Past-sensitive pointer analysis for symbolic execution

David Trabish, Timotej Kapus, Noam Rinetzky, Cristian Cadar

Abstract

We propose a novel fine-grained integration of pointer analysis with dynamic analysis, including dynamic symbolic execution. This is achieved via past-sensitive pointer analysis, an on-demand pointer analysis instantiated with an abstraction of the dynamic state on which it is invoked. We evaluate our technique in three application scenarios: chopped symbolic execution, symbolic pointer resolution, and write integrity testing. Our preliminary results show that the approach can have a significant impact in these scenarios, by effectively improving the precision of standard pointer analysis with only a modest performance overhead.

BibTeX

@inproceedings{Trabish-al:FSE20,
  author    = {David Trabish and
               Timotej Kapus and
               Noam Rinetzky and
               Cristian Cadar},
  title     = {Past-sensitive pointer analysis for symbolic execution},
  booktitle = {{ESEC/SIGSOFT} {FSE}},
  pages     = {197--208},
  publisher = {{ACM}},
  year      = {2020},
}

Past-sensitive pointer analysis for symbolic execution

Abstract

Related papers