Symbolic Execution for (Almost) Free: Hijacking an Existing Implementation to Perform Symbolic Execution
Name
MIT-CSAIL-TR-2014-007.pdf
Size
266.83 KB
Format
Adobe PDF
Checksum (MD5)
55e5121b1b4572a32cc016c68ec046ea
Download all files submitted through automated deposit
Author(s)
Near, Joseph P.
Jackson, Daniel
Advisor(s)
Daniel Jackson
Date Issued
April 22, 2014
Series/Report no.
MIT-CSAIL-TR-2014-007
Abstract
Symbolic execution of a language is traditionally achieved by replacing the language s interpreter with an entirely new interpreter. This may be an unnecessary burden, and it is tempting instead to try to use as much of the existing interpret infrastructure as possible, both for handling aspects of the computation that are not symbolic, and for propagating symbolic ones. This approach was used to implement Rubicon, a bounded verification system for Ruby on Rails web applications, in less than 1000 lines of Ruby code. Rubicon uses symbolic execution to derive verification conditions from Rails applications and an off-the-shelf solver to check them. Despite its small size, Rubicon has been used to find previously unknown bugs in open-source Rails applications. The key idea is to encode symbolic values and operations in a library written in the target language itself, overriding only a small part of the standard interpreter. We formalize this approach, showing that replacing a few key operators with symbolic versions in a standard interpreter gives the same effect as replacing the entire interpreter with a symbolic one.
Subjects
symbolic execution
web applications
security
verification
Terms of Use
Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International
Persistent DSpace Link
