Pathfinder: Symbolic Execution in Practice

A survey and controlled experiment in symbolic execution with KLEE and angr, measuring how much search strategy actually decides what an executor covers under a fixed budget. angr recovers a hidden authentication token from a compiled binary with no source; a ...