research-article

Public Access

Enhancing symbolic execution with veritesting

Authors:

Thanassis Avgerinos,

Alexandre Rebert,

David BrumleyAuthors Info & Claims

Communications of the ACM, Volume 59, Issue 6

Pages 93 - 100

https://doi.org/10.1145/2927924

Published: 23 May 2016 Publication History

All formats PDF

First page of PDF

References

[1]

Allen, J.R., Kennedy, K., Porterfield, C., Warren, J. Conversion of control dependence to data dependence. In Proceedings of the 10th ACM SIGACT-SIGPLAN Symposium on Principles of Programming Languages (Austin, Texas, 1983). ACM Press, New York, NY, 177--189.

Digital Library

[2]

Avgerinos, T., Rebert, A., Cha, S.K., Brumley, D. Enhancing symbolic execution with veritesting. In Proceedings of the 36th International Conference on Software Engineering, ICSE 2014 (Hyderabad, India, 2014). ACM, New York, NY, 1083--1094. URL http://doi.acm.org/10.1145/2568225.2568293.

Digital Library

[3]

Babic, D., Hu, A.J. Calysto: Scalable and precise extended static checking. In Proceedings of the 30th International Conference on Software Engineering (Leipzig, Germany, 2008). ACM, New York, NY, 211--220.

Digital Library

[4]

Bounimova, E., Godefroid, P., Molnar, D. Billions and billions of constraints: Whitebox Fuzz testing in production. In Proceedings of the 35th IEEE International Conference on Software Engineering (San Francisco, CA, 2013). IEEE Press, Piscataway, NJ, 122--131.

Digital Library

[5]

Cadar, C., Sen, K. Symbolic execution for software testing: three decades later. Commun. ACM 56, 2 (2013), 82--90.

Digital Library

[6]

Cadar, C., Dunbar, D., Engler, D. KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In Proceedings of the 8th USENIX Symposium on Operating System Design and Implementation (San Diego, CA, 2008). USENIX Association, Berkeley, CA, 209--224.

Digital Library

[7]

Cha, S.K., Avgerinos, T., Rebert, A., Brumley, D. Unleashing mayhem on binary code. In Proceedings of the 33rd IEEE Symposium on Security and Privacy (2012). IEEE Computer Society, Washington, DC, 380--394.

Digital Library

[8]

Chipounov, V., Kuznetsov, V., Candea, G. S2E: A platform for in vivo multi-path analysis of software systems. In Proceedings of the 16th International Conference on Architectural Support for Programming Languages and Operating Systems (Newport Beach, CA, 2011). ACM, New York, NY, 265--278.

Digital Library

[9]

de Moura, L., Bjørner, N. Satisfiability modulo theories: Introduction and applications. Commun. ACM 54, 9 (Sept. 2011), 69. ISSN 00010782. URL http://dl.acm.org/citation.cfm?doid=1995376.1995394.

Digital Library

[10]

Flanagan, C., Saxe, J. Avoiding exponential explosion: Generating compact verification conditions. In Proceedings of the 28th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (London, United Kingdom, 2001). ACM, New York, NY, 193--205.

Digital Library

[11]

Godefroid, P. Compositional dynamic test generation. In Proceedings of the 34th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (Nice, France, 2007). ACM, New York, NY, 47--54.

Digital Library

[12]

Godefroid, P., Levin, M.Y., Molnar, D. SAGE: Whitebox fuzzing for security testing. Commun. ACM 55, 3 (2012), 40--44.

Digital Library

[13]

Hansen, T., Schachte, P., Søndergaard, H. State joining and splitting for the symbolic execution of binaries. Runtime Verif. (2009), 76--92.

Digital Library

[14]

King, J.C. Symbolic execution and program testing. Commun. ACM 19, 7 (1976), 385--394.

Digital Library

[15]

Koelbl, A., Pixley, C. Constructing efficient formal models from high-level descriptions using symbolic simulation. Int. J. Parallel Program. 33, 6 (Dec. 2005), 645--666.

Digital Library

[16]

Kuznetsov, V., Kinder, J., Bucur, S., Candea, G. Efficient state merging in symbolic execution. In Proceedings of the 33rd ACM SIGPLAN Conference on Programming Language Design and Implementation (Beijing, China, 2012). ACM, New York, NY, 193--204.

Digital Library

[17]

Lattner, C., Adve, V. LLVM: A compilation framework for lifelong program analysis & transformation. In Proceedings of the International Symposium on Code Generation and Optimization: Feedback-directed and Runtime Optimization (Palo Alto, CA, 2004). IEEE Computer Society, Washington, DC, 75--86.

Digital Library

[18]

Leino, K.R.M. Efficient weakest preconditions. Inform. Process. Lett. 93, 6 (2005), 281--288.

Digital Library

[19]

Mayhem. 1.2K Crashes in Debian, 2013. URL http://lists.debian.org/debian-devel/2013/06/msg00720.html.

[20]

Mayhem. Open Source Statistics & Analysis, 2013. URL http://www.forallsecure.com/summaries.

[21]

Schwartz, E.J., Avgerinos, T., Brumley, D. All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask). In Proceedings of the 31st IEEE Symposium on Security and Privacy (2010). IEEE Computer Society, Washington, DC, 317--331.

Digital Library

[22]

Tu, P., Padua, D. Efficient building and placing of gating functions. In Proceedings of the 16th ACM Conference on Programming Language Design and Implementation (La Jolla, CA, 1995). ACM, New York, NY, 47--55.

Digital Library

[23]

Xie, Y., Aiken, A. Scalable error detection using boolean satisfiability. In Proceedings of the 32nd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (Long Beach, CA, 2005). ACM, New York, NY, 351--363.

Digital Library

Cited By

Vandercammen MDe Roover C(2025)State Merging for Concolic Testing of Event-driven ApplicationsScience of Computer Programming10.1016/j.scico.2025.103264(103264)Online publication date: Jan-2025
https://doi.org/10.1016/j.scico.2025.103264
Qian CPang LKuang XQin JZang YZhao QZhang J(2024)BSP: Branch Splitting for Unsolvable Path Hybrid FuzzingElectronics10.3390/electronics1324493513:24(4935)Online publication date: 13-Dec-2024
https://doi.org/10.3390/electronics13244935
Hu QChen WWang ZLu SNie YLi XKuang X(2023)BSFuzz: Branch-State Guided Hybrid FuzzingElectronics10.3390/electronics1219403312:19(4033)Online publication date: 25-Sep-2023
https://doi.org/10.3390/electronics12194033
Show More Cited By

Index Terms

Enhancing symbolic execution with veritesting
1. Software and its engineering
  1. Software creation and management
    1. Software verification and validation
      1. Software defect analysis
        Software testing and debugging
2. Theory of computation
  1. Semantics and reasoning
    1. Program semantics

Recommendations

Enhancing symbolic execution with veritesting
ICSE 2014: Proceedings of the 36th International Conference on Software Engineering

We present MergePoint, a new binary-only symbolic execution system for large-scale and fully unassisted testing of commodity off-the-shelf (COTS) software. MergePoint introduces veritesting, a new technique that employs static symbolic execution to ...
Veritesting Challenges in Symbolic Execution of Java

Scaling symbolic execution to industrial-sized programs is an important open research problem. Veritesting is a promising technique that improves scalability by combining the advantages of static symbolic execution with those of dynamic symbolic ...
Staged symbolic execution
SAC '12: Proceedings of the 27th Annual ACM Symposium on Applied Computing

Recent advances in constraint solving technology and raw computation power have led to a substantial increase in the effectiveness of techniques based on symbolic execution for systematic bug finding. However, scaling symbolic execution remains a ...

Comments

Information & Contributors

Information

Published In

cover image Communications of the ACM

Communications of the ACM Volume 59, Issue 6

June 2016

106 pages

ISSN:0001-0782

EISSN:1557-7317

DOI:10.1145/2942427

Editor:
Moshe Y. Vardi
Association for Computing Machinery, New York, NY

Issue’s Table of Contents

Copyright © 2016 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 23 May 2016

Published in CACM Volume 59, Issue 6

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Qualifiers

Research-article
Research
Refereed

Funding Sources

Prabhu and Poonam Goel Fellowship
Defense Advanced Research Projects Agency
National Science Foundation

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

12
Total Citations
View Citations
17,691
Total Downloads

Downloads (Last 12 months)1,367
Downloads (Last 6 weeks)141

Reflects downloads up to 14 Jan 2025

Other Metrics

View Author Metrics

Citations

Cited By

Vandercammen MDe Roover C(2025)State Merging for Concolic Testing of Event-driven ApplicationsScience of Computer Programming10.1016/j.scico.2025.103264(103264)Online publication date: Jan-2025
https://doi.org/10.1016/j.scico.2025.103264
Qian CPang LKuang XQin JZang YZhao QZhang J(2024)BSP: Branch Splitting for Unsolvable Path Hybrid FuzzingElectronics10.3390/electronics1324493513:24(4935)Online publication date: 13-Dec-2024
https://doi.org/10.3390/electronics13244935
Hu QChen WWang ZLu SNie YLi XKuang X(2023)BSFuzz: Branch-State Guided Hybrid FuzzingElectronics10.3390/electronics1219403312:19(4033)Online publication date: 25-Sep-2023
https://doi.org/10.3390/electronics12194033
Yao XZhang GPan FGong DWei C(2022)Orderly Generation of Test Data via Sorting Mutant Branches Based on Their Dominance Degrees for Weak Mutation TestingIEEE Transactions on Software Engineering10.1109/TSE.2020.301496048:4(1169-1184)Online publication date: 1-Apr-2022
https://doi.org/10.1109/TSE.2020.3014960
Godboley SJaffar JMaghareh RDutta ACadar CZhang X(2021)Toward optimal mc/dc test case generationProceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis10.1145/3460319.3464841(505-516)Online publication date: 11-Jul-2021
https://dl.acm.org/doi/10.1145/3460319.3464841
Nosco TZiegler JClark ZMarrero DFinkler TBarbarello APetullo WCapkun SRoesner F(2020)The industrial age of hackingProceedings of the 29th USENIX Conference on Security Symposium10.5555/3489212.3489276(1129-1146)Online publication date: 12-Aug-2020
https://dl.acm.org/doi/10.5555/3489212.3489276
Cloosters TRodler MDavi LCapkun SRoesner F(2020)TEEREXProceedings of the 29th USENIX Conference on Security Symposium10.5555/3489212.3489260(841-858)Online publication date: 12-Aug-2020
https://dl.acm.org/doi/10.5555/3489212.3489260
Wang YJia PLiu LHuang CLiu Z(2020)A systematic review of fuzzing based on machine learning techniquesPLOS ONE10.1371/journal.pone.023774915:8(e0237749)Online publication date: 18-Aug-2020
https://doi.org/10.1371/journal.pone.0237749
Liang HYu WAi LJiang LLi JJaccheri LDingsøyr TChitchyan R(2020)A Practical Concolic Execution Technique for Large Scale Software SystemsProceedings of the 24th International Conference on Evaluation and Assessment in Software Engineering10.1145/3383219.3383254(312-317)Online publication date: 15-Apr-2020
https://dl.acm.org/doi/10.1145/3383219.3383254
Gao JXu YJiang YLiu ZChang WJiao XSun J(2020)EM-Fuzz: Augmented Firmware Fuzzing via Memory CheckingIEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems10.1109/TCAD.2020.301304639:11(3420-3432)Online publication date: Nov-2020
https://doi.org/10.1109/TCAD.2020.3013046
Show More Cited By

View Options

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Digital Edition

View this article in digital edition.

Digital Edition

Magazine Site

View this article on the magazine site (external)

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Article

Media

Figures

Other

Tables

View Issue’s Table of Contents