Model Generation for Quantified Formulas: A Taint-Based Approach

Abstract

We focus in this paper on generating models of quantified first-order formulas over built-in theories, which is paramount in software verification and bug finding. While standard methods are either geared toward proving the absence of solution or targeted to specific theories, we propose a generic approach based on a reduction to the quantifierfree case. Our technique allows thus to reuse all the efficient machinery developed for that context. Experiments show a substantial improvement over state-of-the-art methods. IntroductionContext. Software verification methods have come to rely increasingly on reasoning over logical formulas modulo theory. In particular, the ability to generate models (i.e., find solutions) of a formula is of utmost importance, typically in the context of bug finding or intensive testing -symbolic execution [19] or bounded model checking [7]. Since quantifier-free first-order formulas on well-suited theories are sufficient to represent many reachability properties of interest, the Satisfiability Modulo Theory (SMT) [6,22] community has primarily dedicated itself to designing solvers able to efficiently handle such problems.Yet, universal quantifiers are sometimes needed, typically when considering preconditions or code abstraction. Unfortunately, most theories handled by SMTsolvers are undecidable in the presence of universal quantifiers. There exist dedicated methods for a few decidable quantified theories, such as Presburger arithmetic [9] or the array property fragment [8], but there is no general and effective enough approach for the model generation problem over universally quantified formulas. Indeed, generic solutions for quantified formulas involving heuristic instantiation and refutation are geared at proving the unsatisfiability of a formula (i.e., absence of solution) [12,18], while recent proposals such as local theory extensions [2], finite instantiation [27,28] or model-based instantiation [25,18] either are too narrow in scope, or handle quantifiers on free sorts only, or restrict themselves to finite models, or may get stuck in infinite refinement loops.Goal and challenge. Our goal is to propose a generic and efficient approach to the model generation problem over arbitrary quantified formulas with support for theories commonly found in software verification. Due to the huge effort made by the community to produce state-of-the-art solvers for quantifier-free theories (QF-solvers), it is highly desirable for this solution to be compatible with current leading decision procedures, namely SMT approaches.Proposal. Our approach turns a quantified formula into a quantifier-free formula with the guarantee that any model of the later contains a model of the former. The benefits are threefold: the transformed formula is easier to solve, it can be sent to standard QF-solvers, and a model for the initial formula is deducible from a model of the transformed one. The idea is to ignore quantifiers but strengthen the quantifier-free part of the formula with an independence condition constr...

Binsec/Rel: Symbolic Binary Analyzer for Security with Applications to Constant-Time and Secret-Erasure

“…in prior large scale studies on both adversarial code and managed code [61,95,96,97]. The IR lifting part has been positively evaluated in an external study [98] and the symbolic engine features aggressive formula optimizations [73].…”

Not All Bugs Are Created Equal, But Robust Reachability Can Tell the Difference

“…Our prototype of Robust Symbolic Execution (RSE) relies on the ability of state of the art Satisfiability Modulo Theory (SMT) solvers [4] to generate models for universally quantified formulas [25,27,44], which comes with a performance and completeness cost-yet we report promising results.…”

“…For other theories, generic methods like E-matching [40] and MBQI [27] have proven rather efficient, although not complete. Sound approximations [25] also have been proposed to reduce quantified formulas to quantifier-free ones. In our experiments, the newly introduced quantifier associates to an increase in the frequency of time-outs and memoryouts, as seen in Sect.…”

Arrays Made Simpler: An Efficient, Scalable and Thorough Preprocessing

“…For reproducibility purposes source code and benchmarks are available online 2 . The implementation comprises 6,300 lines of OCaml integrated into the Tfml SMT formula preprocessing engine [19], part of the Binsec symbolic execution tool [15]. It comprises all simplifications and optimizations described in Sec.…”