We thank the respective reviewers for their valuable feedback. The reviews have helped us address several areas of our research and improve its overall quality.
The following is a list of changes applied to the paper to address the reviews.
Except the added appendices, all modified text in the paper is colored red so that it is easier to track.
The source code is available at https://abiusx.com/malmax/.
The source code is available at \url{https://malmax.s3.amazonaws.com/malmax.html}.
\vspace{1em}
...
...
@@ -43,6 +53,7 @@ The source code is available at https://abiusx.com/malmax/.
\item\inlinetitle{Reviewers 1, 3 and 4: The contrast between counterfactual execution and multi-path exploration is not clear in the paper.}
\vspace{-1em}
Counterfactual execution, multi-path exploration, and forced execution share the same idea of forcibly exploring possible execution paths to cover as much code as possible.
MalMax is closer to forced execution techniques than multi-path exploration techniques as it forcibly drives execution into a branch even if the branch condition is not satisfied.
However, MalMax is different from multi-path execution and forced execution in that MalMax shares global artifacts (e.g., global variables, function/class/constant definitions, etc.) between the isolated execution environments to discover new dynamically generated code, particularly those created via constructs such as \code{eval} and \code{include} that are commonly used in PHP applications.
...
...
@@ -100,8 +111,10 @@ The source code is available at https://abiusx.com/malmax/.
\textbf{Section 5} discusses how MalMax mitigates state-explosion and path-explosion problems.
\vspace{1em}
\item\inlinetitle{Reviewer 2: The possibility of incorrect states and inconsistencies caused by cooperative state isolation need to be discussed.}
\vspace{-1em}
MalMax might exercise infeasible paths because it enters every branch it encounters.
Execution of infeasible paths can result in incorrect program states, potentially leading to false positives and false negatives.
Moreover, artifacts shared from an infeasible path can create new isolated executions with incorrect program states, compounding the problem.
