Specification of concretization and symbolization policies in symbolic execution

David, Robin; Bardin, Sébastien; Feist, Josselin; Mounier, Laurent; Potet, Marie-Laure; Ta, Thanh Dinh; Marion, Jean-Yves

doi:10.1145/2931037.2931048

Cited by 17 publications

(12 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…5.5). Regarding experiments over SE-generated formulas, we also consider three variants corresponding to standard concretization / symbolization policies [14] (cf. Sec.…”

Section: Methodsmentioning

confidence: 99%

“…In the restricted case where all indexes of reads and writes are constant values, a persistent map with logarithmic lookup and insertion can be used to simplify all row occurrences -yielding fast and scalable simplification. This representation is used in symbolic execution tools [10] with strong concretization policy [23,14] during the formula generation step in order to limit the introduction of arrays, but it is not suited to general purpose array solvers as it cannot cope with symbolic indexes.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Arrays Made Simpler: An Efficient, Scalable and Thorough Preprocessing

Farinier

David

Bardin

et al.

EPiC Series in Computing

Self Cite

View full text Add to dashboard Cite

The theory of arrays has a central place in software verification due to its ability to model memory or data structures. Yet, this theory is known to be hard to solve in both theory and practice, especially in the case of very long formulas coming from unrolling-based verification methods. Standard simplification techniques à la read-over-write suffer from two main drawbacks: they do not scale on very long sequences of stores and they miss many simplification opportunities because of a crude syntactic (dis-)equality reasoning. We propose a new approach to array formula simplification based on a new dedicated data structure together with original simplifications and low-cost reasoning. The technique is efficient, scalable and it yields significant simplification. The impact on formula resolution is always positive, and it can be dramatic on some specific classes of problems of interest, e.g. very long formula or binary-level symbolic execution. While currently implemented as a preprocessing, the approach would benefit from a deeper integration in an array solver.

show abstract

“…5.5). Regarding experiments over SE-generated formulas, we also consider three variants corresponding to standard concretization / symbolization policies [14] (cf. Sec.…”

Section: Methodsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Arrays Made Simpler: An Efficient, Scalable and Thorough Preprocessing

Farinier

David

Bardin

et al.

EPiC Series in Computing

Self Cite

View full text Add to dashboard Cite

show abstract

“…Instead of simply allocating the required memory in the given segment, the modified AllocateIn function works as follows. If the current size of the segment is under the threshold, the allocation is performed in that segment (lines [11][12]. Otherwise, we choose another segment (which could either be a new segment or an existing one) and we try to allocate in there (14)(15).…”

Section: Segmented Memory Modelmentioning

confidence: 99%

A segmented memory model for symbolic execution

Kapus

Cadar

2019

Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of

View full text Add to dashboard Cite

Symbolic execution is an effective technique for exploring paths in a program and reasoning about all possible values on those paths. However, the technique still struggles with code that uses complex heap data structures, in which a pointer is allowed to refer to more than one memory object. In such cases, symbolic execution typically forks execution into multiple states, one for each object to which the pointer could refer. In this paper, we propose a technique that avoids this expensive forking by using a segmented memory model. In this model, memory is split into segments, so that each symbolic pointer refers to objects in a single segment. The size of the segments are bound by a threshold, in order to avoid expensive constraints. This results in a memory model where forking due to symbolic pointer dereferences is significantly reduced, often completely. We evaluate our segmented memory model on a mix of whole program benchmarks (such as m4 and make) and library benchmarks (such as SQLite), and observe significant decreases in execution time and memory usage. CCS CONCEPTS • Software and its engineering → Software testing and debugging.

show abstract

“…As we have seen in this article, several symbolic executors resort to concretization in the presence of symbolic pointers. The framework presented by David et al [35] describes concretization policies for symbolic values and addresses, shedding light on this research problem and paving the way to a systematic study of concretization strategies and policy tuning. Along these lines, we believe that the delayed concretization technique with uninterpreted functions proposed by Pȃsȃreanu et al [36] to handle non-linear constraints could be value in the setting of pointer concretization strategies too.…”

Section: Concretization Strategiesmentioning

confidence: 99%

Memory models in symbolic execution: key ideas and new thoughts

Borzacchiello

Coppa

D’Elia

et al. 2019

Software Testing Verif & Rel

View full text Add to dashboard Cite

Symbolic execution is a popular program analysis technique that allows seeking for bugs by reasoning over multiple alternative execution states at once. As the number of states to explore may grow exponentially, a symbolic executor may quickly run out of space. For instance, a memory access to a symbolic address may potentially reference the entire address space, leading to a combinatorial explosion of the possible resulting execution states. To cope with this issue, state-of-the-art executors either concretize symbolic addresses that span memory intervals larger than some threshold or rely on advanced capabilities of modern satisfiability modulo theories solvers. Unfortunately, concretization may result in missing interesting execution states, for example, where a bug arises, while offloading the entire problem to constraint solvers can lead to very large query times. In this article, we first contribute to systematizing knowledge about memory models for symbolic execution, discussing how four mainstream symbolic executors deal with symbolic addresses. We then introduce MEMSIGHT, a new approach to symbolic memory that reduces the need for concretization: rather than mapping address instances to data as previous approaches do, our technique maps symbolic address expressions to data, maintaining the possible alternative states resulting from the memory referenced by a symbolic address in a compact, implicit form. Experiments on prominent programs show that MEMSIGHT, which we implemented in both ANGR and KLEE, enables the exploration of states that are unreachable for memory models that perform concretization and provides a performance level comparable with memory models relying on advanced solver theories. MEMORY MODELS IN SYMBOLIC EXECUTION: KEY IDEAS AND NEW THOUGHTS3 of 35 used in the context of state-of-the-art symbolic executors. A crucial design goal for our approach is that it should be general enough not only to support bug detection but also to be valuable in application contexts where users are interested in possible consequences of these bugs, for example, understanding how they can be exploited.Our approach, which we call MEMSIGHT, natively accounts for merging [3,4], a mainstream performance enabler in symbolic executors. We integrated MEMSIGHT into the state-of-the-art symbolic executors ANGR [5] and KLEE [6]: an experimental evaluation shows that MEMSIGHT allows for broader state exploration on prominent benchmarks analysed with ANGR, while it provides valuable run-time speedups when symbolically executing real-world programs under KLEE.A preliminary version [7] of this work appeared in the Proceedings of the 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE 2017), where we introduced the main idea behind MEMSIGHT (Section 3) and presented a preliminary experimental evaluation related to MEMSIGHT when integrated into ANGR (Section 5.2.2). ‡ For our example to be meaningful, we assume that b resides in memory rather than in a CPU register. § In SMT-LIB [9], the theories of...

show abstract

Specification of concretization and symbolization policies in symbolic execution

Cited by 17 publications

References 32 publications

Arrays Made Simpler: An Efficient, Scalable and Thorough Preprocessing

Arrays Made Simpler: An Efficient, Scalable and Thorough Preprocessing

A segmented memory model for symbolic execution

Memory models in symbolic execution: key ideas and new thoughts

Contact Info

Product

Resources

About