kth.sePublications KTH
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Forward Symbolic Execution for Trustworthy Automation of Binary Code Verification
Uppsala University, Uppsala, Sweden.ORCID iD: 0000-0001-5311-1781
KTH, School of Electrical Engineering and Computer Science (EECS), Theoretical Computer Science.ORCID iD: 0000-0003-0228-1240
Intel Labs, Hillsboro, OR, USA.ORCID iD: 0000-0002-6793-0451
KTH, School of Electrical Engineering and Computer Science (EECS), Theoretical Computer Science.ORCID iD: 0000-0001-5432-6442
Show others and affiliations
2026 (English)In: Verification, Model Checking, and Abstract Interpretation - 27th International Conference, VMCAI 2026, Proceedings, Springer Science and Business Media Deutschland GmbH , 2026, p. 147-172Conference paper, Published paper (Refereed)
Abstract [en]

Control flow in unstructured programs can be complex and dynamic, which makes static analysis difficult. Yet, automated reasoning about unstructured control flow is important when certifying properties of binary (machine) code in trustworthy systems, e.g., cryptographic routines. We present a theory of forward symbolic execution for unstructured programs suitable for use in theorem provers that enables automated verification of both functional and non-functional program properties. The theory’s foundation is a set of inference rules where each member corresponds to an operation in a symbolic execution engine. The rules are designed to give control over the tradeoff between the preservation of precision and introduction of overapproximation. We instantiate our theory for BIR, a previously proposed intermediate language for binary analysis. We demonstrate how symbolic executors can be constructed for BIR with common optimizations such as pruning of infeasible symbolic states. We implemented our theory in the HOL4 theorem prover using the HolBA binary analysis library, obtaining machine-checked proofs of soundness of symbolic execution for BIR. We practically evaluated two applications of our theory: verification of functional properties of RISC-V binaries and verification of execution time bounds of programs running on the ARM Cortex-M0 processor. The evaluation shows that such verification can be automated with moderate overhead on medium-sized programs.

Place, publisher, year, edition, pages
Springer Science and Business Media Deutschland GmbH , 2026. p. 147-172
Keywords [en]
binary analysis, symbolic execution, theorem proving
National Category
Computer Sciences Computer Systems Control Engineering
Identifiers
URN: urn:nbn:se:kth:diva-376726DOI: 10.1007/978-3-032-15700-3_8Scopus ID: 2-s2.0-105028353230OAI: oai:DiVA.org:kth-376726DiVA, id: diva2:2039401
Conference
27th International Conference on Verification, Model Checking, and Abstract Interpretation, VMCAI 2026, Rennes, France, January 12-13, 2026
Note

Part of ISBN 9783032156990

QC 20260217

Available from: 2026-02-17 Created: 2026-02-17 Last updated: 2026-02-17Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full textScopus

Authority records

Palmskog, KarlDam, MadsGuanciale, RobertoNemati, Hamed

Search in DiVA

By author/editor
Lindner, AndreasPalmskog, KarlConstable, ScottDam, MadsGuanciale, RobertoNemati, Hamed
By organisation
Theoretical Computer ScienceNetwork and Systems Engineering
Computer SciencesComputer SystemsControl Engineering

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 25 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf