This document provides an overview of symbolic execution and concolic testing techniques. It introduces the author and their background. It then discusses black-box versus white-box testing approaches. Several symbolic execution and concolic testing tools are described, including CUTE, KLEE, CREST, CREST-BV, Mayhem, BitBlaze, BuzzFuzz, and AEG. Finally, it briefly mentions code reuse and clone detection techniques.

1. 2015.05.29

2. Who am I
• @dongsamb
•BoB 1st
•SW Maestro 4th
•Korea Univ. M.S./Ph.D Integrated Course Student

3. Black-box Testing vs White-box Testing

4. 2014, HeartBleed, ShellShork

6. Symbolic Execution

7. Symbolic Execution
PC: {True} [x1 = i1]

8. Symbolic Execution
PC: {True} [x1 = i1, y1 = i2]

9. Symbolic Execution
PC: { x1 > 80 ?} [x1 = i1, y1 = i2]

10. Symbolic Execution
PC: { x1 > 80} [x2 = y1 * 2, y1 = i2]

11. Symbolic Execution
PC: { x1 > 80} [x2 = y1 * 2, y2 = 0]

12. Symbolic Execution
PC: { x1 > 80 ∧ x2 == 256 ?} [x2 = y1 * 2, y2 = 0]

13. Symbolic Execution
PC: { x1 > 80 ∧ x2 == 256} [x2 = y1 * 2, y2 = 0]
(x1 > 80) ∧ (x2 == 256)

14. Symbolic Execution
PC: { x1 <= 80} [x1 = i1, y1 = i2]

15. Symbolic Execution
PC: { x1 <= 80} [x2 = 0, y1 = i2]

16. Symbolic Execution
PC: { x1 <= 80} [x2 = 0, y2 = 0]

17. Symbolic Execution
PC: { (x1 <= 80) ∨ ((x1 > 80) ∧ (x2 != 256)) }
[ (x2 = 0, y2 = 0) ∨ (x2 = y1 * 2, y2 = 0) ]

18. •CUTE ( 2005 )
•CONCrete + symbOLIC
•dynamic symbolic execution
• (Feasible)
,
- , ,
• ,
Concolic Testing

19. •KLEE ( Stanford, 2008 )
•LLVM
•Constraint Solver
Concolic Testing

20. •CREST (Heuristics for Dynamic Test Generation,2008)
•Yices2
•Z3 - Microsoft
Concolic Testing + SMT Solver

21. CREST-BV (2013, KAIST)
Concolic Testing + SMT Solver

23. Concolic + @
Mayhem (2012, CMU)

24. •BitBlaze(2008, UC Berkeley)
•BuzzFuzz(2009, MIT)
•AEG:Automatic Exploit Generation(2011, CMU)
•Enhancing Symbolic Execution with
Veritesting(2014, CMU)
Concolic + @

25. Concolic + @

26. Code Reuse

28. •Metadata analysis
•Static source code analysis
•Source code differencing and
analysis Software metrics
•Visualization
•Clone detection
•Frequent-pattern mining
•Social network analysis
Code reuse ( code clone)

29. Products

30. Products

31. Products

32. Products

36. Thanks!
•QnA?