Skip to content
History of symbolic execution (as well as SAT/SMT solving, fuzzing, and taint data tracking)
Branch: master
Clone or download
Latest commit 7e819ee Dec 30, 2017
Type Name Latest commit message Commit time
Failed to load latest commit information.
LICENSE Readme update. Dec 27, 2017


  • Symbolic execution timeline highlights some major tools and ideas of pure symbolic execution, dynamic symbolic execution (concolic) as well as related ideas of model checking, SAT/SMT solving, black-box fuzzing, taint data tracking, and other dynamic analysis techniques.
  • Solving timeline highlights major SAT and SMT techniques and solvers (including solvers not related to symbolic execution).

There is also temporary timeline of some tools not displayed in the diagrams above.

Symbolic execution

⚠️ PNG preview could be outdated. See symbolic-execution.svg for the latest version.


SAT and SMT solving

⚠️ PNG preview could be outdated. See solving.svg for the latest version.


Building PNG or PDF

Please, install fonts for correct SVG display:

Use Inkscape to build PNG or PDF. Example for symbolic-execution diagram:

  • PNG: inkscape diagram/symbolic-execution.svg --export-png diagram/symbolic-execution.png --export-dpi 150,
  • PDF: inkscape diagram/symbolic-execution.svg --export-pdf diagram/symbolic-execution.pdf.


We use colors from GitHub Linguist for input languages.


Feel free to suggest changes or add new information. If your change is minor (like typo), you can just edit source code of symbolic-execution.svg. If change is major, you are encouraged to either create new issue, or edit symbolic-execution.svg (Inkscape editor is strongly recommended due to source code issues).

Before commiting

Please, use SVGO for diagram optimization before commiting (to get more clean diff):

svgo diagram/symbolic-execution.svg \
    --pretty \
    --enable=sortAttrs \
    --disable=removeEditorsNSData \
    --disable=cleanupIDs \

Tools structure

File tools.yml contains tools YAML description. E.g.:

  since: 2005
  input: C
  uses: lp_solve
  based: CIL
  description: random testing and direct execution
You can’t perform that action at this time.