A copy of this work was available on the public web and has been preserved in the Wayback Machine. The capture dates from 2021; you can also visit <a rel="external noopener" href="https://arxiv.org/pdf/2109.03698v1.pdf">the original URL</a>. The file type is <code>application/pdf</code>.
Towards Symbolic Pointers Reasoning in Dynamic Symbolic Execution
[article]
<span title="2021-09-08">2021</span>
<i >
arXiv
</i>
<span class="release-stage" >pre-print</span>
Preserved Fulltext
Other Versions
<span title="2022-03-22">2022</span>
<span class="release-stage">accepted</span>
<span class="external-identifiers"> <a target="_blank" rel="external noopener" href="https://arxiv.org/abs/2109.03698v2">arXiv:2109.03698v2</a> <a target="_blank" rel="external noopener" href="https://fatcat.wiki/release/2nnoamsamfhwbfef4bvxbg7gtq">fatcat:2nnoamsamfhwbfef4bvxbg7gtq</a> </span>
<span class="external-identifiers"> <a target="_blank" rel="external noopener" href="https://arxiv.org/abs/2109.03698v2">arXiv:2109.03698v2</a> <a target="_blank" rel="external noopener" href="https://fatcat.wiki/release/2nnoamsamfhwbfef4bvxbg7gtq">fatcat:2nnoamsamfhwbfef4bvxbg7gtq</a> </span>
Dynamic symbolic execution is a widely used technique for automated software testing, designed for execution paths exploration and program errors detection. A hybrid approach has recently become widespread, when the main goal of symbolic execution is helping fuzzer increase program coverage. The more branches symbolic executor can invert, the more useful it is for fuzzer. A program control flow often depends on memory values, which are obtained by computing address indexes from user input.
<span class="external-identifiers">
<a target="_blank" rel="external noopener" href="https://arxiv.org/abs/2109.03698v1">arXiv:2109.03698v1</a>
<a target="_blank" rel="external noopener" href="https://fatcat.wiki/release/wrlas2jxrjapbotpcr4ic5ej4y">fatcat:wrlas2jxrjapbotpcr4ic5ej4y</a>
</span>
more »
... er, most DSE tools don't support such dependencies, so they miss some desired program branches. We implement symbolic addresses reasoning on memory reads in our dynamic symbolic execution tool Sydr. Possible memory access regions are determined by either analyzing memory address symbolic expressions, or binary searching with SMT-solver. We propose an enhanced linearization technique to model memory accesses. Different memory modeling methods are compared on the set of programs. Our evaluation shows that symbolic addresses handling allows to discover new symbolic branches and increase the program coverage.
<a target="_blank" rel="noopener" href="https://web.archive.org/web/20210914200920/https://arxiv.org/pdf/2109.03698v1.pdf" title="fulltext PDF download" data-goatcounter-click="serp-fulltext" data-goatcounter-title="serp-fulltext">
<button class="ui simple right pointing dropdown compact black labeled icon button serp-button">
<i class="icon ia-icon"></i>
Web Archive
[PDF]
<div class="menu fulltext-thumbnail">
<img src="https://blobs.fatcat.wiki/thumbnail/pdf/b9/e3/b9e31c0daa37bc85c3e7bb7365d5ff0fd572d74e.180px.jpg" alt="fulltext thumbnail" loading="lazy">
</div>
</button>
</a>
<a target="_blank" rel="external noopener" href="https://arxiv.org/abs/2109.03698v1" title="arxiv.org access">
<button class="ui compact blue labeled icon button serp-button">
<i class="file alternate outline icon"></i>
arxiv.org
</button>
</a>