Symbolon: Symbolic Execution by Learning Code Transformation

2026-06-27

AI Summary

Symbolic execution struggles to scale to real-world programs due to path explosion and complex constraints. This work proposes a learning-driven, context-sensitive code transformation approach: effective transformations are first mined offline from small programs, formulated as a search problem over program representations, and distilled into a reusable library of agent skills, which is then integrated into the symbolic execution engine KLEE. This is the first method to incorporate learned, context-aware transformations into symbolic execution, overcoming the limitations of traditional rigid optimizations. Experimental results demonstrate that, across 32 real-world programs, the approach achieves an average 3.69× improvement in line coverage, reduces peak memory consumption by 29.2×, and decreases per-query solving time by up to 123×, while uncovering 21 previously unknown vulnerabilities in the Linux kernel.

Abstract

Symbolic execution is a powerful program analysis technique with broad applications, such as vulnerability detection, security testing, and malware analysis. However, this technique is known to suffer from scalability issues, e.g., path explosion, complex constraints, due to certain structural and semantic patterns commonly presented in real-world programs. Existing approaches attempt to escape these patterns by transforming programs into new representations to reduce the execution cost. Unfortunately, these transformations are often too rigid to exploit diverse local program semantics and sometimes rely on compiler optimizations designed for concrete execution that may misalign with the goals of symbolic execution. We present Symbolon, a framework that automatically learns diverse code transformations and applies them context-sensitively to improve symbolic execution. Our key insight is to formulate transformation discovery as a search problem over program representations. To make the search practical, Symbolon learns transformations cheaply offline on small programs, distills them into a reusable library of agent skills, and uses an agent to instantiate these skills on repo-level targets. Our evaluation shows that Symbolon substantially improves the symbolic execution engine KLEE across 16 search strategies on 32 real-world programs, increasing line coverage by 3.69x on average while reducing peak memory and per-query solver time by 29.2x and 123x, respectively. When applied to the latest Linux kernel, Symbolon uncovers 21 previously unknown bugs, all of which have been reported to the kernel maintainers.

Problem

• symbolic execution
• path explosion
• code transformation
• scalability
• program analysis

Innovation

• symbolic execution
• code transformation
• program representation
• search-based learning
• context-sensitive optimization