Abstract—Software testing is an expensive and time consuming process, often involving the manual creation of comprehensive regression test suites. However, current testing method...
A static analysis design is sufficient if it can prove the property of interest with an acceptable number of false alarms. Ultimately, the only way to confirm that an analysis d...
Processor emulators are widely used to provide isolation and instrumentation of binary software. However they have proved difficult to implement correctly: processor specificati...
Lorenzo Martignoni, Stephen McCamant, Pongsin Poos...
Abstract. Trigger-based code (malicious in many cases, but not necessarily) only executes when specific inputs are received. Symbolic execution has been one of the most powerful t...
Automatically generating sufficient database states is imperative to reduce human efforts in testing database applications. Complementing the traditional block or branch coverage...
Given a program and an assertion in that program, determining if the assertion can fail is one of the key applications of program analysis. Symbolic execution is a well-known techn...
Although they are helpful in many cases, state-of-the-art bug reporting systems may impose excessive overhead on users, leak private information, or provide little help to the dev...
We present an effective technique for crosschecking an IEEE 754 floating-point program and its SIMD-vectorized version, implemented in KLEE-FP, an extension to the KLEE symbolic ...
Peter Collingbourne, Cristian Cadar, Paul H. J. Ke...
Symbolic execution is a powerful automated technique for generating test cases. Its goal is to achieve high coverage of software. One major obstacle in adopting the technique in pr...
Partial evaluation is a program specialization technique that allows to optimize programs for which partial input is known. We show that partial evaluation can be used with advanta...