Dynamic symbolic execution of Java programs using JNI

Abstract

For the sake of better performance, platform-specific facilities support, or the use of legacy code, Java applications may use JNI (Java Native Interface) to call native functions. We present an approach to perform dynamic symbolic execution of a Java program that tracks tainted data flow through Java bytecode and native code of shared libraries. We propose a tool based on modified virtual machine and static binary code instrumentation. This allows us to collect path constraints for both bytecode and binary code execution but avoid redundant processing of virtual machine own code. Modified path constraints are checked for their satisfiability in order to generate new inputs and execute new paths (to cover new basic blocks of target program). We describe initial experiments with our implementation based on Avian virtual machine and Dyninst.