A Deterministic Memory Allocator

(1)

A Deterministic Memory Allocator for Dynamic Symbolic Execution

Daniel Schemmel, Julian Büning, Frank Busse, Martin Nowack, Cristian Cadar

(2)

int x = input();

if (x == 0) { abort();

} else {

return x;

}

Dynamic Symbolic Execution

(3)

int x = input();

if (x == 0) { abort();

} else {

return x;

}

state 1 x ≔ 𝜆 ,

(4)

int x = input();

if (x == 0) { abort();

} else {

return x;

}

Dynamic Symbolic Execution

state 1 x ≔ 𝜆 , 𝜆 = 0

(5)

int x = input();

if (x == 0) { abort();

} else {

return x;

}

state 1 x ≔ 𝜆 , 𝜆 = 0

state 1’

x ≔ 𝜆 , 𝜆 ≠ 0 state 1’

x ≔ 𝜆 , 𝜆 ≠ 0

(6)

• What is the address of x?

Address Translation in KLEE

(7)

KLEE Process

(8)

KLEE Process

Address Translation in KLEE

state 1 state 1

state 2 state 2

(9)

KLEE Process

state 1

state 1 FE FE FE FEFE FE FE FE

state 2 state 2

(10)

KLEE Process

state 1

state 1 FE FE FE FEFE FE FE FE

state 2 state 2

0xDEADBEEF

(11)

KLEE Process

Address Translation in KLEE

state 1

state 1 00 00 00 0000 00 00 00 FE FE FE FEFE FE FE FE

state 2 state 2

0xDEADBEEF

(12)

KLEE Process

state 1

state 2 state 2

0xDEADBEEF

(13)

KLEE Process

state 1

state 1’

state 2 state 2

0xDEADBEEF

(14)

KLEE Process

Address Translation in KLEE

state 1

state 1’

state 1’ FF FF FF FFFF FF FF FF

state 2 state 2

0xDEADBEEF

(15)

KLEE Process

state 1

state 1’

state 2 state 2

Used for external function calls

0xDEADBEEF

(16)

KLEE Process

Address Translation in KLEE

state 1

state 1’

state 2 state 2

Used for external function calls

FE FE FE FE FE FE FE FE 00 00 00 00

00 00 00 00

0xDEADBEEF 0xFACEFEED

(17)

The Need for Deterministic Memory Allocation

• For experiments to be repeatable, memory allocation must be repeatable

(18)

• Advanced symbolic execution techniques benefit from or outright require deterministic execution

(19)

The Need for Deterministic Memory Allocation

– POR-SE [Symbolic partial-order execution for testing multi-threaded programs. Schemmel et al. CAV 2020]

(20)

– SYMLIVE [Symbolic liveness analysis of real-world software. Schemmel et al. CAV 2018]

(21)

The Need for Deterministic Memory Allocation

– SYMLIVE [Symbolic liveness analysis of real-world software. Schemmel et al. CAV 2018]

(22)

KDA

^LLOC

• An allocator specifically for dynamic symbolic execution can do better!

(23)

KDA

^LLOC

• Important properties:

(24)

KDA

^LLOC

1. Support for external calls (addresses valid in host process)

(25)

KDA

^LLOC

2. Cross-run determinism (multiple runs should behave the same)

(26)

KDA

^LLOC

2. Cross-run determinism (multiple runs should behave the same) 3. Cross-path determinism (multiple paths should behave the same)

(27)

KDA

^LLOC

2. Cross-run determinism (multiple runs should behave the same) 3. Cross-path determinism (multiple paths should behave the same) 4. Spatially distanced allocations (misindexing an array should trap)

(28)

KDA

^LLOC

2. Cross-run determinism (multiple runs should behave the same) 3. Cross-path determinism (multiple paths should behave the same) 4. Spatially distanced allocations (misindexing an array should trap) 5. Temporally distanced allocations (use-after-free should trap)

(29)

KDA

^LLOC

2. Cross-run determinism (multiple runs should behave the same) 3. Cross-path determinism (multiple paths should behave the same) 4. Spatially distanced allocations (misindexing an array should trap) 5. Temporally distanced allocations (use-after-free should trap)

6. Stability (minor changes should not snowball)

(30)

General Architecture

• mmap one large region and attach forkable metadata to the initial state

(31)

General Architecture

• mmap one large region and attach forkable metadata to the initial state – This region is only used to provide addresses and for external calls

(32)

• mmap one large region and attach forkable metadata to the initial state – This region is only used to provide addresses and for external calls – Object data is already state-dependent

(33)

General Architecture

• Categorize allocations to reduce snowball effect

(34)

– Multiple allocators, especially to disconnect stack and heap

(35)

General Architecture

– Multiple allocators, especially to disconnect stack and heap – Binned allocations

(36)

Memory Layout for KDA

^LLOC

(37)

Slot Allocator for Sized Bins: Spatially Distanced

(38)

Slot Allocator for Sized Bins: Spatially Distanced

(39)

Slot Allocator for Sized Bins: Spatially Distanced

(40)

Memory Consumption

DFS R^NDC^OV

(41)

Performance

DFS R^NDC^OV

(42)

Solver Time

DFS R^NDC^OV

(43)

M

^O

K

^LEE

: Fewer Diverging Locations

(44)

char* s = (char*)dest;

const char* p = (const char*)src;

if (p >= s) { while (n) {

*s++ = *p++;

--n;

}

M

O

K

LEE

: Fewer Divergences in memmove

} else {

while (n) { --n;

s[n] = p[n];

} }

return dest;

(45)

*s++ = *p++;

--n;

}

M

O

K

LEE

: Fewer Divergences in memmove

} else {

while (n) { --n;

s[n] = p[n];

} }

return dest;

(46)

*s++ = *p++;

--n;

}

M

O

K

LEE

: Fewer Divergences in memmove

} else {

while (n) { --n;

s[n] = p[n];

} }

return dest;

(47)

Summary & Conclusion

(48)

Summary & Conclusion

• The memory allocator has significant impact on dynamic symbolic execution

(49)

• We implemented KDA^LLOC in KLEE and show:

(50)

– Performance and memory consumption are not impacted negatively

(51)

Summary & Conclusion

– Performance and memory consumption are not impacted negatively – Use-after-free detection is improved (general benefit)

(52)

– Specific benefits for multiple DSE-based techniques

(53)

Summary & Conclusion

– Specific benefits for multiple DSE-based techniques

• KDA is becoming part of mainline KLEE!

(54)

char *mallocfree() {

char *s = strdup("A");

free(s);

char *t = strdup("B");

return s;

}

Guaranteed Use-After-Free Behavior

int main(void) {

char *s = mallocfree();

puts(s);

return 0;

}

• KDALLOC guarantees detection when quarantine is enabled

(55)

Query Structure with KDAlloc

(56)

Query Structure without KDAlloc