A tight integration of symbolic execution and fuzzing

Yaëlle Vinçont (1) , Sébastien Bardin (2) , Michaël Marcozzi (2)

1 LMF - Laboratoire Méthodes Formelles
2 LSL - Laboratoire Sûreté des Logiciels

Most bug finding tools rely on either fuzzing or symbolic execution. While they both work well in some situations, fuzzing struggles with complex conditions and symbolic execution suffers from path explosion and high constraint solving costs. In order to enjoy the advantages from both techniques, we propose a new approach called Lightweight Symbolic Execution (LSE) that integrates well with fuzzing. Especially, LSE does not require any call to a constraint solver and allows for quickly enumerating inputs. In this short paper, we present the basic concepts of LSE together with promising preliminary experiments.

Domains: Software Engineering [cs.SE]

Yaëlle Vinçont, Sébastien Bardin, Michaël Marcozzi. A tight integration of symbolic execution and fuzzing. Lecture Notes in Computer Science, 2021, FPS 2021 - The 14th International Symposium on Foundations & Practice of Security, 13291, ⟨10.1007/978-3-031-08147-7_20⟩. ⟨cea-04232795⟩