Reinforcement learning has numerous applications for the testing and analysis of video game content. However, deploying it in existing games is a challenging engineering effort, requiring suitable representations of states, actions, and rewards based on the game rules. We propose using the program analysis technique of symbolic execution on the game code to automatically determine a precise action model when deploying reinforcement learning in existing games. Our technique automatically computes appropriate discrete action spaces for games, including action masks indicating the validity of actions depending on the agent's current state. We conduct a comprehensive evaluation of the technique on a varied dataset of seven Unity games with the Proximal Policy Optimization (PPO) and Deep Q Learning (DQN) deep reinforcement learning approaches. The results show that the agents using the analysis significantly out-perform those using generic action spaces covering the input device, and perform on par with those using manually specified action spaces.

Automated exploration has many important applications for testing and analysis of games. Techniques for automated exploration require the capability of identifying the set of available user actions at a given game state, then performing the action selected by the exploration logic. This has been traditionally supported by having the game developer provide an API for this purpose or randomly guessing inputs. In this paper we develop a program analysis based technique for performing an automated analysis of the input-handling logic of the game code, then using this information to provide the set of player actions available at a game state (as well as the device inputs that should be simulated to perform a chosen action). We focus on developing such a technique for games built with the Unity game engine. We implemented an automatic exploration tool based on our technique and evaluated its state exploration performance for six open-source Unity games. We found that our approach is competitive with manually specified actions and is fast enough to play the games in real time.

Local databases underpin important features in many mobile applications, such as responsiveness in the face of poor connectivity. However, failure to use such databases correctly can lead to high resource consumption or even security vulnerabilities. We present SAND, an extensible static analysis approach that checks for misuse of local databases, also known as SQL antipatterns, in mobile apps. SAND features novel abstractions for common forms of application/database interactions, which enables concise and precise specification of the antipatterns that SAND checks for. To validate the efficacy of SAND, we have experimented with a diverse suite of 1,000 Android apps. We show that the abstractions that power SAND allow concise specification of all the known antipatterns from the literature (12-74 LOC), and that the antipatterns are modeled accurately (99.4-100% precision). As for performance, SAND requires on average 41 seconds to complete a scan on a mobile app.