Many security and software testing applications require checking whether certain properties
of a program hold for any possible usage scenario. For instance, a tool for identifying …

Symbiotic 10 brings four substantial improvements. First, we extended our clone of Klee
called JetKlee with lazy memory initialization. With this extension, JetKlee can symbolically …

One of the major concerns of dynamic symbolic execution (DSE) based automated test case
generation is its huge search space which restricts its usage for industrial-size program …

Symbolic execution is an established program analysis technique that aims to search all
possible execution paths of the given program. Due to the so-called path explosion problem …

Symbolic execution, a standard technique in program analysis, is a particularly successful
and popular component in systems for test-case generation. One of the open research …

We introduce a segment-offset-plane memory model for symbolic execution that supports
symbolic pointers, allocations of memory blocks of symbolic sizes, and multi-writes. We …

We address the problem of constraint encoding explosion which hinders the applicability of
state merging in symbolic execution. Specifically, our goal is to reduce the number of …

Anotace Cílem práce je navrhnout a implementovat paměťový model pro nástroj symbolické
exekuce Klee tak, aby podporoval alokace paměti se symbolickou velikostí. Textová část …

Dynamic symbolic execution is a powerful program analysis technique but is often limited by
the path-explosion problem, particularly in the presence of heavily branching loops. In this …

Formal methods have repeatedly demonstrated their relevance in search and analysis of
bugs. If current methods are well suited to critical code analysis where mistakes are not a …