搜索
分类号学号2005612100139学校代码10487密级硕士学位论文基于PAT树的符号执行工具的设计与实现学位申请人：黄晋学科专业：计算机软件与理论指导教师：卢炎生教授答辩日期:2007年6月2日AThesisSubmittedinPartialFulfillmentoftheRequirementsfortheDegreeofMasterofEngineeringASymbolicExecutionToolbasedonProgramAnalysisTreeCandidate:HuangJinMajor:ComputerSoftwareandTheorySupervisor:Prof.LuYanshengHuazhongUniversityofScienceandTechnologyWuhan430074,P.R.ChinaJun.,20073独创性声明本人声明所呈交的学位论文是我个人在导师指导下进行的研究工作及取得的研究成果。尽我所知，除文中已经标明引用的内容外，本论文不包含任何其他个人或集体已经发表或撰写过的研究成果。对本文的研究做出贡献的个人和集体，均已在文中以明确方式标明。本人完全意识到，本声明的法律结果由本人承担。学位论文作者签名：日期：2007年月日学位论文版权使用授权书本学位论文作者完全了解学校有关保留、使用学位论文的规定，即：学校有权保留并向国家有关部门或机构送交论文的复印件和电子版，允许论文被查阅和借阅。本人授权华中科技大学可以将本学位论文的全部或部分内容编入有关数据库进行检索，可以采用影印、缩印或扫描等复制手段保存和汇编本学位论文。保密□，在_____年解密后适用本授权书。不保密□√。（请在以上方框内打“√”）学位论文作者签名：指导教师签名：日期：2007年月日日期：2007年月日本论文属于华中科技大学硕士学位论文I摘要随着软件产业的不断发展，程序的规模越来越大，完全依靠手工进行测试的难度越来越大，这就需要一些辅助测试的自动化测试工具。自动化测试工具能够自动地分析项目的源程序，自动地生成测试用例，并且达到一定的程序测试覆盖率，大大提高软件的可靠性和正确性，并且节约大量的人力和时间。符号执行使用抽象的符号表示程序中变量的值，来模拟程序的执行。符号执行的研究对于软件测试中测试用例的产生方法和程序证明理论研究，以及软件工程中逆向工程的研究都有重要的意义。因此，无论在软件工程的理论研究，还是在软件测试自动化的工程实践中，符号执行都有进一步研究的价值。目前国内外对符号执行进行了较深入的研究，并且已经开发出了一些工具。但是符号执行的一些问题尚待解决，而且国内外缺乏针对Java的符号执行工具。对数组的处理和模块调用的处理，仍旧是Java语言符号执行研究的难点。此外，Java语言是一种面向对象的语言，其面向对象的复杂特性也增加了其符号执行研究的难度。基于程序静态分析树PAT(ProgramAnalysisTree)树的符号执行方法是一种自动化的程序静态分析方法。该方法通过分析Java源程序建立PAT树。程序静态分析树能够对Java程序进行形式化的描述。基于程序静态分析树的遍历方法是一种基于Java程序的逻辑结构的算法。此外，符号执行系统的程序基本结构处理策略、符号计算方法和方法调用也是研究的重点，针对数组这个符号执行的难点也进行了相关的研究。最后，通过一个针对Java程序的符号执行工具JSE(JavaSymbolicExecutor)分析表明了基于PAT树的符号执行在实践中的可行性。关键字：自动化测试，程序静态分析，符号执行，程序静态分析树华中科技大学硕士学位论文IIAbstractWiththerapiddevelopmentofsoftwareindustry,programsarebecominglargerandmuchmorecomplexthaneverbefore.Duringthedevelopmentofsoftware,itistoodifficulttotestalltheprogramsmanually,soautomaticallytestingtoolsarenecessarytoanalysisprograms.Ifthetoolscananalysisprogramsautomatically,evengeneratetestdataautomaticallywithhighcoverageofprograms,thereliabilityofsoftwarewillbeimproveddramaticallyandconsiderableresourcewillbesaved.Symbolicexecutionsimulatesexecutionofprogramswithsymbolsinsteadofrealvalues.Symbolicexecutionisausefulmethodforprogramtestingandreverseengineering.Manypeoplehavedonealotofresearchonsymbolicexecution.Somesymbolicexecutiontoolshavebeendeveloped.Stilltherearesomeproblemsofsymbolicexecutionneedtobesolved.Firstofall,nosymbolicexecutionsystemofJavaprogramhasbeendeveloped.Secondly,solutionsforarrayandmodulecallarestilldifficultiesofJavasymbolicexecution.Finally,thecomplexityofJavaincreasesthedifficultyofthesymbolicexecutionimplement.ThesymbolicexecutionbasedonPAT(programanalysistree)isanautomaticprogramstaticanalysismethod,whichcananalysistheJavaprogram.Also,avisitingmethodisdesignedforPAT.Moreover,someresearchesonsymbolicexecutionhavebeendone.Attheendofthisthesis,asymbolicexecutiontoolcalledJSE(JavaSymbolicExecutor)isdeveloped.Keywords:AutomaticallyTesting,StaticAnalysis,SymbolicExecution,ProgramAnalysisTree华中科技大学硕士学位论文III目录摘要····················································································IABSTRACT············································································II1绪论1.1研究背景·········································································(1)1.2符号执行系统的意义··························································(3)1.3符号执行系统的研究现状····················································(5)1.4论文的组织结构································································(8)2符号执行系统JSE2.1符号执行系统概述·····························································(9)2.2符号执行系统架构···························································(10)2.3小结·············································································(13)3JAVA程序静态分析技术3.1程序静态分析··································································(15)3.2程序静态分析树·······························································(16)3.3小结·············································································(22)4基于PAT树的符号执行技术4.1控制流图········································································(23)4.2基于PAT树的符号执行方法···············································(25)4.3小结·············································································(32)5符号执行系统测试华中科技大学硕士学位论文IV5.1测试环境········································································(33)5.2功能测试········································································(33)5.3小结·············································································(39)6总结及未来的工作6.1本文总结········································································(40)6.2进一步工作·····································································(40)致谢················································································(42)参考文献············································································(44)华中科技大学硕士学位论文11绪论本章首先介绍了软件测试中符号执行系统的研究背景、意义和主要研究内容，概述了符号执行系统的任务、设计原则和实现难点，然后列举了迄今为止具有代表性的系统和框架，以及它们的优缺点，接着指出了本文的研究重点：程序符号执行系统设计与实现。最后指出其存在的不足，并提出了改进的方案。1.1研究背景随着信息技术的飞速发展，软件产品应用到了人类社会生活中的各个领域，但是各种软件故障也对社会带来了极大的经济损失，甚至产生了一定的破坏作用。特别是对于安全关键系统(SafetyCriticalSystem，如民航订票系统、银行结算系统、自动