Symbolic Path Merging in Manticore

Summary: A Trail of Bits wintern implemented opportunistic state merging in Manticore, a symbolic execution engine for X86, X64, and Ethereum binaries, merging states at the same program location when an isMergeable predicate finds equivalent input, output socket buffers, memory, and system call traces. On a test binary, this cut explored execution paths by 33% when compiled with gcc -Os and by 20% with -O3.
Why it matters: Path explosion is the barrier that keeps symbolic execution from finishing on real programs, and a 33% reduction in explored paths on a simple example is a measure of how far a lightweight, externally-independent optimization gets you toward that goal.

Read the original at Trail of Bits Blog ↗