Sporting the beyond

First, CodePhage feeds the "secure" input -- the only that doesn't result in crashes -- to the donor. It then tracks the sequence of operations the donor executes and information them the usage of a symbolic expression, a string of symbols that describes the logical constraints the operations impose.Sooner or later, for example, the donor can also test to look whether or not the scale of the input is underneath some threshold. If it is, CodePhage will upload a time period to its growing symbolic expression that represents the situation of being below that threshold. It would not document the real size of the document -- just the constraint imposed via the check.

Next, CodePhage feeds the donor the crash-inducing enter. again, it builds up a symbolic expression that represents the operations the donor plays. whilst the brand new symbolic expression diverges from the antique one, however, CodePhage interrupts the method. The divergence represents a constraint that the safe enter met and the crash-inducing input does not. As such, it can be a safety test lacking from the recipient.

CodePhage then analyzes the recipient to locate places at which the enter meets most, however no longer pretty all, of the limitations defined by means of the new symbolic expression. The recipient may additionally perform unique operations in a special order than the donor does, and it can keep records in exceptional forms. however the symbolic expression describes the nation of the records after it's been processed, now not the processing itself.

At each of the locations it identifies, CodePhage can dispense with maximum of the limitations described by way of the symbolic expression -- the constraints that the recipient, too, imposes. starting with the first vicinity, it interprets the few constraints that continue to be into the language of the recipient and inserts them into the supply code. Then it runs the recipient once more, the usage of the crash-inducing input.

If the program holds up, the brand new code has solved the trouble. If it does not, CodePhage movements on to the following candidate location within the recipient. If this system is still crashing, even after CodePhage has tried maintenance at all of the candidate places, it returns to the donor program and keeps building up its symbolic expression, till it arrives at any other factor of divergence.