Symbolic execution is an effective method to analyse an application's properties thoroughly, based on the idea of analysing every control flow path an application can take. Although symbolic execution has many different use cases, it suffers from two main challenges: the state space explosion problem and the computationally expensive solving of constraints collected along the paths. The primary goal of this thesis is to tackle both issues and improve the applicability of symbolic execution, i.e., allowing larger and more complex applications to be analysed by symbolic execution. This work will focus on C and C++ as languages for systems programming. Moreover, this work heavily builds on KLEE --- a symbolic execution engine based on the LLVM framework. We took on the challenge of managing the memory used by symbolic execution more efficiently. If an application is tested, symbolic execution tracks its memory. Due to the state space explosion problem, dynamic symbolic execution must handle many states simultaneously. Choosing the right granularity of tracked memory changes will positively impact symbolic execution's performance and memory utilisation. While constraint solving is one computationally expensive part of symbolic execution, incremental solving is an effective method for SMT and SAT solving to reuse existing solutions and speed up the solving process. Unfortunately, utilising this approach is less straightforward in symbolic execution as it hinders different optimisations and caching strategies used by symbolic execution. We introduce a technique that nevertheless helps to combine these methods efficiently. Furthermore, we researched how a multi-threaded symbolic execution engine can efficiently utilise process-local resources, avoiding inter-process communication. We mainly focus on the shared use of solver queries across threads by separating shared and common query constraints and re-using the latter results more efficiently across multiple queries. Besides the general challenges of symbolic execution, we found it difficult to evaluate the improvement we made along with this work. While partially caused by our learning process, we found that symbolic execution and its state-space explosion problem make it hard to compare contributions in this field and assess their impact. Therefore, we came up with Deterministic State-Space Exploration that improves this process.

In this study I explore boundary work processes that older adults do which influences friendships among residents of a progressive care retirement community. Accounts of boundary work as mechanisms for including some and excluding other residents as potential friends were collected by using a combination of quantitative surveys and qualitative interviews from residents (age 65+) of a progressive care retirement community in the United States. First, a survey explored symbolic boundaries related to cultural capital, defined as music and leisure interest and participation, as well as structural and social aspects of friendships among residents (N=66). Second, in-depth interviews of a sub-sample of residents of an assisted living facility within the community (N=15), were conducted to examine older adults' narratives of how they use cultural capital as a mechanism of symbolic boundary work that influences their friendships with others in the retirement community. The administrator of the assisted living facility (N=1) was also interviewed. Findings from this study suggested that cultural capital was associated with sociability which offers some support for the relational "tool kit" model of the theory. However, findings from in-depth interviews suggested that while music and leisure interests and participation may be important, valuations of bodies were more likely to influence "othering" of residents, although the two are related. This study enriches our understanding of how symbolic boundary use varies by group and context, as well as makes theoretical contributions to the literature on symbolic boundaries by exploring the ways in which aging may alter the use of boundaries. / Ph. D.

The treatment of eating disorders (EDs) presents many challenges. Therapists' reactions towards clients (countertransference) may further complicate treatment. Countertransference may be partially due to the therapist's own vulnerabilities. Due to the personal connection to the work, countertransference towards ED clients may be pronounced among therapists with eating disorder lived experience (EDLE). Previous research indicates that 25-50% of ED therapists have EDLE; yet, minimal research examines how therapists negotiate their experiences while treating ED clients. The existing literature largely operates from the assumption that EDLE is a liability. While therapists with EDLE have some distinct challenges, therapists with EDLE may also have a unique perspective to offer the ED profession. The present study sought to understand how therapists with EDLE use their EDLE as a resource in their clinical work with ED clients. The study was guided by the theoretical frameworks of social constructivism and symbolic interactionism, as well as the person-of-the-therapist clinical training philosophy. Using constructivist grounded theory methodology, semi-structured interviews (Mtime = 89 minutes) were conducted with 22 therapists with EDLE, who work with ED clients. Participants explored how they use and manage their EDLE during key tasks of treatment with their ED clients. Results revealed that therapists engaged in two, interconnected constellations of processes (systems) in order to use and manage their EDLE in clinical practice. The first system (The Central System) helps therapists transform their personal experiences into clinical guidance that they can use to inform their work. The second system (The Checks and Balances System) helps the therapist find a balance between connecting with the client, while also allowing for differences of experiences to emerge. Lastly, personal processes (personal meaning making, values surrounding authenticity, and stigma surrounding EDLE), existing outside of these systems, were also found to impact the ways in which therapists use and manage themselves. Findings have implications for the EDLE literature, by providing novel ways therapists can use their EDLE. Findings also have implications for the POTT framework by exploring how POTT can be adapted for therapists who share lived experiences with their clients. A POTT-EDLE is proposed for training therapists with EDLE. / Doctor of Philosophy / The treatment of eating disorders (EDs) presents many challenges (e.g., frequent comorbidity, high rates of relapse, and the life-threatening nature of the disorder). Therapists' reactions towards clients (countertransference) may further complicate treatment. Countertransference (e.g., worry, frustration, hopelessness) may be partially due to the therapist's own unresolved issues and vulnerabilities. Due to the personal and professional connections to the work, countertransference towards ED clients may be particularly pronounced among therapists with eating disorder lived experience (EDLE). Previous research indicates that 25-50% of ED therapists have EDLE; yet, minimal research examines how therapists use and manage their experiences while treating ED clients. The existing literature largely operates from the assumption that EDLE is a liability and therapists with EDLE are working from a deficit. While therapists with EDLE have some distinct challenges, therapists with EDLE may also have a unique perspective to offer the ED profession. The study sought to understand how therapists with EDLE use their EDLE as a resource in their clinical work with ED clients. Interviews were conducted with 22 therapists with EDLE who work with ED clients. Results revealed that therapists engaged in two systems in order to use and manage their EDLE in clinical practice. The first system (The Central System) helps therapists transform their personal experiences into clinical guidance that they can use to inform their work. The second system (The Checks and Balances System) helps the therapist find a balance between connecting with the client, while also allowing for differences of experiences to emerge. The Central System and The Checks and Balances System work in tandem in order for the therapist to both use and manage their EDLE. Results describe the multiple processes informing these systems. Lastly, personal processes (personal meaning making, values surrounding authenticity, and stigma surrounding EDLE), existing outside of these systems, were also found to impact the ways in which therapists use and manage themselves. Findings have clinical and training implications for how therapists with EDLE can use and manage their EDLE to inform their clinical work with ED clients.

The translation of binary code to higher-level models has wide applications, including decompilation, binary analysis, and binary rewriting. This calls for high reliability of the underlying trusted computing base (TCB) of the translation methodology. A key challenge is to reduce the TCB by validating its soundness. Both the definition of soundness and the validation method heavily depend on the context: what is in the TCB and how to prove it. This dissertation presents three research contributions. The first two contributions include reducing the TCB in binary verification, and the last contribution includes a binary verification process that leverages a reduced TCB. The first contribution targets the validation of OCaml-to-PVS translation -- commonly used to translate instruction-set-architecture (ISA) specifications to PVS -- where the destination language is non-executable. We present a methodology called OPEV to validate the translation between OCaml and PVS, supporting non-executable semantics. The validation includes generating large-scale tests for OCaml implementations, generating test lemmas for PVS, and generating proofs that automatically discharge these lemmas. OPEV incorporates an intermediate type system that captures a large subset of OCaml types, employing a variety of rules to generate test cases for each type. To prove the PVS lemmas, we develop automatic proof strategies and discharge the test lemmas using PVS Proof-Lite, a powerful proof scripting utility of the PVS verification system. We demonstrate our approach in two case studies that include 259 functions selected from the Sail and Lem libraries. For each function, we generate thousands of test lemmas, all of which are automatically discharged. The dissertation's second contribution targets the soundness validation of a disassembly process where the source language does not have well-defined semantics. Disassembly is a crucial step in binary security, reverse engineering, and binary verification. Various studies in these fields use disassembly tools and hypothesize that the reconstructed disassembly is correct. However, disassembly is an undecidable problem. State-of-the-art disassemblers suffer from issues ranging from incorrectly recovered instructions to incorrectly assessing which addresses belong to instructions and which to data. We present DSV, a systematic and automated approach to validate whether the output of a disassembler is sound with respect to the input binary. No source code, debugging information, or annotations are required. DSV defines soundness using a transition relation defined over concrete machine states: a binary is sound if, for all addresses in the binary that can be reached from the binary's entry point, the bytes of the (disassembled) instruction located at an address are the same as the actual bytes read from the binary. Since computing this transition relation is undecidable, DSV uses over-approximation by preventing false positives (i.e., the existence of an incorrectly disassembled reachable instruction but deemed unreachable) and allowing, but minimizing, false negatives. We apply DSV to 102 binaries of GNU Coreutils with eight different state-of-the-art disassemblers from academia and industry. DSV is able to find soundness issues in the output of all disassemblers. The dissertation's third contribution is WinCheck: a concolic model checker that detects memory-related properties of closed-source binaries. Bugs related to memory accesses are still a major issue for security vulnerabilities. Even a single buffer overflow or use-after-free in a large program may be the cause of a software crash, a data leak, or a hijacking of the control flow. Typical static formal verification tools aim to detect these issues at the source code level. WinCheck is a model-checker that is directly applicable to closed-source and stripped Windows executables. A key characteristic of WinCheck is that it performs its execution as symbolically as possible while leaving any information related to pointers concrete. This produces a model checker tailored to pointer-related properties, such as buffer overflows, use-after-free, null-pointer dereferences, and reading from uninitialized memory. The technique thus provides a novel trade-off between ease of use, accuracy, applicability, and scalability. We apply WinCheck to ten closed-source binaries available in a Windows 10 distribution, as well as the Windows version of the entire Coreutils library. We conclude that the approach taken is precise -- provides only a few false negatives -- but may not explore the entire state space due to unresolved indirect jumps. / Doctor of Philosophy / Binary verification is a process that verifies a class of properties, usually security-related properties, on binary files, and does not need access to source code. Since a binary file is composed of byte sequences and is not human-readable, in the binary verification process, a number of assumptions are usually made. The assumptions often involve the error-free nature of a set of subsystems used in the verification process and constitute the verification process's trusted computing base (or TCB). The reliability of the verification process therefore depends on how reliable the TCB is. The dissertation presents three research contributions in this regard. The first two contributions include reducing the TCB in binary verification, and the last contribution includes a binary verification process that leverages a reduced TCB. The dissertation's first contribution presents a validation on OCaml-to-PVS translations -- commonly used to translate a computer architecture's instruction specifications to PVS, a language that allows mathematical specifications. To build up a reliable semantical model of assembly instructions, which is assumed to be in the TCB, it is necessary to validate the translation. The dissertation's second contribution validates the soundness of the disassembly process, which translates a binary file to corresponding assembly instructions. Since the disassembly process is generally assumed to be trustworthy in many binary verification works, the TCB of binary verification could be reduced by validating the soundness of the disassembly process. With the reduced TCB, the dissertation introduces WinCheck, the dissertation's third and final contribution: a concolic model checker that validates pointer-related properties of closed-source Windows binaries. The pointer-related properties include absence of buffer overflow, absence of use-after-free, and absence of null-pointer dereference.

Concurrent software has been widely utilizing in computer systems owing to the highly efficient computation. However, testing and verifying concurrent software remain challenging tasks. This matter is not only because of the non-deterministic thread interferences which are hard to reason about but also because of the large state space due to the simultaneous path and interleaving explosions. That is, the number of program paths in each thread may be exponential in the number of branch conditions, and also, the number of thread interleavings may be exponential in the number of concurrent operations. This dissertation presents a set of new methods, built upon symbolic execution, a program analysis technique that systematically explores program state space, for testing concurrent programs. By modeling both functional and non-functional properties of the programs as assertions, these new methods efficiently analyze the viable behaviors of the given concurrent programs. The first method is assertion guided symbolic execution, a state space reduction technique that identifies and eliminates redundant executions w.r.t the explored interleavings. The second method is incremental symbolic execution, which generates test inputs only for the influenced program behaviors by the small code changes between two program versions. The third method is SYMPLC, a technique with domain-specific reduction strategies for generating tests for the multitasking Programmable Logic Controller (PLC) programs written in languages specified by the IEC 61131-3 standard. The last method is adversarial symbolic execution, a technique for detecting concurrency related side-channel information leaks by analyzing the cache timing behaviors of a concurrent program in symbolic execution. This dissertation evaluates the proposed methods on a diverse set of both synthesized programs and real-world applications. The experimental results show that these techniques can significantly outperform state-of-the-art symbolic execution tools for concurrent software. / Doctor of Philosophy / Software testing is a technique that runs software as a black-box on computer hardware multiple times, with different inputs per run, to test if the software behavior conforms to the designed functionality by developers. Nowadays, programmers have been increasingly developing multithreaded and multitasking software, e.g., web browser and web server, to utilize the highly efficient multiprocessor hardware. This approach significantly improves the software performance since a large computing job can now decompose to a set of small jobs which can then distribute to concurrently running threads (tasks). However, testing multithreaded (multitask) software is extremely challenging. The most critical problem is the inherent non-determinism. Typically, executing sequential software with the same input data always results in the same output. However, running a multithreaded (multitask) software multiple times, even under the same input data, may yield different output in each run. The root reason is that concurrent threads (tasks) may interleave their running progress at any time; thus the internal software execution order may be altered unexpectedly, causing runtime errors. Meanwhile, finding such faults is difficult, since the number of all possible interleavings can be exponentially growing in the number of concurrent thread (task) operations. This dissertation proposes four methods to test multithreaded/multitask software efficiently. The first method summarizes the already-tested program behaviors to avoid future testing runs that cannot lead to new faults. The second method only tests program behaviors that are impacted by program changes. The third method tests multitask Programmable Logic Controller (PLC) programs by excluding infeasible testing runs w.r.t the PLC semantics. The last method tests non-functional program properties by systematic concurrency analysis. This dissertation evaluates these methods upon a diverse set of benchmarks. The experimental results show that the proposed methods significantly outperform state-of-the-art techniques for concurrent software analysis.

Those living without a diagnosis reside in an invisible margin of health and family research. The purpose of this study was to explore illness uncertainty as experienced by women and their families in the United States. I examined illness uncertainty through a feminist ecological interactionist (FEI) approach with three core constructs: interaction, agency, and context. I conducted narrative-focused, semi-structured interviews with 15 women (aged 25-46) and 11 family members (aged 22 to 62) identified by each woman and completed a constant comparative grounded theory analysis. The findings revealed women's lived experiences with symptoms and social support, interactions with the medical system, and agency in the context of such uncertainty. Findings also model a System of Illness Uncertainty that contends that women's experiences with illness uncertainty is an endless process that changes over time. In the System of Illness Uncertainty, women were Doubters, Resisters, Persisters, or Burnouts; all women experienced a paradigm shift regarding the Western health system as a result of their experiences. This research adds to the knowledge base on individuals who occupy spaces between the legitimized, diagnosable ill and the symptom-free healthy. Implications affect not only individuals and their families, but the politics of Western medical establishments. / Ph. D.

By listening to peoples' constructed stories of special places, the average person begins to understand why and how attachments to places form. This study concerns the attachments residents of Isle au Haut, Maine possess on the remote island, which borders part of Acadia National Park. The purpose of this study is to uncover social components of both place attachment and place identity among island residents as well as explain the process by which those residents form attachments. Twelve interviews were conducted both on Isle au Haut as well as nearby Mount Desert Island. Qualitative data were collected from a purposive sample of island residents and National Park Service employees who are responsible for managing the park on the island. In-depth interviews were the sole means of data collection and provided detailed stories of life on the island and attachments that have formed. This study uses grounded theory techniques in data analysis to ultimately form a theory grounded in the collected data. The findings from this study indicate that social interaction is key to residents forming an attachment to Isle au Haut. Further, three major social constructs emerged from the data analysis. Those constructs are sense of community, shared purpose, and shared history, all of which were found to contribute to place identity and place attachment among the residents. The results also suggest place identity as more salient than place dependence in residents' narratives concerning their attachment to the island. / Master of Science

Over the last two decades, chip design has been conducted at the register transfer (RT) Level using Hardware Descriptive Languages (HDL), such as VHDL and Verilog. The modeling at the behavioral level not only allows for better representation and understanding of the design, but also allows for encapsulation of the sub-modules as well, thus increasing productivity. Despite these benefits, validating a RTL design is not necessarily easier. Today, design validation is considered one of the most time and resource consuming aspects of hardware design. The high costs associated with late detection of bugs can be enormous. Together with stringent time to market factors, the need to guarantee the correct functionality of the design is more critical than ever. The work done in this thesis tackles the problem of RTL design validation and presents new frameworks for functional test generation. We use branch coverage as our metric to evaluate the quality of the generated test stimuli. The initial effort for test generation utilized simulation based techniques because of their scalability with design size and ease of use. However, simulation based methods work on input spaces rather than the DUT's state space and often fail to traverse very narrow search paths in large input spaces. To encounter this problem and enhance the ability of test generation framework, in the following work in this thesis, certain design semantics are statically extracted and recurrence relationships between different variables are mined. Information such as relations among variables and loops can be extremely valuable from test generation point of view. The simulation based method is hybridized with Z3 based symbolic backward execution engine with feedback among different stages. The hybridized method performs loop abstraction and is able to traverse narrow design paths without performing costly circuit analysis or explicit loop unrolling. Also structural and functional unreachable branches are identified during the process of test generation. Experimental results show that the proposed techniques are able to achieve high branch coverage on several ITC'99 benchmark circuits and their modified variants, with significant speed up and reduction in the sequence length. / Master of Science

Considerable research has been directed towards efficient test stimuli generation for Register Transfer Level (RTL) circuits. However, stimuli generation frameworks are still not capable of generating effective stimuli for all circuits. Some of the limiting factors are 1) It is hard to ascertain if a branch in the RTL code is reachable, and 2) Some hard-to-reach branches require intelligent algorithms to reach them. Since unreachable branches cannot be reached by any test sequence, we propose a method to deduce unreachability of a branch by looking for the possible values which a signal can take in an RTL code without explicit unrolling of the design. To the best of our knowledge, this method has been able to identify more unreachable branches than any method published in this domain, while being computationally less expensive. Moreover, some branches require very specific values on input signals in specific cycles to reach them. Conventional symbolic execution can generate those values but is computationally expensive. We propose a cycle-by-cycle restrictive symbolic execution that analyzes only a selected subset of program statements to reduce the computational cost. Our proposed method gathers information from an initial execution trace generated by any technique, to intelligently decide specific cycles where the application of this method will be helpful. This method can hybrid with simulation-based test stimuli generation methods to reduce the cost of formal verification. With this method, we were able to reach some previously unreached branches in ITC99 benchmark circuits. / Master of Science

Despite increased usage of online dating platforms, perceptions of meeting partners online remain generally stigmatized. When people internalize stigmatized online dating narratives as self-stigma, there are implications for psychological wellbeing and relational health. In the current study, through an open-ended online survey, I explored online dating narratives and perceptions of stigma in the experiences of 110 participants who met their partners online. I used thematic analysis (Braun and Clark, 2006) to identify and illustrate resulting themes, which revealed that (a) a general stigma about meeting partners online persists; (b) individuals are more likely to share that they met their partner online if they perceive their audience to be trustworthy; (c) intersections of race, ethnicity, gender, and sexual orientation influence how people share their online dating narratives; (d) a hierarchy of legitimacy exists amongst online dating platforms; and (e) the benefits of meeting online often outweigh the stigma. I used both symbolic interactionist and narrative therapy frameworks to explore the implications of these findings and make suggestions for marriage and family therapists (MFT) working with clients who met their partners online. As well, I proposed competencies in online relationships for MFT education. / Ph. D.