Directed symbolic execution

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 6887 LNCS, Issue , 2011, Pages 95-111

  Ma, Kin Keung ^a   Yit Phang, Khoo ^a   Foster, Jeffrey S ^a   Hicks, Michael ^a  

^a UNIVERSITY OF MARYLAND   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CALL CHAINS; CONTROL FLOW GRAPHS; DISTANCE METRICS; HYBRID STRATEGIES; INTER-PROCEDURAL; PROGRAM EXECUTION; SEARCH STRATEGIES; SYMBOLIC EXECUTION; TRUE POSITIVE;

DATA FLOW ANALYSIS; PROBLEM SOLVING;

STATIC ANALYSIS;

EID: 80053121582     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-23702-7_11     Document Type: Conference Paper

References (36)

1. Bornat, R.: Proving pointer programs in Hoare logic. In: MPC, pp. 102-126 (2000)
2. Boyer, R.S., Elspas, B., Levitt, K.N.: SELECT - a formal system for testing and debugging programs by symbolic execution. In: ICRS, pp. 234-245 (1975)
3. Burnim, J., Sen, K.: Heuristics for scalable dynamic test generation. In: ASE, pp. 443-446 (2008)
4. Cadar, C., Dunbar, D., Engler, D.R.: KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs. In: OSDI, pp. 209-224 (2008)
5. Cadar, C., Ganesh, V., Pawlowski, P.M., Dill, D.L., Engler, D.R.: EXE: automatically generating inputs of death. In: CCS, pp. 322-335 (2006) (Pubitemid 47131380)
6. Coreutils - GNU core utilities, http://www.gnu.org/software/coreutils/
7. Edelkamp, S., Leue, S., Lluch-Lafuente, A.: Directed explicit-state model checking in the validation of communication protocols. Software Tools for Technology Transfer 5(2), 247-267 (2004)
8. Edelkamp, S., Lluch-Lafuente, A., Leue, S.: Trail-directed model checking. Electrical Notes Theoretical Computer Science 55(3), 343-356 (2001) (Pubitemid 40715768)
9. Fähndrich, M., Rehof, J., Das, M.: Scalable context-sensitive flow analysis using instantiation constraints. In: PLDI, pp. 253-263 (2000) (Pubitemid 32394099)
10. Ganesh, V., Dill, D.L.: A decision procedure for bit-vectors and arrays. In: Damm, W., Hermanns, H. (eds.) CAV 2007. LNCS, vol. 4590, pp. 519-531. Springer, Heidelberg (2007)
11. Godefroid, P., Klarlund, N., Sen, K.: DART: directed automated random testing. In: PLDI, pp. 213-223 (2005)
12. Godefroid, P., Levin, M.Y., Molnar, D.A.: Active property checking. In: EMSOFT, pp. 207-216 (2008)
13. Godefroid, P., Levin, M.Y., Molnar, D.A.: Automated whitebox fuzz testing. In: NDSS (2008)
14. Groce, A., Visser, W.: Model checking Java programs using structural heuristics. In: ISSTA, pp. 12-21 (2002)
15. Howden, W.E.: Symbolic testing and the DISSECT symbolic evaluation system. IEEE Transactions on Software Engineering 3(4), 266-278 (1977)
16. Khoo, Y.P., Chang, B.-Y.E., Foster, J.S.: Mixing type checking and symbolic execution. In: PLDI, pp. 436-447 (2010)
17. King, J.C.: Symbolic execution and program testing. CACM 19(7), 385-394 (1976)
18. The KLEE Symbolic Virtual Machine, http://klee.llvm.org
19. Kodumal, J., Aiken, A.: The set constraint/CFL reachability connection in practice. In: PLDI, pp. 207-218 (2004)
20. Kupferschmid, S., Hoffmann, J., Dierks, H., Behrmann, G.: Adapting an AI planning heuristic for directed model checking. In: Valmari, A. (ed.) SPIN 2006. LNCS, vol. 3925, pp. 35-52. Springer, Heidelberg (2006) (Pubitemid 44019617)
21. Landi, W., Ryder, B.G.: Pointer-induced aliasing: a problem taxonomy. In: POPL, pp. 93-103 (1991)
22. Lattner, C., Adve, V.: LLVM: a compilation framework for lifelong program analysis transformation. In: CGO, pp. 75-86 (2004)
23. Ma, K.-K., Khoo, Y.P., Foster, J.S., Hicks, M.: Directed symbolic execution. Technical Report CS-TR-4979, UMD-College Park (April 2011)
24. Majumdar, R., Sen, K.: Hybrid concolic testing. In: ICSE, pp. 416-426 (2007)
25. Meyering, J.: Seq: give a proper diagnostic for an invalid-format=%option (2008), http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id= b8108fd2ddf77ae79cd014f4f37798a52be13fd1
26. Morris, J.M.: A general axiom of assignment. Assignment and linked data structure. A proof of the Schorr-Waite algorithm. In: Broy, M., Schmidt, G. (eds.) Theoretical Foundations of Programming Methodology, pp. 25-51 (1982)
27. Necula, G.C., McPeak, S., Rahul, S.P., Weimer, W.: CIL: Intermediate language and tools for analysis and transformation of C programs. In: CC 2002. LNCS, vol. 2304, pp. 213-228. Springer, Heidelberg (2002)
28. The Newlib Homepage, http://sourceware.org/newlib/
29. Osterweil, L.J., Fosdick, L.D.: Program testing techniques using simulated execution. In: ANSS, pp. 171-177 (1976)
30. Rehof, J., Fähndrich, M.: Type-base flow analysis: from polymorphic subtyping to CFL-reachability. In: PLDI, pp. 54-66 (2001)
31. Reisner, E., Song, C., Ma, K.-K., Foster, J.S., Porter, A.: Using symbolic evaluation to understand behavior in configurable software systems. In: ICSE, pp. 445-454 (2010)
32. Reps, T.W.: Program analysis via graph reachability. In: ILPS, pp. 5-19 (1997)
33. μClibc, http://www.uclibc.org/
34. Xie, T., Tillmann, N., de Halleux, J., Schulte, W.: Fitness-guided path exploration in dynamic symbolic execution. In: DSN, pp. 359-368 (2009)
35. Zamfir, C.: Personal communication (May 2011)
36. Zamfir, C., Candea, G.: Execution synthesis: a technique for automated software debugging. In: EuroSys, pp. 321-334 (2010)