EXE: Automatically Generating Inputs of Death

Cristian Cadar, Vijay Ganesh, Peter M. Pawlowski, David L. Dill, Dawson R. Engler

13th ACM conference on Computer and

communications security (CCS), 2006

Presented By: Clayton Andrews

Outline

EXE Motivation Real bugs How to use Example STP

Optimization

Experiments

Search Heuristics

Conclusion

Contributions

EXE

EXecution generated Executions

An effective-bug finding tool

Not manual or randomly constructed input

Runs on symbolic input allowed to be “anything”

EXE

Code can generate its own test cases

Runs the code on all inputs at once

Follows all paths

Motivation

Possible paths of code execution can be large Manual testing far from exhaustive Difficult for developers to reason all paths

Random testing not sufficient Suppose bug exists for 1 input of 100 trillion

Dynamic tools require initial test cases Presents same problem as manual test

Real Bugs

Berkeley Packet Filter Evil packet filters exploit buffer overruns

udhcpd DHCP server Generates packets that invalid reads/writes

pcre library Bad regular expressions that compromise

How to Use

Simply call the method make_symbolic() on any input that is unconstrained

Compiled using the EXE compiler, exe-cc

Then compiled using a standard compiler E.g. gcc

Example

STP

EXE's constraint solver More precisely a decision procedure

Decision procedures Determine satisfiability of logic formulas Express constraints to satisfy an expression

STP

Co-designed for EXE

Faster than CVCL, a similar system 550x faster

Optimizations

Caching EXE caches results of satisfiability queries

Constraint independence Breaks apart constraints into subsets (A[1]= A[2]+ A[3]) (A[2] >A[4]) (A[7]= A[8])∧ ∧

(A[1]= A[2]+ A[3]) (A[2] >A[4])∧ A[7]= A[8]

Experiments

Bpf, pcre, udhcpd, expant and tcpdump

Search Heuristics

Every time EXE forks it must choose a path

By default, EXE uses depth-first search

Use heuristics to choose “interesting” paths

Search Heuristics

Their BFS uses a mixture of best-first and depth-first search

New heuristics are easy to plugin

Conclusion

EXE uses symbolic execution to find bugs

STP was co-designed to be fast

EXE was powerful enough to uncover bugs in real programs

Contributions

The decision procedure STP was created

Code can be tested through all paths at once

Does not rely on manual input or “luck”

Reference

"EXE: automatically generating inputs of death", Cadar, Cristian and Ganesh, Vijay and Pawlowski, Peter M. and Dill, David L. and Engler, Dawson R., 13th ACM conference on Computer and communications security (CCS), 2006.

Questions?