Search

Symbolic execution techniques are widely adopted in diverse fields, including software quality analysis, software defect detection and so on. Symbolic execution engines assist people to apply the technique on exploiting and test data generation conveniently. However, symbolic execution is quite hard to scale to large and complicated programs which have massive paths and conditional statements due to path explosion. Moreover, for the development cycle of software systems, the necessity to generate test data frequently and rapidly makes them tough to apply symbolic execution technique on software testing. In this paper, we propose three modes of slicing-based testability transformations to change the semantics of programs while maintaining or improving the code coverage of generated test data by the symbolic execution tool: KLEE. The concept of these testability transformations is in decreasing the execution load of KLEE through shortening execution paths in programs. Our proposed testability transformation Mode 1 (TTM1) slices programs with an automated program slicing tool and takes functions in the program as the slicing criterion. On the other hand, our proposed testability transformations Mode 2 (TTM2) and Mode 3 (TTM3) slice programs manually and limit the max depth of paths in programs to a specific value as the slicing criterion. Experimental results show TTM1 could decrease 4.5% of solver queries while increasing 6.6% of code coverage on average. TTM2 could decrease 7.7% of solver queries while increasing 5.4% of coverage on average. TTM3 could decrease 17.6% of solver queries while increasing 3.6% of coverage on average. It can be observed that though the semantics of programs change due to slicing, the coverage of test data generated by KLEE could maintain the same or even become higher. Our finding also indicates that there is room to design slicing-based testability transformations to improve quality of test generation with symbolic execution. [ABSTRACT FROM AUTHOR]

Symbolic execution is a highly practical program analysis technology. With the gradual deepening of its research and the continuous maturity of technology itself, it has been widely used in software testing and other fields. KLEE is a symbolic execution tool built on the LLVM compilation framework that automatically generates test cases for high coverage of complex and environmentally intensive programs. This article comprehensively describes the basic principle, development situation, current issues of symbolic execution, and KLEE's infrastructure as well as the generation of test cases. To some extent, it highlights the unique advantages of symbolic execution in software testing and analysis. [ABSTRACT FROM AUTHOR]

Copyright of Transactions of Beijing Institute of Technology is the property of Beijing University of Technology and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Abstract Analysis of software that supports symbolic execution of binary files is carried out. The models of symbolic memory are analyzed. The approaches of processing cycles are described. The ways of using solvers and analysis of their performance are shown for symbolic execution. The tasks of further development of the interpreter are set. The results obtained can be used to develop a symbol interpreter for the validation of deep neural networks. [ABSTRACT FROM AUTHOR]

Binary relational algebra provides semantic foundations for major areas of computing, such as database design, state-based modeling and functional programming. Remarkably, static checking support in these areas fails to exploit the full semantic content of relations. In particular, properties such as the simplicity or injectivity of relations are not statically enforced in operations such as database queries, state transitions, or composition of functional components. When data models, their constraints and operations are represented by point-free binary relational expressions, proof obligations can be expressed as inclusions between relational expressions. We developed a typedirected, strategic term rewriting system that can be used to simplify relational proof obligations and ultimately reduce them to tautologies. Such reductions can be used to provide extended static checking for design contraints commonly found in software modeling and development. [ABSTRACT FROM AUTHOR]

The implementations of network protocols are often prone to errors. These flaws lead to reduced performance, security breaches or it may bring down the entire network. Detecting such flaws is difficult because of the exponential size of the state space and many bugs manifest only after a prolonged operation. This paper focuses to detect the various types of flaws in network protocol implementation. The approach is to use the packet rules derived from protocol specification and test packets generated using symbolic execution for testing. Thus discover the violations in the implementation of network protocol DHCP. The entire system is based on these techniques and it is being evaluated on multiple cores. This procedure can be used as a general framework for testing other protocols. [ABSTRACT FROM AUTHOR]

Designing test cases and generating data are very important phases in software engineering these days. In order to generate test data, some generators such as random test data generators, data specification generators and path-oriented (Path-Wise) test data generators are employed. One of the most important problems in the path-oriented test data generator is the lack of attention given to discovering faults by the test data. In this paper an approach is proposed to generate some test data automatically so that we can realize the goal of discovering more faults in less time. The number of faults near the boundaries of the input domain is more than the center, according to the Pareto 80–20 principle the test data of this approach will be generated at 20% of the allowable area boundary. To do this, we extracted the boundary hypercuboids and then the test data will be generated by exploiting these hypercuboids. The experimental results show that the fault detection probability and the fault detection speed are improved significantly, compared with the previous approaches. By generating data in this way, more faults are discovered in a short period of time which makes it more possible to deliver products on time. [ABSTRACT FROM AUTHOR]

In this paper we propose a scheme for reachability testing to achieve statement coverage in the dynamic testing of concurrent programs. Previous studies on reachability testing have only enumerated the feasible interleavings of a concurrent program for a given input. The proposed scheme derives inputs from SYN-sequences obtained in reachability testing and uses these inputs to perform reachability testing multiple times in order to achieve statement-coverage testing for a concurrent program. We prove formally that the proposed method can achieve statement-coverage testing if all the path conditions derived from SYN-sequences can be solved and the concurrent program contains no dead code. [ABSTRACT FROM AUTHOR]

Abstract: Malware writers often use packing technique to hide malicious payload. A number of dynamic unpacking tools are.designed in order to identify and extract the hidden code in the packed malware. However, such unpacking methods.are all based on a highly controlled environment that is vulnerable to various anti-unpacking techniques. If execution.environment is suspicious, malwares may stay inactive for a long time or stop execution immediately to evade.detection. In this paper, we proposed a novel approach that automatically reasons about the environment requirements.imposed by malware, then directs a unpacking tool to change the controlled environment to extract the hide code at.the new environment. The experimental results show that our approach significantly increases the resilience of the.traditional unpacking tools to environment-sensitive malware. [Copyright &y& Elsevier]

The problem of finding unfeasible paths (UFP: computation paths that are never executed for any input) is important in test data generation and effect propagation analyses. In this paper a directed graph representation executable in parallel, called path dependence flow graph, is proposed which is suited to problems of finding properties of procedural programs along computation paths such as the UFP detection problem. Also, a method is given that symbolically computes logical expressions necessary for UFP detection by parallel abstract interpretation of this graph. Furthermore a method for detecting UFP is presented that converts an obtained logical expression into a Presburger sentence and that applies a truth value decision method for Presburger sentences to it. By using this method, the computation control is made simple and the removal of computations that are not necessary for UFP detection is made easy. In addition since partial results can be shared, UFPs are detected more efficiently. [ABSTRACT FROM AUTHOR]