Remote Concolic Multiverse Debugging -- Extended Version with Additional Appendices

TL;DR

This paper presents a trace-based multiverse debugger for microcontrollers that uses concolic execution to efficiently explore nondeterministic program paths, reducing state explosion and resource overhead.

Contribution

It introduces a novel hybrid concolic and trace-based multiverse debugging technique that effectively prunes redundant paths and improves debugging efficiency on resource-constrained microcontrollers.

Findings

Significant reduction in state space compared to traditional methods

Prototype implementation on WARDuino WebAssembly VM demonstrates feasibility

Enhanced debugging efficiency with lower memory and communication overhead

Abstract

Debugging nondeterministic programs is inherently difficult, particularly in microcontroller environments where execution paths can diverge unpredictably due to external sensor inputs. Traditional debugging techniques often fail to capture or reproduce this nondeterministic behavior effectively. Multiverse debugging has emerged as a compelling technique to debug nondeterministic programs, allowing developers to systematically explore all possible execution paths. Unfortunately, current multiverse debuggers are snapshot-based and most operate over a model of the program, limiting their use for debugging resource-constrained microcontrollers. Additionally, current multiverse debuggers, even ones specifically designed for microcontrollers suffer from state explosion making the state space overwhelming during debugging. To address these challenges, we introduce a trace-based multiverse debugger with a novel state-space reduction technique based on concolic execution. Our approach interleaves concolic analysis with live debugging to identify input values that define unique program paths. This hybrid technique efficiently prunes redundant paths from the state space while ensuring full code coverage. Unlike MIO, a recently published multiverse debugger for microcontrollers that focuses on IO consistency, our approach directly targets state explosion by leveraging concolic execution and uses a trace-based approach, significantly reducing the memory and communication overhead. We implemented a prototype using the WARDuino WebAssembly VM, demonstrating the feasibility and efficiency of our approach in real-world scenarios. Our results highlight substantial reductions in the state space compared to traditional multiverse debugging. This makes multiverse debugging more accessible and efficient for developers working with complex, nondeterministic programs running on microcontrollers.