Loop-extended symbolic execution on binary programs

  • Authors:

  • Prateek Saxena;Pongsin Poosankam;Stephen McCamant;Dawn Song

  • Affiliations:

  • University of California, Berkeley, Berkeley, CA, USA;Carnegie Mellon University, Pittsburgh, PA, USA;University of California, Berkeley, CA, USA;University of California, Berkeley, CA, USA

  • Venue:
  • Proceedings of the eighteenth international symposium on Software testing and analysis
  • Year:
  • 2009

Quantified Score

Hi-index 0.02

Visualization

Abstract

Mixed concrete and symbolic execution is an important technique for finding and understanding software bugs, including security-relevant ones. However, existing symbolic execution techniques are limited to examining one execution path at a time, in which symbolic variables reflect only direct data dependencies. We introduce loop-extended symbolic execution, a generalization that broadens the coverage of symbolic results in programs with loops. It introduces symbolic variables for the number of times each loop executes, and links these with features of a known input grammar such as variable-length or repeating fields. This allows the symbolic constraints to cover a class of paths that includes different numbers of loop iterations, expressing loop-dependent program values in terms of properties of the input. By performing more reasoning symbolically, instead of by undirected exploration, applications of loop-extended symbolic execution can achieve better results and/or require fewer program executions. To demonstrate our technique, we apply it to the problem of discovering and diagnosing buffer-overflow vulnerabilities in software given only in binary form. Our tool finds vulnerabilities in both a standard benchmark suite and 3 real-world applications, after generating only a handful of candidate inputs, and also diagnoses general vulnerability conditions.