Andrei Arusoaie, Dorel Lucanu, Vlad Rusu. Symbolic execution based on language transformation. Computer Languages, Systems \& Structures, Volume 44 Part A:48-71, December 2015. [doi]
Abstract We propose a language-independent symbolic execution framework for languages endowed with a formal operational semantics based on term rewriting. Starting from a given definition of a language, a new language definition is generated, with the same syntax as the original one, but whose semantical rules are transformed in order to rewrite over logical formulas denoting possibly infinite sets of program states. Then, the symbolic execution of concrete programs is, by definition, the execution of the same programs with the symbolic semantics. We prove that the symbolic execution thus defined has the properties naturally expected from it (with respect to concrete program execution). A prototype implementation of our approach was developed in the K Framework. We demonstrate the tool’s genericity by instantiating it on several languages, and illustrate it on the reachability analysis and model checking of several programs.
PDF available at https://hal.inria.fr/hal-01186008.