Abstract
Symbolic execution is a basic concept for the static analysis of programs. It amounts to representing sets of concrete program states as a logical formula relating the program variables, and interpreting sets of executions as a transformation of that formula. We are interested in formalising the correctness of a symbolic interpreter engine, expressed by an over-approximation property stating that symbolic execution covers all concrete executions, and an under-approximation property stating that no useless symbolic states are generated. Our formalisation is tailored for automated verification, that is the automated discharge of verification conditions to SMT solvers. To achieve this level of automation, we appropriately annotate the code of the symbolic interpreter with an original use of both ghost data and ghost statements.
This work has been partially supported by the ANR project CoLiS, contract number ANR-15-CE25-0001.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Albert, E., Arenas, P., Gómez-Zamalloa, M., Rojas, J.M.: Test case generation by symbolic execution: basic concepts, a CLP-based instance, and actor-based concurrency. In: Bernardo, M., Damiani, F., Hähnle, R., Johnsen, E.B., Schaefer, I. (eds.) SFM 2014. LNCS, vol. 8483, pp. 263–309. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-07317-0_7
Arusoaie, A., Lucanu, D., Rusu, V.: A Generic Framework for Symbolic Execution: Theory and Applications. Research Report RR-8189, Inria, September 2015. https://hal.inria.fr/hal-00766220
Bertot, Y., Castéran, P.: Interactive Theorem Proving and Program Development. Texts in Theoretical Computer Science. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-662-07964-5
Bobot, F., Filliâtre, J.C., Marché, C., Paskevich, A.: Let’s verify thiswith Why3. Int. J. Softw. Tools Technol. Transf. (STTT) 17(6), 709–727 (2015). https://doi.org/10.1007/s10009-014-0314-5. http://hal.inria.fr/hal-00967132/en, see alsohttp://toccata.lri.fr/gallery/fm2012comp.en.html
Clochard, M., Marché, C., Paskevich, A.: Deductive verification with ghost monitors, November 2018. https://hal.inria.fr/hal-01926659. Working paper
Dailler, S., Marché, C., Moy, Y.: Lightweight interactive proving inside an automatic program verifier. In: Proceedings of the Fourth Workshop on Formal Integrated Development Environment, F-IDE, Oxford, UK, 14 July 2018 (2018). https://hal.inria.fr/hal-01936302
Filliâtre, J.C., Gondelman, L., Paskevich, A.: The spirit of ghost code. Formal Methods Syst. Des. 48(3), 152–174 (2016). https://doi.org/10.1007/s10703-016-0243-x. https://hal.archives-ouvertes.fr/hal-01396864v1
Jeannerod, N., Marché, C., Treinen, R.: A formally verified interpreter for a shell-like programming language. In: Paskevich, A., Wies, T. (eds.) VSTTE 2017. LNCS, vol. 10712, pp. 1–18. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-72308-2_1. https://hal.archives-ouvertes.fr/hal-01534747
Jeannerod, N., Treinen, R.: Deciding the first-order theory of an algebra of feature trees with updates. In: Galmiche, D., Schulz, S., Sebastiani, R. (eds.) IJCAR 2018. LNCS (LNAI), vol. 10900, pp. 439–454. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-94205-6_29. https://hal.archives-ouvertes.fr/hal-01760575
Jourdan, J.H., Laporte, V., Blazy, S., Leroy, X., Pichardie, D.: A formally-verified C static analyzer. In: 42nd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pp. 247–259. ACM, Mumbai, January 2015. https://doi.org/10.1145/2676726.2676966. https://hal.inria.fr/hal-01078386
Winskel, G.: The Formal Semantics of Programming Languages: An Introduction. MIT Press, Cambridge (1993)
Acknowledgement
We would like to thank Nicolas Jeannerod, Ralf Treinen, Mihaela Sighireanu and Yann Regis-Gianas, partners of the CoLiS project, for their input and remarks on the design of the symbolic interpreter and the formulation of expected properties. We also thank Burkhart Wolff for his feedback about related work on symbolic execution.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Becker, B., Marché, C. (2020). Ghost Code in Action: Automated Verification of a Symbolic Interpreter. In: Chakraborty, S., Navas, J. (eds) Verified Software. Theories, Tools, and Experiments. VSTTE 2019. Lecture Notes in Computer Science(), vol 12031. Springer, Cham. https://doi.org/10.1007/978-3-030-41600-3_8
Download citation
DOI: https://doi.org/10.1007/978-3-030-41600-3_8
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-41599-0
Online ISBN: 978-3-030-41600-3
eBook Packages: Computer ScienceComputer Science (R0)