Annual Report 2010 - Fachgruppe Informatik an der RWTH Aachen ...

Synthesizing Best Transformers for Binary Code Analysis
Jörg Brauer and Andy King
In August 2009, Jörg Brauer and Andy King, have started a joint project to put forward the
state-of-the-art in abstract interpretation of binary code. Andy King, who is working with the
University of Kent in Canterbury and Portcullis Computer Security Limited, is a widely
appreciated expert in reasoning about low-level program semantics using satisfiability solving.
The key observation this project is based on is that binary code behaves very differently
compared to programs presented in high-level programming languages such as C, and thus
requires different verification methods. In particular, a single assignment in C is frequently
compiled into a sequence of instructions, which leads to a tight coupling between the
semantics of different instructions. Similarly, control logic is typically formulated in terms of
Boolean relations over single bits. Following these two observations, the use of SAT-solving
appears natural to reason about binary code.
The key contribution of this cooperation lies in novel methods for synthesizing optimal
abstract interpretations of binary programs, with a special focus on the integration of
overflows that occur in machine arithmetic. The results have been published in two major
conferences on program verification, namely the 17th International Static Analysis
Symposium (SAS’10, Perpignan, France) and the 15th International Workshop on Formal
Methods for Industrial Critical Systems (FMICS’10, Antwerp, Belgium). Two more papers are
currently under review. The cooperation of Jörg and Andy has been supported by the Royal
Society, the British national academy of sciences, with a international travel grant and an
industrial secondment, the UMIC cluster of excellence, and the DFG graduate school
AlgoSyn.
Synthesis of State Space Generators for Model Checking Microcontroller Assembly
Code (DFG Research Training Group 1298 “AlgoSyn”)
Dominique Gückel
The [mc]square model checker verifies microcontroller programs by means of a simulator.
The simulator is used to execute the program to be verified, and thus to create the state space.
As the model checking algorithm is separated from the microcontroller simulator, it is possible
to add support for new platforms by adding new simulators. However, there are certain
constraints which prevent us from using just any simulator, such as the ones provided by
device manufacturers. Manually implementing simulators is possible, but time-consuming
and error-prone.
The goal of our ongoing research in AlgoSyn is to improve the development process in the
aforementioned two aspects. For this purpose, we have developed a synthesis system, centered
around a new language called State Space Generator Description Language (SGDL). The
system is now in its second year of existence. In the first year, the primary goals were to
363