SMT solving is often a major source of cost in a broad range of techniques such as symbolic execution. Thus, speeding up SMT solving is still an urgent requirement. A dominant approach, which is known as eager SMT solving, is to reduce a first-order formula to a pure Boolean formula, which is handed to an expensive SAT solver to determine the satisfiability. We observe that the SAT solver can utilize the knowledge in the first-order formula to boost its solving efficiency. Unfortunately, despite much progress, it is still not clear how to make use of the knowledge in an eager SMT solver. This paper addresses the problem by introducing a new and fast method, which utilizes the interval and data-dependence information learned from the first-order formulas. We have implemented the approach as a tool called Trident and evaluated it on three symbolic analysis platforms (Angr, Qsym, and Pinpoint). The experimental results, based on thirty real-world projects that generate about seven million queries, show that our approach significantly reduces the total solving time from 2.9x to 7.9x over three state-of-the-art SMT solvers (Z3, CVC4, and Boolector), without sacrificing the number of solved instances. We also demonstrate that Trident achieves end-to-end speedups for three program analysis clients by 1.9x, 1.6x, and 2.4x, respectively.
Mon 20 Jul Times are displayed in time zone: (GMT-07:00) Tijuana, Baja California change
|12:10 - 12:30|
Yao PeisenHKUST, Qingkai ShiThe Hong Kong University of Science and Technology, Heqing Huang, Charles ZhangThe Hong Kong University of Science and TechnologyDOI
|12:30 - 12:50|
|12:50 - 13:10|
Frank BusseImperial College London, Martin NowackImperial College London, Cristian CadarImperial College LondonDOI Pre-print Media Attached