Close Encounters with Symbolic Execution (Part 2)

Summary: Trail of Bits published the second part of a two-part post showing how to use KLEE with mcsema to symbolically execute Linux binaries, building KLEE for LLVM 3.2 on 32-bit Ubuntu 14.04 and converting a 32-bit maze-oracle ELF binary to LLVM bitcode. A driver intercepting read() and exit() marked input as symbolic and asserted on exit(1), and KLEE found four solutions to the maze that matched the original results.
Bottom line: The post states the same approach could generate high code coverage tests for closed source binaries or find security vulnerabilities in arbitrary binary applications, meaning symbolic execution can be applied to opaque binaries without source or prior knowledge of the program's logic.

Read the original at Trail of Bits Blog ↗