Path exploration based on symbolic output

Qi, Dawei; Nguyen, Hoang Duong Thien; Roychoudhury, Abhik

doi:10.1145/2522920.2522925

Cited by 24 publications

(11 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Interference of two inputs happens when they jointly affect one statement, or statements linked by control or data dependences. [84] focuses on outputs, placing two paths in the same partition if they have the same relevant slice with respect to the program output. A relevant slice is the transitive closure of dynamic data and control A Survey of Symbolic Execution Techniques 0:21 dependencies, and also of potential dependencies involving statements that affect the output by not getting executed.…”

Section: Path Subsumption and Equivalencementioning

confidence: 99%

A Survey of Symbolic Execution Techniques

et al. 2018

View full text Add to dashboard Cite

Many security and software testing applications require checking whether certain properties of a program hold for any possible usage scenario. For instance, a tool for identifying software vulnerabilities may need to rule out the existence of any backdoor to bypass a program's authentication. One approach would be to test the program using different, possibly random inputs. As the backdoor may only be hit for very specific program workloads, automated exploration of the space of possible inputs is of the essence. Symbolic execution provides an elegant solution to the problem, by systematically exploring many possible execution paths at the same time without necessarily requiring concrete inputs. Rather than taking on fully specified input values, the technique abstractly represents them as symbols, resorting to constraint solvers to construct actual instances that would cause property violations. Symbolic execution has been incubated in dozens of tools developed over the last four decades, leading to major practical breakthroughs in a number of prominent software reliability applications. The goal of this survey is to provide an overview of the main ideas, challenges, and solutions developed in the area, distilling them for a broad audience.If you are considering citing this survey, we would appreciate if you could use the following BibTeX entry: http://goo.gl/Hf5Fvc 0:2 R. Baldoni et al.

show abstract

Section: Path Subsumption and Equivalencementioning

confidence: 99%

A Survey of Symbolic Execution Techniques

et al. 2018

View full text Add to dashboard Cite

show abstract

“…We conceptually and experimentally compare to this approach. Related works [84], [92] suggest grouping together paths based on similar symbolic expressions in variables, and use such symbolic expressions as dynamic summaries to group paths.…”

Section: A Symbolic Executionmentioning

confidence: 99%

Neuro-Symbolic Execution: Augmenting Symbolic Execution with Neural Constraints

Shen¹,

Shinde

Ramesh³

et al. 2019

Proceedings 2019 Network and Distributed System Security Symposium

Self Cite

View full text Add to dashboard Cite

Symbolic execution is a powerful technique for program analysis. However, it has many limitations in practical applicability: the path explosion problem encumbers scalability, the need for language-specific implementation, the inability to handle complex dependencies, and the limited expressiveness of theories supported by underlying satisfiability checkers. Often, relationships between variables of interest are not expressible directly as purely symbolic constraints. To this end, we present a new approach-neuro-symbolic execution-which learns an approximation of the relationship between program values of interest, as a neural network. We develop a procedure for checking satisfiability of mixed constraints, involving both symbolic expressions and neural representations. We implement our new approach in a tool called NEUEX as an extension of KLEE, a state-of-the-art dynamic symbolic execution engine. NEUEX finds 33 exploits in a benchmark of 7 programs within 12 hours. This is an improvement in the bug finding efficacy of 94% over vanilla KLEE. We show that this new approach drives execution down difficult paths on which KLEE and other DSE extensions get stuck, eliminating limitations of purely SMT-based techniques.

show abstract

“…Program dependence information and user provided abstraction strategies are used in [64] to compute equivalence classes of paths that can reach a specific program location. [65] uses dynamically computed relevant slice conditions to explore paths that are relevant to a slicing criteria. Control flow analysis and weakest-precondition computation are combined in [66] to generate tests that exercise code changes due to patches.…”

Section: Guided Symbolic Executionmentioning

confidence: 99%

ProXray: Protocol Model Learning and Guided Firmware Analysis

Fowze

Tian

Hernandez

et al. 2019

IIEEE Trans. Software Eng.

View full text Add to dashboard Cite

The number of Internet of Things (IoT) has reached 7 billion globally in early 2018 and are nearly ubiquitous in daily life. Knowing whether or not these devices are safe and secure to use is becoming critical. IoT devices usually implement communication protocols such as USB and Bluetooth within firmware to allow a wide range of functionality. Thus analyzing firmware using domain knowledge from these protocols is vital to understand device behavior, detect implementation bugs, and identify malicious components. Unfortunately, due to the complexity of these protocols, there is usually no formal specification available that can help automate the firmware analysis; as a result significant manual effort is currently required to study these protocols and to reverse engineer the device firmware. In this paper, we propose a new firmware analysis methodology using symbolic execution called ProXray, which can learn a protocol model from known firmware, and apply the model to recognize the protocol relevant fields and detect functionality within unknown firmware automatically. After the training phase, ProXray can fully automate the firmware analysis process while supporting user's queries in the form of protocol relevant constraints. We have applied ProXray to the USB and the Bluetooth protocols by learning protocol constraint models from firmware that implement these protocols. We are then able to map protocol fields and identify USB functionality automatically within all 6 unknown USB firmware while achieving more than an order of magnitude speedup in reaching protocol relevant targets in unknown Bluetooth firmware. Our model achieved high coverage of the USB and Bluetooth specifications for several important protocol fields. ProXray provides a new method to apply domain knowledge to firmware analysis automatically.

show abstract

Path exploration based on symbolic output

Cited by 24 publications

References 26 publications

A Survey of Symbolic Execution Techniques

A Survey of Symbolic Execution Techniques

Neuro-Symbolic Execution: Augmenting Symbolic Execution with Neural Constraints

ProXray: Protocol Model Learning and Guided Firmware Analysis

Contact Info

Product

Resources

About