<story><title>A Survey of Symbolic Execution Techniques (2018)</title><url>https://arxiv.org/abs/1610.00502</url></story><parent_chain><item><author>touisteur</author><text>I&amp;#x27;m curious, HN. Apart from Fujitsu, do any of you use Symbolic Execution in an Industrial setting or in your day-to-day job ? I&amp;#x27;m starting to see fuzzing &amp;#x27;largely&amp;#x27; adopted, and an uptick of interest in proof (see recent partnership between Nvidia and AdaCore on Spark2014 for firmware), but not much on Symbolic Execution ?&lt;p&gt;Apart from Trail of Bits, University Research teams, and automatic patching competitions ?&lt;p&gt;Anyone using cbmc, Klee, angr, s2e ?</text></item></parent_chain><comment><author>jor-el</author><text>I have come across many pentesting labs using these tools to deal with obfuscated binaries. You can check Quakslab&amp;#x27;s blog, they have articles on this [0]. Another interesting project is of cracking Tigress VM using Symbolic execution [1]. The use has dramatically increased in past few years as many new tools are available and also hardware is more performant now. 
I am also using these tools in my day-to-day job to deal with obfuscated binaries and reverse engineering. I use Miasm [2].&lt;p&gt;PS: My company is hiring for such roles  &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;netsec&amp;#x2F;comments&amp;#x2F;b90hep&amp;#x2F;rnetsecs_q2_2019_information_security_hiring&amp;#x2F;ek374i0&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.reddit.com&amp;#x2F;r&amp;#x2F;netsec&amp;#x2F;comments&amp;#x2F;b90hep&amp;#x2F;rnetsecs_q2_...&lt;/a&gt;&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.quarkslab.com&amp;#x2F;deobfuscation-recovering-an-ollvm-protected-program.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.quarkslab.com&amp;#x2F;deobfuscation-recovering-an-ollvm...&lt;/a&gt;
[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.quarkslab.com&amp;#x2F;deobfuscation-recovering-an-ollvm-protected-program.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.quarkslab.com&amp;#x2F;deobfuscation-recovering-an-ollvm...&lt;/a&gt;
[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;cea-sec&amp;#x2F;miasm&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;cea-sec&amp;#x2F;miasm&lt;/a&gt;</text></comment>
<story><title>A Survey of Symbolic Execution Techniques (2018)</title><url>https://arxiv.org/abs/1610.00502</url></story><parent_chain><item><author>touisteur</author><text>I&amp;#x27;m curious, HN. Apart from Fujitsu, do any of you use Symbolic Execution in an Industrial setting or in your day-to-day job ? I&amp;#x27;m starting to see fuzzing &amp;#x27;largely&amp;#x27; adopted, and an uptick of interest in proof (see recent partnership between Nvidia and AdaCore on Spark2014 for firmware), but not much on Symbolic Execution ?&lt;p&gt;Apart from Trail of Bits, University Research teams, and automatic patching competitions ?&lt;p&gt;Anyone using cbmc, Klee, angr, s2e ?</text></item></parent_chain><comment><author>PaulHoule</author><text>My experience about any area I&amp;#x27;ve specialized in is that for every one that is talked about publicly there are maybe ten things that are not being talked about.&lt;p&gt;This is particularly the case when the new technology is a particular competitive advantage.&lt;p&gt;One firm that I worked for developed a highly competitive product using a deep neural net (back when the Restricted Boltzmann Machine was a thing!) and the &amp;quot;deep learning&amp;quot; hype was just starting.  They sent a marketing person to my office to interview me about what things we could say about the product that would make it sound impressive and I told him all about it,  but his superiors didn&amp;#x27;t let him use the material because they didn&amp;#x27;t want competitors to know how it worked.</text></comment>