Fitness-guided path exploration in dynamic symbolic execution

Xie, Tao; Tillmann, Nikolai; Halleux, Jonathan de; Schulte, Wolfram

doi:10.1109/dsn.2009.5270315

Cited by 180 publications

(142 citation statements)

References 15 publications

Supporting

Mentioning

140

Contrasting

Unclassified

Order By: Relevance

“…Any path exploration algorithm can therefore be employed to perform dynamic symbolic execution for discovering buffer overflow vulnerabilities. We limited our evaluation to DFS and CFGDIRECTED, but we could have also compared SEBO with testing tools such as PEX [128] and FITNEX [141], which were used in the previous chapter for the evaluation of structural coverage testing. In summary, after the first testing time limit, DFS failed in 10 cases, CFGDIRECTED 16…”

Section: Methodsmentioning

confidence: 99%

“…To evaluate the effectiveness of our proposed approach, we conducted experiments on the selected test subjects, and compared SCT with two widely adopted search strategies, random input search (or RANDOM) and depth-first search (or DFS), and with three automated test input generation tools: CREST [19], PEX [128], and FITNEX [141]. For CREST, we chose the control-flow graph directed search strategy (or CFGDIRECTED), which was confirmed as the "best" search algorithm by the experimental data.…”

Section: Methodsmentioning

confidence: 99%

“…Furthermore, the use of fitness functions provides suitable measurement for targeting particular code elements of testing. These features of searchbased testing have been exploited to improve dynamic symbolic execution toward achieving high structural coverage by guiding path exploration [141] and by solving floating point computations [84].…”

Section: Search-based Testingmentioning

confidence: 99%

“…They include the sample, testloop, and hello_world functions. The first function was adopted from the work of Ferguson and Korel [52] while the last two functions were adopted from the work of Xie et al [141]. The next six test subjects, valves_nest<i> with i = {2, 5, 10, 20, 50, 100}, are from the work of Baluda et al [12].…”

Section: Test Subjectsmentioning

confidence: 99%

“…All the test subjects were in C code and to enable comparison with tools such as PEX [128] and FITNEX [141], we converted them to C# code. …”

Section: Test Subjectsmentioning

confidence: 99%

See 4 more Smart Citations

Goal-oriented dynamic test generation

Khoo

Fong

et al. 2015

Information and Software Technology

View full text Add to dashboard Cite

Section: Methodsmentioning

confidence: 99%

Section: Methodsmentioning

confidence: 99%

Section: Search-based Testingmentioning

confidence: 99%

Section: Test Subjectsmentioning

confidence: 99%

“…All the test subjects were in C code and to enable comparison with tools such as PEX [128] and FITNEX [141], we converted them to C# code. …”

Section: Test Subjectsmentioning

confidence: 99%

See 3 more Smart Citations

Goal-oriented dynamic test generation

Khoo

Fong

et al. 2015

Information and Software Technology

View full text Add to dashboard Cite

Design and implementation of a dynamic symbolic execution tool for windows executables

Chen

Zhang

Zhu

et al. 2013

J Software Evolu Process

View full text Add to dashboard Cite

Dynamic symbolic execution, or DSE for short, has become a promising technique in software testing. However, the implementation details of DSE have not been described in depth in existing works. Although some open-source DSE tools are available nowadays, to design and implement a specific DSE tool from scratch is necessary for some reasons. To this end, we implement a Smart Fuzzing Tool for Windows Native Executables, or SMAFE for short, which utilizes Pin and STP for instrumentation and constraint solving, respectively. Advantages of Pin and STP make SMAFE portable. The major contribution of this paper is our detailed description of the implementation of DSE, including symbolization of inputs, tracking of symbols, synchronization of overlapped symbols, environment modeling, and so on. A practical case study validates the effectiveness of SMAFE. Then, the experiments with two benchmark sets present that the code coverage is above 90% on average. Benefits from this paper are at least twofold: moderating learning curve for scholars and shortening the development circle for practitioners.instructions that affect EFLAGS is considerably large. Hence, the cost of the complete method is rather expensive. Furthermore, the complete method is more complete than we need because we empirically observed that only three instructions CMP, TEST, and SUB are commonly utilized for comparison in practice (account for 100% of comparisons in our experiments).As other instructions, comparison instructions also need to convert into the CRD language. CMP and SUB are converted into 'CMPn' operation straightforwardly. But the conversion of TEST is different. SMAFE does the conversion according to the semantics of TEST. For instance, here is an instruction 'TEST al, 10' and the register al is symbolized as input1. The conversion result in CRD language is '(CMP8 (AND8 input1 10) 0)'. Figure 9. Heuristic rules for searching in memory tables. 1262 T. CHEN ET AL.

show abstract

Search‐based testing using constraint‐based mutation

Malburg

2013

Software Testing Verif & Rel

View full text Add to dashboard Cite

SUMMARYMany modern automated test generators are based on either metaheuristic search techniques or use constraint solvers. Both approaches have their advantages, but they also have specific drawbacks: Search‐based methods may get stuck in local optima and degrade when the search landscape offers no guidance; constraint‐based approaches, on the other hand, can only handle certain domains efficiently. This paper describes a method that integrates both techniques and delivers the best of both worlds. On a high‐level view, the proposed method uses a genetic algorithm to generate tests, but the twist is that during evolution, a constraint solver is used to ensure that mutated offspring efficiently explores different control flow. Experiments on 20 case study programmes show that on average the combination improves branch coverage by 28% over search‐based techniques while reducing the number of tests by 55%, and improves coverage by 13% over constraint‐based techniques while reducing the number of tests by 73%. Copyright © 2013 John Wiley & Sons, Ltd.

show abstract

Fitness-guided path exploration in dynamic symbolic execution

Cited by 180 publications

References 15 publications

Goal-oriented dynamic test generation

Goal-oriented dynamic test generation

Design and implementation of a dynamic symbolic execution tool for windows executables

Search‐based testing using constraint‐based mutation

Contact Info

Product

Resources

About