Execution Environment:
Interaction with network files, operating system, or external code can complicate the analysis

For this reason, this method is usually used alongside Fuzzing and Static Analysis, not as a complete replacement for them

Differences between the three methods

Methods Main Idea
Symbolic Execution
Path analysis with symbolic values ​​and constraints

Concrete Execution
Execution of the program with real values

Concolic Execution
Real execution with symbolic path analysis

In Concolic Execution, the actual execution of the program is the starting point. Path conditions are recorded. One of the conditions is changed to check the new path, and the solver tries to find a suitable input

This method is used in binary analysis, automatic testing, discovery of less-examined paths, and assistance in Fuzzing

@reverseengine