Citation Context

...GHz Intel Xeon quad core processor with 4GB RAM running Microsoft Windows Server 2003. Table 2. Empirical evaluation of SMASH on 16 device drivers. Overall comparison. A comparison of SMASH with DASH =-=[5]-=- (this is the non-compositional may-must analysis described in Figure 7) on all 69 device drivers and 85 properties is shown in Table 1. The total number of lines of code analyzed is 342000 lines of c...

Citation Context

...tyle of concolic execution ala Dart [5]. Our first attempt in this direction was the Synergy algorithm [6], which handled single procedure programs with only integer variables. Then, we proposed Dash =-=[3]-=-, which had new ideas to handle pointer aliasing and procedure calls in programs. Throughout this evolution, Yogi has been our implementation vehicle to realize and evaluate these algorithms. Currentl...

Citation Context

...tor operations. This way, the rapid progress in SMT solvers can be directly utilized to improve performance in practice. In the presence of unknown functions, trace-based abstraction techniques as in =-=[29]-=-, which uses concrete parameter/return values to model library functions, are employed to derive the predictive model, while ensuring that the analysis results remain precise. 8 Conclusions In this pa...

Citation Context

...rams (smpp) [13] lifts DPLL(T ) to programs, using a sat solver to guide an abstract interpreter. Deep integration techniques embed program analysis in satisfiability architectures. Examples are yogi =-=[3]-=- and lazy annotation [16], both of which require quantifier-free first order theories. We use abstract domains and transformers. 2 Program Model and Domain This section introduces the program model an...

Citation Context

...PI-semantics engines to determine how mode variables are transformed. The ideas in SLAM has been extended to lazy abstraction [24], which interleaves the abstraction and checking process, and to YOGI =-=[4]-=-, which combines testing and theorem proving to construct abstractions. Most developments that follow SLAM, such as those surveyed in [26] focus on improving either model checking or abstraction. Our ...

Citation Context

...romising results by combining symbolic with concrete execution [11, 17, 31, 47, 49, 52] or with grammar-based input generation [30]. In contrast to combination of concrete executions with abstraction =-=[6, 46]-=-, UDITA focuses on test generation by efficiently covering a set of concrete executions, without approximation. We have no evidence that any of the existing approaches can find bugs such as those that...

Citation Context

... Programmers are typically unaware of such details; however, they are often the source of exploitable security vulnerabilities. The algorithms used in software model checkers that work on source code =-=[5, 23,6]-=- would be be unsound if applied to machine code. For instance, before starting the verification process proper, SLAM [5] and BLAST [23] perform flow-insensitive (and possibly field-sensitive) points-t...

Citation Context

...bility of paths to an error location, to compute program invariants. In our previous work [2], we used predicate abstraction to generalize symbolic program executions. Note that Synergy [17] and Dash =-=[4]-=- are considered underapproximation-driven according to our categorization, as they use weakestprecondition computations along infeasible symbolic paths to refine a partition of the state space with th...

Citation Context

...�σ 3(a) (b) s1: x = x ⊕ y; s2: y = x ⊕ y; s3: x = x ⊕ y; t1: ∗px = ∗px ⊕ ∗py; t2: ∗py = ∗px ⊕ ∗py; t3: ∗px = ∗px ⊕ ∗py; 0: px: py: Before v &py &py (c) 0: px: py: After v &py v [1] mov eax, [ebp−10] =-=[2]-=- xor eax, [ebp−14] [3] mov [ebp−10], eax [4] mov eax, [ebp−10] [5] xor eax, [ebp−14] [6] mov [ebp−14], eax [7] mov eax, [ebp−10] [8] xor eax, [ebp−14] [9] mov [ebp−10], eax (d) Fig. 1. (a) Code fragme...

Citation Context

...es partially these problems by encoding large loop-free blocks into a Boolean formula relying on the capabilities of an SMT solver, although for loops the same issues still remain. Synergy/DASH/SMASH =-=[14, 4, 13]-=- use test-generation features to enhance the process of verification. The main advantage comes from the use of symbolic execution provided by DART [12] to make the refinement phase cheaper. The main d...