Symbolic execution with Java Pathfinder

原创 2012年05月17日 20:33:07

JPF has an extension for symbolically executing Java bytecode (called SPF). I have been using SPF for analyzing some pieces of code. This post introduces installation and basic configurations of SPF to help JPF beginners. As the official documents are really more suitable for those experienced JPF users.

Install Java Pathfinder (jpf-core + jpf-symbc)

Step 1: download sources

I am using Eclipse as Java IDE, so here I assume you are using Eclipse. For downloading the sources of JPF, we can import projects from its Mercurial repositories (if you do not have Mercurial plugin installed, please install it before moving on).

Step 2: build the jpf-core and jpf-symbc

JPF projects are ant-based, so you should use ant to build these two projects. Then you are done with installation.

JPF configuration (assume we are using Eclipse plugin to run JPF,here tells you how to install the plugin)

Step 1: copy the imported two projects (jpf-core and jpf-symbc) to a safe place in your machine (to avoid modification)

I put them under C:\Users\me\projects\jpf\

Step 2: configure the file

Create a folder call ".jpf" under your home directory (as Eclipse JPF plugin by default seaches ~/.jpf for the configuration file). Windows does not allow a folder name starting with a dot, so you can use command line tools to create this folder. Under the folder, create a file with the following content

# JPF site configuration

jpf.home = ${user.home}/projects/jpf

# can only expand system properties
jpf-core = ${user.home}/projects/jpf/jpf-core

# annotation properties extension
jpf-aprop = ${jpf.home}/jpf-aprop

# numeric extension
jpf-numeric = ${jpf.home}/jpf-numeric

# symbolic extension
jpf-symbc = ${jpf.home}/jpf-symbc

# concurrent extension
#jpf-concurrent = ${jpf.home}/jpf-concurrent

jpf-shell = ${jpf.home}/jpf-shell

jpf-awt = ${jpf.home}/jpf-awt

jpf-awt-shell = ${jpf.home}/jpf-awt-shels

Note that even in Windows, the path separator is slash (/) instead of back slash (\). Sometimes, back slash is ok, but occasionally it causes problems. So using slash is suggested according to my personal experience.

Run SPF (with and without plugin)

1. Using JPF plugin to verify java programs

JPF plugin knows where the JPF and SPF classes reside (jars under the build folder of jpf-core and jpf-symbc), so using plugin saves a lot of efforts. Please make sure that in Eclipse, Window->Preference->Java->JPF Preference->path to points to the directory where we create the configuration file (by default it is set up correctly).

Suppose we create a new Java project "TestJPF" and a class "MyClass".

public class MyClass {
	public int myMethod(int x, int y){
		int z = x + y;
		if (z > 0) {
				z = 1;
			} else{
				z = -1;
//			System.out.println("path 1 explored");
		} else {
				z = z - x;
			} else{
				z = z + x;
//			System.out.println("path 2 explored");
		z = 2 * z;
		return z;
	public static void main(String[] args){
		MyClass mc = new MyClass();
		mc.myMethod(1, 2);
We can symbolically run the myMethod() method to explore every possible path, and SPF can help generate test cases to cover those paths (test generation is the typical magic of symbolic execution). In order to do so, you only need to create a .jpf file under the project folder. Lets call it MyClass.jpf. It content specifies the configuration of SPF. JPF is a great tool, but its configuration is intimidating. JPF's flexibility comes with a price.

The right click MyClass.jpf, and click "verify", you should the following content printed on Eclipse console.

Executing command: java -jar C:\Users\andrewust\projects\jpf\jpf-core\build\RunJPF.jar +shell.port=4242 D:\java_workspace\Temp\MyClass.jpf 
Running Symbolic PathFinder ...
JavaPathfinder v6.0 (rev ${version}) - (C) RIACS/NASA Ames Research Center

====================================================== system under test

====================================================== search started: 5/17/12 8:20 PM

====================================================== results
no errors detected

====================================================== statistics
elapsed time:       00:00:00
states:             new=7, visited=0, backtracked=7, end=4
search:             maxDepth=3, constraints hit=0
choice generators:  thread=1 (signal=0, lock=1, shared ref=0), data=3
heap:               new=321, released=42, max live=321, gc-cycles=5
instructions:       2974
max memory:         59MB
loaded code:        classes=75, methods=960

====================================================== search finished: 5/17/12 8:20 PM

In the future post, I will explain those configuration parameters in a .jpf file. The minimal set includes target, classpath, and symbolic.method.

2. Configure a Eclipse run to symbolically execute a method

Here we don't need any .jpf file to specify JPF configurations. We specify them as Java properties (arguments when running a program using "java MyClass XXXX") by configuring a run.

Step 1 Add jpf-core and jpf-symbc to buildpath (without jpf-plugin, we need to explicitly add them as library so that JVM can find corresponding classes)

You can simply add the jars under jpf-core/build, jpf-core/lib, jpf-symbc/build, and jpf-symbc/lib as external jars. Or create user libraries to organize those jars. For example, I create jpf-core, jpf-symbc, and jpf-lib for holding those jars, and then add the three libraries to my build path.

Step 2 Run configuration

The we are done here. Click run, you will see the same results as in the run with plugin.

Java Pathfinder 安装编译详解

1.首先需要从Sourceforge或JPF 的SVN站点上下载整个的JPF目录(trunk 或 jpf release)2.确保你的机器上已经安装好JAVA环境,并设置好了环境变量3.有条件的话,最...
  • wirror800
  • wirror800
  • 2009年05月06日 11:29
  • 2640

Java PathFinder(一) Java PathFinder基于Eclipse的安装配置及使用

  • qq_24451605
  • qq_24451605
  • 2016年05月14日 13:13
  • 5053

common strengths and weaknesses of symbolic execution

Strengths: when a test case fails, the program is proven to be incorrect; automatic test cases catch...
  • haifeng_gu
  • haifeng_gu
  • 2017年06月03日 21:33
  • 104


  • zmycoco2
  • zmycoco2
  • 2013年11月29日 11:31
  • 1072

ln: creating symbolic link 'path' Operation not supported 问题解决方法

本次将window目录mount给linux,编译rpm安装包时,出现如下错误: ”’extracting debug info from /root/window/EcoX/EcoX-1.0.0/...
  • duxiaohua15
  • duxiaohua15
  • 2016年11月22日 10:32
  • 422


说明:此文来自《QTP自动化测试实践》         PathFinder对象中的Locate方法用于返回QTP中指定的目录的全路径。可以通过选择菜单“Toos|Options”来打开小图的界面,...
  • wangxianglian
  • wangxianglian
  • 2011年12月01日 17:04
  • 1767

符号执行 首先随便找个开源...
  • cnbird2008
  • cnbird2008
  • 2017年02月20日 20:10
  • 1643

File is a broken symbolic link:

今天升级xcode8  然后做的sok的demo  跑不起来了。 看都错误是这个,当时比较蒙蔽,这个file  是自己sdk中的一个 .bundle文件。我在xcode编译顺序上调整了一下,还是不行...
  • qq_16844001
  • qq_16844001
  • 2016年09月21日 19:01
  • 751

Symbolic Breakpoint使用

简介symbolic breakpoint是一个全局短点,功能非常强大,但很少有人关注使用它。使用创建断点symbolic breakpoint使用很简单,点击断点界面的“+”号,选择”Add Sym...
  • xiepanqi
  • xiepanqi
  • 2016年04月10日 10:45
  • 2131

SymNet:scalable symbolic execution for modernnetworks论文

SymNet: scalable symbolic execution for modern networks 这篇论文Sigcomm 2016上,本篇论文采用符号执行的方法,采用SEFL语言建立网络...
  • syh_486_007
  • syh_486_007
  • 2016年12月27日 21:16
  • 590
您举报文章:Symbolic execution with Java Pathfinder