TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

A Survey of Symbolic Execution Techniques (2018)

117 点作者 kachnuv_ocasek大约 6 年前

7 条评论

dtornabene大约 6 年前
This is a solid paper if you want to learn something about SymbEx. If it <i>really</i> interests you and you want something more tutorial oriented, pick up a copy of Practical Binary Analysis, out recently from nostarch. The last chapters are a tutorial intro to it using Triton. If you&#x27;re a functional programmer and already know some Haskell or Ocaml or are able to pick it up quickly, check out BAP, the binary analysis platform, its got a bunch of tools&#x2F;analysis built in already for this stuff and there&#x27;s a fair amount of fascinating research done using or on the platform itself.<p><a href="https:&#x2F;&#x2F;practicalbinaryanalysis.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;practicalbinaryanalysis.com&#x2F;</a><p><a href="https:&#x2F;&#x2F;github.com&#x2F;BinaryAnalysisPlatform&#x2F;bap" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;BinaryAnalysisPlatform&#x2F;bap</a><p>Cool fact about BAP, there&#x27;s a really weird but very cool embedded lisp that allows you to drive execution of single instructions via meta programming. It works via a term rewriting system. Seriously one of the coolest lisps I&#x27;ve found out in the wild.<p><a href="http:&#x2F;&#x2F;binaryanalysisplatform.github.io&#x2F;bap&#x2F;api&#x2F;master&#x2F;Bap_primus.Std.Primus.Lisp.html" rel="nofollow">http:&#x2F;&#x2F;binaryanalysisplatform.github.io&#x2F;bap&#x2F;api&#x2F;master&#x2F;Bap_p...</a><p>Also, the docs for the project are borderline decadent in their completeness and the team responsible are quite active via gitter. For real, if you&#x27;re interested in binary analysis, check it out.
评论 #19970087 未加载
touisteur大约 6 年前
I&#x27;m curious, HN. Apart from Fujitsu, do any of you use Symbolic Execution in an Industrial setting or in your day-to-day job ? I&#x27;m starting to see fuzzing &#x27;largely&#x27; adopted, and an uptick of interest in proof (see recent partnership between Nvidia and AdaCore on Spark2014 for firmware), but not much on Symbolic Execution ?<p>Apart from Trail of Bits, University Research teams, and automatic patching competitions ?<p>Anyone using cbmc, Klee, angr, s2e ?
评论 #19970453 未加载
评论 #19969786 未加载
评论 #19970014 未加载
评论 #19971679 未加载
评论 #19970051 未加载
derefr大约 6 年前
Is anyone here using Symbolic Execution for something <i>besides</i> source code verification?<p>I’m attempting to use the technique right now in the context of writing an execution tracer for a bytecode VM runtime, where I want to “recover” ABI types for arbitrary bytecode (that I don’t have the source to), in order to emit traces that describe what’s going on in high-level terms (e.g. “foo[x][y].z = 3” rather than “$329f = ($329f &amp; (~(1 &lt;&lt; 32) &lt;&lt; 8)) | (%r25 &amp; 0xff)”.)<p>So I’m doing a static-analysis pass of the bytecode (essentially a decompilation pass) which symbolically executes math ops to build up symbolic formulae representing the math being done, and to associate program-counter positions in the bytecode with value bindings in the formulae; and then I’m feeding those associations to the runtime tracer, so that it can notice when it’s on an “interesting” PC position and feed its current register&#x2F;stack value into an instance of the associated formula, for me to emit once I get all the bindings of the formula filled in.<p>So far I haven’t found any texts or papers talking about using symbolic execution in this context (to recover information lost due to previous compilation, in a pass “within” a tracer, JIT, transpiler, or anything else that starts with bytecode or IR), which is kind of annoying. Anyone have any resources? Projects that use this technique? (I’m thinking that this is something you’d see done in sufficiently-advanced game-console emulators, as a “deoptimization” pass to recover structure to help dynamic recompilation optimize better.)<p>Also, related question: if I’ve got a stack machine, and <i>all</i> the jumps in the ISA are indirect jumps (but with literal values pushed on the stack), is there any way to recover the edges between basic blocks <i>without</i> doing a symbolic exec over the stack ops (i.e. to discover, among all the DUPs and SWAPs and such, which constant stack-slot the jump op is actually receiving)? I’m pretty sure there is a “weaker” method, but I’m stymied here by my lack of compiler-theory education; everything I google about dominance hierarchies and such assumes you’re starting with a model of a register machine with direct jumps (where the edges are context-free extractable from the jump ops).
评论 #19971129 未加载
kolinko大约 6 年前
Oh oh, a room for a shameless plug! :)<p>I managed to use symbolic execution to build a smart contract decompiler - Eveem.org. What you see there is essentially a trace from a symbolic execution of an Ethereum contract, plus some postprocessing.
some_random大约 6 年前
&quot;Sometimes you can’t see how important something is in its moment, even if it seems kindof important. This is probably one of those times.”<p>&gt; Cyber Grand Challenge highlights from DEF CON 24, August 6, 2016
srfilipek大约 6 年前
&gt; Soundness prevents false negatives, i.e., all possible unsafe inputs are guaranteed to be found, while completeness prevents false positives, i.e., input values deemed unsafe are actually unsafe.<p>I really dislike this definition. It is confusing and backwards from normal math&#x2F;logic parlance.
评论 #19976309 未加载
tempguy9999大约 6 年前
Oh heck yes, this is interesting to me.<p>In part answer to touisteur, I don&#x27;t use it and can&#x27;t see myself ever using it in industry where it&#x27;s just &#x27;get stuff done&#x27; and if it&#x27;s not too buggy it goes into production. Which is a real downer.