We address the issue of recovering a both safe and precise approximation of the Control Flow Graph (CFG) of a program given as an executable file. The problem is tackled in an original way, with a refinement-based static analysis working over finite sets of constant values. Requirement propagation allows the analysis to automatically adjust the domain precision only where it is needed, resultin...

For processing compiled code, model checkers require accurate model extraction from binaries. We present our fully configurable binary analysis platform JAKSTAB, which resolves indirect branches by multiple rounds of disassembly interleaved with dataflow analysis. We demonstrate that this iterative disassembling strategy achieves better results than the state-of-the-art tool IDA Pro. Introducti...

Control dependences characterize how the predicates in a program govern the execution of other statements and predicates. Control dependences are defined in terms of a program’s control-flow graph; given a control-flow graph G, a corresponding control dependence graph, CDG(G), can be constructed. This paper addresses the inverse problem: we define an algorithm that, given a control dependence g...

We transform a CFG into a PEG in two steps. First, we transform the CFG into an Abstract PEG (A-PEG). Conceptually, an A-PEG is a PEG that operates over programs stores rather than individual variables, and whose nodes represent the basic blocks of the CFG. Figure 1(b) shows a sample A-PEG, derived from the CFG in Figure 1(a). The A-PEG captures the structure of the original CFG using θ, pass a...

In this paper, we present new pointcuts and primitives to Aspect-Oriented Programming (AOP) languages that are needed for systematic hardening of security concerns. The two proposed pointcuts allow to identify particular join points in a program’s control-flow graph (CFG). The first one is the GAFlow, Closest Guaranteed Ancestor, which returns the closest ancestor join point to the pointcuts of...

In command and control (C&C) speech interaction, users interact by speaking commands or asking questions typically specified in a context-free grammar (CFG). Unfortunately, users often produce out-ofgrammar (OOG) commands, which can result in misunderstanding or nonunderstanding. We explore a simple approach to handling OOG commands that involves generating a backoff grammar from any CFG using ...

We study the minimum concave cost flow problem over a two-dimensional grid network (CFG), where one dimension represents time (1 ≤ t ≤ T ) and the other dimension represents echelons (1 ≤ l ≤ L). The concave function over each arc is given by a value oracle. We give a polynomial-time algorithm for finding the optimal solution when the network has a fixed number of echelons and all sources lie a...

Search-based optimization methods have been used for software engineering activities such as software testing. In the field of software testing, search-based test data generation refers to application of meta-heuristic optimization methods to generate test data that cover the code space of a program. Automatic test data generation that can cover all the paths of software is known as a major cha...

Dengue fever is a self-limiting communicable viral disease, transmitted through mosquito bites. Its Case Fatality Grade (CFG) varies across population due to variations in load, immunity of the patient, early diagnosis, and availability high-end treatment facility. This study describes an initial effort automate process CFG predictions. Two established Statistical Machine Learning (SML) algorit...

A model checker can produce a trace of counterexample, for a erroneous program, which is often long and difficult to understand. In general, the part about the loops is the largest among the instructions in this trace. This makes the location of errors in loops critical, to analyze errors in the overall program. In this paper, we explore the scalability capabilities of LocFaults, our error loca...