Chapter 6 Symbolic execution Course Model checking Volker Stolz, - PowerPoint PPT Presentation

Chapter 6 Symbolic execution Course “Model checking” Volker Stolz, Martin Steffen Autumn 2019

Section Targets Chapter 6 “Symbolic execution” Course “Model checking” Volker Stolz, Martin Steffen Autumn 2019

Chapter 6 Learning Targets of Chapter “Symbolic execu- tion”. The chapter gives an not too deep introduction to symbolic execution and concolic execution.

Chapter 6 Outline of Chapter “Symbolic execution”. Targets Introduction Testing and path coverage Symbolic execution Concolic testing

Section Introduction Testing and path coverage Symbolic execution Concolic testing Chapter 6 “Symbolic execution” Course “Model checking” Volker Stolz, Martin Steffen Autumn 2019

Introduction IN5110 – Verification and specification of parallel systems • symbolic execution: “old” technique [3] Targets • natural also in the context of testing Targets & Outline • concolic execution: extension Introduction Testing and path coverage • used also in compiler Symbolic execution Concolic testing • code generation • optimization 6-6

Code example IN5110 – Verification and specification of parallel systems Targets Targets & Outline Introduction Testing and path coverage Symbolic execution Concolic testing 6-7

How to analyse a (simple) program like that? : IN5110 – Verification and specification of parallel systems • testing Targets Targets & Outline • “verification” (whatever that means) Introduction • could include code review Testing and path coverage Symbolic execution • model-checking? Hm? Concolic testing • symbolic and concolic execution (see later) 6-8

Testing • maybe the most used method for ensuring software (and system) “quality” • broad field IN5110 – Verification and • many different testing goals, techniques specification of parallel systems • also used in combination, in different phases of software engineering cycle • here: focus on Targets Targets & Outline “white-box” testing Introduction Testing and path coverage • AKA structural testing Symbolic execution Concolic testing • program code available (resp. CFG) • also focus: unit testing Goals • detect errors • check corner cases 6-9 • provide high (code) coverage

(Code) coverage • note: typically a non-concurrent setting (unit testing) IN5110 – Verification and • different coverage criteria specification of parallel systems • nodes • edges, conditions • combinations thereof Targets • path coverage Targets & Outline Introduction • defined to answer the question Testing and path coverage Symbolic execution Concolic testing When have I tested “enough”? path coverage • ambitious to impossible (loops) • note: still not all reachable states , i.e., not verified yet 6-10

Path coverage IN5110 – Verification and specification of parallel systems Targets Targets & Outline Introduction Testing and path coverage Symbolic execution Concolic testing 6-11

Path coverage IN5110 – Verification and specification of parallel systems Targets Targets & Outline Introduction Testing and path coverage Symbolic execution Concolic testing 6-11

Path coverage IN5110 – Verification and specification of parallel systems Targets Targets & Outline Introduction Testing and path coverage Symbolic execution Concolic testing 6-11

Path coverage IN5110 – Verification and specification of parallel systems Targets Targets & Outline Introduction Testing and path coverage Symbolic execution Concolic testing 6-11

Path coverage IN5110 – Verification and specification of parallel systems Targets Targets & Outline Introduction Testing and path coverage Symbolic execution Concolic testing 6-11

Path coverage IN5110 – Verification and specification of parallel systems Targets Targets & Outline Introduction Testing and path coverage Symbolic execution Concolic testing • 3 possible exec. path • corresponding path conditions • “optimal”: cover all path • find input set to run program covering all those paths 6-11

Random testing IN5110 – Verification and specification of parallel systems • most naive way of testing • generating random inputs Targets Targets & Outline • concrete input values Introduction • dynamic executions of programs Testing and path coverage Symbolic execution Concolic testing • observe actual behavior and • compare it agains expected behavior 6-12

Random testing • different inputs, different paths • maybe IN5110 – Verification and • ( x, y ) = (700 , 500) specification of parallel systems • ( x, y ) = ( − 700 , 500) • . . . Targets Targets & Outline Introduction Testing and path coverage Symbolic execution Concolic testing 6-13

Random testing • different inputs, different paths IN5110 – • maybe Verification and specification of • ( x, y ) = (700 , 500) parallel systems • ( x, y ) = ( − 700 , 500) • . . . Targets Targets & Outline Introduction Testing and path coverage Symbolic execution Concolic testing 6-13

One path so far missed IN5110 – Verification and specification of parallel systems Targets Targets & Outline Introduction Testing and path coverage Symbolic execution Concolic testing 6-14

How to get that path (or others)? IN5110 – Verification and specification of parallel systems Targets Targets & Outline Introduction Testing and path coverage Symbolic execution • maybe: ( x, y ) = (145 , 10) Concolic testing • by chance: very low probability to randomly get y = 10 • path condition 6-15

How to get that path (or others)? IN5110 – Verification and specification of parallel systems Targets Targets & Outline Introduction Testing and path coverage Symbolic execution • maybe: ( x, y ) = (145 , 10) Concolic testing • by chance: very low probability to randomly get y = 10 Symbolic representation x > 0 ∧ y = 10 • path condition 6-15

Symbolic execution IN5110 – Verification and specification of parallel systems • symbols instead of concrete value Targets Targets & Outline • use if path conditions, aka path constraints Introduction • cf. connection to SAT and SMT Testing and path coverage Symbolic execution • constraint solver computes real values Concolic testing 6-16

Simple example IN5110 – Verification and specification of parallel systems Targets Targets & Outline Introduction Testing and path coverage Symbolic execution • in the code: assignments not equations ( y := Concolic testing read() ) • introduce variable s for read() • assignments • y := read() ⇒ y = s • y := 2*y ⇒ y = 2 s • branching point in line 4 • right: 2 s = 12 • left: 2 s � = 12 6-17

Which input leads to the error? IN5110 – Verification and specification of parallel systems Targets Targets & Outline Constraint solver Introduction Testing and path coverage Symbolic execution Concolic testing Solve the path constraint 2 s = 12 • child’s play: the solution is s = 6 • but: requires solver that can do “arithmetic”, including multiplication 6-18

In summary Symbolic execution for dummies IN5110 – Verification and specification of • take the code (resp. the CFG of the code) parallel systems • collect all paths into path conditions • big conjunctions of all conditions along each the path Targets • each condition b will have Targets & Outline • one positive mention b in one continuation of the path Introduction • one negated mention ¬ b in the other continuation Testing and path coverage Symbolic execution • solve the constraints for paths leading to errors with an Concolic testing approriate SMT solver • works best for loop-free program • cf. also SSA • but there is another problem as well (see next) 6-19

How about the program we started with? IN5110 – Verification and specification of parallel systems Targets Targets & Outline Introduction Testing and path coverage Symbolic execution Concolic testing 6-20

Complex condition x 3 IN5110 – Verification and specification of parallel systems Targets Targets & Outline Introduction Testing and path coverage Symbolic execution • non-linear constraint Concolic testing • in general undecidable • most constraint solvers throw the towel • for instance: execution stops, no path covered 6-21

What can one do? IN5110 – Verification and specification of parallel systems what can one do (beyond accepting the SE won’t cover all path)? Targets • “static analysis”: abstracting Targets & Outline • cover both path approximately Introduction • theorem proving? one cannot sell that to testers Testing and path coverage Symbolic execution Concolic testing Concolic testing Concrete & Symbolic = “concolic” 6-22

Concolic testing IN5110 – Verification and specification of parallel systems • here following DART • combination of two techniques Targets Targets & Outline Random testing Symbolic execution Introduction Testing and path coverage • concrete values • symbols, variables Symbolic execution Concolic testing • dynamic execution • static analysis • other name: Dynamic symbolic execution (DSE) 6-23