A CIL Tutorial - Department of Computer Science - ETH ZÃ¼rich

More documents

Recommendations

Info

CHAPTER 15. AUTOMATED TEST GENERATION 126 void (autotest foo)(int input a, int input b) { int c, d, e; c = a * b; d = a + b; e = c - d; if (e == 14862436) explode(); if (d == 700) explode(); return; } Figure 15.1: Example let a = a0 in let b = b0 in let c = a * b in let d = a + b in let e = c-d in (e != 14862436) && (d != 700) Figure 15.2: Path Condition
CHAPTER 15. AUTOMATED TEST GENERATION 127 15.1 Background This approach goes by many names including directed automated random testing, concolic testing, whitebox fuzzing, and smart fuzzing. Further, researchers have created a number of tools implementing the approach, and variations on it, for a number of dierent languages. These include DART [3], CUTE [4], CREST [1], and PEX [5]. In particular, CREST also uses CIL as compiler front-end, and Yices [2] for the SMT solver as we will here, and is much more complete than the implementation in this tutorial. Therefore, as a starting point for further investigation of automated test generation based on CIL, CREST is likely to be a more appropriate choice. However, one possible advantage to this simpler tutorial implementation is that it uses OCaml rather than C++ to implement the calls to the SMT solver by using the features of the OCaml runtime that allow OCaml calls to be made from C code. Since these more complete tools exist, for the purposes of this tutorial we'll make some simplifying assumptions. In particular, this implementation will handle only scalar values, and regular and null-terminated arrays of scalar values. That is, struct and union types are not handled. Also, Only functions annotated autotest and instrument will be instrumented for symbolic execution. If a non-instrumented function is called from within an autotest function, only its concrete return value will be used in the path condition. In other words, inputs will not be generated to explore functions not annotated autotest or instrument. Finally, our path-exploration algorithm will give up when the SMT solver is unable to generate a new model for any of the available branches whose sense could be ipped. A more complete implementation would avoid getting stuck in this case. 15.2 Organization A bit more code than in previous tutorials is required to implement these features, so instead of listing and commenting on all of it, we'll take a short tour through a few select functions, types, and modules to get an idea of how the code works, and the high-level ideas behind it. 15.2.1 Instrumentation The code using CIL to instrument a program with calls to the SMT solver is in source le src/tut15.ml. Before carrying out the instrumentation however, we use CIL's Simplify module to break down complex expressions and l-values. A full description of its eects can be found in the CIL documentation. For now, it suces to point out that expressions are simplied to the extent that all binary and unary operations operate only on constants or l-values. This is achieved by the Simplify module by introducing additional temporary variables and assignments. The instrumentation calls notify the automated testing runtime of a number of important events: assignments, conditionals, function calls and returns, and entering and leaving an autotest function. For assignments and conditionals, the calls are passed both the addresses and values of the operands and results. Including the concrete values allows the symbolic execution to underapproximate the concrete execution when the SMT solver lacks a theory for some operation performed by the program. In particular, instead of representing the operation symbolically, the SMT solver can under-approximate the program's behavior by using the concrete values. This under-
Page 1 and 2:
A CIL Tutorial Using CIL for langua
Page 3 and 4:
Contents Preface 4 Introduction 5 0
Page 5 and 6:
CONTENTS 3 13 Whole-program Analysi
Page 7 and 8:
Introduction The C Intermediate Lan
Page 9 and 10:
References [1] clang: a C language
Page 11 and 12:
CHAPTER 0. OVERVIEW AND ORGANIZATIO
Page 13 and 14:
Chapter 1 The AST The Concrete Synt
Page 15 and 16:
CHAPTER 1. THE AST 13 1.2 Printing
Page 17 and 18:
References [1] Andrew W. Appel. Mod
Page 19 and 20:
CHAPTER 2. VISITING THE AST 17 open
Page 21 and 22:
CHAPTER 2. VISITING THE AST 19 $ ci
Page 23 and 24:
Chapter 3 Dataow Analysis Dataow An
Page 25 and 26:
CHAPTER 3. DATAFLOW ANALYSIS 23 Cod
Page 27 and 28:
CHAPTER 3. DATAFLOW ANALYSIS 25 let
Page 29 and 30:
CHAPTER 3. DATAFLOW ANALYSIS 27 and
Page 31 and 32:
CHAPTER 3. DATAFLOW ANALYSIS 29 let
Page 33 and 34:
CHAPTER 3. DATAFLOW ANALYSIS 31 DoC
Page 35 and 36:
CHAPTER 3. DATAFLOW ANALYSIS 33 tes
Page 37 and 38:
References [1] Aws Albarghouthi, Ra
Page 39 and 40:
CHAPTER 4. INSTRUMENTATION 37 type
Page 41 and 42:
CHAPTER 4. INSTRUMENTATION 39 metho
Page 43 and 44:
CHAPTER 4. INSTRUMENTATION 41 $ cil
Page 45 and 46:
CHAPTER 5. INTERPRETED CONSTRUCTORS
Page 47 and 48:
CHAPTER 5. INTERPRETED CONSTRUCTORS
Page 49 and 50:
Chapter 6 Overriding Functions When
Page 51 and 52:
CHAPTER 6. OVERRIDING FUNCTIONS 49
Page 53 and 54:
References [1] Kumar Avijit, Pratee
Page 55 and 56:
CHAPTER 7. TYPE QUALIFIERS 53 let c
Page 57 and 58:
CHAPTER 7. TYPE QUALIFIERS 55 let w
Page 59 and 60:
CHAPTER 7. TYPE QUALIFIERS 57 $ cil
Page 61 and 62:
Chapter 8 Dependant Type Qualiers O
Page 63 and 64:
CHAPTER 8. DEPENDANT TYPE QUALIFIER
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Chapter 9 Type Qualier Inference In
Page 75 and 76:
CHAPTER 9. TYPE QUALIFIER INFERENCE
Page 77 and 78: CHAPTER 9. TYPE QUALIFIER INFERENCE
Page 83 and 84: Chapter 10 Adding a New Kind of Sta
Page 85 and 86: CHAPTER 10. ADDING A NEW KIND OF ST
Page 93 and 94: Chapter 11 Program Verication In th
Page 95 and 96: CHAPTER 11. PROGRAM VERIFICATION 93
Page 107 and 108: Chapter 12 Comments CIL has a very
Page 109 and 110: CHAPTER 12. COMMENTS 107 let printC
Page 111 and 112: References [1] Lin Tan, Ding Yuan,
Page 113 and 114: CHAPTER 13. WHOLE-PROGRAM ANALYSIS
Page 115 and 116: CHAPTER 13. WHOLE-PROGRAM ANALYSIS
Page 117 and 118: CHAPTER 14. IMPLEMENTING A SIMPLE D
Page 127: Chapter 15 Automated Test Generatio
Page 131 and 132: CHAPTER 15. AUTOMATED TEST GENERATI
Page 133 and 134: CHAPTER 15. AUTOMATED TEST GENERATI
Page 135 and 136: Index A (module), 10, 13, 15, 10, 1
Page 137 and 138: INDEX 135 isCacheReportType, 11, 11
show all

A CIL Tutorial - Department of Computer Science - ETH ZÃ¼rich

Create successful ePaper yourself

Delete template?

Save as template?