OSMOSE: automatic structural testing of executables

Abstract

Verification is usually performed on a high‐level view of the software, either specification or program source code. However, in certain circumstances verification is more relevant when performed at the machine‐code level. This paper focuses on automatic test data generation from a stand‐alone executable. Low‐level analysis is much more difficult than high‐level analysis since even the control‐flow graph is not available and bit‐level instructions have to be modelled faithfully. The paper shows how ‘path‐based’ structural test data generation can be adapted from structured language to machine code, using both state‐of‐the‐art technologies and innovative techniques. The results have been implemented in a tool named OSMOSE and encouraging experiments have been conducted. Copyright © 2010 John Wiley & Sons, Ltd.

Binary-Level Testing of Embedded Programs

“…Overview OSMOSE is a binary-level DSE tool [3], [5]. It takes as input an executable file, an entry address, a description of the initial memory state and a coverage criterion (plus optional DSE parameters).…”

“…In the past years, we developed and used our own binarylevel DSE tool OSMOSE [3], [5] in a number of case-studies from aeronautics (in collaboration with SAGEM, French aeronautic equipment manufacturer) and energy (in collaboration with EdF, French energy supplier). In this article, we describe several features that we found of practical interest for the success of these case-studies.…”

The BINCOA Framework for Binary Code Analysis

“…Osmose: test data generation. Osmose [3,4] is a test data generation tool for binary code, based on dynamic symbolic execution and bit-vector constraint solving. The tool also offers test suite replay via a simulation engine, test suite completion, (unsafe) test suite coverage estimation, (under-approximated) CFG recovery and a graphical user interface.…”

“…We are aware of two other generic low-level models suitable for executable analysis, but none of them is open. DBA can be seen as the successor of the Generic Assembly Language (GAL) of Osmose [4], which is similar to DBAinbothgoalsand shape. However DBA are more concise, easier to manipulate andmoreexpressivethan GAL.…”

“…3-DBA are already used by three different analysers: Osmose [3,4] for test generation, TraceAnalyzer for safe Control-Flow Graph (CFG) reconstruction (based on [6]) and Insight, a platform providing front-end, simulation and some value analysis mechanism. Altogether, these three tools prove that DBA can encode a few different architectures and ISAs (including PowerPC and x86).…”