Symbolic execution for software testing: Three decades later

Communications of the ACM

Volumn 56, Issue 2, 2013, Pages 82-90

  Cadar, Cristian ^a   Sen, Koushik ^b  

^a IMPERIAL COLLEGE LONDON   (United Kingdom)

^b UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EFFECTIVE PROGRAMS; LARGE PROGRAMS; LOW-LEVEL PROGRAMS; SEMANTIC PROPERTIES; SOFTWARE ERRORS; SYMBOLIC EXECUTION;

APPLICATION PROGRAMS; ERRORS; SEMANTICS; TESTING;

SOFTWARE TESTING;

EID: 84873677532     PISSN: 00010782     EISSN: 15577317     Source Type: Journal    
DOI: 10.1145/2408776.2408795     Document Type: Review

References (40)

1. A nand, S., Pasareanu, C.S. and Visser, W. JPF-SE: A symbolic execution extension to Java PathFinder. In Proceedings of TACAS'07.
2. A vgerinos, T., Cha, S.K., Hao, B.L.T. and Brumley, D. AEG : Automatic exploit generation. In Proceedings of NDSS'11, (Feb. 2011).
3. B aluda, M., Braione, P., Denaro, G. and Pezzè, M. Structural coverage of feasible code. In Proceedings of AST'10.
4. B ethea, D., Cochran, R. and Reiter, M. Server-side verification of client behavior in online games. In Proceedings of NDSS'10, 2010.
5. B oonstoppel, P., Cadar, C. and Engler, D. RWset: Attacking path explosion in constraint-based test generation. In Proceedings of TACAS'08, (Mar-Apr 2008).
6. B oyer, R.S., Elspas, B. and Levitt, K.N. SELECT -A formal system for testing and debugging programs by symbolic execution. SIGPLAN Not. 10 (1975), 234245.
7. B urnim, J. and Sen, K. Heuristics for scalable dynamic test generation. In Proceedings of ASE'08, (Sept. 2008).
8. C adar, C., Dunbar, D. and Engler, D. KLE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In Proceedings of OSDI'08, (Dec 2008).
9. C adar, C. and Engler, D. Execution generated test cases: How to make systems code crash itself (invited paper). In Proceedings of SPIN'05, (Aug 2005).
10. C adar, C., Ganesh, V., Pawlowski, P., Dill, D. and Engler, D. EXE: Automatically generating inputs of death. In Proceedings of CCS'06, (Oct-Nov 2006). An extended version appeared in ACM TISEC 12, 2 (2008).
11. C hipounov, V. and Candea, G. Reverse engineering of binary device drivers with RevNIC. In Proceedings of EuroSys'10, (Apr 2010).
12. C larke, L.A. A program testing system. In Proceedings of the 1976 Annual Conference, 488491.
13. C ollingbourne, P., Cadar, C. and Kelly, P.H. Symbolic crosschecking of floating-point and SIMD code. In Proceedings of EuroSys'11, (Apr 2011).
14. C ui, H., Wu, J. che Tsai, C. and Yang, J. Stable deterministic multithreading through schedule memoization. In Proceedings of OSDI'10.
15. D e Moura, L. and Bjørner, N. Z3: An efficient SMT solver. In Proceedings of TACAS'08, (Mar-Apr 2008).
16. D e Moura, L. and Bjørner, N. Satisfiability modulo theories: introduction and applications. Commun. ACM 54, 9 (Sept. 2011), 6977.
17. E lkarablieh, B., Godefroid, P. and Levin, M.Y. Precise pointer reasoning for dynamic test generation. In Proceedings of ISSTA'09.
18. G anesh, V. and Dill, D.L. A decision procedure for bit-vectors and arrays. In Proceedings of CAV'07, (July 2007).
19. G odefroid, P., Klarlund, N. and Sen, K. DART : Directed Automated Random Testing. In Proceedings of PLDI'05, (June 2005).
20. G odefroid, P., Levin, M., and Molnar, D. Automated whitebox fuzz testing. In Proceedings of NDSS'08, (Feb. 2008).
21. H astings, R. and Joyce, B. Purify: Fast detection of memory leaks and access errors. In Proceedings of Winter USENIX Conference, 1992.
22. Kim, Y., Kim, M., and Dang, N. Scalable distributed concolic testing: A case study on a flash storage platform. In Proceedings of ICTAC'10, 199213.
23. King, J.C. Symbolic execution and program testing. Commun. ACM 19, 7 (July 1976), 385394.
24. L attner, C. and Adve, V. LLVM: A compilation framework for lifelong program analysis and transformation. In Proceedings of CGO'04, (Mar 2004).
25. L i, G., Li, P., Sawaga, G, Gopalakrishnan, G., Ghosh, I. and Rajan, S.P. GKLE: Concolic verification and test generation for GPUs. In Proceedings of PPoPP'12.
26. M ajumdar, R. and Sen, K. Hybrid concolic testing. In Proceedings of ICSE'07, (May 2007).
27. M ajumdar, R. and Sen, K. Latest: Lazy dynamic test input generation. Technical Report UCB/EECS -2007-36. EECS Department, University of California, Berkeley, Mar. 2007.
28. N ethercote, N. and Seward, J. Valgrind: A program supervision framework. Electronic Notes in Theoretical Computer Science 89, 2 (2003).
29. R use, M., Sarkar, T. and Basu, S. Analysis & detection of SQL injection vulnerabilities via automatic test case generation of programs. In Proceedings of SAINT'10, (July 2010).
30. S asnauskas, R., Link, J.A.B., Alizai, M.H., and Wehrle, K. Kleenet: Automatic bug hunting in sensor network applications. In Proceedings of IPSN'10, (Apr 2010).
31. S en, K. Scalable Automated Methods for Dynamic Program Analysis. Ph.D. thesis. University of Illinois at Urbana-Champaign, June 2006.
32. S en, K. and Agha, G. Automated systematic testing of open distributed programs. In Proceedings of FASE'06, 2006.
33. S en, K. and Agha, G. CUTE and jCUTE : Concolic unit testing and explicit path model-checking tools. In Proceedings of CAV'06.
34. S en, K. and Agha, G. A race-detection and flipping algorithm for automated testing of multi-threaded programs. In Proceedings of HVC, (2006).
35. S en, K., Marinov, D. and Agha, G. CUTE: A concolic unit testing engine for C. In Proceedings of ESEC/FSE'05, (Sept. 2005).
36. S ong, J., Ma, T., Cadar, C. and Pietzuch, P. Rule-based verification of network protocol implementations using symbolic execution. In Proceedings of ICCCN'11, (May 2011).
37. T illmann, N. and de Halleux, J. Pex -White box test generation for .NET. In Proceedings of TAP'08, (Apr. 2008).
38. Xu, Z., Kim, Y., Kim, M., Rothermel, G. and Cohen, M.B. Directed test suite augmentation: Techniques and trade-offs. In Proceedings of FSE'10, (Nov. 2010).
39. Y ang, J., Sar, C., Twohey, P., Cadar, C. and Engler, D. Automatically generating malicious disks using symbolic execution. In IEEE Symposium on Security and Privacy, (May 2006).
40. Z amfir, C. and Candea, G. Execution synthesis: A technique for automated software debugging. In Proceedings of EuroSys'10, (Apr 2010).