Bit-Vector CHC Solving for Binary Analysis and Binary Analysis for Bit-Vector CHC Solving

2026-03-27

AI Summary

Existing constrained Horn clause (CHC) solvers lack support for binary program analysis, and benchmarks involving bit-vector CHCs are scarce. This work proposes the first systematic pipeline that encodes binary analysis problems into quantifier-free bit-vector logic-based CHCs and provides the first evaluation of the feasibility of CHC solving in this setting. Leveraging compiled binaries from 983 C-language invariant inference benchmarks, we construct a novel bit-vector CHC benchmark suite exhibiting diverse structures and difficulty levels. Experimental results show that a portfolio strategy combining off-the-shelf CHC solvers solves 59.5% and 66.1% of the instances on unoptimized and optimized binaries, respectively, achieving performance comparable to source-level verifiers. These findings demonstrate the effectiveness and potential of the proposed approach for binary-level verification.

Abstract

For high-assurance software, source-level reasoning is insufficient: we need binary-level guarantees. Despite constrained Horn clause (CHC) solving being one of the most popular forms of automated verification, prior work has not evaluated the viability of CHC solving for binary analysis. To fill this gap, we assemble a pipeline that encodes binary analysis problems as CHCs in the SMT logic of quantifier-free bit vectors, and show that off-the-shelf CHC solvers achieve reasonable success on binaries compiled from 983 C invariant inference benchmarks: a portfolio solves 59.5% and 66.1% of the problems derived from the unoptimized and optimized binaries, respectively -- roughly equal to the success rate of a leading C verifier on the source code (60.1%). Moreover, we show that binary analysis provides a valuable source of bit-vector CHC benchmarks (which are in short supply): binary-derived problems differ from existing benchmarks both structurally and in solver success rates and rankings. Augmenting CHC solving competitions with binary-derived benchmarks will encourage solver developers to improve bit-vector reasoning, in turn making CHC solving a more effective tool for binary analysis.

Problem

• Bit-Vector CHC Solving
• Binary Analysis
• Constrained Horn Clauses
• SMT
• Benchmarking

Innovation

• Bit-Vector CHC Solving
• Binary Analysis
• Constrained Horn Clauses
• SMT
• Benchmark Generation