JP6954080B2 - Information processing equipment, analysis programs and analysis methods - Google Patents

Description

The present invention relates to an information processing device and the like.

When a system administrator maintains or rebuilds an existing system, information such as system documents and knowledge of experts is important in order to understand the current state of the system. However, for example, in a system that is operated for a long period of time, a situation may occur in which information that requires work for maintenance or reconstruction is insufficient due to inadequate documents or the absence of experts.

In such a case, the system administrator takes measures to supplement the lacking information by analyzing the program which is the implementation entity of the system instead of the document or the expert. This program analysis is called logic extraction from the program. Here, the logic of the program refers to the processing content described in the program, and indicates the input / output relationship as the execution result of the program.

As an example of the technology for extracting logic from a program, there is a method using symbolic execution. Symbolic execution is a program analysis method in which a symbol value is set in an input variable and a processing path is extracted while determining an executable branch in a conditional branch. The result of symbolic execution is the conditions and output for each executable path. It is realized by the input condition and output logic table described by the input variable.

A reference example of symbolic execution will be described with reference to FIGS. 15 to 17. 15 to 17 are diagrams showing a reference example of symbolic execution.

As shown in FIG. 15, as a result of performing symbolic execution on the example A of the program, the condition (path condition) and the output (path output) for each extracted path are described. The result of organizing the results of symbolic execution is the logic table of the analysis results. In example A of the program, the comparison value of the condition of the IF statement is described using literals such as'male'and'female'. In the path condition and path output of the result of symbolically executing the program example A, the comparison value is described using a literal. The comparison values are described using literals in the conditions and output of the logic table of the analysis results.

The program example B of FIG. 16 has the same logic as the program example A. As in the example B of the program, the comparison value of the condition of the IF statement can be described by using a constant. Here, the type of the input variable "gender" is a two-digit character string type. The path condition and path output as a result of symbolic execution for example B of the program are described using a character string defined by a character string type constant whose comparison value is two digits.

The program example C of FIG. 17 has the same logic as the program example A. As in example C of the program, the comparison value of the condition of the IF statement can be described by using a constant. Here, the type of the input variable "gender" is a one-digit number type. In the path condition and path output as a result of symbolic execution for example C of the program, the comparison value is described using a numerical value defined by a one-digit numeric type constant.

Since the value of the constant used as the comparison value of the condition of the IF statement is set to distinguish it from other constants, the value itself may be meaningless. For example, in Example C of the program of FIG. 17, the value "1" of the constant meaning "male" used as the comparison value of the condition of the IF statement is set to distinguish it from the constant meaning "female". Therefore, the value itself has no meaning.

Japanese Unexamined Patent Publication No. 2015-133031 Japanese Unexamined Patent Publication No. 2016-99726

However, in a program in which there is no semantic connection between the constant value (constant value) and the constant name, there is a problem that it takes time to interpret the symbolic execution result and the logic table. For example, in the logic table of FIG. 17, since the meaning of the constant value "1" described by the condition is unknown, it takes time and effort to interpret the constant value "1".

Therefore, a method of replacing the constant value in the logic table with the constant name can be considered by using the relationship between the constant name and the constant value described in the definition of the constant in the program. For example, in the logic table of FIG. 17, a method of replacing the constant value "1" described in the condition with the constant name "male" by using the 000011 sentence in the example C of the program can be considered. This facilitates the interpretation of the logic table.

However, if there are duplicate constant values in the definition of constants in the program, there is a problem that the constant name for the constant value described in the condition cannot be uniquely specified. Further, if there is a condition related to the variable after posting the constant value to the variable, there is a problem that the constant name for the constant value posted to the variable cannot be uniquely specified.

Here, the problem of replacing the constant value with the constant name will be described with reference to FIGS. 18A and 18B. 18A and 18B are diagrams illustrating a problem in replacing a constant value with a constant name.

As shown in FIG. 18A, example D of the program includes the definition of constants and the processing contents. The constant value "1" is duplicated in the definition of the constant (lines 000013, 00015, 000024). That is, there are a plurality of constant names that define the constant value as "1", such as "standard", "Tokyo", and "regional difference". Then, there are two constant value "1" in No. 3 of the result of symbolic execution of the program example D shown in FIG. 18B, and the constant name for each constant value "1" cannot be uniquely specified.

Further, (numerical value = 1) is included as a condition in No. 3 of the result of symbolic execution of the program example D shown in FIG. 18B. The IF condition corresponding to (numerical value = 1) in the condition is (numerical value Not = relay) (line 000034 in FIG. 18A), but the variable "relay" is not a constant because it does not exist in the definition of the constant. At the time when this condition is evaluated, the constant value corresponding to the constant name "reference" is posted in the variable "relay" (line 000033 in FIG. 18A). However, the constant name for the constant value posted to the variable "relay" cannot be tracked. That is, if there is a condition regarding the variable to which the constant value is posted, the constant name for the constant value posted to the variable cannot be uniquely specified.

One aspect of the present invention is to improve the interpretation of symbolic execution results.

In one aspect, the information processing device is an information processing device that analyzes a program by using symbolic execution, and includes an extraction unit that sequentially extracts instruction statements from the program and an instruction statement extracted by the extraction unit. When the update statement updates a variable, the recording unit that records the relationship between the variable name of the variable and the constant name indicating the meaning of the value for updating the variable included in the update statement in the storage unit, and the instruction. When the statement is a branch statement that branches the path, symbolic execution is performed on the branch statement based on the related part that associates the branch statement with the relationship and the branch statement and the relationship associated with the related part. It has a replacement unit that replaces the constant value included in the result with information including the constant name stored in the relationship.

According to one embodiment, it is possible to improve the interpretation of the symbolic execution result.

FIG. 1 is a diagram showing a functional configuration of an information processing device according to an embodiment. FIG. 2 is a diagram showing an example of the operation of the constant determination unit according to the embodiment. FIG. 3 is a diagram showing an example of the operation of the constant relation recording unit according to the embodiment. FIG. 4 is a diagram showing an example of the operation of the constant relationship control unit according to the embodiment. FIG. 5A is a diagram (1) showing an example of the operation of the constant information addition unit according to the embodiment. FIG. 5B is a diagram (2) showing an example of the operation of the constant information addition unit according to the embodiment. FIG. 6 is a diagram showing an example of the operation of the constant information interpretation unit according to the embodiment. FIG. 7 is a diagram showing an example of a logic table according to an embodiment. FIG. 8 is a diagram showing an example of a flowchart of the analysis process according to the embodiment. FIG. 9 is a diagram showing an example of a flowchart of the constant determination process according to the embodiment. FIG. 10 is a diagram showing an example of a flowchart of the constant relation recording process according to the embodiment. FIG. 11 is a diagram showing an example of a flowchart of the constant relationship control process according to the embodiment. FIG. 12 is a diagram showing an example of a flowchart of the constant information addition process according to the embodiment. FIG. 13 is a diagram showing an example of a flowchart of the constant information interpretation process according to the embodiment. FIG. 14 is a diagram showing an example of a computer that executes an analysis program. FIG. 15 is a diagram (1) showing a reference example of symbolic execution. FIG. 16 is a diagram (2) showing a reference example of symbolic execution. FIG. 17 is a diagram (3) showing a reference example of symbolic execution. FIG. 18A is a diagram (1) illustrating a problem in the case of replacing a constant value with a constant name. FIG. 18B is a diagram (2) illustrating a problem in the case of replacing a constant value with a constant name.

Hereinafter, examples of the information processing apparatus, analysis program, and analysis method disclosed in the present application will be described in detail with reference to the drawings. The present invention is not limited to the examples.

[Functional configuration of information processing device according to the embodiment]
FIG. 1 is a diagram showing a functional configuration of an information processing device according to an embodiment. The information processing apparatus 1 shown in FIG. 1 analyzes a program having a plurality of constant names using the same numerical value as different meanings by using symbolic execution. Symbolic execution here refers to a program analysis method in which symbolic values are set in input variables in a program and a processing path is extracted while determining an executable branch in a conditional branch. In such symbolic execution, when the instruction statement to be executed is an update statement that updates a variable, the information processing apparatus 1 records the relationship between the variable name and the constant name included in the update statement in the storage unit. When the instruction statement is a conditional branch statement that branches the path, the information processing device 1 associates the conditional branch statement with the relationship. The information processing device 1 determines the path condition (of the symbolic execution result) for the conditional branch statement of the program based on the relationship between the conditional branch statement including the variable name of the program and the variable name and the constant name stored in the storage unit. Replace the constant value in it with information containing the constant name stored in the relationship.

The information processing device 1 has a control unit 10 and a storage unit 20. The control unit 10 corresponds to an electronic circuit such as a CPU (Central Processing Unit). Then, the control unit 10 has an internal memory for storing programs and control data that define various processing procedures, and executes various processes by these. The control unit 10 includes a symbolic execution unit 11, a constant determination unit 12, a constant relationship recording unit 13, a constant relationship control unit 14, a constant information addition unit 15, a path condition path output recording unit 16, a constant information interpretation unit 17, and condition simplification. It has a part 18. The symbolic execution unit 11 is an example of an extraction unit. The constant relationship recording unit 13 is an example of a recording unit. The constant relationship control unit 14 is an example of a related unit. The constant information addition unit 15 is an example of a replacement unit.

The storage unit 20 is, for example, a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory (Flash Memory), or a storage device such as a hard disk or an optical disk. The storage unit 20 has a program 21, a constant management table 22, a symbolic execution result 23, and a logic table 24.

The program 21 is a program to be executed symbolically.

The constant management table 22 is a table that manages the relationship between the variable name and the constant name. The variable name is the name of the area for updating the variable. The constant name is the name of the area in which the constant is set. The constant name is described in the definition of the constant in the program 21. In the constant management table 22, when the statement is an update statement in the symbolic execution of the program 21, the constant name meaning the value of the update source and the variable name of the update destination (variable name of the update variable) are associated with each other. to manage. The update statement is a statement that updates the update source value to the update destination area. Examples of the update statement include a posting instruction and an arithmetic instruction. A posting instruction is an instruction statement that posts or assigns the value of a reference variable (update source) to the area of another variable (update variable). In COBOL language, MOVE is applicable. In "MOVE A TO B", it is used when the value of the reference variable A is transferred to another variable B. Further, the arithmetic instruction means an instruction statement for calculating addition, subtraction, multiplication and division.

The symbolic execution result 23 is an execution result of the symbolic execution. The symbolic execution result 23 is an execution result in which a path condition and a path output are described for the processing path extracted by the symbolic execution.

The logic table 24 is a table in which the symbolic execution results are organized, and is a table in which conditions and outputs are described with respect to the symbol values set in the input variables. The logic table 24 is generated using the symbolic execution result 23.

The symbolic execution unit 11 executes symbolic execution for each instruction statement in the program 21.

The constant determination unit 12 determines whether or not the reference variable is a constant when the instruction statement to be analyzed by symbolic execution is an update statement. For example, the constant determination unit 12 determines whether or not the name of the reference variable is included in the definition of the constant in the program 21. When the name of the reference variable is included in the definition of the constant, the constant determination unit 12 outputs that the reference variable is a constant. The constant determination unit 12 manages the reference variable in the constant management table when the name of the reference variable is not included in the definition of the constant and the name of the reference variable is managed in the constant management table 22. Outputs that it is a variable that has been created. The name of the reference variable is not included in the definition of the constant, but it may be included in the definition of the working variable. The definition of a work variable is a variable that is temporarily used during work, and corresponds to lines 27 to 30 in program D of FIG. 18A, for example. In such a case, the constant determination unit 12 may output that the reference variable is a constant.

When the reference variable determined by the constant determination unit 12 is determined to be a constant, the constant relationship recording unit 13 stores the constant relationship between the constant name (constant name) and the variable name of the update variable in the constant management table. Record at 22.

For example, when the constant relationship recording unit 13 receives the instruction statement and the output content from the constant determination unit 12, the output content indicates that the reference variable is a constant, the following processing is performed. When the variable name of the update variable in the statement does not exist in the constant management table 22, the constant relationship recording unit 13 sets the variable name of the update variable and the constant name of the reference variable (the constant name meaning the value of the update source). The constant relationship with is added to the constant management table 22. As a result, the constant relation recording unit 13 associates the update variable in the instruction statement with the constant name meaning the constant value to be updated to this update variable even if there is a duplicate constant value in the definition of the constant in the program. be able to. When the variable name of the update variable in the instruction statement exists in the constant management table 22, the constant relationship recording unit 13 updates the constant name for the variable name of the update variable to the constant name of the reference variable in the instruction statement. As a result, the constant relation recording unit 13 can associate the update variable in the instruction statement with the constant name meaning the constant value to be updated to this update variable.

Further, the constant relation recording unit 13 performs the following processing when the output content indicates that the reference variable is a variable managed in the constant management table. The constant relationship recording unit 13 acquires the constant name corresponding to the reference variable in the instruction statement from the constant management table 22, and adds the constant relationship between the acquired constant name and the variable name of the update variable in the instruction statement to the constant management table 22. do. As a result, the constant relation recording unit 13 can track the constant name meaning the constant value updated in this update variable even when the update variable that has already been updated is used as the reference variable in the instruction statement. The constant name can be associated with the variable name of the update variable in the statement.

The constant relationship control unit 14 controls the constant relationship recorded by the constant relationship recording unit 13. For example, the constant relationship control unit 14 stores the instruction statement at the time of path branching and the constant management table 22 at the time of path branching in association with each other at the time of path branching. Further, when the constant relation control unit 14 is the end point of the path, the instruction statement at the end point of the path and the constant management table 22 at the end point of the path are stored in association with each other. Then, when the constant relation control unit 14 backtracks the path to the path branch in which the constant management table 22 is saved, the constant relationship control unit 14 reproduces the constant management table 22 saved at the time of the path branch.

When the constant information addition unit 15 outputs the path condition and the path output, the constant information addition unit 15 adds the constant information to the constant value described in the path condition and the path output by using the constant relationship controlled by the constant relationship control unit 14. do. That is, the constant information addition unit 15 replaces the path condition and the path output output as the symbolic execution result with the symbolic execution result 23 including the path condition and the path output in which the constant information is added to the constant value.

For example, the constant information addition unit 15 acquires the condition of the conditional branch statement and the path condition when the processing of the symbolic execution is the recording process of the path condition. The path condition referred to here is a condition that can be branched in a conditional branch statement and is executed when one of the branches is selected. As an example, when the THEN branch is selected in the IF statement, the condition of the IF statement becomes the path condition. Then, when the variable name of the variable of the path condition is in the variable name of the update variable of the constant management table 22 associated with the conditional branch statement of the path condition, the constant information addition unit 15 determines the variable name of the update variable. The constant name (constant information) corresponding to is added to the constant value described in the path condition.

Further, the constant information addition unit 15 acquires the path output when the symbolic execution process is the path output recording process. The path output here means the output executed at the end point of the path. Then, when the variable name of the variable of the path output is in the variable name of the update variable of the constant management table 22 associated with the statement of the path output, the constant information addition unit 15 sets the variable name of the update variable. Add the corresponding constant name (definition information) to the constant value described in the path output.

The path condition path output recording unit 16 records the path condition and the path output to which the constant information is added by the constant information addition unit 15 as the symbolic execution result 23.

The constant information interpretation unit 17 interprets the constant information added to the path condition in order to simplify the path condition of the symbolic execution result 23.

For example, the constant information interpretation unit 17 acquires the path condition to which the constant information is added from the symbolic execution result 23 when the path condition is simplified. The constant information interpretation unit 17 determines whether or not the variable of the comparison condition is the one to which the constant information is added for each comparison condition in the path condition. When the variable of the comparison condition is the one to which the constant information is added, the constant information interpretation unit 17 returns to the original path condition. That is, the constant information interpretation unit 17 excludes the constant information from the variables of the comparison condition in the path condition. Then, the constant information interpretation unit 17 records the correspondence between the comparison condition having the variable to which the constant information is added and the original comparison condition from which the constant information is excluded.

Further, when the comparison condition in the acquired path condition is returned to the original comparison condition, the constant information interpretation unit 17 passes the original path condition to the condition reduction unit 18 in order to simplify the original path condition.

Further, when the constant information interpretation unit 17 changes the original path condition simplified by the condition simplification unit 18 into a path condition to which constant information is added, the constant information interpretation unit 17 uses a correspondence relationship to reduce the path condition. For each comparison condition inside, the variable of the comparison condition is returned to the one to which the constant information is added. Then, the constant information interpretation unit 17 converts the simplified original path condition into a path condition to which the constant information is added, and outputs the simplified new path condition.

The condition simplification unit 18 simplifies the path condition. As an example, when the path condition is "(numerical value = 1) AND ((location NOT = 2) AND (location = 1))", this path condition is set to "(numerical value = 1) AND (location = 1)". "Simplified.

[Example of operation of constant determination unit]
FIG. 2 is a diagram showing an example of the operation of the constant determination unit according to the embodiment. The processing content of the program 21 is shown on the left side of FIG. The program 21 will be described as the program D shown in FIG. 18A. The instruction statements included in the processing contents of the program 21 are processed one by one.

As an example, a case where the statement "MOVE no problem TO error" having a line number of 32 is processed will be described. The constant determination unit 12 determines whether or not the instruction statement is an update statement. Here, since the instruction statement is a MOVE instruction (posting instruction), it is determined to be an update statement.

The constant determination unit 12 determines whether or not the name of the reference variable is a constant. Here, the name of the reference variable is "no problem". "No problem" is included in the 23rd line of the definition of the constant. That is, "no problem" is a constant. Therefore, since the name of the reference variable is a constant, the constant determination unit 12 outputs "1" indicating that the reference variable is a constant.

As an example, a case where the instruction statement “IF (numerical value NOT = relay) THEN” having a line number of 34 is processed will be described. The constant determination unit 12 determines whether or not the instruction statement is an update statement. Here, since the instruction statement is an IF instruction (conditional instruction), it is determined that it is not an update statement. Therefore, the constant determination unit 12 outputs "0" indicating that the instruction statement is not an update statement.

As an example, a case where the instruction statement “MOVE NG TO relay B” having a line number of 36 is input to the constant determination unit 12 will be described. The constant determination unit 12 determines whether or not the instruction statement is an update statement. Here, since the instruction statement is a MOVE instruction (posting instruction), it is determined to be an update statement.

The constant determination unit 12 determines whether or not the name of the reference variable is a constant. Here, the name of the reference variable is "NG". "NG" is included in the 21st line of the definition of the constant. That is, "NG" is a constant. Therefore, since the name of the reference variable is a constant, the constant determination unit 12 outputs "1" indicating that the reference variable is a constant. After that, the constant relationship recording unit 13 adds the constant relationship between the variable name “relay B” of the update variable and the constant name “NG” of the reference variable to the constant management table 22.

Next, as an example, a case where the instruction statement “MOVE relay BTO result” having the line number 37 is processed will be described. The constant determination unit 12 determines whether or not the instruction statement is an update statement. Here, since the instruction statement is a MOVE instruction (posting instruction), it is determined to be an update statement.

The constant determination unit 12 determines whether or not the name of the reference variable is a constant. Here, the name of the reference variable is "relay B". "Relay B" is not included in the definition of the constant. That is, "relay B" is not a constant.

Further, the constant determination unit 12 determines whether or not the name of the reference variable is managed in the constant management table 22. Here, in the process of the 36th line one line before, the name of the reference variable "relay B" is added to the constant management table 22 this time, so that the name of the reference variable is managed in the constant management table 22. Is determined. Therefore, since the "relay B" is a variable managed by the constant management table, the constant determination unit 12 outputs "3" indicating that the reference variable is a variable managed by the constant management table.

[Example of operation of constant relation recording unit]
FIG. 3 is a diagram showing an example of the operation of the constant relation recording unit according to the embodiment. On the left side of FIG. 3, the instruction statement and the output of the constant determination unit 12 are shown as inputs of the constant relation recording unit 13 for each line number. The program 21 will be described as the program D shown in FIG. 18A. It is assumed that nothing has been set in the constant management table 22 yet.

As an example, a case where the statement "MOVE no problem TO error" having a line number of 32 is processed will be described. On the left side of FIG. 3, “1” indicating that the reference variable is a constant is shown as the output of the constant determination unit 12. When the reference variable is "1", the following processing is performed. When the variable name of the update variable in the statement does not exist in the constant management table 22, the constant relationship recording unit 13 adds the constant relationship between the variable name of the update variable and the constant name of the reference variable to the constant management table 22. .. When the variable name of the update variable in the instruction statement exists in the constant management table 22, the constant relationship recording unit 13 updates the constant name for the variable name of the update variable to the constant name of the reference variable in the instruction statement. Here, nothing is set in the constant management table 22 yet. Therefore, the constant relationship recording unit 13 adds the constant relationship between the variable name "error" of the update variable and the constant name "no problem" of the reference variable to the constant management table 22.

As an example, a case where the instruction statement “MOVE reference TO relay” having a line number of 33 is processed will be described. On the left side of FIG. 3, “1” indicating that the reference variable is a constant is shown as the output of the constant determination unit 12. Since the reference variable is "1", the processing is the same as that of the statement with line number 32. Here, the variable name "relay" of the update variable of the instruction statement does not exist in the constant management table 22. Therefore, the constant relationship recording unit 13 adds the constant relationship between the variable name “relay” of the update variable and the constant name “reference” of the reference variable to the constant management table 22. As a result, the constant relation recording unit 13 can associate the update variable in the instruction statement with the constant name meaning the constant value to be updated to this update variable.

As an example, a case where the instruction statement “IF (numerical value NOT = relay)” having a line number of 34 is processed will be described. On the left side of FIG. 3, “0” indicating that the instruction statement is not an update statement is shown as the output of the constant determination unit 12. Therefore, the constant relation recording unit 13 does not process anything.

As an example, a case where the statement "MOVE standard difference TO error" having a line number of 35 is processed will be described. On the left side of FIG. 3, “1” indicating that the reference variable is a constant is shown as the output of the constant determination unit 12. Since the reference variable is "1", the processing is the same as that of the statement with line number 32. Here, the variable name "error" of the update variable of the instruction statement exists in the constant management table 22. Therefore, the constant relation recording unit 13 updates the constant name "no problem" for the variable name "error" of the update variable to the constant name "reference difference" of the reference variable in the instruction statement. As a result, the constant relation recording unit 13 can associate the update variable in the instruction statement with the constant name meaning the constant value to be updated to this update variable.

As an example, a case where the instruction statement “MOVE NG TO relay B” having a line number of 36 is processed will be described. On the left side of FIG. 3, “1” indicating that the reference variable is a constant is shown as the output of the constant determination unit 12. Since the reference variable is "1", the processing is the same as that of the statement with line number 32. Here, the variable name “relay B” of the update variable of the instruction statement does not exist in the constant management table 22. Therefore, the constant relationship recording unit 13 adds the constant relationship between the variable name “relay B” of the update variable and the constant name “NG” of the reference variable to the constant management table 22.

As an example, a case where the instruction statement “MOVE relay BTO result” having the line number 37 is processed will be described. On the left side of FIG. 3, “3” indicating that the reference variable is a variable managed in the constant management table 22 is shown as the output of the constant determination unit 12. When the reference variable is "3", the following processing is performed. The constant relationship recording unit 13 acquires the constant name corresponding to the reference variable in the instruction statement from the constant management table 22, and adds the constant relationship between the acquired constant name and the variable name of the update variable in the instruction statement to the constant management table 22. do. Here, the constant relation recording unit 13 acquires the constant name “NG” corresponding to the reference variable “relay B” in the instruction statement from the constant management table 22. The constant relationship recording unit 13 adds the constant relationship between the acquired constant name “NG” and the variable name “result” of the update variable in the instruction statement to the constant management table 22. As a result, the constant relation recording unit 13 uses the constant name "relay B" in the instruction statement to mean the updated constant value even when the updated variable is used. "NG" can be tracked. Then, the constant relationship recording unit 13 can relate the constant name "NG" to the variable name "output" of the update variable in the instruction statement.

[Example of operation of constant relation control unit]
FIG. 4 is a diagram showing an example of the operation of the constant relationship control unit according to the embodiment. The flowchart shown in FIG. 4 shows the processing flow of the program D shown in FIG. 18A. The broken line indicates the order of processing of symbolic execution.

As shown in FIG. 4, when the instruction statement being processed is a path branch statement and a plurality of branches can be executed, the constant relationship control unit 14 displays the constant management table 22 in association with the instruction statement. save. When the instruction statement being processed is the end point of the path, the constant relation control unit 14 saves the constant management table 22 in association with the instruction statement. Then, when the constant relation control unit 14 backtracks the path to the path branch in which the constant management table 22 is saved, the constant management table 22 saved in this path branch statement is restored. Note that the fact that a plurality of branches can be executed means that both the Yes branch condition and the No branch condition can be satisfied. Satisfiability is determined using, for example, an SMT (SAT Modulo Theory) solver.

The constant relationship control unit 14 performs the above processing in the order of the symbolic execution processing.

The above processing when the instruction statement being processed is “IF (numerical value NOT = relay)?” (Line 34 of the program D shown in FIG. 18A) will be described. Since the instruction statement being processed is a path branch statement (IF statement) and a plurality of branches can be executed, the constant relationship control unit 14 saves the constant management table 22 in association with the instruction statement (IF statement). (<1>).

The above processing when the instruction statement being processed is “EXIT PROGRAM” (line 38 of the program D shown in FIG. 18A) will be described. Since the instruction statement being processed is the end point of the path, the constant relation control unit 14 saves the constant management table 22 in association with the instruction statement (EXIT statement) (<2>).

Then, when the constant relation control unit 14 backtracks the path to the path branch in which the constant management table 22 is saved (line 34 of the program D shown in FIG. 18A), the constant management unit 14 saves the constant in the path branch statement (IF statement). Restore Table 22 (<3>).

The above processing when the instruction statement being processed is “IF (location = Osaka OR Nagoya OR Fukuoka)?” (Line 40 of program D shown in FIG. 18A) will be described. Since the instruction statement being processed is a path branch statement (IF statement) and a plurality of branches can be executed, the constant relationship control unit 14 saves the constant management table 22 in association with the instruction statement (IF statement). (<4>).

The above processing when the instruction statement being processed is “EXIT PROGRAM” (line 51 of the program D shown in FIG. 18A) will be described. Since the instruction statement being processed is the end point of the path, the constant relation control unit 14 saves the constant management table 22 in association with the instruction statement (EXIT statement) (<5>).

Then, when the constant relation control unit 14 backtracks the path to the path branch in which the constant management table 22 is saved (line 38 of the program D shown in FIG. 18A), the constant management unit 14 saves the constant in the path branch statement (IF statement). Restore Table 22 (<6>).

[Example of operation of constant information addition part]
5A and 5B are diagrams showing an example of the operation of the constant information addition unit according to the embodiment. The flowchart shown in FIG. 5A shows the processing flow of the program D shown in FIG. 18A. The broken line indicates the order of processing of symbolic execution.

As shown in FIG. 5A, the constant information addition unit 15 performs the following processing when the processing of the symbolic execution is the recording processing of the path condition.

As an example, it is performed when the instruction statement being processed is "IF (numerical value NOT = relay)?" (Line 34 of program D shown in FIG. 18A). The constant information addition unit 15 acquires the path condition and the conditional expression of the conditional branch statement corresponding to the path condition. Here, "(numerical value NOT = 1)" is acquired as the path condition. "(Numeric value NOT = relay)" is acquired as the conditional expression of the conditional branch statement corresponding to the path condition.

Then, when the variable name of the variable of the path condition is in the variable name of the update variable of the constant management table 22 associated with the conditional branch statement corresponding to this path condition, the constant information addition unit 15 updates this. Add the constant name (constant information) corresponding to the variable name of the variable to the constant value of the path condition. Here, in the constant management table 22, when the variable name of the update variable is "error", "no problem" is set as the constant name of the reference variable. When the variable name of the update variable is "relay", "reference" is set as the constant name of the reference variable. Then, in the constant information addition unit 15, since the variable name "relay" of the variable of the path condition is in the variable name of the update variable in the constant management table 22, the constant name "reference" corresponding to the variable name "relay" of the update variable To get. Then, the constant information addition unit 15 adds the constant name "reference" corresponding to the variable name "relay" of the update variable to the constant value "1" of the path condition. That is, the new path condition is "(numerical value NOT = reference # 13c_1)". The number after "#" indicates the number of lines in which the definition of the constant name "reference" is described on the program 21. That is, the constant name "reference" is described on the 13th line.

Further, the constant information addition unit 15 performs the following processing when the processing of the symbolic execution is the recording processing of the path output.

As an example, it is performed when the instruction statement being processed is "EXIT PROGRAM" (line 36 of program D shown in FIG. 18A). The constant information addition unit 15 acquires the path output. Here, "result = 1; error = 3" is acquired as the path output.

Then, when the variable name of the variable on the left side of the path output is in the variable name of the update variable in the constant management table 22 associated with the statement of the path output, the constant information addition unit 15 is the variable of the update variable. Add the constant name (definition information) corresponding to the name to the constant value of the path output. Here, in the constant management table 22, when the variable name of the update variable is "error", "difference in reference" is set as the constant name of the reference variable. When the variable name of the update variable is "relay", "reference" is set as the constant name of the reference variable. When the variable name of the update variable is "relay B", "NG" is set as the constant name of the reference variable. When the variable name of the update variable is "result", "NG" is set as the constant name of the reference variable. Then, since the variable "result" on the left side of the path output is in the variable name of the update variable in the constant management table 22, the constant information addition unit 15 sets the constant name "NG" corresponding to the variable name "result" of the update variable. get. Then, the constant information addition unit 15 adds the constant name "NG" corresponding to the variable name "result" of the update variable to the constant value "1" of the path output. Similarly, in the constant information addition unit 15, since the variable "error" on the left side of the path output is in the variable name of the update variable in the constant management table 22, the constant name "criteria difference" corresponding to the variable name "error" of the update variable To get. Then, the constant information addition unit 15 adds the constant name "reference difference" corresponding to the variable name "error" of the update variable to the constant value "3" of the path output. That is, the new path output is "(result = NGc_1; error = reference difference # 26c_3)". The number after "#" indicates the number of lines in which the definition of the constant name "difference in reference" is described on the program 21. That is, the constant name "difference in reference" is described on the 26th line.

Then, the constant information addition unit 15 outputs the newly replaced path condition and path output.

That is, as shown in FIG. 5B, the constant information addition unit 15 uses the constant name (constant information) using the symbolic execution result 23'including the path condition and the path output for each path and the constant management table 22 for each path. ) Is added to the constant value to generate the symbolic execution result 23. Then, the constant information addition unit 15 outputs the path condition and the path output in which the reference numeral 23'is replaced with the reference numeral 23. As a result, the constant information addition unit 15 can improve the readability of the symbolic execution result 23.

[Example of operation of constant information interpretation unit]
FIG. 6 is a diagram showing an example of the operation of the constant information interpretation unit according to the embodiment. Note that FIG. 6 describes the operation of the constant information interpretation unit 17 with respect to the path condition of No. 3 of the symbolic execution result 23 shown in FIG. 5B.

As shown in FIG. 6, the constant information interpretation unit 17 acquires the path condition to which the constant information is added, which is No. 3 from the symbolic execution result 23, as an input. Here, the path condition of No. 3 with constant information added is "((numerical value # 7 =" reference # 13c_1') AND (location # 6NOT ='Osaka # 16c_2') AND (location # 6NOT ='Nagoya # 17c_3). ') AND (place # 6 NOT ='Fukuoka # 18c_4') AND (place # 6 ='Tokyo # 15c_1')) ".

Then, the constant information interpretation unit 17 determines whether or not the variable of the comparison condition is the one to which the constant information is added for each comparison condition of the path condition. Then, when the variable of the comparison condition is the one to which the constant information is added, the constant information interpretation unit 17 returns to the original comparison condition and records the correspondence. Here, when the comparison condition is "numerical value # 7 ='reference # 13c_1'", the variable "1" of the comparison condition is the one to which the constant information "reference" is added, so that the constant information interpretation unit 17 , This comparison condition is returned to the original comparison condition "numerical value # 7 = 1". Then, the constant information interpretation unit 17 records "numerical value # 7 ='reference # 13c_1'" before replacement and "numerical value # 7 = 1" after replacement in a corresponding relationship. Before replacement is a comparison condition with a variable to which constant information is added. After the replacement is the original comparison condition excluding the constant information.

Similarly, when the comparison condition is "location # 6NOT ='Osaka # 16c_2'", the variable "2" of the comparison condition is the one to which the constant information "Osaka" is added, so that the constant information interpretation unit 17 , This comparison condition is returned to the original comparison condition "location # 6 NOT = 2". Then, the constant information interpretation unit 17 records before and after the replacement in a correspondence relationship.

Similarly, the constant information interpretation unit 17 repeats the process until there is no comparison condition in the path condition to which the constant information is added. As a result, the constant information interpretation unit 17 acquires the original path condition by using the comparison condition after the replacement of the correspondence. Here, the original path condition of No3 is "((numerical value # 7 = 1) AND (location # 6NOT = 2) AND (location # 6NOT = 3) AND (location # 6NOT = 4) AND (location # 6 =). 1)) ”.

Then, the condition simplification unit 18 simplifies the acquired path condition. Here, the original path condition of No. 3 is simplified as "((numerical value # 7 = 1) AND (location # 6 = 1))". That is, when the numerical value # 7 is 1, the path condition that the place # 6 is not 3 and not 4 but 1 is "the numerical value # 7 is 1 and the place # 6 is 1". Is simplified.

Then, the constant information interpretation unit 17 returns the variable of the comparison condition to the one to which the constant information is added for each comparison condition in the path condition reduced by the condition simplification unit 18 by using the correspondence relationship. Here, the constant information interpretation unit 17 uses the correspondence relationship to change the comparison condition "(numerical value # 7 = 1)" in the simplified path condition to "(numerical value # 7 ='reference # 13c_1')". Return to. The constant information interpretation unit 17 returns the comparison condition "(location # 6 = 1)" in the simplified path condition to "(location # 6 ='Tokyo # 15c_1')" by using the correspondence.

Then, the constant information interpretation unit 17 outputs a new path condition to which the constant information is added. Here, the new path condition of No. 3 to which the constant information is added is "((numerical value # 7 ='reference # 13c_1') AND (location # 6 ='Tokyo # 15c_1'))".

In this way, the constant information interpretation unit 17 may simplify the path conditions of the symbolic execution result 23 shown in FIG. 5B.

FIG. 7 is a logic table 24 in which the symbolic execution result 23, which is a simplified path condition, is arranged. FIG. 7 is a diagram showing an example of a logic table according to an embodiment. As shown in FIG. 7, the logic table 24 is replaced with a constant value to which a constant name (constant information) is appropriately added. Therefore, the logic table 24 can be improved in readability as compared with the logic table (see FIG. 18B) shown in the reference example.

[Flowchart of analysis process]
Next, an example of the flowchart of the analysis process according to the embodiment will be described with reference to FIGS. 8 to 13.

FIG. 8 is a diagram showing an example of a flowchart of the analysis process according to the embodiment. As shown in FIG. 8, in the analysis process, it is assumed that the program 21 to be analyzed by symbolic execution is read.

As shown in FIG. 8, the analysis process extracts a statement to be analyzed by symbolic execution from the program 21 (step S11).

In the analysis process, the constant determination process processed by the constant determination unit 12 is executed for the extracted instruction statement (step S12). The flowchart of the constant determination process will be described later. The analysis process executes the constant relationship recording process processed by the constant relationship recording unit 13 (step S13). The flowchart of the constant relation recording process will be described later. In the analysis process, the constant relationship control process processed by the constant relationship control unit 14 is executed (step S14). The flowchart of the constant relation control process will be described later. The analysis process executes the constant information addition process processed by the constant information addition unit 15 (step S15). The flowchart of the constant information addition process will be described later. The analysis process executes the constant information interpretation process processed by the constant information interpretation unit 17 (step S16). The flowchart of the constant information interpretation process will be described later.

The analysis process determines whether or not the instruction statement is final (step S17). If it is determined that the instruction statement is not final (step S17; No), the analysis process proceeds to step S11 in order to extract the next instruction statement. On the other hand, when it is determined that the instruction statement is final (step S17; Yes), the analysis process ends the process.

[Flowchart of constant determination processing]
FIG. 9 is a diagram showing an example of a flowchart of the constant determination process according to the embodiment. In FIG. 9, the update sentence is described as a posting command.

As shown in FIG. 9, the constant determination unit 12 receives the instruction statement being analyzed by symbolic execution (step S21). The constant determination unit 12 determines whether or not the instruction statement is a variable transcription instruction (step S22). When it is determined that the instruction statement is a variable transcription instruction (step S22; Yes), the constant determination unit 12 acquires the reference variable of the instruction statement (step S23). As an example, if the statement is "MOVE no problem TO error", then the statement is a transcription instruction. "No problem" is acquired as a reference variable of the statement.

Then, the constant determination unit 12 determines whether or not the reference variable is a constant (step S24). When it is determined that the reference variable is a constant (step S24; Yes), the constant determination unit 12 outputs "1" indicating that the reference variable is a constant (step S25). For example, when the name of the reference variable is included in the definition of the constant in the program 21, the constant determination unit 12 determines that the reference variable is a constant and outputs "1". Then, the constant determination unit 12 ends the constant determination process.

On the other hand, when it is determined that the reference variable is not a constant (step S24; No), the constant determination unit 12 determines whether or not the reference variable has an initial value (step S26). The case where the reference variable has an initial value means, for example, the case where the reference variable is included in the definition of the work variable on the program 21 and the definition of the work variable has the initial value. When it is determined that the reference variable has an initial value (step S26; Yes), the constant determination unit 12 outputs "2" indicating that the reference variable has an initial value (step S27). Then, the constant determination unit 12 ends the constant determination process.

On the other hand, when it is determined that the reference variable has no initial value (step S26; No), the constant determination unit 12 determines whether or not the reference variable is a variable managed in the constant management table 22 (step). S28). When it is determined that the reference variable is a variable managed in the constant management table 22 (step S28; Yes), the constant determination unit 12 indicates that the reference variable is a variable managed in the constant management table. 3 ”is output (step S29). Then, the constant determination unit 12 ends the constant determination process.

On the other hand, when it is determined that the reference variable is not a variable managed in the constant management table 22 (step S28; No), the constant determination unit 12 shifts to step S30. If it is determined that the instruction statement is not a variable transcription instruction (step S22; No), the constant determination unit 12 proceeds to step S30. In step S30, the constant determination unit 12 outputs "0" (step S30). Then, the constant determination unit 12 ends the constant determination process.

[Flowchart of constant relation recording process]
FIG. 10 is a diagram showing an example of a flowchart of the constant relation recording process according to the embodiment.

As shown in FIG. 10, the constant relationship recording unit 13 receives the instruction statement of the posting command and the output of the constant determination process from the constant determination unit 12 (step S41). The constant relationship recording unit 13 determines whether or not the output is “0” (step S42). When it is determined that the output is "0" (step S42; Yes), the constant relation recording unit 13 ends the constant relation recording process.

When it is determined that the output is not "0" (step S42; No), the constant relationship recording unit 13 determines whether or not the output is "1" or "2" (step S43). When it is determined that the output is "1" or "2" (step S43; Yes), the constant relation recording unit 13 sets the update variable to Key, and if Key already exists in the constant management table 22, the update variable is set. Update the constant value for. The constant relationship recording unit 13 adds a constant relationship to the constant management table 22 in which the update variable is set to Key and the update variable is set to Key and the constant name is the constant name of the reference variable if the key does not already exist in the constant management table 22. (Step S44). As an example, in the case of the instruction statement of the transfer instruction of line number 32 shown in FIG. 3, the constant relationship recording unit 13 sets the update variable as "error" and the constant name as "no problem". Add to management table 22. As an example, in the case of the instruction statement of the transfer instruction of line number 35 shown in FIG. 3, the constant relation recording unit 13 has an update variable “error” existing in the constant management table 22, so that the update variable “error” Update the constant value for to "difference in standard". Then, the constant relation recording unit 13 ends the constant relation recording process.

On the other hand, when it is determined that the output is not "1" and "2" (step S43; No), the constant relation recording unit 13 determines whether or not the output is "3" (step S45). When it is determined that the output is "3" (step S45; Yes), the constant relation recording unit 13 sets the reference variable to Key and acquires the constant value for Key from the constant management table 22. The constant relation recording unit 13 adds the update variable and the acquired constant value to the constant management table 22 (step S46). As an example, in the case of the instruction statement of the transfer instruction of line number 37 shown in FIG. 3, the constant relation recording unit 13 sets the reference variable as “relay 2” and sets the constant value for “relay 2” from the constant management table 22. Get "NG". The constant relationship hypochondrium 13 adds a constant relationship having an update variable of "output" and a constant name of "NG" to the constant management table 22. Then, the constant relation recording unit 13 ends the constant relation recording process.

On the other hand, when it is determined that the output is not "3" (step S45; No), the constant-related recording unit 13 ends the constant-related recording process.

[Flowchart of constant relationship control processing]
FIG. 11 is a diagram showing an example of a flowchart of the constant relationship control process according to the embodiment.

As shown in FIG. 11, the constant relationship control unit 14 receives the instruction being analyzed by symbolic execution (step S51). The constant relationship control unit 14 determines whether or not there is an instruction statement (step S52). If it is determined that there is no instruction statement (step S52; No), the constant relation control unit 14 ends the constant relation control process.

On the other hand, when it is determined that there is an instruction statement (step S52; Yes), the constant relation control unit 14 determines whether or not the instruction statement is a conditional branch statement and a plurality of branches can be executed ( Step S53). Note that the fact that a plurality of branches can be executed means that both the Yes branch condition and the No branch condition can be satisfied. Satisfaction is determined using, for example, an SMT solver.

When it is determined that the instruction statement is a conditional branch statement and a plurality of branches can be executed (step S53; Yes), the constant relationship control unit 14 associates the constant management table 22 with the received instruction statement. Save (step S54). As an example, it corresponds to <1> and <4> shown in FIG. Then, the constant relation control unit 14 shifts to step S51 in order to receive the next instruction statement.

On the other hand, when it is determined that the instruction statement is a conditional branch statement and a plurality of branches cannot be executed (step S53; No), the constant relationship control unit 14 determines whether or not the instruction statement is the last of the paths. Determine (step S55). When it is determined that the instruction statement is the last of the path (step S55; Yes), the constant relation control unit 14 backtracks the path to the branch instruction statement in which the constant management table 22 is saved. The constant relation control unit 14 replaces the constant management table 22 with the stored one (step S56). As an example, it corresponds to <2> and <3> and <5> and <6> shown in FIG. Then, the constant relation control unit 14 shifts to step S51 in order to receive the next instruction statement.

On the other hand, when it is determined that the instruction statement is not the end of the path (step S55; No), the constant relationship control unit 14 proceeds to step S51 in order to receive the next instruction statement.

[Flowchart of constant information addition processing]
FIG. 12 is a diagram showing an example of a flowchart of the constant information addition process according to the embodiment.

As shown in FIG. 12, the constant information addition unit 15 acquires constant definition information from the program 21 (step S61). The constant information addition unit 15 acquires the symbolic execution process (step S62). The constant information addition unit 15 determines whether or not the process is a path condition recording process (step S63).

When it is determined that the process is the path condition recording process (step S63; Yes), the constant information addition unit 15 acquires the condition of the conditional branch statement and the path condition (step S64). For example, the condition of the conditional branch statement may be obtained from the statement statement. As the path condition, the processing result of the symbolic execution (the path condition of the symbolic execution result 23'shown in FIG. 5B) may be acquired.

Then, the constant information addition unit 15 determines whether or not the variable of the path condition is in the Key of the constant management table 22 (step S65). For example, the constant information addition unit 15 determines whether or not the variable name of the variable of the path condition is in the variable name (Key) of the update variable of the constant management table 22 associated with the conditional branch statement corresponding to this path condition. To judge.

When it is determined that the variable of the path condition is in the Key of the constant management table 22 (step S65; Yes), the constant information addition unit 15 describes the constant information and the constant information in the constant value of the path condition corresponding to the variable. The number of rows is added (step S66), and the number of rows may be obtained from the definition information of the constant. For example, when the variable name of the variable of the path condition is in the variable name of the update variable of the constant management table 22 associated with the conditional branch statement corresponding to this path condition, the constant information addition unit 15 updates this. Add the constant name (constant information) corresponding to the variable name of the variable to the constant value of the path condition. As an example, it corresponds to <1> shown in FIG. 5A. Then, the constant information addition unit 15 proceeds to step S62 in order to acquire the next symbolic execution process.

On the other hand, when it is determined that the variable of the path condition is not in the Key of the constant management table 22 (step S65; No), the constant information addition unit 15 shifts to step S62 in order to acquire the next symbolic execution process. do.

If it is determined in step S63 that the process is not the path condition recording process (step S63; No), the constant information addition unit 15 determines whether or not the process is the path output recording process (step S67). ).

When it is determined that the process is the path output recording process (step S67; Yes), the constant information addition unit 15 acquires the path output (step S68). For example, as the path output, the processing result of the symbolic execution (the path output of the symbolic execution result 23'shown in FIG. 5B) may be acquired.

Then, the constant information addition unit 15 determines whether or not the variable on the left side of the path output is in the Key of the constant management table 22 (step S69). For example, the constant information addition unit 15 determines whether or not the variable name of the variable on the left side of the path output is in the variable name of the update variable in the constant management table 22 associated with the instruction statement of the path output.

When it is determined that the variable on the left side of the path output is in the Key of the constant management table 22 (step S69; Yes), the constant information addition unit 15 sets the constant value on the right side of the path output corresponding to the variable on the left side to a constant. The number of lines in which the information and the constant information are described is added (step S70). The number of lines may be obtained from the definition information of the constant. As an example, it corresponds to <2> shown in FIG. 5A. Then, the constant information addition unit 15 proceeds to step S62 in order to acquire the next symbolic execution process.

On the other hand, when it is determined that the variable on the left side of the path output is not in the Key of the constant management table 22 (step S69; No), the constant information addition unit 15 obtains the next symbolic execution process in step S62. Move to.

If it is determined in step S67 that the process is not the path output recording process (step S67; No), the constant information addition unit 15 determines whether or not the process is the end process (step S71). When it is determined that the process is not the end process (step S71; No), the constant information addition unit 15 proceeds to step S62 in order to acquire the next symbolic execution process.

On the other hand, when it is determined that the process is the end process (step S71; Yes), the constant information addition unit 15 ends the constant information addition process.

[Flowchart of constant information interpretation processing]
FIG. 13 is a diagram showing an example of a flowchart of the constant information interpretation process according to the embodiment.

As shown in FIG. 13, the constant information interpretation unit 17 receives the path condition to which the constant information is added (step S81). The constant information interpretation unit 17 acquires the comparison condition i (i is an integer of 1 to N) in the path condition (step S82). Note that N indicates the maximum number of comparison conditions in the path condition. The constant information interpretation unit 17 sets i to 1 (step S83).

The constant information interpretation unit 17 determines whether or not i is N or less (step S84). When it is determined that i is N or less (step S84; Yes), the constant information interpreting unit 17 determines whether or not the variable of the comparison condition i is a variable to which constant information is added (step S85). .. When it is determined that the variable of the comparison condition i is not the variable to which the constant information is added (step S85; No), the constant information interpretation unit 17 proceeds to step S87.

On the other hand, when it is determined that the variable of the comparison condition i is a variable to which the constant information is added (step S85; Yes), the constant information interpretation unit 17 returns to the original comparison condition and changes the variable to which the constant information is added. The correspondence between the comparison condition and the original comparison condition is recorded (step S86). Then, the constant information interpretation unit 17 proceeds to step S87.

In step S87, the constant information interpretation unit 17 increments i (step S87) and shifts to step S84 in order to transition to the processing of the next comparison condition. In step S84, when it is determined that i is larger than N (step S84; No), the constant information interpreting unit 17 restores the original path condition (step S88).

Then, the condition simplification unit 18 simplifies the original path condition (step S89).

Then, the constant information interpretation unit 17 acquires the comparison condition j (j is an integer of 1 to M) in the simplified path condition (step S90). In addition, M represents the maximum number of comparison conditions in a path condition. The constant information interpretation unit 17 sets j to 1 (step S91).

The constant information interpretation unit 17 determines whether or not j is M or less (step S92). When it is determined that j is M or less (step S92; Yes), the constant information interpreting unit 17 determines whether or not the comparison condition j has a correspondence relationship (step S93). When it is determined that the comparison condition j does not have a correspondence relationship (step S93; No), the constant information interpretation unit 17 proceeds to step S95.

On the other hand, when it is determined that the comparison condition j has a correspondence relationship (step S93; Yes), the constant information interpretation unit 17 returns to the comparison condition to which the constant information is added according to the correspondence relationship (step S94). Then, the constant information interpretation unit 17 shifts to step S95.

In step S95, the constant information interpretation unit 17 increments j (step S95) and shifts to step S92 in order to transition to the processing of the next comparison condition. In step S92, when it is determined that j is larger than M (step S92; No), the constant information interpretation unit 17 ends the constant information interpretation process.

[Effect of Examples]
According to the above embodiment, the information processing apparatus 1 analyzes the program 21 by using symbolic execution. The information processing device 1 sequentially extracts instruction statements from the program 21. When the extracted statement is an update statement that updates a variable, the information processing device 1 constantly manages the relationship between the variable name of the variable and the constant name indicating the meaning of the value for updating the variable included in the update statement. Record in Table 22. The information processing apparatus 1 associates the branch statement with the constant management table 22 when the instruction statement is a branch statement that branches the path. Based on the associated branch statement and the constant management table 22, the information processing device 1 converts the constant value included in the symbolic execution result 23'for the branch statement into information including the constant name stored in the constant management table 22. Replace. According to such a configuration, the information processing apparatus 1 uses the relationship between the variable name and the constant name stored at the time of executing the update statement even if the program has the same value and the constant name having different meanings. By replacing the constant value included in the symbolic execution result 23'with the information including the constant name, the readability of the symbolic execution result 23 can be improved. In addition, the information processing device 1 can improve the readability of the logic table in which the symbolic execution result 23 is arranged. As a result, the information processing apparatus 1 can improve the readability for understanding the program and extracting the usage.

Further, according to the above embodiment, the information processing apparatus 1 records the relationship between the variable name and the constant name included in the extracted first update statement in the constant management table 22. When the variable name included in the extracted second update statement is the same as the variable name included in the first update statement, the information processing device 1 sets the constant name of the relationship associated with the variable name. Update and record the constant name included in the second update statement. According to such a configuration, the information processing apparatus 1 can keep the relationship between the variable name and the constant name included in the instruction statement in the latest state when the instruction statement is executed by updating the relationship between the variable name and the constant name at any time. As a result, the information processing apparatus 1 can improve the readability of the symbolic execution result by substituting the constant value included in the symbolic execution result with the information including the constant name by using this relationship.

Further, according to the above embodiment, the information processing apparatus 1 records the relationship between the variable name and the constant name included in the extracted first update statement in the constant management table 22. When the constant name included in the extracted second update statement is stored as a variable name in the constant management table 22, the information processing device 1 is associated with the variable name stored in the constant management table 22. Add and record the constant name and the variable name included in the second update statement. According to such a configuration, the information processing apparatus 1 can track the constant name indicating the updated constant value in the update variable even when the updated variable is already used as the reference variable in the instruction statement. , This constant name can be associated with the variable name of the update variable in the statement.

Further, according to the above embodiment, the information processing apparatus 1 associates the branch statement with the constant management table 22 when executing the branch statement in the branch statement at the time of backtracking. According to such a configuration, the information processing apparatus 1 can accurately record the relationship regarding the path of the next condition derived from this branch statement by associating the branch statement with the relationship when executing the branch statement at the time of backtracking. ..

[others]
In the above embodiment, the program 21 to be executed symbolically has been described as a COBOL language. However, the program 21 to be executed symbolically is not limited to the COBOL language, and may be C language or Java (registered trademark) Script, and any program that expresses a constant value by a constant name or a variable name. It may be a language.

Further, each component of the information processing apparatus 1 shown does not necessarily have to be physically configured as shown in the figure. That is, the specific mode of distribution / integration of the information processing device 1 is not limited to the one shown in the figure, and all or part of the information processing device 1 may be functionally or physically in an arbitrary unit according to various loads and usage conditions. It can be distributed and integrated. For example, the constant information interpretation unit 17 and the condition simplification unit 18 may be integrated as one unit. Further, the constant information addition unit 15 may be distributed into an additional unit that adds constant information to the path condition and an additional unit that adds constant information to the path output. Further, the storage unit 20 may be connected as an external device of the information processing device 1 via a network.

In addition, the various processes described in the above embodiment can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. Therefore, in the following, an example of a computer that executes an analysis program that realizes the same functions as the information processing apparatus 1 shown in FIG. 1 will be described. FIG. 14 is a diagram showing an example of a computer that executes an analysis program.

As shown in FIG. 14, the computer 200 includes a CPU 203 that executes various arithmetic processes, an input device 215 that receives data input from a user, and a display control unit 207 that controls the display device 209. Further, the computer 200 has a drive device 213 for reading a program or the like from a storage medium, and a communication control unit 217 for exchanging data with another computer via a network. Further, the computer 200 has a memory 201 for temporarily storing various information and an HDD 205. The memory 201, CPU 203, HDD 205, display control unit 207, drive device 213, input device 215, and communication control unit 217 are connected by a bus 219.

The drive device 213 is, for example, a device for the removable disk 211. The HDD 205 stores the analysis program 205a and the analysis-related information 205b.

The CPU 203 reads the analysis program 205a, expands it in the memory 201, and executes it as a process. Such a process corresponds to each functional unit of the information processing apparatus 1. The analysis-related information 205b corresponds to the program 21, the constant management table 22, the symbolic execution result 23, and the logic table 24. Then, for example, the removable disk 211 stores each information such as the analysis program 205a.

The analysis program 205a does not necessarily have to be stored in the HDD 205 from the beginning. For example, the program is stored in a "portable physical medium" such as a flexible disk (FD), a CD-ROM, a DVD disk, a magneto-optical disk, or an IC card inserted into the computer 200. Then, the computer 200 may read the analysis program 205a from these and execute the analysis program 205a.

1 Information processing device 10 Control unit 11 Symbolic execution unit 12 Constant judgment unit 13 Constant relation recording unit 14 Constant relation control unit 15 Constant information addition unit 16 Pass condition Path output recording unit 17 Constant information interpretation unit 18 Condition reduction unit 20 Storage unit 21 Program 22 Constant management table 23 Symbolic execution result 24 Logic table

Claims (6)

An information processing device that analyzes a program using symbolic execution.
An extraction unit that sequentially extracts instruction statements from the program,
When the statement extracted by the extraction unit is an update statement that updates a variable, the relationship between the variable name of the variable and the constant name indicating the meaning of the value for updating the variable included in the update statement is stored. The recording section that records in the section and the recording section
When the statement is a branch statement that branches the path, the related part that associates the branch statement with the relationship and
A replacement unit that replaces a constant value included in the symbolic execution result for the branch statement with information including the constant name stored in the relationship based on the branch statement and the relationship associated with the related unit. ,
An information processing device characterized by having. The recording unit
The relationship between the variable name and the constant name included in the first update statement extracted by the extraction unit is recorded in the storage unit.
When the variable name included in the second update statement extracted by the extraction unit is the same as the variable name included in the first update statement, the constant name of the relationship associated with the variable name is used. The information processing apparatus according to claim 1, wherein the constant name included in the second update statement is updated and recorded. The recording unit
The relationship between the variable name and the constant name included in the first update statement extracted by the extraction unit is recorded in the storage unit.
When the constant name included in the second update statement extracted by the extraction unit is stored as a variable name in the relationship, the constant name associated with the variable name stored in the relationship and the second The information processing apparatus according to claim 1, wherein the variable names included in the update statement of the above are added and recorded. The related part is
The information processing apparatus according to claim 1, wherein the branch statement at the time of backtracking associates the branch statement with the relationship when the branch statement is executed. Sequentially extract statements from the program to be executed symbolically
When the extracted statement is an update statement that updates a variable, the relationship between the variable name of the variable and the constant name indicating the meaning of the value for updating the variable included in the update statement is recorded in the storage unit.
When the statement is a branch statement that branches the path, the branch statement and the relationship are associated with each other.
Based on the associated branch statement and the relationship, the information processing apparatus executes a process of replacing the constant value included in the symbolic execution result for the branch statement with the information including the constant name stored in the relationship. An analysis program to let you. An information processing device that analyzes a program using symbolic execution
Sequentially extract statements from the program
When the extracted statement is an update statement that updates a variable, the relationship between the variable name of the variable and the constant name indicating the meaning of the value for updating the variable included in the update statement is recorded in the storage unit.
When the statement is a branch statement that branches the path, the branch statement and the relationship are associated with each other.
Based on the associated branch statement and the relationship, the process of replacing the constant value included in the symbolic execution result for the branch statement with the information including the constant name stored in the relationship is executed. Analysis method.

Images