一句话：提出过去敏感指针分析，将指针分析与动态分析（含动态符号执行）细粒度结合，以提升指针精度且开销适中。
符号执行中常需解析间接指针引用，而标准指针分析是静态的、对动态执行上下文不敏感，精度往往不足。本文提出 past-sensitive pointer analysis：一种按需（on-demand）实例化的指针分析，其输入是以调用时刻的动态状态抽象（即“过去”已执行状态的抽象）为参数，从而把指针分析与动态分析（包括动态符号执行）做到细粒度集成。作者在三个应用场景中评估该技术：chopped symbolic execution、symbolic pointer resolution 与 write integrity testing。初步结果表明，该方法在这些场景中能显著提升标准指针分析的精度，而性能开销仅为适度水平。
We propose a novel fine-grained integration of pointer analysis with dynamic analysis, including dynamic symbolic execution. This is achieved via past-sensitive pointer analysis, an on-demand pointer analysis instantiated with an abstraction of the dynamic state on which it is invoked. We evaluate our technique in three application scenarios: chopped symbolic execution, symbolic pointer resolution, and write integrity testing. Our preliminary results show that the approach can have a significant impact in these scenarios, by effectively improving the precision of standard pointer analysis with only a modest performance overhead.
DOI 原文 ·
@inproceedings{paperbot5772,
title = {Past-sensitive pointer analysis for symbolic execution},
author = {David Trabish and Timotej Kapus and Noam Rinetzky and Cristian Cadar},
booktitle = {FSE},
year = {2020},
doi = {10.1145/3368089.3409698}
}