Reflections on the Experimental Evaluation of a Binary-Level Symbolic Analyzer for Spectre

Abstract

execution. A well-known analysis technique that scales well on binary code is symbolic execution (SE) [4], [5]. In order to analyze speculative constant-time, it must be adapted to additionally consider transient execution introduced by the speculative semantics. However, modeling these new behaviors explicitly does not scale because it quickly leads to state explosion. Therefore, the challenge is to optimize this exploration in order to make the analysis applicable to real code.