{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,25]],"date-time":"2026-04-25T08:43:42Z","timestamp":1777106622720,"version":"3.51.4"},"reference-count":50,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2012,2,1]],"date-time":"2012-02-01T00:00:00Z","timestamp":1328054400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Comput. Syst."],"published-print":{"date-parts":[[2012,2]]},"abstract":"<jats:p>\n            This article presents S\n            <jats:sup>2<\/jats:sup>\n            E, a platform for analyzing the properties and behavior of software systems, along with its use in developing tools for comprehensive performance profiling, reverse engineering of proprietary software, and automated testing of kernel-mode and user-mode binaries. Conceptually, S\n            <jats:sup>2<\/jats:sup>\n            E is an automated path explorer with modular path analyzers: the explorer uses a symbolic execution engine to drive the target system down all execution paths of interest, while analyzers measure and\/or check properties of each such path. S\n            <jats:sup>2<\/jats:sup>\n            E users can either combine existing analyzers to build custom analysis tools, or they can directly use S\n            <jats:sup>2<\/jats:sup>\n            E\u2019s APIs.\n          <\/jats:p>\n          <jats:p>\n            S\n            <jats:sup>2<\/jats:sup>\n            E\u2019s strength is the ability to scale to large systems, such as a full Windows stack, using two new ideas:\n            <jats:italic>selective symbolic execution<\/jats:italic>\n            , a way to automatically minimize the amount of code that has to be executed symbolically given a target analysis, and\n            <jats:italic>execution consistency models<\/jats:italic>\n            , a way to make principled performance\/accuracy trade-offs during analysis. These techniques give S\n            <jats:sup>2<\/jats:sup>\n            E three key abilities: to simultaneously analyze entire families of execution paths instead of just one execution at a time; to perform the analyses in-vivo within a real software stack---user programs, libraries, kernel, drivers, etc.---instead of using abstract models of these layers; and to operate directly on binaries, thus being able to analyze even proprietary software.\n          <\/jats:p>","DOI":"10.1145\/2110356.2110358","type":"journal-article","created":{"date-parts":[[2012,3,6]],"date-time":"2012-03-06T13:18:22Z","timestamp":1331039902000},"page":"1-49","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":154,"title":["The S2E Platform"],"prefix":"10.1145","volume":"30","author":[{"given":"Vitaly","family":"Chipounov","sequence":"first","affiliation":[{"name":"\u00c9cole Polytechnique F\u00e9d\u00e9rale de Lausanne (EPFL), Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Volodymyr","family":"Kuznetsov","sequence":"additional","affiliation":[{"name":"\u00c9cole Polytechnique F\u00e9d\u00e9rale de Lausanne (EPFL), Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"George","family":"Candea","sequence":"additional","affiliation":[{"name":"\u00c9cole Polytechnique F\u00e9d\u00e9rale de Lausanne (EPFL), Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2012,2]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/268998.266637"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1217935.1217943"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-14295-6_11"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.5555\/1247360.1247401"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/1646353.1646374"},{"key":"e_1_2_1_6_1","unstructured":"Bochs. 2011. Bochs IA-32 emulator. http:\/\/bochs.sourceforge.net\/. Bochs . 2011. Bochs IA-32 emulator. http:\/\/bochs.sourceforge.net\/."},{"key":"e_1_2_1_7_1","volume-title":"Proceedings of the International Conference on Tools and Algorithms for the Construction and Analysis of Systems.","author":"Boonstoppel P."},{"key":"e_1_2_1_8_1","unstructured":"Brumley D. Hartwig C. Kang M. G. Newsome Z. L. J. Poosankam P. Song D. and Yin H. 2007. BitScope: Automatically dissecting malicious binaries. Tech. rep. CMU-CS-07-133 Carnegie Mellon University. Brumley D. Hartwig C. Kang M. G. Newsome Z. L. J. Poosankam P. Song D. and Yin H. 2007. BitScope: Automatically dissecting malicious binaries. Tech. rep. CMU-CS-07-133 Carnegie Mellon University."},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/1966445.1966463"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/1254810.1254830"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/378993.379236"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/1180405.1180445"},{"key":"e_1_2_1_13_1","volume-title":"Proceedings of the Symposium on Operating Systems Design and Implementation.","author":"Cadar C."},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/1755913.1755932"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/1950365.1950396"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1375581.1375615"},{"key":"e_1_2_1_17_1","unstructured":"DTrace. 2011. Dtrace. http:\/\/www.sun.com\/bigadmin\/content\/dtrace\/index.jsp. DTrace . 2011. Dtrace. http:\/\/www.sun.com\/bigadmin\/content\/dtrace\/index.jsp."},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/263699.263717"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/1190216.1190226"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1065010.1065036"},{"key":"e_1_2_1_21_1","volume-title":"Proceedings of the Network and Distributed System Security Symposium.","author":"Godefroid P."},{"key":"e_1_2_1_22_1","unstructured":"IEEE. 2005. Standard 1666: SystemC language reference manual. http:\/\/standards.ieee.org\/getieee\/1666\/. IEEE . 2005. Standard 1666: SystemC language reference manual. http:\/\/standards.ieee.org\/getieee\/1666\/."},{"key":"e_1_2_1_23_1","volume-title":"Intel 64 and IA-32 Architectures Software Developers Manual","author":"Intel"},{"key":"e_1_2_1_24_1","unstructured":"Java PathFinder. 2007. Java PathFinder. http:\/\/javapathfinder.sourceforge.net. Java PathFinder . 2007. Java PathFinder. http:\/\/javapathfinder.sourceforge.net."},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/800027.808444"},{"key":"e_1_2_1_26_1","volume-title":"Proceedings of the USENIX Annual Technical Conference.","author":"Kuznetsov V."},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/1065167.1065169"},{"key":"e_1_2_1_28_1","volume-title":"Proceedings of the International Symposium on Code Generation and Optimization.","author":"Lattner C."},{"key":"e_1_2_1_29_1","unstructured":"Levon J. and Elie P. 1998. Oprofile. http:\/\/oprofile.sourceforge.net. Levon J. and Elie P. 1998. Oprofile. http:\/\/oprofile.sourceforge.net."},{"key":"e_1_2_1_30_1","unstructured":"Lua 2010. Lua: A lightweight embeddable scripting language. http:\/\/www.lua.org\/. Lua 2010. Lua: A lightweight embeddable scripting language. http:\/\/www.lua.org\/."},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/1065010.1065034"},{"key":"e_1_2_1_32_1","volume-title":"WHDC: Develop hardware for windows","author":"Microsoft","year":"2011"},{"key":"e_1_2_1_33_1","unstructured":"Microsoft. 2011b. Windbg. http:\/\/msdn.microsoft.com\/en-us\/windows\/hardware\/gg463009. Microsoft . 2011b. Windbg. http:\/\/msdn.microsoft.com\/en-us\/windows\/hardware\/gg463009."},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/96267.96279"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2009.18"},{"key":"e_1_2_1_36_1","volume-title":"Proceedings of the Symposium on Operating System Design and Implementation.","author":"Musuvathi M."},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/1755913.1755947"},{"key":"e_1_2_1_38_1","volume-title":"Proceedings of the Linux Symposium.","author":"Prasad V."},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/1390630.1390635"},{"key":"e_1_2_1_40_1","doi-asserted-by":"crossref","unstructured":"Pulkkinen T. Nelson K. Pulkkinen E. Cumming M. and Schulze M. 2011. libsigc++ --- The Typesafe Callback Framework for C++. http:\/\/libsigc.sourceforge.net\/. Pulkkinen T. Nelson K. Pulkkinen E. Cumming M. and Schulze M. 2011. libsigc++ --- The Typesafe Callback Framework for C++. http:\/\/libsigc.sourceforge.net\/.","DOI":"10.1002\/mma.1501"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/265924.265927"},{"key":"e_1_2_1_42_1","volume-title":"Proceedings of the Working Conference on Reverse Engineering.","author":"Schwarz B."},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/1321631.1321746"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/1081706.1081750"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-89862-7_1"},{"key":"e_1_2_1_46_1","unstructured":"Valgrind. 2011. Valgrind. http:\/\/valgrind.org\/. Valgrind . 2011. Valgrind. http:\/\/valgrind.org\/."},{"key":"e_1_2_1_47_1","unstructured":"Wheeler D. 2010. SLOCCount. http:\/\/www.dwheeler.com\/sloccount\/. Wheeler D. 2010. SLOCCount. http:\/\/www.dwheeler.com\/sloccount\/."},{"key":"e_1_2_1_48_1","volume-title":"Proceedings of the Symposium on Operating Systems Design and Implementation.","author":"Yang J."},{"key":"e_1_2_1_49_1","volume-title":"Proceedings of the Symposium on Networked Systems Design and Implementation.","author":"Yang J."},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISPASS.2007.363733"}],"container-title":["ACM Transactions on Computer Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2110356.2110358","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2110356.2110358","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T12:23:40Z","timestamp":1750249420000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2110356.2110358"}},"subtitle":["Design, Implementation, and Applications"],"short-title":[],"issued":{"date-parts":[[2012,2]]},"references-count":50,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2012,2]]}},"alternative-id":["10.1145\/2110356.2110358"],"URL":"https:\/\/doi.org\/10.1145\/2110356.2110358","relation":{},"ISSN":["0734-2071","1557-7333"],"issn-type":[{"value":"0734-2071","type":"print"},{"value":"1557-7333","type":"electronic"}],"subject":[],"published":{"date-parts":[[2012,2]]},"assertion":[{"value":"2011-08-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2011-10-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2012-02-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}