EXE : Automatically Generating Inputs of Death. Cadar, C., Ganesh, V., Pawlowski, P., M., Dill, D., L., & Engler, D., R. In 13th ACM Conference on Computer and Communications S ecurity, pages 322-335, 2006. ![EXE : Automatically Generating Inputs of Death [pdf]](https://bibbase.org/img/filetypes/pdf.svg "pdf")
Paper ![EXE : Automatically Generating Inputs of Death [link]](https://bibbase.org/img/filetypes/link.svg "link")
Website abstract bibtex This paper presents EXE, an effective bug-finding tool that automatically generates inputs that crash real code. Instead of running code on manually or randomly constructed input, EXE runs it on symbolic input initially allowed to be "anything." As checked code runs, EXE tracks the constraints on each symbolic (i.e., input-derived) memory location. If a statement uses a symbolic value, EXE does not run it, but instead adds it as an input-constraint; all other statements run as usual. If code conditionally checks a symbolic expression, EXE forks execution, constraining the expression to be true on the true branch and false on the other. Because EXE reasons about all possible values on a path, it has much more power than a traditional runtime tool: (1) it can force execution down any feasible program path and (2) at dangerous operations (e.g., a pointer dereference), it detects if the current path constraints allow any value that causes a bug.When a path terminates or hits a bug, EXE automatically generates a test case by solving the current path constraints to find concrete values using its own co-designed constraint solver, STP. Because EXE's constraints have no approximations, feeding this concrete input to an uninstrumented version of the checked code will cause it to follow the same path and hit the same bug (assuming deterministic code).EXE works well on real code, finding bugs along with inputs that trigger them in: the BSD and Linux packet filter implementations, the udhcpd DHCP server, the pcre regular expression library, and three Linux file systems.
@inProceedings{
title = {EXE : Automatically Generating Inputs of Death},
type = {inProceedings},
year = {2006},
identifiers = {[object Object]},
keywords = {attack generation,bolic execution,bug finding,constraint solving,dynamic analysis,sym-,test case generation},
pages = {322-335},
websites = {http://doi.acm.org/10.1145/1180405.1180445},
id = {07461bca-1e95-3d6b-9140-fcd3ca54ab13},
created = {2011-04-01T15:33:15.000Z},
file_attached = {true},
profile_id = {2834d4fc-14a3-3cd2-ad99-1eef34b88927},
group_id = {d14f7e13-b2b1-3278-8a95-a430f57d0ad3},
last_modified = {2016-02-29T21:21:39.000Z},
read = {true},
starred = {false},
authored = {false},
confirmed = {true},
hidden = {false},
citation_key = {Cadar2006},
abstract = {This paper presents EXE, an effective bug-finding tool that automatically generates inputs that crash real code. Instead of running code on manually or randomly constructed input, EXE runs it on symbolic input initially allowed to be "anything." As checked code runs, EXE tracks the constraints on each symbolic (i.e., input-derived) memory location. If a statement uses a symbolic value, EXE does not run it, but instead adds it as an input-constraint; all other statements run as usual. If code conditionally checks a symbolic expression, EXE forks execution, constraining the expression to be true on the true branch and false on the other. Because EXE reasons about all possible values on a path, it has much more power than a traditional runtime tool: (1) it can force execution down any feasible program path and (2) at dangerous operations (e.g., a pointer dereference), it detects if the current path constraints allow any value that causes a bug.When a path terminates or hits a bug, EXE automatically generates a test case by solving the current path constraints to find concrete values using its own co-designed constraint solver, STP. Because EXE's constraints have no approximations, feeding this concrete input to an uninstrumented version of the checked code will cause it to follow the same path and hit the same bug (assuming deterministic code).EXE works well on real code, finding bugs along with inputs that trigger them in: the BSD and Linux packet filter implementations, the udhcpd DHCP server, the pcre regular expression library, and three Linux file systems.},
bibtype = {inProceedings},
author = {Cadar, Cristian and Ganesh, Vijay and Pawlowski, Peter M and Dill, David L and Engler, Dawson R},
booktitle = {13th ACM Conference on Computer and Communications S ecurity}
}
Downloads: 0
{"_id":"nwDt596Fn9kDqgZiE","bibbaseid":"cadar-ganesh-pawlowski-dill-engler-exeautomaticallygeneratinginputsofdeath-2006","downloads":0,"creationDate":"2016-08-26T19:08:51.263Z","title":"EXE : Automatically Generating Inputs of Death","author_short":["Cadar, C.","Ganesh, V.","Pawlowski, P., M.","Dill, D., L.","Engler, D., R."],"year":2006,"bibtype":"inProceedings","biburl":null,"bibdata":{"title":"EXE : Automatically Generating Inputs of Death","type":"inProceedings","year":"2006","identifiers":"[object Object]","keywords":"attack generation,bolic execution,bug finding,constraint solving,dynamic analysis,sym-,test case generation","pages":"322-335","websites":"http://doi.acm.org/10.1145/1180405.1180445","id":"07461bca-1e95-3d6b-9140-fcd3ca54ab13","created":"2011-04-01T15:33:15.000Z","file_attached":"true","profile_id":"2834d4fc-14a3-3cd2-ad99-1eef34b88927","group_id":"d14f7e13-b2b1-3278-8a95-a430f57d0ad3","last_modified":"2016-02-29T21:21:39.000Z","read":"true","starred":false,"authored":false,"confirmed":"true","hidden":false,"citation_key":"Cadar2006","abstract":"This paper presents EXE, an effective bug-finding tool that automatically generates inputs that crash real code. Instead of running code on manually or randomly constructed input, EXE runs it on symbolic input initially allowed to be \"anything.\" As checked code runs, EXE tracks the constraints on each symbolic (i.e., input-derived) memory location. If a statement uses a symbolic value, EXE does not run it, but instead adds it as an input-constraint; all other statements run as usual. If code conditionally checks a symbolic expression, EXE forks execution, constraining the expression to be true on the true branch and false on the other. Because EXE reasons about all possible values on a path, it has much more power than a traditional runtime tool: (1) it can force execution down any feasible program path and (2) at dangerous operations (e.g., a pointer dereference), it detects if the current path constraints allow any value that causes a bug.When a path terminates or hits a bug, EXE automatically generates a test case by solving the current path constraints to find concrete values using its own co-designed constraint solver, STP. Because EXE's constraints have no approximations, feeding this concrete input to an uninstrumented version of the checked code will cause it to follow the same path and hit the same bug (assuming deterministic code).EXE works well on real code, finding bugs along with inputs that trigger them in: the BSD and Linux packet filter implementations, the udhcpd DHCP server, the pcre regular expression library, and three Linux file systems.","bibtype":"inProceedings","author":"Cadar, Cristian and Ganesh, Vijay and Pawlowski, Peter M and Dill, David L and Engler, Dawson R","booktitle":"13th ACM Conference on Computer and Communications S ecurity","bibtex":"@inProceedings{\n title = {EXE : Automatically Generating Inputs of Death},\n type = {inProceedings},\n year = {2006},\n identifiers = {[object Object]},\n keywords = {attack generation,bolic execution,bug finding,constraint solving,dynamic analysis,sym-,test case generation},\n pages = {322-335},\n websites = {http://doi.acm.org/10.1145/1180405.1180445},\n id = {07461bca-1e95-3d6b-9140-fcd3ca54ab13},\n created = {2011-04-01T15:33:15.000Z},\n file_attached = {true},\n profile_id = {2834d4fc-14a3-3cd2-ad99-1eef34b88927},\n group_id = {d14f7e13-b2b1-3278-8a95-a430f57d0ad3},\n last_modified = {2016-02-29T21:21:39.000Z},\n read = {true},\n starred = {false},\n authored = {false},\n confirmed = {true},\n hidden = {false},\n citation_key = {Cadar2006},\n abstract = {This paper presents EXE, an effective bug-finding tool that automatically generates inputs that crash real code. Instead of running code on manually or randomly constructed input, EXE runs it on symbolic input initially allowed to be \"anything.\" As checked code runs, EXE tracks the constraints on each symbolic (i.e., input-derived) memory location. If a statement uses a symbolic value, EXE does not run it, but instead adds it as an input-constraint; all other statements run as usual. If code conditionally checks a symbolic expression, EXE forks execution, constraining the expression to be true on the true branch and false on the other. Because EXE reasons about all possible values on a path, it has much more power than a traditional runtime tool: (1) it can force execution down any feasible program path and (2) at dangerous operations (e.g., a pointer dereference), it detects if the current path constraints allow any value that causes a bug.When a path terminates or hits a bug, EXE automatically generates a test case by solving the current path constraints to find concrete values using its own co-designed constraint solver, STP. Because EXE's constraints have no approximations, feeding this concrete input to an uninstrumented version of the checked code will cause it to follow the same path and hit the same bug (assuming deterministic code).EXE works well on real code, finding bugs along with inputs that trigger them in: the BSD and Linux packet filter implementations, the udhcpd DHCP server, the pcre regular expression library, and three Linux file systems.},\n bibtype = {inProceedings},\n author = {Cadar, Cristian and Ganesh, Vijay and Pawlowski, Peter M and Dill, David L and Engler, Dawson R},\n booktitle = {13th ACM Conference on Computer and Communications S ecurity}\n}","author_short":["Cadar, C.","Ganesh, V.","Pawlowski, P., M.","Dill, D., L.","Engler, D., R."],"urls":{"Paper":"http://bibbase.org/service/mendeley/2a5aa585-ad83-3b8c-9373-0fad35bf58e0/file/55171ec7-445b-2ae9-1cd6-70945be2e4a4/2006-EXE__Automatically_Generating_Inputs_of_Death.pdf.pdf","Website":"http://doi.acm.org/10.1145/1180405.1180445"},"bibbaseid":"cadar-ganesh-pawlowski-dill-engler-exeautomaticallygeneratinginputsofdeath-2006","role":"author","keyword":["attack generation","bolic execution","bug finding","constraint solving","dynamic analysis","sym-","test case generation"],"downloads":0},"search_terms":["exe","automatically","generating","inputs","death","cadar","ganesh","pawlowski","dill","engler"],"keywords":["attack generation","bolic execution","bug finding","constraint solving","dynamic analysis","sym-","test case generation"],"authorIDs":[]}