research-article

Chopped symbolic execution

Authors:

Andrea Mattavelli,

Cristian CadarAuthors Info & Claims

ICSE '18: Proceedings of the 40th International Conference on Software Engineering

Pages 350 - 360

https://doi.org/10.1145/3180155.3180251

Published: 27 May 2018 Publication History

Abstract

Symbolic execution is a powerful program analysis technique that systematically explores multiple program paths. However, despite important technical advances, symbolic execution often struggles to reach deep parts of the code due to the well-known path explosion problem and constraint solving limitations.

In this paper, we propose chopped symbolic execution, a novel form of symbolic execution that allows users to specify uninteresting parts of the code to exclude during the analysis, thus only targeting the exploration to paths of importance. However, the excluded parts are not summarily ignored, as this may lead to both false positives and false negatives. Instead, they are executed lazily, when their effect may be observable by code under analysis. Chopped symbolic execution leverages various on-demand static analyses at runtime to automatically exclude code fragments while resolving their side effects, thus avoiding expensive manual annotations and imprecision.

Our preliminary results show that the approach can effectively improve the effectiveness of symbolic execution in several different scenarios, including failure reproduction and test suite augmentation.

References

[1]

A. V. Aho, M. S. Lam, R. Sethi, and J. D. Ullman. Compilers: Principles, Techniques, and Tools. Addison Wesley, 2nd edition, 2006.

Digital Library

[2]

S. Anand, P. Godefroid, and N. Tillmann. Demand-driven compositional symbolic execution. In Proc. of the 14th International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS'08), Mar.-Apr. 2008.

Digital Library

[3]

S. Anand, C. S. Păsăreanu, and W. Visser. JPF-SE: A Symbolic Execution Extension to Java PathFinder. In Proc. of the 13th International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS'07), Mar.-Apr. 2007.

Digital Library

[4]

L. O. Andersen. Program Analysis and Specialization for the C Programming Language. PhD thesis, 1994.

[5]

A. Aquino, F. A. Bianchi, C. Meixian, G. Denaro, and M. Pezzè. Reusing constraint proofs in program analysis. In Proc. of the International Symposium on Software Testing and Analysis (ISSTA'15), July 2015.

Digital Library

[6]

D. Babić, L. Martignoni, S. McCamant, and D. Song. Statically-directed dynamic automated test generation. In Proc. of the International Symposium on Software Testing and Analysis (ISSTA'11), July 2011.

Digital Library

[7]

D. Binkley and M. Harman. A survey of empirical results on program slicing. Advances in Computers, 62:105--178, 2004.

[8]

P. Boonstoppel, C. Cadar, and D. Engler. RWset: Attacking path explosion in constraint-based test generation. In International Conference on Tools and Algorithms for the Construction and Analysis of Systems, 2008.

Digital Library

[9]

S. Bugrara and D. Engler. Redundant state detection for dynamic symbolic execution. In Proc. of the 2013 USENIX Annual Technical Conference (USENIX ATC'13), June 2013.

Digital Library

[10]

J. Burnim and K. Sen. Heuristics for scalable dynamic test generation. In Proc. of the 23rd IEEE International Conference on Automated Software Engineering (ASE'08), Sept. 2008.

Digital Library

[11]

C. Cadar, D. Dunbar, and D. Engler. KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs. In Proc. of the 8th USENIX Symposium on Operating Systems Design and Implementation (OSDI'08), Dec. 2008.

Digital Library

[12]

C. Cadar, V. Ganesh, P. Pawlowski, D. Dill, and D. Engler. EXE: Automatically Generating Inputs of Death. In Proc. of the 13th ACM Conference on Computer and Communications Security (CCS'06), Oct.-Nov. 2006.

Digital Library

[13]

C. Cadar, P. Godefroid, S. Khurshid, C. Pasareanu, K. Sen, N. Tillmann, and W. Visser. Symbolic Execution for Software Testing in Practice---Preliminary Assessment. In Proc. of the 33rd International Conference on Software Engineering, Impact Track (ICSE Impact'11), May 2011.

Digital Library

[14]

C. Cadar and K. Sen. Symbolic Execution for Software Testing: Three Decades Later. Commun. ACM, 56(2):82--90, 2013.

Digital Library

[15]

S. K. Cha, T. Avgerinos, A. Rebert, and D. Brumley. Unleashing Mayhem on binary code. In Proc. of the IEEE Symposium on Security and Privacy (IEEE S&P'12), May 2012.

Digital Library

[16]

V. Chipounov and G. Candea. Reverse engineering of binary device drivers with revnic. In Proc. of the 5th European Conference on Computer Systems (EuroSys'10), Apr. 2010.

Digital Library

[17]

P. Collingbourne, C. Cadar, and P. H. Kelly. Symbolic crosschecking of floating-point and SIMD code. In Proc. of the 6th European Conference on Computer Systems (EuroSys'11), Apr. 2011.

Digital Library

[18]

P. Collingbourne, C. Cadar, and P. H. Kelly. Symbolic crosschecking of data-parallel floating-point code. IEEE Transactions on Software Engineering (TSE), 40(7):710--737, 2014.

Digital Library

[19]

L. De Moura and N. Bjørner. Satisfiability modulo theories: introduction and applications. Commun. ACM, 54(9):69--77, Sept. 2011.

Digital Library

[20]

DG website. https://github.com/mchalupa/dg.

[21]

I. Erete and A. Orso. Optimizing constraint solving to better support symbolic execution. In Proc. of the Workshop on Constraints in Software Testing, Verification, and Analysis (CSTVA'11), Mar. 2011.

Digital Library

[22]

V. Ganesh and D. L. Dill. A decision procedure for bit-vectors and arrays. In Proc. of the 19th International Conference on Computer-Aided Verification (CAV'07), July 2007.

Digital Library

[23]

P. Godefroid. Compositional dynamic test generation. In Proc. of the 34th ACM Symposium on the Principles of Programming Languages (POPL'07), Jan. 2007.

Digital Library

[24]

P. Godefroid, N. Klarlund, and K. Sen. DART: Directed automated random testing. In Proc. of the Conference on Programing Language Design and Implementation (PLDI'05), June 2005.

Digital Library

[25]

P. Godefroid, M. Y. Levin, and D. A. Molnar. Automated whitebox fuzz testing. In Proc. of the 15th Network and Distributed System Security Symposium (NDSS'08), Feb. 2008.

[26]

M. Hind. Pointer analysis: Haven't we solved this problem yet? In Proc. of the 2nd ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering (PASTE'01), June 2001.

Digital Library

[27]

X. Jia, C. Ghezzi, and S. Ying. Enhancing reuse of constraint solutions to improve symbolic execution. In Proc. of the International Symposium on Software Testing and Analysis (ISSTA'15), July 2015.

Digital Library

[28]

V. Kuznetsov, J. Kinder, S. Bucur, and G. Candea. Efficient state merging in symbolic execution. In Proc. of the Conference on Programing Language Design and Implementation (PLDI'12), June 2012.

Digital Library

[29]

C. Lattner and V. Adve. LLVM: A compilation framework for lifelong program analysis & transformation. In Proc. of the 2nd International Symposium on Code Generation and Optimization (CGO'04), Mar. 2004.

Digital Library

[30]

T. Liu, M. Araújo, M. d'Amorim, and M. Taghdiri. A comparative study of incremental constraint solving approaches in symbolic execution. In Proc. of the Haifa Verification Conference (HVC'14), Nov. 2014.

[31]

N. Nethercote and J. Seward. Valgrind: A program supervision framework. Electronic Notes in Theoretical Computer Science, 89(2), 2003.

[32]

H. D. T. Nguyen, D. Qi, A. Roychoudhury, and S. Chandra. SemFix: Program repair via semantic analysis. In Proc. of the 35th International Conference on Software Engineering (ICSE'13), May 2013.

Digital Library

[33]

H. Palikareva and C. Cadar. Multi-solver support in symbolic execution. In Proc. of the 25th International Conference on Computer-Aided Verification (CAV'13), July 2013.

[34]

D. M. Perry, A. Mattavelli, X. Zhang, and C. Cadar. Accelerating array constraints in symbolic execution. In Proc. of the International Symposium on Software Testing and Analysis (ISSTA'17), July 2017.

Digital Library

[35]

K. Sen, D. Marinov, and G. Agha. CUTE: A concolic unit testing engine for C. In Proc. of the joint meeting of the European Software Engineering Conference and the ACM Symposium on the Foundations of Software Engineering (ESEC/FSE'05), Sept. 2005.

Digital Library

[36]

K. Sen, G. Necula, L. Gong, and W. Choi. Multise: Multi-path symbolic execution using value summaries. In Proc. of the joint meeting of the European Software Engineering Conference and the ACM Symposium on the Foundations of Software Engineering (ESEC/FSE'15), Aug.-Sept. 2015.

Digital Library

[37]

Y. Smaragdakis and G. Balatsouras. Pointer analysis. Found. Trends Program. Lang., 2(1):1--69, Apr. 2015.

Digital Library

[38]

Y. Sui and J. Xue. SVF: Interprocedural static value-flow analysis in LLVM. In Proc. of the 25th International Conference on Compiler Construction (CC'16), Mar. 2016.

Digital Library

[39]

N. Tillmann and J. De Halleux. Pex: white box test generation for .NET. In Proc. of the 2nd International Conference on Tests and Proofs (TAP'08), Apr. 2008.

Digital Library

[40]

F. Tip. A survey of program slicing techniques. Journal of Programming Languages, 3(3):121--189, 1995.

[41]

W. Visser, J. Geldenhuys, and M. B. Dwyer. Green: reducing, reusing and recycling constraints in program analysis. In Proc. of the ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE'12), Nov. 2012.

Digital Library

[42]

M. Weiser. Program slicing. In Proceedings of the 5th International Conference on Software Engineering, ICSE '81, pages 439--449, Piscataway, NJ, USA, 1981. IEEE Press.

Digital Library

[43]

T. Xie, N. Tillmann, J. Halleux, and W. Schulte. Fitness-guided path exploration in dynamic symbolic execution. In Proc. of the 2009 International Conference on Dependable Systems and Networks (DSN'09), June 2009.

[44]

B. Xu, J. Qian, X. Zhang, Z. Wu, and L. Chen. A brief survey of program slicing. SIGSOFT Softw. Eng. Notes, 30(2):1--36, Mar. 2005.

Digital Library

[45]

G. Yang, C. S. Păsăreanu, and S. Khurshid. Memoized symbolic execution. In Proc. of the International Symposium on Software Testing and Analysis (ISSTA'12), July 2012.

Digital Library

Cited By

Xia THu HWu DBalzarotti DXu W(2024)DEEPTYPEProceedings of the 33rd USENIX Conference on Security Symposium10.5555/3698900.3699229(5877-5894)Online publication date: 14-Aug-2024
https://dl.acm.org/doi/10.5555/3698900.3699229
Busse FNowack MCadar CBöhme MNoller YSzekeres L(2024)Sparse Symbolic Loop Execution (Registered Report)Proceedings of the 3rd ACM International Fuzzing Workshop10.1145/3678722.3685535(61-69)Online publication date: 13-Sep-2024
https://dl.acm.org/doi/10.1145/3678722.3685535
Yoon JCha S(2024)FeatMaker: Automated Feature Engineering for Search Strategy of Symbolic ExecutionProceedings of the ACM on Software Engineering10.1145/36608151:FSE(2447-2468)Online publication date: 12-Jul-2024
https://dl.acm.org/doi/10.1145/3660815
Show More Cited By

Index Terms

Chopped symbolic execution
1. Software and its engineering
  1. Software creation and management
    1. Software verification and validation
      1. Software defect analysis
        Software testing and debugging

Recommendations

Enhancing symbolic execution with veritesting
ICSE 2014: Proceedings of the 36th International Conference on Software Engineering

We present MergePoint, a new binary-only symbolic execution system for large-scale and fully unassisted testing of commodity off-the-shelf (COTS) software. MergePoint introduces veritesting, a new technique that employs static symbolic execution to ...
Veritesting Challenges in Symbolic Execution of Java

Scaling symbolic execution to industrial-sized programs is an important open research problem. Veritesting is a promising technique that improves scalability by combining the advantages of static symbolic execution with those of dynamic symbolic ...
Runtime exception detection in Java programs using symbolic execution

Most of the runtime failures of a software system can be revealed during test execution only, which has a very high cost. In Java programs, runtime failures are manifested as unhandled runtime exceptions.

In this paper we present an approach and tool ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

ICSE '18: Proceedings of the 40th International Conference on Software Engineering

May 2018

1307 pages

ISBN:9781450356381

DOI:10.1145/3180155

Conference Chair:
Michel Chaudron
Chalmers University of Technology, University of Gothenburg, Sweden
,
General Chair:
Ivica Crnkovic
Chalmers University of Technology, University of Gothenburg, Sweden
,
Program Chairs:
Marsha Chechik
University of Toronto, Canada
,
Mark Harman
Facebook and University College London, United Kingdom

Copyright © 2018 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Sponsors

SIGSOFT: ACM Special Interest Group on Software Engineering
IEEE-CS: Computer Society

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 27 May 2018

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

ICSE '18

Sponsor:

SIGSOFT
IEEE-CS

ICSE '18: 40th International Conference on Software Engineering

May 27 - June 3, 2018

Gothenburg, Sweden

Acceptance Rates

Overall Acceptance Rate 276 of 1,856 submissions, 15%

Upcoming Conference

ICSE 2025

2025 IEEE/ACM 46th International Conference on Software Engineering

April 26 - May 3, 2025

Ottawa , ON , Canada

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

55
Total Citations
View Citations
770
Total Downloads

Downloads (Last 12 months)68
Downloads (Last 6 weeks)9

Reflects downloads up to 25 Jan 2025

Other Metrics

View Author Metrics

Citations

Cited By

Xia THu HWu DBalzarotti DXu W(2024)DEEPTYPEProceedings of the 33rd USENIX Conference on Security Symposium10.5555/3698900.3699229(5877-5894)Online publication date: 14-Aug-2024
https://dl.acm.org/doi/10.5555/3698900.3699229
Busse FNowack MCadar CBöhme MNoller YSzekeres L(2024)Sparse Symbolic Loop Execution (Registered Report)Proceedings of the 3rd ACM International Fuzzing Workshop10.1145/3678722.3685535(61-69)Online publication date: 13-Sep-2024
https://dl.acm.org/doi/10.1145/3678722.3685535
Yoon JCha S(2024)FeatMaker: Automated Feature Engineering for Search Strategy of Symbolic ExecutionProceedings of the ACM on Software Engineering10.1145/36608151:FSE(2447-2468)Online publication date: 12-Jul-2024
https://dl.acm.org/doi/10.1145/3660815
Zou CHe DSui YXue J(2024)TIPS: Tracking Integer-Pointer Value Flows for C++ Member Function PointersProceedings of the ACM on Software Engineering10.1145/36607791:FSE(1609-1631)Online publication date: 12-Jul-2024
https://dl.acm.org/doi/10.1145/3660779
Yi QYu YYang G(2024)Compatible Branch Coverage Driven Symbolic Execution for Efficient Bug FindingProceedings of the ACM on Programming Languages10.1145/36564438:PLDI(1633-1655)Online publication date: 20-Jun-2024
https://dl.acm.org/doi/10.1145/3656443
Sun XGupta RBond MLee JPayer H(2024)SSRD: Shapes and Summaries for Race Detection in Concurrent Data StructuresProceedings of the 2024 ACM SIGPLAN International Symposium on Memory Management10.1145/3652024.3665505(68-81)Online publication date: 20-Jun-2024
https://dl.acm.org/doi/10.1145/3652024.3665505
Zheng PSu BLuo XChen TZhang NZheng ZChristakis MPradel M(2024)LENT-SSE: Leveraging Executed and Near Transactions for Speculative Symbolic Execution of Smart ContractsProceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis10.1145/3650212.3680303(566-577)Online publication date: 11-Sep-2024
https://dl.acm.org/doi/10.1145/3650212.3680303
Miltenberger MArzt S(2024)Precisely Extracting Complex Variable Values from Android AppsACM Transactions on Software Engineering and Methodology10.1145/364959133:5(1-56)Online publication date: 4-Jun-2024
https://dl.acm.org/doi/10.1145/3649591
Kolchyn OPotiyenko S(2024)Model-Based Test Cases Generation for Extended Data Flow Coverage CriteriaSoftware Engineering Methods Design and Application10.1007/978-3-031-70285-3_43(568-581)Online publication date: 23-Oct-2024
https://doi.org/10.1007/978-3-031-70285-3_43
He NZhao ZWang JHu YGuo SWang HLiang GLi DChen XGuo YJust RFraser G(2023)Eunomia: Enabling User-Specified Fine-Grained Search in Symbolically Executing WebAssembly BinariesProceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis10.1145/3597926.3598064(385-397)Online publication date: 12-Jul-2023
https://dl.acm.org/doi/10.1145/3597926.3598064
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten