Search

Code analysis for defect detection is very important in the modern world, especially in the case of complex multi-thread applications. An example of a tool, suitable for software of high complexity, is the famous S2E, which allows for full-system emulation with symbolic execution. This paper presents several major enhancements for S2E, including: firstly, support for multiple virtual cores, allowing to have parallel speed-up; secondly, on this basis, a race checker plugin to detect defects of this sort in multi-thread programs. This development has concerned such interesting points of research as scheduling in multi-core emulation and race detection with symbolic execution. [ABSTRACT FROM AUTHOR]

Abstract: Nowadays, software developers often face the following problem: there is a large amount of inputs that cause the program to crash. In practice, this amount of inputs is too large to be analyzed manually in a reasonable time. This paper contains an overview and analysis of existing methods for this problem. A new method for analyzing crashes to select unique defects is proposed. The method is based on comparison of control flow graphs (CFGs). For this purpose, a special metric is introduced: the graphs are considered similar if the metric does not exceed a certain threshold, which is a filtering parameter. Information about the graphs is collected dynamically at runtime through instrumentation of the program's binary code. The method is applicable to binary executables and does not require any debugging information. The developers, having estimated their time and effort, can significantly reduce the number of crashes to be analyzed. In addition, an effective algorithm for fixing software bugs that cause crashes is proposed. The method is implemented as part of the fuzzer developed at the Institute for System Programming of the Russian Academy of Sciences (ISP RAS) and tested on a set of programs for x86-64/Linux. The test results show that the number of crashes to be analyzed can be reduced by several times. [ABSTRACT FROM AUTHOR]