MUI: Visualizing symbolic execution with Manticore and Binary Ninja

Summary: A Trail of Bits intern built the Manticore User Interface (MUI), a Binary Ninja plugin with custom Qt widgets that visualizes Manticore's symbolic execution state exploration inside the Binary Ninja UI. The plugin adds a State List widget, a Graph View provenance tree, find and avoid commands, custom hooks, and basic EVM support built on crytic-compile and ethersplay, and was used to solve a Manticore crackme challenge with the input coldlikeminisodas.
Key Takeaway: State explosion, where branches and loops multiply the states to explore exponentially (three loop iterations already yield eight states), is hard to diagnose when symbolic execution libraries offer no view of the exploration process; MUI's state list and provenance graph put a human in the loop at the point where that growth happens.

Read the original at Trail of Bits Blog ↗