State Joining and Splitting for the Symbolic Execution of Binaries

Authors:
Trevor Hansen;Peter Schachte;Harald Søndergaard
Affiliations:
Department of Computer Science and Software Engineering, The University of Melbourne, Australia 3010;Department of Computer Science and Software Engineering, The University of Melbourne, Australia 3010;Department of Computer Science and Software Engineering, The University of Melbourne, Australia 3010
Venue:
Runtime Verification
Year:
2009

Citing 0
Cited 5

Efficient Generation of Stimuli for Functional Verification by Backjumping Across Extended FSMs

Journal of Electronic Testing: Theory and Applications
Optimizing data shuffling in data-parallel computation by understanding user-defined functions

NSDI'12 Proceedings of the 9th USENIX conference on Networked Systems Design and Implementation
Efficient state merging in symbolic execution

Proceedings of the 33rd ACM SIGPLAN conference on Programming Language Design and Implementation
Input-covering schedules for multithreaded programs

Proceedings of the 2013 ACM SIGPLAN international conference on Object oriented programming systems languages & applications
FIE on firmware: finding vulnerabilities in embedded systems using symbolic execution

SEC'13 Proceedings of the 22nd USENIX conference on Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

Symbolic execution can be used to explore the possible run-time states of a program. It makes use of a concept of "state" where a variable's value has been replaced by an expression that gives the value as a function of program input. Additionally, a state can be equipped with a summary of control-flow history: a "path constraint" keeps track of the class of inputs that would have caused the same flow of control. But even simple programs can have trillions of paths, so a path-by-path analysis is impractical. We investigate a "state joining" approach to making symbolic execution more practical and describe the challenges of applying state joining to the analysis of unmodified Linux x86 executables. The results so far are mixed, with good results for some code. On other examples, state joining produces cumbersome constraints that are more expensive to solve than those generated by normal symbolic execution.