Optimizing Constraint Solving to Better Support Symbolic Execution Ikpeme Erete and Alessandro Orso School of Computer Science – College of Computing Georgia Institute of Technology Partially supported by : NSF, IBM, and MSR
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) 07. if (b < c) 08. // do something Path condition (PC): 09. else 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 07. if (b < c) 08. // do something Path condition (PC): 09. else 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 07. if (b < c) 08. // do something Path condition (PC): 09. else 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 07. if (b < c) 08. // do something Path condition (PC): 09. else 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 , e=d 0 +10 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 , e=d 0 +10 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, 4F, Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 , e=d 0 +10 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, 4F, Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 , e=d 0 +10 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) Λ (b 0 <= 5) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, 4F, Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 , e=d 0 +10 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) Λ (b 0 <= 5) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, 4F, 6T, Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 , e=d 0 +10 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) Λ (b 0 <= 5) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, 4F, 6T, Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 , e=d 0 +10 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) Λ (b 0 <= 5) Λ (a 0 < d 0 + 10) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, 4F, 6T, Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 , e=d 0 +10 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) Λ (b 0 <= 5) Λ (a 0 < d 0 + 10) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, 4F, 6T, 7T Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 , e=d 0 +10 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) Λ (b 0 <= 5) Λ (a 0 < d 0 + 10) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, 4F, 6T, 7T Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 , e=d 0 +10 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) Λ (b 0 <= 5) Λ (a 0 < d 0 + 10) Λ (b 0 < c 0 ) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, 4F, 6T, 7T Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 , e=d 0 +10 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) Λ (b 0 <= 5) Λ (a 0 < d 0 + 10) Λ (b 0 < c 0 ) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Background: Dynamic Symbolic Execution Inputs: a=4, b= 5, c=6, d=1 01. foo(int a, int b, int c, int d) { 02. if (c > a) 2T, 4F, 6T, 7T Executed branches: 03. int e=d+10 04. if (b > 5) 05. // do something Symbolic state: 06. else if (a < e) a=a 0 , b=b 0 , c=c 0 , d=d 0 , e=d 0 +10 07. if (b < c) 08. // do something Path condition (PC): 09. else (c 0 > a 0 ) Λ (b 0 <= 5) Λ (a 0 < d 0 + 10) Λ (b 0 < c 0 ) 10. // do something 11. else DSE: 12. // do something 13. return 14. }
Recommend
More recommend
