Using symbolic execution to guide test generation

Lee, Gareth; Morris, John; Parker, Kris; Bundell, G.A.; Lam, Peng

doi:10.1002/stvr.309

Cited by 20 publications

(4 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In particular, dating back to the mid 70's, symbolic execution might be considered the most traditional approach to automated test data generation. Such approach, which has been put aside for some time, because of the many underlying difficulties, is today revitalized by the resurgence of strongly-typed languages and by the development of more powerful constraint solvers; Lee and coauthors [53] survey most promising developments.…”

Section: Challenge: Test Input Generationmentioning

confidence: 99%

Software Testing Research: Achievements, Challenges, Dreams

Bertolino

2007

Future of Software Engineering (FOSE '07)

596

372

View full text Add to dashboard Cite

Section: Challenge: Test Input Generationmentioning

confidence: 99%

Software Testing Research: Achievements, Challenges, Dreams

Bertolino

2007

Future of Software Engineering (FOSE '07)

596

372

View full text Add to dashboard Cite

“…Automatic testing leverages forward symbolic execution to achieve high code coverage and automatic input generation [5][6][7][8][9][10][11]. Most of these applications automatically generate inputs to trigger well-defined bugs [12][13][14][15][16][17], such as integer overflow, memory errors, null pointer dereference, etc.…”

Section: A Symbolic Execution and Its Applicationsmentioning

confidence: 99%

Branch Obfuscation Using Binary Code Side Effects

Hong¹,

Zhang²,

Ma³

et al. 2013

Proceedings of the International Conference on Computer, Networks and Communication Engineering (ICCNCE 2013)

View full text Add to dashboard Cite

The path constraints are leaked by binary conditional jump instructions which are the binary representation of software's internal logic. Based on the problem of software's path constraints leaking, reverse engineering using path-sensitive techniques such as symbolic execution and theorem proving poses a new threat to software intellectual property protection. In order to mitigate path information leaking problem, this paper proposed a novel branch obfuscation scheme that uses binary code side effects to hide path constraints and takes advantage of remote trusted entity to protect software's control flow graph, without changing software's functionality. The experimental results show that this branch obfuscation technique could effectively protect software's path constraints against state-of-the-art reverse engineering, yet practical in terms of performance.

show abstract

“…Symbolic execution is well known and has been applied for test generation and program verification. [50,51,52] Usually implementing it requires some form of constraint solving [53,54], and so Conformiq Qtronic also sports a constraint solver under the hood. Maybe interestingly, the data domain for our solver is the least D such that…”

Section: Challenge: Supporting Known Testing Heuristicsmentioning

confidence: 99%

Implementing Conformiq Qtronic

Huima¹

2007

Testing of Software and Communicating Systems

View full text Add to dashboard Cite

Abstract. Conformiq Qtronic1 is a commercial tool for model driven testing. It derives tests automatically from behavioral system models. These are black-box tests [1] by nature, which means that they depend on the model and the interfaces of the system under test, but not on the internal structure (e.g. source code) of the implementation.In this essay, which accompanies my invited talk, I survey the nature of Conformiq Qtronic, the main implementation challenges that we have encountered and how we have approached them. Problem StatementConformiq Qtronic is an ongoing attempt to provide an industrially applicable solution to the following technical problem: Create an automatic method that provided an object (a model) M that describes the external behavior of an open system (begin interpreted via well-defined semantics) constructs a strategy to test real-life black-box systems (implementations) I in order to find out if they have the same external behavior as M .(Now the fact that we have created a company with the mission to solve this technical problem hints that we believe it to be a good idea to employ automatic methods of this kind in actual software development processes-which is not a priori self-evident. In this essay, however, I will not touch these commercial and methodological issues, but will concentrate on the technical problem only.)Two notes are due, and the first concerns the test harness. It is namely usually so that the model M describes a system with different interfaces and behavior than the real implementation that is being tested (iut, implementation under test). Virtually always, the model M is somehow described on a higher level of abstraction than the real implementation. As a concrete example, sip (Session Initiation Protocol) [2] is a packet-oriented protocol that is run over a transport (e.g. udp [3]) and that has an ascii encoding: every sip packet is encoded as a series of ascii characters. However, some possible model M for testing an sip implementation could define the logical flow of packets with their main contents but not describe, for instance, their actual encoding. How can this model M be used to test a real sip implementation that requires ascii encoded packets over udp? The answer is that the "abstract" tests generated automatically from 1 www.conformiq.com A.

show abstract

Using symbolic execution to guide test generation

Cited by 20 publications

References 21 publications

Software Testing Research: Achievements, Challenges, Dreams

Software Testing Research: Achievements, Challenges, Dreams

Branch Obfuscation Using Binary Code Side Effects

Implementing Conformiq Qtronic

Contact Info

Product

Resources

About