Binary symbolic execution with KLEE-Native

Summary: Trail of Bits describes KLEE-Native, a fork of the KLEE symbolic execution tool that lifts machine code to LLVM bitcode so it can operate on binary program snapshots rather than source code. The project uses an INT3 breakpoint injected via ptrace to capture memory and register state mid-execution, paravirtualizes libc through an LD_PRELOAD library to intercept functions like malloc, and replaces KLEE's eager forking with eager concretization and depth-first exploration using state continuations.
Key Takeaway: KLEE has long been hard for bug hunters to adopt because it needs source code and a workable build system, so a binary-only path changes who can run symbolic execution against software they cannot compile. The tradeoff the team names is speed: lifting machine code means emulating SIMD-heavy libc functions like strcpy, strcmp, and memset, which the authors call slow and prone to state forking on symbolic data.

Read the original at Trail of Bits Blog ↗