Program Vulnerability Mining System based on Symbolic Execution

Abstract

In recent years, vulnerability mining is a hot topic. Existing vulnerability mining methods of binary program are mainly based on fuzzy testing. These methods discover vulnerabilities by continuously inputting random data into the target program, in order to trigger the binary program's errors. However, the vulnerability output of these methods mainly depends on the input random data. The coverage rate of program execution path is low in these methods. In order to improve the coverage rate of program execution path and discover more unknown vulnerabilities, this paper presents an automatic vulnerability mining system based on symbolic execution. This system discovers vulnerabilities by performing constraint check on each execution path of the binary program. This system contains five modules, and each module is responsible for mining a type of vulnerabilities. This system has been developed based on the Python's Angr module. An experiment based on test programs is conducted to evaluate this system. The experimental results validate the effectiveness of this system. The experiment results also show that this system can discover most of the binary program's execution paths.