\chapter{Introduction}

\section{Automatic Program Verification with SATABS}

Recent security issues in popular operating systems have shown that
traditional verification approaches like unit testing are insufficient
to find complex bugs like buffer overflows. Many formal verification
methods that are based on an exhaustive examination of the state space
of the program under test have failed to detect such bugs, too. The reason
is twofold: First, the tools are unable to handle programs of reasonable
size. Second, the tools do not process the input program directly, but
generate an (abstract) model which does not accurately reflect the
properties of the original pogram (e.g., 32-bit integers are often 
modeled in terms of natural numbers $\mathbb{N}$, thus neglecting
possible arithmetic overflow).

\satabs is a verification tool for ANSI-C programs. It allows verifying 
array bounds (buffer overflows), pointer safety, exceptions and
user-specified assertions. Integer arithmetic is modeled accurately,
therefore \satabs is able to detect a class of bugs that has so far
gone unnoticed by many formal verification tools. 

\satabs computes 
an abstraction of the program in order to handle large amounts of code.
In order to use \satabs it is not necessary to understand the
abstraction refinement mechanism. For the interested reader, a 
high-level introduction is provided in Chapter~\ref{chap:overview}.
\seealso{\ref{chap:overview}}

\section{A Short Tutorial}\label{sec:tutorial}

In order to give a brief overview of the capabilities of \satabs we
start with a series of small examples. The description of the installation
of the tool is postponed to Chapter~\ref{chap:installation}.
\seealso{\ref{chap:installation}}

The issue of buffer overflows has brought wide public attention.
A buffer is a contiguous allocated chunk of memory, represented by
an array or a pointer in C. Programs written in C do
not provide automatic bounds checking on the buffer, which means a 
program can -- accidentally or maliciously -- 
write past a buffer. The following example is a perfectly valid C program
(in the sense that a compiler compiles it without any errors):

\begin{verbatim}
int main () {
    int buffer[10];
    buffer[20] = 10;
}
\end{verbatim}

However, the write access to an address outside the allocated memory
region can lead to unexpected behaviour. In particular, such bugs
can be exploited to overwrite the return address of a function, thus
enabling the execution of arbitrary user induced code. 
\satabs is able to detect this problem and reports that the ``upper bound
property'' of the buffer is violated. \satabs is capable of checking the
lower and upper bounds, even for arrays with dynamic size.

More here:
\begin{itemize}
\item show a counterexample
\item explain that (at least in theory) there are no false positives/negatives
\end{itemize}
