🤖 AI Summary
Symbolic execution provides formal verification guarantees but suffers from path explosion and high SMT-solving complexity, limiting scalability to real-world software. To address this, we propose the first divide-and-conquer symbolic execution framework based on program slicing: the program is decomposed into independent slices, each executed symbolically in isolation; memory and control-flow side effects are then modeled and incrementally merged, thereby avoiding global path explosion. Our core contributions are (1) a composable side-effect merging mechanism and (2) a constraint decomposition strategy—enabling, for the first time, incremental and formally verifiable modular symbolic execution. Experimental evaluation demonstrates that our approach achieves a 3.2× speedup in path exploration while reducing memory overhead by 57%, all while preserving formal correctness guarantees.
📝 Abstract
Symbolic Execution is a formal method that can be used to verify the behavior of computer programs and detect software vulnerabilities. Compared to other testing methods such as fuzzing, Symbolic Execution has the advantage of providing formal guarantees about the program. However, despite advances in performance in recent years, Symbolic Execution is too slow to be applied to real-world software. This is primarily caused by the emph{path explosion problem} as well as by the computational complexity of SMT solving. In this paper, we present a divide-and-conquer approach for symbolic execution by executing individual slices and later combining the side effects. This way, the overall problem size is kept small, reducing the impact of computational complexity on large problems.
