How would one find test cases for a self-implemented value set analysis (VSA)?

Question

I read a blog post about value set analysis (VSA). For VSA, see e.g. here.

The blog author writes

I’ve been trying to get to the point where the example in Balakrishnan’s dissertation works. I chose this example because I don’t know of any others!

I was wondering how one would test a custom VSA implementation. How can one find test cases?

My guess is one could run & trace a simple application and record (concrete, i.e. run-time) values for some memory areas or registers. These values then should show up in the result of the corresponding memory / registers after having done the static VSA, right?

For the beginning, it would be easier to have some examples. Are you aware of any examples (other than those in the official papers)?

Answer 1

Well, using dynamic analysis is one way, but you can probably start with some small, self-evident edge cases, e.g.:

test edx, 1
jz @even
[here, edx is odd]
even:
[here, edx is even]

test edx, edx
jg @greater
[here, edx is <=0]
greater:
[here, edx is >0]

and so on.