Protocol Knowledge Combined Directed Symbolic Execution for Binary Programs

Symbolic Execution based defect discovery techniques for binary programs are now widely applied. However, because of the path explosion problem, it´s still not applicable for security analysis on large programs. A great many infeasible paths in the target program also reduce the performance. To fast generate test cases reaching the potentially vulnerable program points, this paper introduces constraints implied in input protocols to symbolic execution, calculates vulnerable point reachable control flow paths using static control flow analysis. The path information is then used to limit dynamic symbolic execution´s path exploration space. Experiments prove the effectiveness of our method on performance enhancement in symbolic execution and defect discovery.