TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

A gentle introduction to symbolic execution

190 点作者 joelburget大约 6 年前

7 条评论

triska大约 6 年前
Very nice, thank you for sharing this!<p>Symbolic execution is also known as <i>abstract interpretation</i>. The program is being interpreted, with concrete values <i>abstracted away</i>, generalized to symbolic elements that often denote several or even infinitely many <i>concrete</i> values.<p>Logic programming languages like Prolog are especially amenable to abstract interpretation, since we can <i>absorb</i> the Prolog system&#x27;s built-in binding environment for variables, and simply plug in different values for the existing variables. We only have to <i>reify</i> unification, i.e., implement it within the language with suitable semantics.<p>An impressive application of this idea is contained in the paper <i>Meta-circular Abstract Interpretation in Prolog</i> by Michael Codish and Harald Søndergaard:<p><a href="http:&#x2F;&#x2F;citeseerx.ist.psu.edu&#x2F;viewdoc&#x2F;summary?doi=10.1.1.137.3604" rel="nofollow">http:&#x2F;&#x2F;citeseerx.ist.psu.edu&#x2F;viewdoc&#x2F;summary?doi=10.1.1.137....</a><p>As one of the examples, the authors show how abstract interpretation over the abstract parity domain {zero, one, even, odd} can be used to derive non-trivial facts about the Ackermann function.<p>In particular, they deduce that <i>Ackermann(i,j)</i> is odd and greater than 1 for all <i>i</i> greater than 1, by taking a Prolog implementation of the Ackermann function, and interpreting it with these abstract domain elements instead of all concrete values (which would not terminate, since there are infinitely many concrete values). This is computed by fixpoint computation, determining the deductive closure of the relation.
评论 #19606989 未加载
评论 #19606765 未加载
joelburget大约 6 年前
Co-author here. We&#x27;re planning to turn this into a series, with additional posts on how symbolic execution works at a lower level, how to present counterexamples to users, and ideas for future programming tools built on symbolic execution.
评论 #19610814 未加载
评论 #19608044 未加载
souprock大约 6 年前
There are actual jobs, in industry, making use of this stuff. For example, here is one that I put in the &quot;Who is hiring?&quot; item this month:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=19543995" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=19543995</a><p>Typically one would convert a binary executable into some other form, then analyze it to find all possible bugs. Of course one quickly slams into troubles like the halting problem, but it is still usually possible to gain useful understanding of the binary executable.
评论 #19609098 未加载
kazinator大约 6 年前
<i>When a program has a free variable, we can consider an entire space of possible execution paths, one for each possible value the variable could take.</i><p>Or we could put on a greasy old pragmatic ball cap and issue an &quot;unbound variable in line 42&quot; error.<p>A free free variable has no &quot;possible value&quot;. If a variable has a value, it has a binding; if it has a binding, it is not a free variable.<p>If we suspect that the variable is not actually free, but rather its definition has not yet appeared, we can defer the processing. Perhaps capture a continuation of the symbolic execution machine, and dispatch it later.<p>If the expression which refers to the free variable is not actually evaluated (as our symbolic execution shows), we can squelch the warning, or change its wording.<p>The idea that a free variable is implicitly universally quantified works in logic, but it doesn&#x27;t transfer to an ordinary programming language (i.e. not Prolog, and its ilk) very well.
llamathrowaway大约 6 年前
Thank you for this. However the labels &#x27;syntax Haskell&#x27; and &#x27;syntax LLVM&#x27; do not seem to display properly on Firefox. Wish you could find a way to fix them.
评论 #19609341 未加载
bediger4000大约 6 年前
I visited this expecting a tutorial about burning someone in effigy. Imagine my surprise!
评论 #19607602 未加载
fwip大约 6 年前
When you say “what is the result when x is 3 and y is 100?” - shouldn&#x27;t the answer be 113, not 103?
评论 #19610672 未加载