The S2E platform: Design, implementation, and applications

ACM Transactions on Computer Systems

Volumn 30, Issue 1, 2012, Pages

  Chipounov, Vitaly ^a   Kuznetsov, Volodymyr ^a   Candea, George ^a  

^a EPFL   (Switzerland)

Author keywords

Analysis; Profiling; Symbolic execution; Testing

Indexed keywords

ABSTRACT MODELS; ANALYSIS; ANALYSIS TOOLS; AUTOMATED PATH; AUTOMATED TESTING; COMPREHENSIVE PERFORMANCE; CONSISTENCY MODEL; EXECUTION PATHS; IN-VIVO; LARGE SYSTEM; PROFILING; PROPRIETARY SOFTWARE; REAL SOFTWARES; SOFTWARE SYSTEMS; SYMBOLIC EXECUTION; TARGET ANALYSIS; TARGET SYSTEMS;

REVERSE ENGINEERING; TESTING;

SOFTWARE TESTING;

EID: 84859090239     PISSN: 07342071     EISSN: 15577333     Source Type: Journal    
DOI: 10.1145/2110356.2110358     Document Type: Conference Paper

References (50)

1. ANDERSON, J., BERC, L., DEAN, J., GHEMAWAT, S., HENZINGER, M., LEUNG, S.-T., SITES, D., VANDEVOORDE, M., WALDSPURGER, C. A., AND WEIHL, W. E. 1997. Continuous profiling: Where have all the cycles gone? In Proceedings of the Symposium on Operating Systems Principles.
2. BALL, T., BOUNIMOVA, E., COOK, B., LEVIN, V., LICHTENBERG, J., MCGARVEY, C., ONDRUSEK, B., RAJAMANI, S. K., AND USTUNER, A. 2006. Thorough static analysis of device drivers. In Proceedings of the ACM EuroSys European Conference on Computer Systems.
3. BALL, T., BOUNIMOVA, E., LEVIN, V., KUMAR, R., AND LICHTENBERG, J. 2010. The static driver verifier research platform. In Proceedings of the International Conference on Computer Aided Verification.
4. BELLARD, F. 2005. QEMU, a fast and portable dynamic translator. In Proceedings of the USENIX Annual Technical Conference.
5. BESSEY, A., BLOCK, K., CHELF, B., CHOU, A., FULTON, B., HALLEM, S., HENRI-GROS, C., KAMSKY, A., MCPEAK, S., AND ENGLER, D. 2010. A few billion lines of code later: Using static analysis to find bugs in the real world. Comm. ACM 53, 2.
6. BOCHS. 2011. Bochs IA-32 emulator. http://bochs.sourceforge.net/.
7. BOONSTOPPEL, P., CADAR, C., AND ENGLER, D. R. 2008. RWset: Attacking path explosion in constraintbased test generation. In Proceedings of the International Conference on Tools and Algorithms for the Construction and Analysis of Systems.
8. BRUMLEY, D., HARTWIG, C., KANG, M. G., NEWSOME, Z. L. J., POOSANKAM, P., SONG, D., AND YIN, H. 2007. BitScope: Automatically dissecting malicious binaries. Tech. rep. CMU-CS-07-133, Carnegie Mellon University.
9. BUCUR, S., URECHE, V., ZAMFIR, C., AND CANDEA, G. 2011. Parallel symbolic execution for automated real-world software testing. In Proceedings of the ACM EuroSys European Conference on Computer Systems.
10. BUNGALE, P. P. AND LUK, C.-K. 2007. PinOS: A programmable framework for whole-system dynamic instrumentation. In Proceedings of the International Conference on Virtual Execution Environments.
11. BURROWS, M., ERLINGSON, U., LEUNG, S.-T., VANDEVOORDE, M. T., WALDSPURGER, C. A., WALKER, K., AND WEIHL, W. E. 2000. Efficient and flexible value sampling. In Proceedings of the International Conference on Architectural Support for Programming Languages and Operating Systems.
12. CADAR, C., GANESH, V., PAWLOWSKI, P. M., DILL, D. L., AND ENGLER, D. R. 2006. EXE: Automatically generating inputs of death. In Proceedings of the Conference on Computer and Communication Security.
13. CADAR, C., DUNBAR, D., AND ENGLER, D. R. 2008. KLEE: Unassisted and automatic generation of highcoverage tests for complex systems programs. In Proceedings of the Symposium on Operating Systems Design and Implemenatation.
14. CHIPOUNOV, V. AND CANDEA, G. 2010. Reverse engineering of binary device drivers with RevNIC. In Proceedings of the ACM EuroSys European Conference on Computer Systems.
15. CHIPOUNOV, V., KUZNETSOV, V., AND CANDEA, G. 2011. S2E: A platform for in-vivo multipath analysis of software systems. In Proceedings of the International Conference on Architectural Support for Programming Languages and Operating Systems.
16. DILLIG, I., DILLIG, T., AND AIKEN, A. 2008. Sound, complete and scalable path-sensitive analysis. In Proceedings of the Conference on Programming Language Design and Implementation.
17. DTRACE. 2011. Dtrace. http://www.sun.com/bigadmin/content/dtrace/index. jsp.
18. GODEFROID, P. 1997. Model checking for programming languages using VeriSoft. In Proceedings of the Symposium on Principles of Programming Languages.
19. GODEFROID, P. 2007. Compositional dynamic test generation. In Proceedings of the Symposium on Principles of Programming Languages.
20. GODEFROID, P., KLARLUND, N., AND SEN, K. 2005. DART: Directed automated random testing. In Proceedings of the Conference on Programming Language Design and Implementation.
21. GODEFROID, P., LEVIN, M. Y., AND MOLNAR, D. 2008. Automated whitebox fuzz testing. In Proceedings of the Network and Distributed System Security Symposium.
22. IEEE. 2005. Standard 1666: SystemC language reference manual. http://standards.ieee.org/getieee/1666/.
23. INTEL. 2011. Intel 64 and IA-32 Architectures Software Developers Manual. Vol. 2.
24. JAVA PATHFINDER. 2007. Java PathFinder. http://javapathfinder. sourceforge.net.
25. KING, J. C. 1975. A new approach to program testing. In Proceedings of the International Conference on Reliable Software.
26. KUZNETSOV, V., CHIPOUNOV, V., AND CANDEA, G. 2010. Testing closed-source binary device drivers with DDT. In Proceedings of the USENIX Annual Technical Conference.
27. LAM, M. S.,WHALEY, J., LIVSHITS, V. B.,MARTIN, M. C., AVOTS, D., CARBIN, M., AND UNKEL, C. 2005. Context-sensitive program analysis as database queries. In Proceedings of the Symposium on Principles of Database Systems.
28. LATTNER, C. AND ADVE, V. 2004. LLVM: A compilation framework for lifelong program analysis and transformation. In Proceedings of the International Symposium on Code Generation and Optimization.
29. LEVON, J. AND ELIE, P. 1998. Oprofile. http://oprofile.sourceforge.net.
30. LUA 2010. Lua: A lightweight embeddable scripting language. http://www.lua.org/.
31. LUK, C.-K., COHN, R.,MUTH, R., PATIL, H., KLAUSER, A., LOWNEY, G.,WALLACE, S., REDDI, V. J., AND HAZELWOOD, K. 2005. PIN: Building customized program analysis tools with dynamic instrumentation. In Proceedings of the Conference on Programming Language Design and Implemenation.
32. MICROSOFT. 2011a. WHDC: Develop hardware for windows. http://www.microsoft.com/whdc.
33. MICROSOFT. 2011b. Windbg. http://msdn.microsoft.com/en-us/windows/ hardware/gg463009.
34. MILLER, B., FREDRIKSEN, L., AND SO, B. 1990. An empirical study of the reliability of UNIX utilities. Comm. ACM 33, 12.
35. MURPHY, C., KAISER, G., VO, I., AND CHU, M. 2009. Quality assurance of software applications using the in vivo testing approach. In Proceedings of the International Conference on Software Testing Verification and Validation.
36. MUSUVATHI, M., QADEER, S., BALL, T., BASLER, G., NAINAR, P. A., AND NEAMTIU, I. 2008. Finding and reproducing Heisenbugs in concurrent programs. In Proceedings of the Symposium on Operating System Design and Implementation.
37. PESTEREV, A., ZELDOVICH, N., AND MORRIS, R. T. 2010. Locating cache performance bottlenecks using data profiling. In Proceedings of the ACM EuroSys European Conference on Computer Systems.
38. PRASAD, V., COHEN, W., EIGLER, F. C., HUNT, M., KENISTON, J., AND CHEN, B. 2005. Locating system problems using dynamic instrumentation. In Proceedings of the Linux Symposium.
39. PǍSǍREANU, C., MEHLITZ, P., BUSHNELL, D., GUNDY-BURLET, K., LOWRY, M., PERSON, S., AND PAPE, M. 2008. Combining unit-level symbolic execution and system-level concrete execution for testing NASA software. In Proceedings of the International Symposium on Software Testing and Analysis.
40. PULKKINEN, T., NELSON, K., PULKKINEN, E., CUMMING, M., AND SCHULZE, M. 2011. libsigc++ - The Typesafe Callback Framework for C++. http://libsigc. sourceforge.net/.
41. SAVAGE, S., BURROWS, M., NELSON, G., SOBALVARRO, P., AND ANDERSON, T. 1997. Eraser: A dynamic data race detector for multithreaded programs. ACM Trans. Comput. Syst. 15, 4.
42. SCHWARZ, B., DEBRAY, S., AND ANDREWS, G. 2002. Disassembly of executable code revisited. In Proceedings of the Working Conference on Reverse Engineering.
43. SEN, K. 2007. Concolic testing. In Proceedings of the International Conference on Automated Software Engineering.
44. SEN, K., MARINOV, D., AND AGHA, G. 2005. CUTE: A concolic unit testing engine for C. In Proceedings of the Symposium on the Foundations of Software Engineering.
45. SONG, D., BRUMLEY, D., YIN, H., CABALLERO, J., JAGER, I., KANG, M. G., LIANG, Z., NEWSOME, J., POOSANKAM, P., AND SAXENA, P. 2008. Bitblaze: A new approach to computer security via binary analysis. In Proceedings of the International Conference on Information Systems Security.
46. VALGRIND. 2011. Valgrind. http://valgrind.org/.
47. WHEELER, D. 2010. SLOCCount. http://www.dwheeler.com/sloccount/.
48. YANG, J., SAR, C., AND ENGLER, D. 2006. EXPLODE: A lightweight, general system for finding serious storage system errors. In Proceedings of the Symposium on Operating Systems Design and Implementation.
49. YANG, J., CHEN, T., WU, M., XU, Z., LIU, X., LIN, H., YANG, M., LONG, F., ZHANG, L., AND ZHOU, L. 2009. MODIST: Transparent model checking of unmodified distributed systems. In Proceedings of the Symposium on Networked Systems Design and Implementation.
50. YOURST, M. T. 2007. PTLsim: A cycle accurate full system x86-64 microarchitectural simulator. In Proceedings of the IEEE International Symposium on Performance Analysis of Systems and Software.