All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask)

Citations Over TimeTop 1% of 2010 papers

Abstract

Dynamic taint analysis and forward symbolic execution are quickly becoming staple techniques in security analyses. Example applications of dynamic taint analysis and forward symbolic execution include malware analysis, input filter generation, test case generation, and vulnerability discovery. Despite the widespread usage of these two techniques, there has been little effort to formally define the algorithms and summarize the critical issues that arise when these techniques are used in typical security contexts. The contributions of this paper are two-fold. First, we precisely describe the algorithms for dynamic taint analysis and forward symbolic execution as extensions to the run-time semantics of a general language. Second, we highlight important implementation choices, common pitfalls, and considerations when using these techniques in a security context.

Related Papers

• → The Auspicious Couple: Symbolic Execution and WCET Analysis(2013)12 cited
• SPA: Symbolic Program Approximation for Scalable Path-sensitive Analysis(2009)
• → Symbolic Analysis via Semantic Reinterpretation(2009)8 cited
• → All-values symbolic execution(2012)
• → All-values symbolic execution(2012)