The S2E Platform: Design, Implementation, and Applications

This article presents (SE)-E-2, a platform for analyzing the properties and behavior of software systems, along with its use in developing tools for comprehensive performance profiling, reverse engineering of proprietary software, and automated testing of kernel-mode and user-mode binaries. Conceptually, (SE)-E-2 is an automated path explorer with modular path analyzers: the explorer uses a symbolic execution engine to drive the target system down all execution paths of interest, while analyzers measure and/or check properties of each such path. (SE)-E-2 users can either combine existing analyzers to build custom analysis tools, or they can directly use (SE)-E-2's APIs. (SE)-E-2's strength is the ability to scale to large systems, such as a full Windows stack, using two new ideas: selective symbolic execution, a way to automatically minimize the amount of code that has to be executed symbolically given a target analysis, and execution consistency models, a way to make principled performance/accuracy trade-offs during analysis. These techniques give (SE)-E-2 three key abilities: to simultaneously analyze entire families of execution paths instead of just one execution at a time; to perform the analyses in-vivo within a real software stack-user programs, libraries, kernel, drivers, etc.-instead of using abstract models of these layers; and to operate directly on binaries, thus being able to analyze even proprietary software.