Sound External-Call Handling for Snapshot Reuse

Develop sound symbolic modeling and handling of external function calls, and characterize its interaction with continuation-based snapshot reuse in compiled concolic execution for WebAssembly.

Background

The snapshot mechanism records symbolic stacks, environments, path conditions, and continuations so that concolic execution can resume from a branch point without re-executing the preceding path. However, external calls such as system or library calls may depend on mutable arguments or environmental state that is not preserved in a snapshot. Treating concrete return values as symbolic values can therefore make resumed snapshots correspond to infeasible executions and undermine soundness.

The paper proposes conservatively disabling snapshot resumption whenever an execution prefix contains an external call. It identifies a more general unresolved direction: symbolically modeling external-function semantics while preserving sound snapshot reuse. Solving this problem would allow the compiled concolic-execution framework to handle programs interacting with external environments without sacrificing correctness or the performance benefits of resumption.