Ghost Code in Action: Automated Verification of a Symbolic Interpreter

Benedikt Becker (1) , Claude Marché (1)

1 TOCCATA - Formally Verified Programs, Certified Tools and Numerical Computations

Symbolic execution is a basic concept for the static analysis of programs. It amounts to representing sets of concrete program states as a logical formula relating the program variables, and interpreting sets of executions as a transformation of that formula. We are interested in formalising the correctness of a symbolic interpreter engine, expressed by an over-approximation property stating that symbolic execution covers all concrete executions, and an under-approximation property stating that no useless symbolic states are generated. Our formalisation is tailored for automated verification, that is the automated discharge of verification conditions to SMT solvers. To achieve this level of automation, we appropriately annotate the code of the symbolic interpreter with an original use of both ghost data and ghost statements.

Keywords: Deductive Program Verification; Symbolic Execution; Automated Theorem Proving; Ghost code

Domains: Logic in Computer Science [cs.LO]

Benedikt Becker, Claude Marché. Ghost Code in Action: Automated Verification of a Symbolic Interpreter. VSTTE 2019 - 11th Working Conference on Verified Software: Tools, Techniques and Experiments, Jul 2019, New York, United States. ⟨10.1007/978-3-030-41600-3_8⟩. ⟨hal-02276257⟩