EXE: Automatically generating inputs of death

DMCA

EXE: Automatically generating inputs of death (2006)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Cristian Cadar , Vijay Ganesh , Peter M. Pawlowski , David L. Dill , Dawson R. Engler

Venue:	In Proceedings of the 13th ACM Conference on Computer and Communications Security (CCS
Citations:	349 - 21 self

BibTeX

@INPROCEEDINGS{Cadar06exe:automatically,
    author = {Cristian Cadar and Vijay Ganesh and Peter M. Pawlowski and David L. Dill and Dawson R. Engler},
    title = {EXE: Automatically generating inputs of death},
    booktitle = {In Proceedings of the 13th ACM Conference on Computer and Communications Security (CCS},
    year = {2006}
}

OpenURL

Abstract

This article presents EXE, an effective bug-finding tool that automatically generates inputs that crash real code. Instead of running code on manually or randomly constructed input, EXE runs it on symbolic input initially allowed to be anything. As checked code runs, EXE tracks the constraints on each symbolic (i.e., input-derived) memory location. If a statement uses a symbolic value, EXE does not run it, but instead adds it as an input-constraint; all other statements run as usual. If code conditionally checks a symbolic expression, EXE forks execution, constraining the expression to be true on the true branch and false on the other. Because EXE reasons about all possible values on a path, it has much more power than a traditional runtime tool: (1) it can force execution down any feasible program path and (2) at dangerous operations (e.g., a pointer dereference), it detects if the current path constraints allow any value that causes a bug. When a path terminates or hits a bug, EXE automatically generates a test case by solving the current path constraints to find concrete values using its own co-designed constraint solver, STP. Because EXE’s constraints have no approximations, feeding this concrete input to an uninstrumented version of the checked code will cause it to follow the same path and hit the same bug (assuming deterministic code).

Keyphrases

current path constraint dangerous operation co-designed constraint solver checked code run possible value feasible program path deterministic code true branch pointer dereference crash real code concrete value effective bug-finding tool uninstrumented version symbolic input symbolic expression traditional runtime tool exe reason symbolic value exe constraint memory location concrete input test case checked code

DMCA