3 ms·

Fuzzing is black-box dynamic testing. Static testing explicitly means you are not executing the program, whereas fuzzing requires generating stimulus, feeding

• thesz 10y ago
  http://pat.keldysh.ru/~roman/doc/2009-Klyuchnikov_Romanenko--Proving_the_Equivalence_of_Higher-Order_Terms_by_Means_of_Supercompilation.pdf http://pat.keldysh.ru/~roman/doc/2009-Klyuchnikov_Romanenko-... You can prove that sqlite_exec("create table a ...insert into a ...select * from a where ...") is equal to, say list ["gaga", "gugu"], given supercompiler that is powerful enough. The paper above proves properties up to termination of programs, so it will prove (Haskell) sum [1..] == sum (map (+1) [0..]) as equal (up to computation of the lists). Would you consider this an example of static analysis? If answer is "yes", bear in mind that supercompilation includes evaluation of the programs - basically, supercompiler executes them, looking for states it already seen. I also would like to hear reasons why if answer is "no".
  • pdq 10y ago
    Yes, that is static analysis. But that is vastly different from standard fuzzing. It's pretty simple: if you execute the program code, whether directly on a processor or in an virtual processor/emulator, it's dynamic analysis. Otherwise it's a variant of static analysis. https://en.wikipedia.org/wiki/Dynamic_program_analysis https://en.wikipedia.org/wiki/Dynamic_program_analysis
    • thesz 10y ago
      Supercompilation evaluates code on a virtual machine, building a trace and looking for a "stop" criteria.