DBTG: Demand-Driven Backtracking Test Generation

Test generation techniques are still weak, especially to large or complex programs. This paper presents a new test generation method, which can automatically generate inputs triggering bugs with greatly mitigating the path explosion problem. The method performs intraprocedural analysis to find potential bugs using a combined symbolic and concrete execution with simplifying callee functions; then backtracks from the bug statement to program entry to find interprocedural paths with pruning infeasible paths in due course; finally expands callee functions of these paths to prune infeasible paths again. Demand-driven means that as few paths as possible are explored in order to find feasible paths triggering bugs. We have implemented a tool based on Phoenix framework and Z3 solver. To the best of our knowledge, it is the first security analysis tool working on intermediate representation between source and binary using a combined symbolic and concrete execution. Preliminary experiments on real code of nbsmtp SMTP client are promising.