PINS: Path-based Inductive Synthesis

In this paper, we present a novel program synthesis approach that is inspired by symbolic testing. We symbolically execute an unknown template program and constrain the program’s behavior over each executed path. As more paths are explored the space of candidate programs narrows until only the valid ones remain. Instead of randomly picking paths, we find that is possible and more efficient to direct path exploration over the unknown template program using a novel technique that parameterizes the symbolic executor by the remaining candidate solutions. We call this approach Pathbased Inductive Synthesis (PINS). We apply PINS to the problem of automatic program inversion. The specification for inversion is implicit as the combination of the original program and the inverse is the identity transform. We observe that an inverse is typically related to the original program and so the space of possible inverses can be inferred by automatically mining the original program for expressions, predicates, and control flow. Using PINS, we show we can synthesize inverses for compressors (e.g., LZ77), packers (e.g., UUEncode), and arithmetic transformers (e.g., image rotations). PINS synthesizes these inverses in a median time of 40 seconds and an average time of 293 seconds, demonstrating the viability of our testing-inspired synthesis approach.