Concolic Testing Dynamic Symbolic Execution Marco Probst - - PowerPoint PPT Presentation

▶
concolic testing
SMART_READER_LITE
LIVE PREVIEW

Concolic Testing Dynamic Symbolic Execution Marco Probst - - PowerPoint PPT Presentation

Dec 19, 2022 29 likes •921 views

Concolic Testing Dynamic Symbolic Execution Marco Probst Albert-Ludwigs-Universitt Freiburg January 25th, 2016 Marco Probst Concolic Testing 1 / 22 Overview Code Example 1 Unit Testing 2 Random Testing Symbolic Execution Concolic

slide-1
SLIDE 1

Concolic Testing

Dynamic Symbolic Execution Marco Probst

Albert-Ludwigs-Universität Freiburg

January 25th, 2016

Marco Probst Concolic Testing 1 / 22

slide-2
SLIDE 2

Overview

1

Code Example

2

Unit Testing Random Testing Symbolic Execution

3

Concolic Testing DART

4

Summary

Marco Probst Concolic Testing 2 / 22

slide-3
SLIDE 3

Overview

1

Code Example

2

Unit Testing Random Testing Symbolic Execution

3

Concolic Testing DART

4

Summary

Marco Probst Concolic Testing 3 / 22

slide-4
SLIDE 4

Program Under Test

Developers writing code [1] . . .

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 } Marco Probst Concolic Testing 4 / 22

slide-5
SLIDE 5

Program Under Test

Developers writing code [1] . . .

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 }

. . . need to test

Marco Probst Concolic Testing 4 / 22

slide-6
SLIDE 6

Overview

1

Code Example

2

Unit Testing Random Testing Symbolic Execution

3

Concolic Testing DART

4

Summary

Marco Probst Concolic Testing 5 / 22

slide-7
SLIDE 7

Unit Testing

Ensure overall software quality Individual components (e.g. functions)

Marco Probst Concolic Testing 6 / 22

slide-8
SLIDE 8

Unit Testing

Ensure overall software quality Individual components (e.g. functions) Goals

◮ Detect errors ◮ Check corner cases ◮ Provide high code coverage (e.g. path coverage)

Marco Probst Concolic Testing 6 / 22

slide-9
SLIDE 9

Path Coverage

Marco Probst Concolic Testing 7 / 22

slide-10
SLIDE 10

Path Coverage

Code Example ⇒ Control Flow ⇒ Execution Paths

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 } Marco Probst Concolic Testing 7 / 22

slide-11
SLIDE 11

Path Coverage

Code Example ⇒ Control Flow ⇒ Execution Paths

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 } Marco Probst Concolic Testing 7 / 22

slide-12
SLIDE 12

Path Coverage

Code Example ⇒ Control Flow ⇒ Execution Paths

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 } Marco Probst Concolic Testing 7 / 22

slide-13
SLIDE 13

Path Coverage

Code Example ⇒ Control Flow ⇒ Execution Paths

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 } Marco Probst Concolic Testing 7 / 22

slide-14
SLIDE 14

Path Coverage

Code Example ⇒ Control Flow ⇒ Execution Paths

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 } Marco Probst Concolic Testing 7 / 22

slide-15
SLIDE 15

Path Coverage

Code Example ⇒ Control Flow ⇒ Execution Paths

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 }

Contradiction: x <= 0 && x > 0 ⇒ not executable

Marco Probst Concolic Testing 7 / 22

slide-16
SLIDE 16

Path Coverage

3 possible execution paths Corresponding path conditions

Marco Probst Concolic Testing 7 / 22

slide-17
SLIDE 17

Path Coverage

3 possible execution paths Corresponding path conditions Optimal: cover all paths Find input set to run program along different paths

Marco Probst Concolic Testing 7 / 22

slide-18
SLIDE 18

Random Testing

Marco Probst Concolic Testing 8 / 22

slide-19
SLIDE 19

Random Testing

Most naive way of testing Generate random inputs Concrete input values Dynamic execution of program Observe behavior Compare against expected behavior e.g. output or "do not crash"

Marco Probst Concolic Testing 8 / 22

slide-20
SLIDE 20

Random Testing on Code Example

Marco Probst Concolic Testing 9 / 22

slide-21
SLIDE 21

Random Testing on Code Example

Random inputs for

f(int x, int y)

Marco Probst Concolic Testing 9 / 22

slide-22
SLIDE 22

Random Testing on Code Example

Random inputs for

f(int x, int y) x = 700, y = 500

Marco Probst Concolic Testing 9 / 22

slide-23
SLIDE 23

Random Testing on Code Example

Random inputs for

f(int x, int y) x = 700, y = 500 x = -700, y = 500

Marco Probst Concolic Testing 9 / 22

slide-24
SLIDE 24

Random Testing on Code Example

Random inputs for

f(int x, int y) x = 700, y = 500 x = -700, y = 500

Similar values are very likely

Marco Probst Concolic Testing 9 / 22

slide-25
SLIDE 25

Random Testing on Code Example

Necessary inputs

x > 0, y = 10

Marco Probst Concolic Testing 9 / 22

slide-26
SLIDE 26

Random Testing on Code Example

Necessary inputs

x > 0, y = 10

Assume 32-bit integers

⇒ 1 out of 232

Marco Probst Concolic Testing 9 / 22

slide-27
SLIDE 27

Random Testing on Code Example

Necessary inputs

x > 0, y = 10

Assume 32-bit integers

⇒ 1 out of 232

Very low probability

Marco Probst Concolic Testing 9 / 22

slide-28
SLIDE 28

Random Testing on Code Example

Necessary inputs

x > 0, y = 10

Assume 32-bit integers

⇒ 1 out of 232

Very low probability Long run . . .

Marco Probst Concolic Testing 9 / 22

slide-29
SLIDE 29

Random Testing on Code Example

Necessary inputs

x > 0, y = 10

Assume 32-bit integers

⇒ 1 out of 232

Very low probability Long run . . . Another technique!

Marco Probst Concolic Testing 9 / 22

slide-30
SLIDE 30

Symbolic Execution [2] & [3]

Symbols instead of concrete values

Marco Probst Concolic Testing 10 / 22

slide-31
SLIDE 31

Symbolic Execution [2] & [3]

Symbols instead of concrete values Connected to path constraints (or path conditions)

Marco Probst Concolic Testing 10 / 22

slide-32
SLIDE 32

Symbolic Execution [2] & [3]

Symbols instead of concrete values Connected to path constraints (or path conditions) Constraint solver computes concrete values

Marco Probst Concolic Testing 10 / 22

slide-33
SLIDE 33

Symbolic Execution [2] & [3]

Symbols instead of concrete values Connected to path constraints (or path conditions) Constraint solver computes concrete values

1 y = read(); 2 y = 2 * y; 3 4 if (y == 12) { 5

fail();

6 } 7 8 complete(); Marco Probst Concolic Testing 10 / 22

slide-34
SLIDE 34

Symbolic Execution [2] & [3]

Symbols instead of concrete values Connected to path constraints (or path conditions) Constraint solver computes concrete values

1 y = read(); 2 y = 2 * y; 3 4 if (y == 12) { 5

fail();

6 } 7 8 complete();

Introduces symbol s for read()

y = read() ⇒ y = s

Marco Probst Concolic Testing 10 / 22

slide-35
SLIDE 35

Symbolic Execution [2] & [3]

Symbols instead of concrete values Connected to path constraints (or path conditions) Constraint solver computes concrete values

1 y = read(); 2 y = 2 * y; 3 4 if (y == 12) { 5

fail();

6 } 7 8 complete();

Introduces symbol s for read()

y = read() ⇒ y = s y = 2 * y ⇒ y = 2 * s

Marco Probst Concolic Testing 10 / 22

slide-36
SLIDE 36

Symbolic Execution [2] & [3]

Symbols instead of concrete values Connected to path constraints (or path conditions) Constraint solver computes concrete values

1 y = read(); 2 y = 2 * y; 3 4 if (y == 12) { 5

fail();

6 } 7 8 complete();

Introduces symbol s for read()

y = read() ⇒ y = s y = 2 * y ⇒ y = 2 * s

Branching point in line 4

y == 12 ⇒ 2 * s == 12 y != 12 ⇒ 2 * s != 12

Marco Probst Concolic Testing 10 / 22

slide-37
SLIDE 37

Symbolic Execution [2] & [3]

Symbols instead of concrete values Connected to path constraints (or path conditions) Constraint solver computes concrete values

1 y = read(); 2 y = 2 * y; 3 4 if (y == 12) { 5

fail();

6 } 7 8 complete();

Introduces symbol s for read()

y = read() ⇒ y = s y = 2 * y ⇒ y = 2 * s

Branching point in line 4

y == 12 ⇒ 2 * s == 12 y != 12 ⇒ 2 * s != 12

Marco Probst Concolic Testing 10 / 22

slide-38
SLIDE 38

Symbolic Execution [2] & [3]

Symbols instead of concrete values Connected to path constraints (or path conditions) Constraint solver computes concrete values

1 y = read(); 2 y = 2 * y; 3 4 if (y == 12) { 5

fail();

6 } 7 8 complete();

Introduces symbol s for read()

y = read() ⇒ y = s y = 2 * y ⇒ y = 2 * s

Branching point in line 4

y == 12 ⇒ 2 * s == 12 y != 12 ⇒ 2 * s != 12

Marco Probst Concolic Testing 10 / 22

slide-39
SLIDE 39

Symbolic Execution [2] & [3]

Symbols instead of concrete values Connected to path constraints (or path conditions) Constraint solver computes concrete values

1 y = read(); 2 y = 2 * y; 3 4 if (y == 12) { 5

fail();

6 } 7 8 complete();

Introduces symbol s for read()

y = read() ⇒ y = s y = 2 * y ⇒ y = 2 * s

Branching point in line 4

y == 12 ⇒ 2 * s == 12 y != 12 ⇒ 2 * s != 12

Which input leads to fail()?

Marco Probst Concolic Testing 10 / 22

slide-40
SLIDE 40

Symbolic Execution [2] & [3]

Symbols instead of concrete values Connected to path constraints (or path conditions) Constraint solver computes concrete values

1 y = read(); 2 y = 2 * y; 3 4 if (y == 12) { 5

fail();

6 } 7 8 complete();

Introduces symbol s for read()

y = read() ⇒ y = s y = 2 * y ⇒ y = 2 * s

Branching point in line 4

y == 12 ⇒ 2 * s == 12 y != 12 ⇒ 2 * s != 12

Which input leads to fail()? Constraint solver yields 6

Marco Probst Concolic Testing 10 / 22

slide-41
SLIDE 41

Symbolic Execution [2] & [3]

Symbols instead of concrete values Connected to path constraints (or path conditions) Constraint solver computes concrete values

1 y = read(); 2 y = 2 * y; 3 4 if (y == 12) { 5

fail();

6 } 7 8 complete();

Introduces symbol s for read()

y = read() ⇒ y = s y = 2 * y ⇒ y = 2 * s

Branching point in line 4

y == 12 ⇒ 2 * s == 12 y != 12 ⇒ 2 * s != 12

Which input leads to fail()? Constraint solver yields 6

⇒ Promising for code example!

Marco Probst Concolic Testing 10 / 22

slide-42
SLIDE 42

Symbolic Execution On Code Example

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 } Marco Probst Concolic Testing 11 / 22

slide-43
SLIDE 43

Symbolic Execution On Code Example

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 }

Non-linear constraint

Marco Probst Concolic Testing 11 / 22

slide-44
SLIDE 44

Symbolic Execution On Code Example

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 }

Non-linear constraint Undecidable problem for most constraint solvers

⇒ Cannot reason about

Marco Probst Concolic Testing 11 / 22

slide-45
SLIDE 45

Symbolic Execution On Code Example

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 }

Non-linear constraint Undecidable problem for most constraint solvers

⇒ Cannot reason about

Execution stops

⇒ No path covered

Marco Probst Concolic Testing 11 / 22

slide-46
SLIDE 46

Symbolic Execution On Code Example

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 }

Non-linear constraint Undecidable problem for most constraint solvers

⇒ Cannot reason about

Execution stops

⇒ No path covered

Only possibility: Problem with constraint solver

Marco Probst Concolic Testing 11 / 22

slide-47
SLIDE 47

Symbolic Execution On Code Example

1 f(int x, int y) { 2

if (x*x*x > 0) {

3

if (x > 0 && y == 10) {

4

fail();

5

}

6

} else {

7

if (x > 0 && y == 20) {

8

fail();

9

}

10

}

11 12

complete();

13 }

Non-linear constraint Undecidable problem for most constraint solvers

⇒ Cannot reason about

Execution stops

⇒ No path covered

Only possibility: Problem with constraint solver

⇒ How to improve?

Marco Probst Concolic Testing 11 / 22

slide-48
SLIDE 48

Overview

1

Code Example

2

Unit Testing Random Testing Symbolic Execution

3

Concolic Testing DART

4

Summary

Marco Probst Concolic Testing 12 / 22

slide-49
SLIDE 49

Concolic Testing

Combination of two techniques

◮ Random Testing ⋆ Concrete values ⋆ Dynamic execution ◮ Symbolic Execution ⋆ Symbols ⋆ Static analysis

Marco Probst Concolic Testing 13 / 22

slide-50
SLIDE 50

Concolic Testing

Combination of two techniques

◮ Random Testing ⋆ Concrete values ⋆ Dynamic execution ◮ Symbolic Execution ⋆ Symbols ⋆ Static analysis

Concolic ⇐ Concrete & Symbolic

Marco Probst Concolic Testing 13 / 22

slide-51
SLIDE 51

Concolic Testing

Combination of two techniques

◮ Random Testing ⋆ Concrete values ⋆ Dynamic execution ◮ Symbolic Execution ⋆ Symbols ⋆ Static analysis

Concolic ⇐ Concrete & Symbolic Symbolic Execution beside Random Testing

⇒ Execute dynamically & explore symbolically

Marco Probst Concolic Testing 13 / 22

slide-52
SLIDE 52

Concolic Testing

Combination of two techniques

◮ Random Testing ⋆ Concrete values ⋆ Dynamic execution ◮ Symbolic Execution ⋆ Symbols ⋆ Static analysis

Concolic ⇐ Concrete & Symbolic Symbolic Execution beside Random Testing

⇒ Execute dynamically & explore symbolically

Also: Dynamic Symbolic Execution

Marco Probst Concolic Testing 13 / 22

slide-53
SLIDE 53

DART in Action (1)

Dynamic Execution Symbolic Execution

Marco Probst Concolic Testing 14 / 22

slide-54
SLIDE 54

DART in Action (1)

Dynamic Execution Random Testing Random inputs

x = 700, y = 500

Symbolic Execution

Marco Probst Concolic Testing 14 / 22

slide-55
SLIDE 55

DART in Action (1)

Dynamic Execution Random Testing Random inputs

x = 700, y = 500

Symbolic Execution Introduce symbols

x1 = X, y1 = Y

Marco Probst Concolic Testing 14 / 22

slide-56
SLIDE 56

DART in Action (1)

Dynamic Execution Random Testing Random inputs

x = 700, y = 500 x*x*x > 0

Symbolic Execution Introduce symbols

x1 = X, y1 = Y

Marco Probst Concolic Testing 14 / 22

slide-57
SLIDE 57

DART in Action (1)

Dynamic Execution Random Testing Random inputs

x = 700, y = 500 x*x*x > 0

Symbolic Execution Introduce symbols

x1 = X, y1 = Y

Constrain X

X*X*X <= 0

Marco Probst Concolic Testing 14 / 22

slide-58
SLIDE 58

DART in Action (1)

Dynamic Execution Random Testing Random inputs

x = 700, y = 500 x*x*x > 0

Symbolic Execution Introduce symbols

x1 = X, y1 = Y

Constrain X

X*X*X <= 0

Solve constraint Non-Linear ⇒ Fail

Marco Probst Concolic Testing 14 / 22

slide-59
SLIDE 59

DART in Action (1)

Dynamic Execution Random Testing Random inputs

x = 700, y = 500 x*x*x > 0

Symbolic Execution Introduce symbols

x1 = X, y1 = Y

Constrain X

X*X*X <= 0

Solve constraint Non-Linear ⇒ Fail Concrete fallback

x1 = 700

Marco Probst Concolic Testing 14 / 22

slide-60
SLIDE 60

DART in Action (1)

Dynamic Execution Random Testing Random inputs

x = 700, y = 500 x*x*x > 0 y != 10

Symbolic Execution Introduce symbols

x1 = X, y1 = Y

Constrain X

X*X*X <= 0

Solve constraint Non-Linear ⇒ Fail Concrete fallback

x1 = 700

Marco Probst Concolic Testing 14 / 22

slide-61
SLIDE 61

DART in Action (1)

Dynamic Execution Random Testing Random inputs

x = 700, y = 500 x*x*x > 0 y != 10

Symbolic Execution Introduce symbols

x1 = X, y1 = Y

Constrain X

X*X*X <= 0

Solve constraint Non-Linear ⇒ Fail Concrete fallback

x1 = 700

Constrain Y

Y == 10

Marco Probst Concolic Testing 14 / 22

slide-62
SLIDE 62

DART in Action (1)

Dynamic Execution Random Testing Random inputs

x = 700, y = 500 x*x*x > 0 y != 10

Symbolic Execution Introduce symbols

x1 = X, y1 = Y

Constrain X

X*X*X <= 0

Solve constraint Non-Linear ⇒ Fail Concrete fallback

x1 = 700

Constrain Y

Y == 10

Solve constraint

x1 = 700, y1 = 10

Marco Probst Concolic Testing 14 / 22

slide-63
SLIDE 63

DART in Action (2)

Dynamic Execution Given inputs

x = 700, y = 10

Symbolic Execution

Marco Probst Concolic Testing 15 / 22

slide-64
SLIDE 64

DART in Action (2)

Dynamic Execution Given inputs

x = 700, y = 10

Symbolic Execution Introduce symbols

x2 = X, y2 = Y

Marco Probst Concolic Testing 15 / 22

slide-65
SLIDE 65

DART in Action (2)

Dynamic Execution Given inputs

x = 700, y = 10 x*x*x > 0

Symbolic Execution Introduce symbols

x2 = X, y2 = Y

Marco Probst Concolic Testing 15 / 22

slide-66
SLIDE 66

DART in Action (2)

Dynamic Execution Given inputs

x = 700, y = 10 x*x*x > 0

Symbolic Execution Introduce symbols

x2 = X, y2 = Y

Constrain X

X*X*X <= 0

Solve constraint Non-Linear ⇒ Fail Concrete fallback

x2 = 700

Marco Probst Concolic Testing 15 / 22

slide-67
SLIDE 67

DART in Action (2)

Dynamic Execution Given inputs

x = 700, y = 10 x*x*x > 0 x > 0 && y == 10

Symbolic Execution Introduce symbols

x2 = X, y2 = Y

Constrain X

X*X*X <= 0

Solve constraint Non-Linear ⇒ Fail Concrete fallback

x2 = 700

Marco Probst Concolic Testing 15 / 22

slide-68
SLIDE 68

DART in Action (2)

Dynamic Execution Given inputs

x = 700, y = 10 x*x*x > 0 x > 0 && y == 10

Symbolic Execution Introduce symbols

x2 = X, y2 = Y

Constrain X

X*X*X <= 0

Solve constraint Non-Linear ⇒ Fail Concrete fallback

x2 = 700

Branch explored

⇒ Nothing to do

Marco Probst Concolic Testing 15 / 22

slide-69
SLIDE 69

DART in Action (2)

Dynamic Execution Given inputs

x = 700, y = 10 x*x*x > 0 x > 0 && y == 10

Symbolic Execution Introduce symbols

x2 = X, y2 = Y

Constrain X

X*X*X <= 0

Solve constraint Non-Linear ⇒ Fail Concrete fallback

x2 = 700

Branch explored

⇒ Nothing to do

No new inputs

Marco Probst Concolic Testing 15 / 22

slide-70
SLIDE 70

DART in Action (3 . . . )

Marco Probst Concolic Testing 16 / 22

slide-71
SLIDE 71

DART in Action (N)

Dynamic Execution Random Testing Random inputs

x = -700, y = 500

Symbolic Execution

Marco Probst Concolic Testing 17 / 22

slide-72
SLIDE 72

DART in Action (N)

Dynamic Execution Random Testing Random inputs

x = -700, y = 500

Symbolic Execution Introduce symbols

xN = X, yN = Y

Marco Probst Concolic Testing 17 / 22

slide-73
SLIDE 73

DART in Action (N)

Dynamic Execution Random Testing Random inputs

x = -700, y = 500 x*x*x <= 0

Symbolic Execution Introduce symbols

xN = X, yN = Y

Marco Probst Concolic Testing 17 / 22

slide-74
SLIDE 74

DART in Action (N)

Dynamic Execution Random Testing Random inputs

x = -700, y = 500 x*x*x <= 0

Symbolic Execution Introduce symbols

xN = X, yN = Y

Branch explored

⇒ Nothing to do

Marco Probst Concolic Testing 17 / 22

slide-75
SLIDE 75

DART in Action (N)

Dynamic Execution Random Testing Random inputs

x = -700, y = 500 x*x*x <= 0 x < 0 && y != 20

Symbolic Execution Introduce symbols

xN = X, yN = Y

Branch explored

⇒ Nothing to do

Marco Probst Concolic Testing 17 / 22

slide-76
SLIDE 76

DART in Action (N)

Dynamic Execution Random Testing Random inputs

x = -700, y = 500 x*x*x <= 0 x < 0 && y != 20

Symbolic Execution Introduce symbols

xN = X, yN = Y

Branch explored

⇒ Nothing to do

Constrain X, Y

X > 0, Y == 20

Marco Probst Concolic Testing 17 / 22

slide-77
SLIDE 77

DART in Action (N)

Dynamic Execution Random Testing Random inputs

x = -700, y = 500 x*x*x <= 0 x < 0 && y != 20

Symbolic Execution Introduce symbols

xN = X, yN = Y

Branch explored

⇒ Nothing to do

Constrain X, Y

X > 0, Y == 20

Solve constraints

xN = 700, yN = 20

Marco Probst Concolic Testing 17 / 22

slide-78
SLIDE 78

DART in Action (N)

Dynamic Execution Random Testing Random inputs

x = -700, y = 500 x*x*x <= 0 x < 0 && y != 20

Symbolic Execution Introduce symbols

xN = X, yN = Y

Branch explored

⇒ Nothing to do

Constrain X, Y

X > 0, Y == 20

Solve constraints

xN = 700, yN = 20

Assumed path

Marco Probst Concolic Testing 17 / 22

slide-79
SLIDE 79

DART in Action (N+1)

Dynamic Execution Given inputs

x = 700, y = 20

Symbolic Execution

Marco Probst Concolic Testing 18 / 22

slide-80
SLIDE 80

DART in Action (N+1)

Dynamic Execution Given inputs

x = 700, y = 20

Symbolic Execution Introduce symbols

xM = X, yM = Y

Marco Probst Concolic Testing 18 / 22

slide-81
SLIDE 81

DART in Action (N+1)

Dynamic Execution Given inputs

x = 700, y = 20 x*x*x > 0

Symbolic Execution Introduce symbols

xM = X, yM = Y

Marco Probst Concolic Testing 18 / 22

slide-82
SLIDE 82

DART in Action (N+1)

Dynamic Execution Given inputs

x = 700, y = 20 x*x*x > 0

Symbolic Execution Introduce symbols

xM = X, yM = Y

Branch explored

⇒ Nothing to do

Marco Probst Concolic Testing 18 / 22

slide-83
SLIDE 83

DART in Action (N+1)

Dynamic Execution Given inputs

x = 700, y = 20 x*x*x > 0 x > 0 && y != 10

Symbolic Execution Introduce symbols

xM = X, yM = Y

Branch explored

⇒ Nothing to do

Marco Probst Concolic Testing 18 / 22

slide-84
SLIDE 84

DART in Action (N+1)

Dynamic Execution Given inputs

x = 700, y = 20 x*x*x > 0 x > 0 && y != 10

Symbolic Execution Introduce symbols

xM = X, yM = Y

Branch explored

⇒ Nothing to do

Branch explored

⇒ Nothing to do

Marco Probst Concolic Testing 18 / 22

slide-85
SLIDE 85

DART in Action (N+1)

Dynamic Execution Given inputs

x = 700, y = 20 x*x*x > 0 x > 0 && y != 10

Symbolic Execution Introduce symbols

xM = X, yM = Y

Branch explored

⇒ Nothing to do

Branch explored

⇒ Nothing to do ⇒ Same as 1st path!

Marco Probst Concolic Testing 18 / 22

slide-86
SLIDE 86

DART Completed

Marco Probst Concolic Testing 19 / 22

slide-87
SLIDE 87

Overview

1

Code Example

2

Unit Testing Random Testing Symbolic Execution

3

Concolic Testing DART

4

Summary

Marco Probst Concolic Testing 20 / 22

slide-88
SLIDE 88

Summary

⇒ Classification of DART ⇒ Drawbacks of Basic Techniques Solely ⇒ Improvement with Concolic Testing

Marco Probst Concolic Testing 21 / 22

slide-89
SLIDE 89

References

[1] Patrice Godefroid, Nils Klarlund, and Koushik Sen. “DART: Directed Automated Random Testing”. In: Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation. PLDI ’05. Chicago, IL, USA: ACM, 2005,

  • pp. 213–223. ISBN: 1-59593-056-6. DOI: 10.1145/1065010.1065036. URL:

http://doi.acm.org/10.1145/1065010.1065036.

[2] James C. King. “Symbolic Execution and Program Testing”. In: Commun. ACM 19.7 (July 1976), pp. 385–394. ISSN: 0001-0782. DOI: 10.1145/360248.360252. URL:

http://doi.acm.org/10.1145/360248.360252.

[3]

  • Wikipedia. Symbolic Execution. June 2015. URL:

http://en.wikipedia.org/wiki/Symbolic_execution.

Marco Probst Concolic Testing 22 / 22