how to explore all execution paths

[yujack008]

i want to explore all execution paths in function.
pseudocode for my idea

symbolic_pc = self.se_engine.eval_expr(ExprId("IRDst", 64))
if type(symbolic_pc) != ExprInt: #one to two paths
      # True
      se_t = se.clone()
      se_t.add_constraint(cond)
      se_t.set_pc(dst_true)
      explore_paths.add(se_t)
      
      # False
      se_f = se.clone()
      se_f.add_constraint(cond ^ ExprInt(1, cond.size))
      se_f.set_pc(dst_false)
      explore_paths.add(se_f)
      return 

[serpilliere]

Hi @yujack008

If you mean by symbolic execution, in general you have to do the following steps:

• first, execute the irblock with symbolic execution
• this gives you the final IRDst value as returned value

This return value may have multiple types:

• ExprInt => in this case, you can add this value to the todo list to symbolic execute next.
• ExprId => it's a case where you have for example a jump to a register with undetermined value. Here you don't have any clues on the value
• ExprOp => a value depending on operators that don't give simple value. You are lacking some clues here as well.
• ExprMem(...) => a bit like the previous case, but the value comes from the memory, and has not been 'resolved'
• ExprCond(cond, A, B) => in the case, you may look at the nature of expression A and B, which can be one of the previous types above!

So in real code, the problem may be a bit harder!