Automated Program Repair through the Evolution of Assembly Code

Transcription

1 Automated Program Repair through the Evolution of Assembly Code Eric Schulte University of New Mexico 08 August / 26

2 Introduction We present a method of automated program repair through the evolution of assembly code compiled from extant software. previous work demonstrated the repair of C programs through evolution of C statements we extend previous work by operating at the level of assembly commands 2 / 26

3 Benets Benets of the assembly code level of representation include General applicable to any language which compiles to Java byte code or x86 assembly code Expressive the small scale of assembly instructions is capable of expressing repairs not possible at the C statement level Coverage the small alphabet of assembly commands and large number of commands in assembly programs provides access to a larger subset of the space of possible programs Robust the functionality of assembly programs is more robust to mutation 3 / 26

4 Comparative Performance Test Suite Runs Expected Test Suite Runs per Repair C assembly 1 ultrix-uniq ultrix-look look ultrix-dero units indent nullhttpd Repair at the Assembly level is roughly 17% slower than at the C level. 4 / 26

5 Technical Approach Stages preprocessing fault localization mutation evolution 5 / 26

6 Technical Approach Stages C Statement Tree Buggy C Program preprocessing fault localization mutation evolution 6 / 26

7 Technical Approach Stages C Statement Tree Buggy C Program preprocessing CIL CIL intermediate fault localization mutation evolution 7 / 26

8 Technical Approach Stages C Statement Tree Buggy C Program preprocessing CIL CIL intermediate fault localization walk path weighted C statement tree mutation evolution 8 / 26

9 Technical Approach Stages C Statement Tree Buggy C Program preprocessing CIL CIL intermediate fault localization walk path weighted C statement tree mutation tree mut. population evolution 9 / 26

10 Technical Approach Stages C Statement Tree Buggy C Program preprocessing CIL CIL intermediate fault localization walk path weighted C statement tree mutation tree mut. population evolution mutate evaluate terminate? 10 / 26

11 Technical Approach Stages preprocessing fault localization mutation C Statement Tree Buggy C Program CIL CIL intermediate walk path weighted C statement tree tree mut. population Assembly Linear Genome Buggy C, Java, etc... Program evolution mutate evaluate terminate? 11 / 26

12 Technical Approach Stages preprocessing fault localization mutation C Statement Tree Buggy C Program CIL CIL intermediate walk path weighted C statement tree tree mut. population Assembly Linear Genome Buggy C, Java, etc... Program gcc -S assembly code evolution mutate evaluate terminate? 12 / 26

13 Technical Approach Stages preprocessing fault localization mutation C Statement Tree Buggy C Program CIL CIL intermediate walk path deterministic weighted C statement tree tree mut. population Assembly Linear Genome Buggy C, Java, etc... Program gcc -S assembly code sample pc stochastic evolution mutate evaluate terminate? 13 / 26

14 Technical Approach Stages preprocessing fault localization mutation C Statement Tree Buggy C Program CIL CIL intermediate walk path weighted C statement tree tree mut. population Assembly Linear Genome Buggy C, Java, etc... Program gcc -S assembly code sample pc weighted assembly genome evolution mutate evaluate terminate? 14 / 26

15 Technical Approach Stages preprocessing fault localization mutation C Statement Tree Buggy C Program CIL CIL intermediate walk path weighted C statement tree tree mut. population Assembly Linear Genome Buggy C, Java, etc... Program gcc -S assembly code sample pc weighted assembly genome array mut. population evolution mutate evaluate terminate? 15 / 26

16 Technical Approach Stages preprocessing fault localization mutation C Statement Tree Buggy C Program CIL CIL intermediate walk path weighted C statement tree tree mut. population Assembly Linear Genome Buggy C, Java, etc... Program gcc -S assembly code sample pc weighted assembly genome array mut. population evolution mutate evaluate mutate evaluate terminate? terminate? 16 / 26

17 Representation and Genetic Operators Linear Genome Individuals are linear genomes of weighted assembly commands. ("main:" "pushl %ebp" "movl %esp"... ) Genetic Operators insert selects an instruction, selects a location, copies the instruction and inserts in the location delete selects an instruction and deletes it swap selects two instructions and swaps them crossover selects a crossover point for each of two individuals and exchanges all instructions after that point between the individuals 17 / 26

18 Fault Localization Technique CPU: program counter oprofile raw addresses Dump of assembler code for function main: 0x main+0: push %ebp 0x main+1: mov %esp,%ebpmain: 0x main+3: and $0xfffffff0,%esp gdb oset in method main: pushl %ebp movl %esp, %ebp andl $-16, %esp mem-mapping.clj index in genome ("main:" "pushl %ebp" "movl %esp"... ) 18 / 26

19 Fault Localization Results Raw Sample Counts Smoothed Weighted Paths samples C assembly weight assembly instruction index assembly instruction index 19 / 26

20 Fault Localization Comparative Path Size Weighted Path Length Weighted Path Sizes C assembly 1 ultrix-uniq ultrix-look look units nullhttpd ultrix-dero indent 20 / 26

21 Generality to Multiple Languages Input: Integer a Input: Integer b Output: gcd(a, b) or 1: if a 0 then 2: print a 3: end if 4: while b 0 do 5: if a > b then 6: a a b 7: else 8: b b a 9: end if 10: end while 11: print a C Haskell Java Program Length Total Solutions Unique Solutions Table: GCD Repair Results by Language Figure: A Buggy version of Euclid's Algorithm 21 / 26

22 Mutational Robustness & Neutral Spaces Concepts Mutational Robustness robustness of phenotype to changes in genotype in the case of computer programs phenotype behavior of the program genotype representation of the program Neutral Space contiguous region of genotype space with constant phenotype 22 / 26

23 Mutational Robustness & Neutral Spaces Relevance Mutational Robustness directly inuences evolvability A large neutral space allows for signicant diversity in representation behavior eciency size etc... A neutral neighborhood denes which functionalities are reachable in a single genotypic step 23 / 26

24 Robustness under Genetic Operators Robustness of Behavior under Genetic Operations insert delete swap % Neutral gcd look dero Program 24 / 26

25 Future Work Investigate Mutational Robustness dierences across languages, algorithms and representations properties of the neutral spaces of assembly programs Improve GP Technique apply ongoing work on the C statement level homologous crossover, steady state mutation, etc... Non-Repair Evolution machine specic optimization disruption of mono-culture (N-variant) 25 / 26

26 Discussion Questions Comments Suggestions 26 / 26