Angelic Checking within Static Driver Verifier: Towards high-precision defects without (modeling) cost

Lahiri, Shuvendu K.; Lal, Akash; Gopinath, S; Nutz, Alexander; Levin, Vladimir; Kumar, Rahul; Deisinger, Nate; Lichtenberg, Jakob; Bansal, Chetan

doi:10.34727/2020/isbn.978-3-85448-042-6_24

Cited by 3 publications

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

Interactive Theorem Proving Modulo Fuzzing

Muduli,

Padulkar,

Roy

2024

Computer Aided Verification

View full text Add to dashboard Cite

Interactive theorem provers (ITPs) exploit the collaboration between humans and computers, enabling proof of complex theorems. Further, ITPs allow extraction of provably correct implementations from proofs. However, often, the extracted code interface with external libraries containing real-life complexities—proprietary library calls, remote/cloud APIs, complex models like ML models, inline assembly, highly non-linear arithmetic, vector instructions etc. We refer to such functions/operations as closed-box components. For such components, the user has to provide appropriate assumed lemmas to model the behavior of these functions. However, we found instances where these assumed lemmas are inconsistent with the actual semantics of these closed-box components. Hence, even correct-by-construction code extracted from an ITP may still behave incorrectly when interfaced with such closed-box components.To this end, we propose StarFuzz, that allows the $$\text {F}^\star $$ F ⋆ interactive theorem prover to provide better end-to-end assurance on the application— even when interfaced with the closed-box components. Under the hood, StarFuzz rides on Sādhak, an SMT solver that combines fuzz testing to allow satisfiability checking over closed-box components. On the $$\text {F}^\star $$ F ⋆ library that includes external implementations in OCaml, StarFuzz discovered four bugs—one bug that revealed an error on the assumed lemmas for a closed-box function, and three bugs in the external implementations of these components.

show abstract

Interactive Theorem Proving Modulo Fuzzing

Muduli,

Padulkar,

Roy

2024

Computer Aided Verification

View full text Add to dashboard Cite

show abstract

Specification synthesis with constrained Horn clauses

Prabhu

Fedyukovich

Madhukar

et al. 2021

Proceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

Satisfiability modulo fuzzing: a synergistic combination of SMT solving and fuzzing

Muduli

Roy

2022

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Programming languages and software engineering tools routinely encounter components that are difficult to reason on via formal techniques or whose formal semantics are not even available—third-party libraries, inline assembly code, SIMD instructions, system calls, calls to machine learning models, etc. However, often access to these components is available as input-output oracles—interfaces are available to query these components on certain inputs to receive the respective outputs. We refer to such functions as closed-box functions . Regular SMT solvers are unable to handle such closed-box functions. We propose Sādhak, a solver for SMT theories modulo closed-box functions. Our core idea is to use a synergistic combination of a fuzzer to reason on closed-box functions and an SMT engine to solve the constraints pertaining to the SMT theories. The fuzz and the SMT engines attempt to converge to a model by exchanging a rich set of interface constraints that are relevant and interpretable by them. Our implementation, Sādhak, demonstrates a significant advantage over the only other solver that is capable of handling such closed-box constraints: Sādhak solves 36.45% more benchmarks than the best-performing mode of this state-of-the-art solver and has 5.72x better PAR-2 score; on the benchmarks that are solved by both tools, Sādhak is (on an average) 14.62x faster.

show abstract

Angelic Checking within Static Driver Verifier: Towards high-precision defects without (modeling) cost

Cited by 3 publications

References 22 publications

Interactive Theorem Proving Modulo Fuzzing

Interactive Theorem Proving Modulo Fuzzing

Specification synthesis with constrained Horn clauses

Satisfiability modulo fuzzing: a synergistic combination of SMT solving and fuzzing

Contact Info

Product

Resources

About