Symbolic Execution
Symbolic execution runs a program with symbolic variables instead of concrete values, analyzing all feasible paths and auto-generating inputs that trigger each.
Purpose
Analyze program behavior precisely, auto-generating high-coverage tests and vulnerability-triggering inputs.
Mechanism
Variables are represented symbolically; path conditions accumulate as constraints. At branches it forks paths and checks feasibility with an SMT solver. Path explosion is the main bottleneck. KLEE and angr perform symbolic execution of C/binaries.
Use cases
- Test generation
- Vulnerability analysis
- Path coverage