PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Close Encounters with Symbolic Execution

blog.trailofbits.com | blog | #darpa | #program-analysis | #symbolic-execution | #mcsema | #klee | #maze-solving
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part 1: a primer on symbolic execution via escalating maze problems, and how KLEE (LLVM-based, enabled by mcsema) lets a DARPA Cyber Grand Challenge system learn inputs for binary-only software.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Close Encounters with Symbolic Execution (Part 2)
Part 2: how to build KLEE with LLVM 3.2 on Ubuntu 14.04 and use mcsema to symbolically execute a maze-oracle binary — translating it to bitcode and solving all paths with a symbolic-input driver.
vulnerability · blog.trailofbits.com
Protecting Software Against Exploitation with DARPA’s CFAR
Trail of Bits describes its DARPA CFAR work on automatically protecting software from 0-day exploits and memory corruption, using McSema-based binary lifting and diversification.
blog · blog.trailofbits.com
Binary symbolic execution with KLEE-Native
KLEE-Native extends the KLEE symbolic executor to binary program snapshots by dynamically lifting machine code to LLVM bitcode, enabling symbolic execution without source using paravirtualization.
blog · blog.trailofbits.com
Symbolic Path Merging in Manticore
A winternship project explores state merging in Manticore: merging similar symbolic states at one program location cut explored paths by 33% in a test, easing symbolic execution's path explosion.
blog · blog.trailofbits.com
The Good, the Bad, and the Weird
Proposes automatically identifying 'weird machines' in software, tracing the exploitation-versus-mitigation arms race back to the Morris worm and applying program analysis.
blog · blog.trailofbits.com
Optimizing Lifted Bitcode with Dead Store Elimination
A Trail of Bits internship project adds dead store elimination passes for McSema-lifted bitcode, cutting roughly 117,000 register-emulation stores from Apache httpd and halving Remill state writes.
Back