EXE: automatically generating inputs of death

By Cristian Cadar, Vijay Ganesh, Peter M. Pawlowski, David L. Dill, Dawson R. Engler. 2006

1,258 citations recorded by the source corpus.

Subfields: Computational Theory and Mathematics, Software

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computational Theory and Mathematics

In Software

Citations in the corpus

Detecting Violations of Differential Privacy (2018, background): “Symbolic execution [9, 10, 26] is widely used for program testing and bug finding.”
Baggy Bounds Checking: An Efficient and Backwards-Compatible Defense against Out-of-Bounds Errors (2009, methodology): “USENIX Association 18th USENIX Security Symposium 73 such as EXE and SAGE [8, 14], as a post-processing step on constraints created by our tool.”
Pex-White Box Test Generation for .NET (2008, methodology): “Most earlier approach to dynamic symbolic execution [12,27,26,6] in fact only use information from the last execution path to determine test inputs that will exercise the next path.”
Taint-based directed whitebox fuzzing (2009, background): “Concolic Testing: Generally speaking, a concolic tester executes the subject program both concretely and symbolically on a seed input until it reaches some interesting program expression [10, 22, 7, 18].”
Information needs for software development analytics (2012, background): “" Much research exists into software testing, especially into automated tool support (e.g., [28], [29]).”
Symbolic Robustness Analysis (2009, methodology): “Our algorithm is based on symbolic execution [3]–[6], which executes the program on symbolic inputs and aggregates symbolic constraints on each execution path.”
An Empirical Evaluation of Using Large Language Models for Automated Unit Test Generation (2023, methodology): “This fact has inspired extensive research on techniques for automated test generation including fuzzing [5], [6], feedback-directed random test generation [7], [8], [9], [10], [11], dynamic symbolic execution [12], [13], [14], [15], and search-based and evolutionary techniques [16], [17].”
TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection (2010, methodology): “For example, with the help of fuzzing tools, “Month of Browser Bugs” [10] and “Month of Kernel Bugs” [11] published bugs in various browsers and kernels on a daily basis for the month of July and November in 2006.”
HAMPI: a solver for string constraints (2009, methodology): “Automatic test-case generation tools that use combined concrete and symbolic execution, also known as concolic execution [5,6,17, 18, 23, 34] have trouble creating test cases that achieve high coverage for programs that expect structured inputs, such as those that require input strings from a contex”
An Attack Surface Metric (2011, background): “’s approach of automatically generating inputs that crash a software system [13].”
AppIntent: analyzing sensitive data transmission in android for privacy leakage detection (2013, background): “generation [14, 17, 27, 28, 34, 39], fuzz testing [35], and security ﬂaws detection [13, 15, 20, 26, 31, 42].”
VUzzer: Application-aware Evolutionary Fuzzing (2017, background): “We note that some of the issues discussed above can be, in principle, handled by symbolic/concolic-based approaches [9], [20], [22], [33] such as Driller [47].”
Automated Whitebox Fuzz Testing (2008, methodology): “Our block-coverage heuristic is related to the “Best-First Search” of EXE [7].”
Driller: Augmenting Fuzzing Through Selective Symbolic Execution (2016, methodology): “Introduced with EXE [5], refined with KLEE [4], and applied to binary code with Mayhem [8] and S2E [10], concolic execution engines interpret an application, model user input using symbolic variables, track constraints introduced by conditional jumps, and use constraint solvers to create inputs to…”
Overcoming an Untrusted Computing Base: Detecting and Removing Malicious Hardware Automatically (2010, methodology): “Formal methods such as symbolic execution [9, 10], model checking [6, 13, 28], and information flow [23, 29] have been applied to software systems for better test coverage and improved security analysis.”
Exploring Multiple Execution Paths for Malware Analysis (2007, background): “The systems that are closest to our work are DART [14] and EXE [7].”