Symbolic execution is a program-analysis technique that is used to address several problems that arise in developing high-quality software. Despite the fact that the symbolic-execution technique is well understood, and performing symbolic execution on simple programs is straightforward, it is still not possible to apply the technique to the general class of large, real-world software. A symbolic-execution system can be effectively applied to large, real-world software if it has at least two features: efficiency and automation. However, efficient and automatic symbolic execution of real-world programs is a lofty goal due to both theoretical and practical reasons. Theoretically, achieving this goal requires solving an intractable problem (i.e., solving constraints). Practically, achieving this goal requires overwhelming effort to implement a symbolic-execution system that can precisely and automatically symbolically execute real-world programs. This research makes three major contributions. 1. Three new techniques that address three important problems of symbolic execution. Compared to existing techniques, the new techniques (2) reduce the manual effort that may be required to symbolically execute those programs that either generate complex constraints or parts of which cannot be symbolically executed due to limitations of a symbolic-execution system. (b) improve the usefulness of symbolic execution (e.g., expose more bugs in a program) by enabling discovery of more feasible paths within a given time budget. 2. A novel approach that uses symbolic execution to generate test inputs for Apps that run on modern mobile devices such as smartphones and tablets. 3. Implementations of the above techniques and empirical results obtained from applying those techniques to real-world programs that demonstrate their effectiveness.
Cited By
- Baldoni R, Coppa E, D’elia D, Demetrescu C and Finocchi I (2018). A Survey of Symbolic Execution Techniques, ACM Computing Surveys, 51:3, (1-39), Online publication date: 31-May-2019.
- Jia X, Ghezzi C and Ying S Enhancing reuse of constraint solutions to improve symbolic execution Proceedings of the 2015 International Symposium on Software Testing and Analysis, (177-187)
Recommendations
Veritesting Challenges in Symbolic Execution of Java
Scaling symbolic execution to industrial-sized programs is an important open research problem. Veritesting is a promising technique that improves scalability by combining the advantages of static symbolic execution with those of dynamic symbolic ...
Staged symbolic execution
SAC '12: Proceedings of the 27th Annual ACM Symposium on Applied ComputingRecent advances in constraint solving technology and raw computation power have led to a substantial increase in the effectiveness of techniques based on symbolic execution for systematic bug finding. However, scaling symbolic execution remains a ...
Speculative Symbolic Execution
ISSRE '12: Proceedings of the 2012 IEEE 23rd International Symposium on Software Reliability EngineeringSymbolic execution is an effective path oriented and constraint based program analysis technique. Recently, there is a significant development in the research and application of symbolic execution. However, symbolic execution still suffers from the ...