Software Engineering

Symbolic Execution

CUHK Shenzhen
Pinjia He
1. Symbolic Execution
2. Concolic Testing (Dynamic SE)
3. Hybrid Concolic Testing

Pinjia He @ CUHK Shenzhen

• A propositional formula is constructed from simple

• Using connectives or logical operators such as NOT,

3
Background: CNF
• CNF: Conjunctive normal form

• A formula is in conjunctive normal form (CNF) if it is

• An AND of ORs.

4
Background: SAT

5
Background: Satisfiability Modulo
Theory

6
Background: Satisfiability Modulo
Theory

7
Background: Satisfiability Modulo
Theory

8
Background: Satisfiability Modulo
Theory

9
 Background: Satisfiability Modulo
Theory

10
First-order logic: https://www.youtube.com/watch?v=ARywou8HLQk
Example SMT Solving

11
Symbolic Execution (SE)

12
Program Validation Approaches

13
Symbolic (and Concolic)
Execution

14
Symbolic Execution (SE)

15
Symbolic Execution (SE)

16
Symbolic Execution

17
More Details

18
Symbolic Execution

19
Symbolic Execution

20
SMT Queries

21
Optimizing SMT Queries

22
Optimizing SMT Queries (cont.)

23
How to use SE find bugs?

24
Overview
• Symbolic Execution (SE)
• Concolic Testing (aka Dynamic SE: DSE)
• Hybrid Concolic Testing

25
Classical SE Practical Issues

26
Solution: Concolic Execution

27
Concolic Execution Details

28
An Illustrative Example

29
An Illustrative Example

30
An Illustrative Example

31
An Illustrative Example

32
An Illustrative Example

33
An Illustrative Example

34
An Illustrative Example

35
An Illustrative Example

36
An Illustrative Example

37
An Illustrative Example

38
An Illustrative Example

39
An Illustrative Example

40
A More Complex Example

41
A More Complex Example

42
A More Complex Example

43
A More Complex Example

44
A More Complex Example

45
A More Complex Example

46
A More Complex Example

47
A More Complex Example

48
A More Complex Example

49
A Third Example

50
A Third Example

51
A Third Example

52
A Third Example

53
A Third Example

54
Example: Testing Data Structures

55
Data-Structure Example

56
Data-Structure Example

57
Data-Structure Example

58
Data-Structure Example

59
Data-Structure Example

60
Data-Structure Example

61
Data-Structure Example

62
Data-Structure Example

63
Data-Structure Example

64
Data-Structure Example

65
Data-Structure Example

66
Data-Structure Example

67
Data-Structure Example

68
Data-Structure Example

69
Data-Structure Example

70
Data-Structure Example

71
Data-Structure Example

72
Data-Structure Example

73
Data-Structure Example

74
SAGE Tool at Microsoft

75
Example: SAGE Crashing a Media
Parser

76
Overview
• Symbolic Execution (SE)
• Concolic Testing (aka Dynamic SE: DSE)
• Hybrid Concolic Testing

77
Limitations

78
Limitations

79
Limitations: A Comparative View

80
Limitations: Example

81
Limitations: Example

82
Hybrid Concolic Testing

83
Hybrid Concolic Testing

84
Hybrid Concolic Testing

85
Hybrid Concolic Testing

86
Hybrid Concolic Testing

87
Hybrid Concolic Testing

88
Summary

89
References

90