I read a blog post about value set analysis (VSA). For VSA, see e.g. here.

The blog author writes

I’ve been trying to get to the point where the example in Balakrishnan’s dissertation works. I chose this example because I don’t know of any others!

I was wondering how one would test a custom VSA implementation. How can one find test cases?

My guess is one could run & trace a simple application and record (concrete, i.e. run-time) values for some memory areas or registers. These values then should show up in the result of the corresponding memory / registers after having done the static VSA, right?

For the beginning, it would be easier to have some examples. Are you aware of any examples (other than those in the official papers)?

  • 3
    As a side note, I think the blog post is wrong about why the VSA implementation is able to have more accurate bounds on eax – in the journal version of the WYSINWYX they mention that this is due to an extra affine analysis step they do, described in the PhD thesis (section "Affine-Relation Analysis"). – Brendan Dolan-Gavitt Oct 27 '16 at 15:30

Well, using dynamic analysis is one way, but you can probably start with some small, self-evident edge cases, e.g.:

test edx, 1
jz @even
[here, edx is odd]
[here, edx is even]

test edx, edx
jg @greater
[here, edx is <=0]
[here, edx is >0]

and so on.

  • Very useful hint. I also did not think of creating samples in assembly. – gogo_gorilla Oct 27 '16 at 12:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.