Path based Dynamic Analysis
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
fault_detection
fuzz
session
testcase
vagrant-setup
valgrind-r12356 update for new automake fix Mar 21, 2013
.gitignore
.travis.yml
LICENSE
README.md
install.sh
stp.tar.gz

README.md

pathgrind Build Status

DOI

Path based Dynamic Analysis (Works for 32-bit programs only)

Requirements

  • bzip2
  • autoconf
  • make
  • gcc
  • python
  • gawk
  • 32 bit libraries for ubuntu (sudo apt-get install ia32-libs)
  • 32 bit c library for building c programs for testing with pathgrind (sudo apt-get install libc6-dev-i386)

On ubuntu you can install the dependencies using apt-get, e.g. sudo apt-get install autoconf

Installation

$ ./install.sh

Configuration

Configuration file: fuzz/settings.cfg

Execution

CLI: $ ./fuzz/fuzz.py

GUI: $ ./fuzz/gui.py

Example

$ ./fuzz/fuzz.py test6

New input are created in testcase/input/

Crash files are be saved in testcase/crash/

You can also read a fairly detailed tutorial on Pathgrind at the SRC:CLR blog

Publications

Exploiting Undefined Behaviors for Efficient Symbolic Execution, ICSE 2014

An Empirical Study of Path Feasibility Queries, CoRR 2013

A Critical Review of Dynamic Taint Analysis and Forward Symbolic Execution, Technical Report NUS 2012