search

gernst / legion-symcc

Fresh implementation of the Legion algorithm on top of SyMCC
Other
0 stars 1 forks source link

Improve sampling scheme #6

Open gernst opened 2 years ago

gernst commented 2 years ago

The current implementation computes one sample using Z3 for each binary execution. We should probably run many executions per such sample, where the input prefix just stays the same, whereas the rest of the inputs varies randomly.

Technically, we should refactor the main loop using some extra functions, such that the control flow works out fine.

gernst commented 2 years ago

Observation about scoring: If we find small win/try using random sampling that is actually an indication that we should symbolically check if there is a rare branch, and that is the opposite of the current score.

gernst commented 2 years ago

Perhaps look at #phantom nodes in a subtree to guide the search?