May 2018
Intermediate to advanced
462 pages
11h 5m
English
Fuzzing, as we discussed previously, explores the state space of a program using random inputs and binary instrumentation. This can be, as we've seen, slow. The ambition of symbolic execution (https://en.wikipedia.org/wiki/Symbolic_execution) is to allow the same exploration of state space, but without random probing. Searching for program crashes is one area of application, but it can also be used with proof tools. Symbolic execution, in a carefully written program, can let you demonstrate that your program can never reach error states. Rust has a partially implemented symbolic execution tool, seer (https://github.com/dwrensha/seer). The project uses z3, a constraint solver, to generate branching ...
Read now
Unlock full access