns. Then we formalized file access control vulnerabilities to propose a scalable detection method and implemented a lightweight analysis system StaticFAC. After evaluating StaticFAC in real‐world Windows software, we discovered 15 0‐day bugs.

show abstract

A Survey of Symbolic Execution Techniques

Cited by 417 publications

References 123 publications

Memory models in symbolic execution: key ideas and new thoughts

Memory models in symbolic execution: key ideas and new thoughts

Benchmarking Symbolic Execution Using Constraint Problems - Initial Results

Static Detection of File Access Control Vulnerabilities on Windows System

Contact Info

Product

Resources

About