Low-level Reachability Analysis based on Formal Logic
Reachability is an important problem in program analysis. Automatically being able to show that – and how – a certain state is reachable, can be used to detect bugs and vulnerabilities. Various research has focused on formalizing a program logic that connects preconditions to post-conditions in the context of reachability analysis, e.g., the very recent work on Outcome Logic. In this paper, we aim to study 1.) how such a formal reachability logic can be used for automated precondition generation, and 2.) how it can be used to reason over low-level assembly code. Automated precondition generation for reachability logic enables to find inputs that provably trigger an assertion (i.e., a post-condition). Motivation for focusing on low-level code, is that low-level code accurately describes actual program behavior, can be targeted in cases where source-code is unavailable, and allows reasoning over low-level properties like return pointer integrity. An implementation has been developed, and the entire system is proven to be sound and complete (the latter only in the absence of unresolved indirections) in the Isabelle/HOL theorem prover. Initial results are obtained on litmus tests and case studies. The results expose limitations: traversal may not terminate, and more scalability would require a compositional approach. However, the results show as well that precondition generation based on low-level reachability logic allows exposing bugs in low-level code.
Tue 18 JulDisplayed time zone: London change
13:30 - 15:00 | TAP Session 2: Low-level code verificationResearch Papers at Oak Chair(s): Julien Signoles Université Paris-Saclay, CEA, List Remote Participants: Zoom Link | ||
13:30 30mTalk | BIRD: A Binary Intermediate Representation for formally verified Decompilation of x86-64 binaries Research Papers P: Daniel Engel Open University Of The Netherlands, Freek Verbeek Open University of the Netherlands, The Netherlands, Binoy Ravindran Virginia Tech DOI Pre-print File Attached | ||
14:00 30mTalk | Low-level Reachability Analysis based on Formal Logic Research Papers P: Nico Naus Virginia Tech, Freek Verbeek Open University of the Netherlands, The Netherlands, Marc Schoolderman Radboud University Nijmegen, Binoy Ravindran Virginia Tech DOI Pre-print | ||
14:30 30mTalk | Testing a Formally Verified Compiler Research Papers P: David Monniaux CNRS/VERIMAG, Léo Gourdin Université Grenoble Alpes, Verimag, Sylvain Boulmé Grenoble Alps University / CNRS / Grenoble INP / VERIMAG, Olivier Lebeltel Université Grenoble Alpes, CNRS, Verimag DOI Pre-print |