Analysis and improvement of unit-level concolic testing for real-world C programs

Abstract

Unit-level concolic testing has become popular as it explores every execution path of each function in a short time with high branch coverage. However, the current concolic unit testing tool suffers a set of limitations. For example, the unit-testing tool cannot determine the actual type of what a void pointer is cast to, and external library functions are not fully supported. Therefore, the branch coverage obtained on real-world programs is not satisfying. This dissertation conducts comprehensive experiments on six real-world subjects using CROWN2.0 ver 2020, a popular commercial unit-level concolic testing tool. In the experiments, all the 324 groups of unexplored branches of the target subjects are thoroughly analyzed, and this dissertation summarizes the analysis into 13 limitations of the current testing tool. For each limitation, this dissertation provides detailed explanations why the corresponding uncovered branches are not covered with code examples. I expect these explanations can help the developers to understand and improve the concolic unit testing tool in the future. Also, this dissertation proposes and applies solutions the obtained limitations, which gives an average improvement on the branch coverage of 77\% for six subjects.