SMT solving is often a major source of cost in a broad range of techniques such as symbolic execution. Thus, speeding up SMT solving is still an urgent requirement. A dominant approach, which is known as eager SMT solving, is to reduce a first-order formula to a pure Boolean formula, which is handed to an expensive SAT solver to determine the satisfiability. We observe that the SAT solver can utilize the knowledge in the first-order formula to boost its solving efficiency. Unfortunately, despite much progress, it is still not clear how to make use of the knowledge in an eager SMT solver. This paper addresses the problem by introducing a new and fast method, which utilizes the interval and data-dependence information learned from the first-order formulas. We have implemented the approach as a tool called Trident and evaluated it on three symbolic analysis platforms (Angr, Qsym, and Pinpoint). The experimental results, based on thirty real-world projects that generate about seven million queries, show that our approach significantly reduces the total solving time from 2.9x to 7.9x over three state-of-the-art SMT solvers (Z3, CVC4, and Boolector), without sacrificing the number of solved instances. We also demonstrate that Trident achieves end-to-end speedups for three program analysis clients by 1.9x, 1.6x, and 2.4x, respectively.
Mon 20 JulDisplayed time zone: Tijuana, Baja California change
12:10 - 13:10 | SYMBOLIC EXECUTION AND CONSTRAINT SOLVINGTechnical Papers at Zoom Chair(s): Marcelo d'Amorim Federal University of Pernambuco Public Live Stream/Recording. Registered participants should join via the Zoom link distributed in Slack. | ||
12:10 20mTalk | Fast Bit-Vector Satisfiability Technical Papers Peisen Yao HKUST, Qingkai Shi The Hong Kong University of Science and Technology, Heqing Huang , Charles Zhang The Hong Kong University of Science and Technology DOI | ||
12:30 20mTalk | Relocatable Addressing Model for Symbolic Execution Technical Papers DOI Pre-print Media Attached | ||
12:50 20mTalk | Running Symbolic Execution Forever Technical Papers Frank Busse Imperial College London, Martin Nowack Imperial College London, Cristian Cadar Imperial College London DOI Pre-print Media Attached |