Advertisement

Ghost Code in Action: Automated Verification of a Symbolic Interpreter

  • Benedikt Becker
  • Claude MarchéEmail author
Conference paper
  • 22 Downloads
Part of the Lecture Notes in Computer Science book series (LNCS, volume 12031)

Abstract

Symbolic execution is a basic concept for the static analysis of programs. It amounts to representing sets of concrete program states as a logical formula relating the program variables, and interpreting sets of executions as a transformation of that formula. We are interested in formalising the correctness of a symbolic interpreter engine, expressed by an over-approximation property stating that symbolic execution covers all concrete executions, and an under-approximation property stating that no useless symbolic states are generated. Our formalisation is tailored for automated verification, that is the automated discharge of verification conditions to SMT solvers. To achieve this level of automation, we appropriately annotate the code of the symbolic interpreter with an original use of both ghost data and ghost statements.

Keywords

Deductive program verification Symbolic execution Automated theorem proving Ghost code 

Notes

Acknowledgement

We would like to thank Nicolas Jeannerod, Ralf Treinen, Mihaela Sighireanu and Yann Regis-Gianas, partners of the CoLiS project, for their input and remarks on the design of the symbolic interpreter and the formulation of expected properties. We also thank Burkhart Wolff for his feedback about related work on symbolic execution.

References

  1. 1.
    Albert, E., Arenas, P., Gómez-Zamalloa, M., Rojas, J.M.: Test case generation by symbolic execution: basic concepts, a CLP-based instance, and actor-based concurrency. In: Bernardo, M., Damiani, F., Hähnle, R., Johnsen, E.B., Schaefer, I. (eds.) SFM 2014. LNCS, vol. 8483, pp. 263–309. Springer, Cham (2014).  https://doi.org/10.1007/978-3-319-07317-0_7CrossRefGoogle Scholar
  2. 2.
    Arusoaie, A., Lucanu, D., Rusu, V.: A Generic Framework for Symbolic Execution: Theory and Applications. Research Report RR-8189, Inria, September 2015. https://hal.inria.fr/hal-00766220
  3. 3.
    Bertot, Y., Castéran, P.: Interactive Theorem Proving and Program Development. Texts in Theoretical Computer Science. Springer, Heidelberg (2004).  https://doi.org/10.1007/978-3-662-07964-5CrossRefzbMATHGoogle Scholar
  4. 4.
    Bobot, F., Filliâtre, J.C., Marché, C., Paskevich, A.: Let’s verify thiswith Why3. Int. J. Softw. Tools Technol. Transf. (STTT) 17(6), 709–727 (2015).  https://doi.org/10.1007/s10009-014-0314-5. http://hal.inria.fr/hal-00967132/en, see alsohttp://toccata.lri.fr/gallery/fm2012comp.en.htmlCrossRefGoogle Scholar
  5. 5.
    Clochard, M., Marché, C., Paskevich, A.: Deductive verification with ghost monitors, November 2018. https://hal.inria.fr/hal-01926659. Working paper
  6. 6.
    Dailler, S., Marché, C., Moy, Y.: Lightweight interactive proving inside an automatic program verifier. In: Proceedings of the Fourth Workshop on Formal Integrated Development Environment, F-IDE, Oxford, UK, 14 July 2018 (2018). https://hal.inria.fr/hal-01936302CrossRefGoogle Scholar
  7. 7.
    Filliâtre, J.C., Gondelman, L., Paskevich, A.: The spirit of ghost code. Formal Methods Syst. Des. 48(3), 152–174 (2016).  https://doi.org/10.1007/s10703-016-0243-x. https://hal.archives-ouvertes.fr/hal-01396864v1CrossRefGoogle Scholar
  8. 8.
    Jeannerod, N., Marché, C., Treinen, R.: A formally verified interpreter for a shell-like programming language. In: Paskevich, A., Wies, T. (eds.) VSTTE 2017. LNCS, vol. 10712, pp. 1–18. Springer, Cham (2017).  https://doi.org/10.1007/978-3-319-72308-2_1. https://hal.archives-ouvertes.fr/hal-01534747CrossRefzbMATHGoogle Scholar
  9. 9.
    Jeannerod, N., Treinen, R.: Deciding the first-order theory of an algebra of feature trees with updates. In: Galmiche, D., Schulz, S., Sebastiani, R. (eds.) IJCAR 2018. LNCS (LNAI), vol. 10900, pp. 439–454. Springer, Cham (2018).  https://doi.org/10.1007/978-3-319-94205-6_29. https://hal.archives-ouvertes.fr/hal-01760575CrossRefGoogle Scholar
  10. 10.
    Jourdan, J.H., Laporte, V., Blazy, S., Leroy, X., Pichardie, D.: A formally-verified C static analyzer. In: 42nd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pp. 247–259. ACM, Mumbai, January 2015.  https://doi.org/10.1145/2676726.2676966. https://hal.inria.fr/hal-01078386
  11. 11.
    Winskel, G.: The Formal Semantics of Programming Languages: An Introduction. MIT Press, Cambridge (1993)CrossRefGoogle Scholar

Copyright information

© Springer Nature Switzerland AG 2020

Authors and Affiliations

  1. 1.Inria & LRI (CNRS Univ. Paris-Sud), Université Paris-SaclayOrsayFrance

Personalised recommendations