Programmable Symbolic Execution Checker for Automated Defect Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional dynamic checkers face challenges in detecting defects in software programs, particularly in complex functions, as they require manual identification of concrete inputs to execute all paths and catch corner-case bugs, which is time-consuming and error-prone, and have limited defect detection capabilities with hardcoded types of defects.
Innovation Solution
A programmable symbolic execution based dynamic checker that compiles software into an intermediate representation, instruments it by modifying instructions according to check patterns, and symbolically executes the instrumented representation to identify errors, allowing for detection of various types of defects, including user-defined errors, without the need for manual input.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual identification of concrete inputs is used to execute all paths, then defect detection coverage is improved, but time consumption and operational complexity increase
Solution Approach 1:
The system performs self-service by automatically generating concrete inputs and executing paths without requiring manual user intervention. The symbolic execution engine autonomously explores program paths, generates test cases, and detects defects, eliminating the need for users to manually identify inputs while maintaining comprehensive defect detection coverage.
Solution Approach 2:
The system performs preliminary actions by pre-computing symbolic expressions and generating concrete inputs before actual execution. The symbolic execution engine prepares test cases and executes paths in advance, allowing comprehensive defect detection without requiring manual input identification at runtime.
2Device complexity
If conventional symbolic execution is used with hardcoded defect types, then implementation simplicity is maintained, but adaptability to detect user-defined errors is reduced
Solution Approach 1:
The system introduces dynamics by allowing the defect detection mechanism to adapt and change based on user-defined configurations. Instead of hardcoded defect types, the system dynamically adjusts its checking behavior through programmable patterns that can be customized to detect various error types, including user-defined errors, while maintaining a relatively simple core implementation.
Solution Approach 2:
The system implements parameter changes by allowing users to modify defect detection parameters through programmable patterns. Users can configure the types of defects to detect by changing pattern parameters rather than modifying the core system structure, enabling adaptability to different error detection requirements while keeping the implementation simple.
3Ease of operation
If conventional dynamic checkers are used, then ease of operation is maintained, but defect detection capability for complex functions is insufficient
Solution Approach 1:
The system introduces an intermediary layer between the user and the execution process. The symbolic execution engine acts as a mediator that automatically handles complex path exploration and defect detection, while the user simply provides high-level patterns for defect detection. This intermediary layer maintains ease of operation for users while significantly improving defect detection capability for complex functions.
Data Source
AI summary
A method of analyzing a software program includes compiling the software program into an intermediate representation. The method also includes finding an instruction in the intermediate representation that matches a pattern in a check pattern. The method also includes generating an instrumented intermediate representation in which the instruction is modified according to an action specified in the check pattern. The method also includes symbolically executing the instrumented intermediate representation.