Abstract:Analyzing programs with loops is a challenging task, suffering from potential issues such as indeterminate number of iterations and exponential growth of control flow complexity. Loop summarization, as a static analysis method for concrete semantic interpretation, receives increasing focuses. It produces symbolic expressions semantically equivalent to the loop program. However, current loop summarization methods are only suitable for single-branch loops or multi-branch loops with simple cycles, without supporting complex loops with irregular branch-to-branch transitions. In this paper, we proposed LoopSCC, a novel loop summarization technique, to achieve concrete semantic interpretation on complex loop. LoopSCC analyzes the control flow at the granularity of single-loop-path and applies the strongly connected components (SCC for short) for contraction and simplification, resulting in the contracted single-loop-path graph (CSG for short). Based on the control flow information provided by the CSG, we can convert the loop summary into a combination of SCC summaries. When an SCC contains irregular branch-to-branch transitions, we propose to explore a convergent range to identify the determinate cycles of different execution paths, referred as oscillatory interval. The loop summarization composed of both iteration conditions and execution operations can eventually be derived recursively. Extensive experiments compared to six state-of-the-art loop interpretation methods are conducted to evaluate the effectiveness of LoopSCC. From the results, LoopSCC outperforms comparative methods in both interpretation accuracy and application effectiveness. Especially, LoopSCC achieves a 100% interpretation accuracy on public common-used benchmark. A systematical study for loop properties on three large-scale programs illustrates that LoopSCC presents outstanding scalability for real-world loop programs.

A New Algorithm for Identifying Loops in Decompilation

Loopster: Static Loop Termination Analysis

A Run-Time Technique for Parallel Loop Identification Based on Distributed System

Proteus: Computing Disjunctive Loop Summary Via Path Dependency Analysis

Structuring 2-way Branches in Binary Executables

A Control Flow Diagram Generation Algorithm Based on Clang Static Analyzer

Iterative-free Program Analysis

Loop Transparency for Scalable Dynamic Symbolic Execution

Highly Efficient Modulo Loop Pipeline for High Level Synthesis

LoopSCC: Towards Summarizing Multi-branch Loops within Determinate Cycles

Loopster++: Termination Analysis for Multi-path Linear Loop

Control Flow Obfuscation Scheme for LLVM Intermediate Languages

Symbolic Evaluation of Chains of Recurrencesfor Loop

An Automatic Optimization Method of Combinational Logic Loops in CGRA

Simple Linear Loops: Algebraic Invariants and Applications

(Un)Solvable Loop Analysis

Folklore Confirmed

Novel Method of Control Flow and Structural Coverage Measurement for Object Code Verification

Automatic enhanced CDFG generation based on runtime instrumentation

A Symbolic Execution Guided Inner Loop Bound Analysis

A method for hidden malcode anomaly detection using dynamic control-flow analysis