Multi-solver Support in Symbolic Execution
نویسندگان
چکیده
In this talk, we will present the results reported in our CAV 2013 paper [6] on integrating support for multiple SMT solvers in the dynamic symbolic execution engine KLEE [2]. In particular, we will outline the key characteristics of the SMT queries generated during symbolic execution, introduce an extension of KLEE that uses a number of state-of-the-art SMT solvers (Boolector [1], STP [4] and Z3 [3]) through the metaSMT [5] solver framework, and compare the solvers’ performance when run on large sets of QF ABV queries obtained during the symbolic execution of real-world software. In addition, we will discuss several options for designing a parallel portfolio solver for symbolic execution tools.
منابع مشابه
Evaluation of String Constraint Solvers Using Dynamic Symbolic Execution
Symbolic execution is a path sensitive program analysis technique used for error detection and test case generation. Symbolic execution tools rely on constraint solvers to determine the feasibility of program paths and generate concrete inputs for feasible paths. Therefore, the effectiveness of such tools depends on their constraint solvers. Most modern constraint solvers for primitive data typ...
متن کاملSolving Polynomial Systems Symbolically and in Parallel
We discuss the parallelization of algorithms for solving polynomial systems symbolically. We introduce a component-level parallelization: our objective is to develop a parallel solver for which the number of processors in use depends on the intrinsic complexity of the input system, that is on geometry of its solution set. This approach creates new opportunities for parallel execution of polynom...
متن کاملA Comparative Study of Randomized Constraint Solvers for Random-Symbolic Testing
The complexity of constraints is a major obstacle for constraint-based software verification. Automatic constraint solvers are fundamentally incomplete: input constraints often build on some undecidable theory or some theory the solver does not support. This paper proposes and evaluates several randomized solvers to address this issue. We compare the effectiveness of a symbolic solver (CVC3), a...
متن کاملAutomatic Test Generation for String Manipulation Programs using Symbolic Execution
S ymbolic execution of string manipulation programs is challenging as the constraint solvers do not typically support logic over strings and non-string operations. KLEE[1] is a symbolic execution tool used to generate test cases with high coverage. It uses Simple Theorem Prover (STP) as its constraint solver. STP encodes constraints only as bit-vector logic and solves the constraints. It has no...
متن کاملChecking the Behavioral Conformance of Web Services with Symbolic Testing and an SMT Solver
Workflow-based service composition languages foster the rapid design and development of distributed applications. The behavioral verification of service Compositions has widely been addressed at design time, using modelchecking. Testing is a complementary technique when it comes to check the behavioral conformance of a service implementation with respect to its specification or to a user or a s...
متن کامل