S2E: a platform for in-vivo multi-path analysis of software systems

By Vitaly Chipounov, Volodymyr Kuznetsov, George Candea. ASPLOS XVI, 2011

757 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Hardware and Architecture, Software

View Paper: https://www.semanticscholar.org/paper/2fb716c1119e2da8f896222f48dbac11209e2486

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Hardware and Architecture

In Software

Citations in the corpus

Coverage-Based Greybox Fuzzing as Markov Chain (2016, background): “There are three major categories depending on the degree of leverage of internal program structure: black-box fuzzing only requires the program to execute [9], [10], [13] while white-box fuzzing [7], [14], [15], [16] requires binary lifting and program analysis, for instance, to construct the contro”
Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware (2015, methodology): “It is a hybrid approach, involving both the target physical device as well as an emulator based on the selective symbolic execution engine S2E [9].”
QSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing (2018, methodology): “The computer science community has developed two notable technologies to automatically find vulnerabilities in software: namely, coverage-guided fuzzing [1–3] and concolic execution [4, 5].”
LAVA: Large-Scale Automated Vulnerability Addition (2016, methodology): “10 lava |= ((unsigned char *) (buf))[1] << (1*8); lava |= ((unsigned char *) (buf))[2] << (2*8);”
SOK: (State of) The Art of War: Offensive Techniques in Binary Analysis (2016, background): “Dynamic Symbolic Execution Various [12], [16], [20] IV-A2, IX Veritesting Veritesting [5] IV-A2, IX Under-constrained DSE UCSE [46] IV-A2, X Symbolic-Assisted Fuzzing Driller [54] IV-A1, XI Static Analyses VSA [6] III-C, VIII Crash Replay Replayer [43] V-A, XII Exploit Generation AEG [4] V-B, XIII E”
Detecting trigger-based behaviors in botnet malware (2015, methodology): “Dynamic symbolic execution, also known as Concolic testing, executes program with predefined symbols [1, 2, 8, 17].”
The Art, Science, and Engineering of Fuzzing: A Survey (2018, background): “2, we intentionally omit dynamic symbolic executors such as [92], [198], [63], [49], [218], [54] because their authors did not explicitly describe their work as a fuzzer.”
Driller: Augmenting Fuzzing Through Selective Symbolic Execution (2016, methodology): “Introduced with EXE [5], refined with KLEE [4], and applied to binary code with Mayhem [8] and S2E [10], concolic execution engines interpret an application, model user input using symbolic variables, track constraints introduced by conditional jumps, and use constraint solvers to create inputs to…”
Directed Greybox Fuzzing (2017, background): “White-box fuzzing based on symbolic execution [7, 8, 12] requires heavy-weight program analysis and constraint solving.”
Unleashing Mayhem on Binary Code (2012, methodology): “Online symbolic execution [10], [29] forks at each branch point.”
An orchestrated survey of methodologies for automated software test case generation (2013, background): “CUTE (Sen et al., 2005), Klee (Cadar et al., 2008), S2E (Chipounov et al., 2011), and Crest 4 target C language.”
Neural Nets Can Learn Function Type Signatures From Binaries (2017, neutral): “chine code is important for applications such as code hardening [54, 34, 53, 26, 52], bug-finding [39, 47, 10], clone detection [18, 38], patching/repair [17, 16, 41] and analysis [12, 22, 21].”