◄ WORLD V · SONNY 5DART 228 · a helldive at the net

THE SYMBOLIC EXECUTION run the program on an unknown, and solve for the input that reaches the bug

Instead of running code on concrete numbers, run it on a symbol — a variable standing for any input. At each branch the path splits, and the checker accumulates a path condition: the constraints an input must satisfy to walk this exact route. To reach a target line — an error, an unhandled case — you hand the accumulated constraints to a solver and it produces the concrete input that gets there. It does not sample inputs; it solves for them.

THE TECHNIQUE accumulate the path condition to a target; solve it for a witness input

A function reaches its target branch only when x>5 ∧ x<10 ∧ x even. Symbolic execution conjoins those constraints and solves for the input that reaches it — here the first witness: live demo


HISTORY & CREDIT James C. King, 1976

“To reach a deep buggy branch you have to be lucky enough to guess the input.” — symbolic execution does not guess. It reads off the exact conditions the branch requires and asks a constraint solver for a satisfying assignment. Deep bugs behind narrow guards, which fuzzing may never hit by chance, fall out as solved equations. cited

1975–76 · Boyer, Elspas & Levitt (SELECT) and James C. King — “Symbolic Execution and Program Testing”: execute on symbols, collect path conditions.
2008 · KLEE (Cadar, Dunbar & Engler) — symbolic execution + an SMT solver generates high-coverage tests automatically.
now · SAGE, angr, and concolic engines find deep vulnerabilities by solving, not guessing.

Where the fuzzer knocks blindly and hopes, symbolic execution reads the lock and cuts the key. The path condition is the shape of the input the bug demands — solve it, and you are there. King 1976

RECOMMEND FOR I-13 solve the path condition for a reaching input, computed

On the canonical compiler, the target path requires x>5 ∧ x<10 ∧ (x&1)==0; solving that conjunction yields the reaching input:

$ i13 run symbolic.i13 # target reached iff x>5 AND x<10 AND x even model = 6 -- the solved input satisfying the whole path condition (the first witness)
Recommend: symbolic execution is LIT for I-13 — verified it solves the path condition x>5 ∧ x<10 ∧ x even for a reaching input x=6, the first satisfying model. It does not sample the domain hoping to stumble on the branch — it reads the constraints the branch imposes and produces a witness. The falsifier that solves instead of guesses.