Fuzzing, as we discussed previously, explores the state space of a program using random inputs and binary instrumentation. This can be, as we've seen, slow. The ambition of symbolic execution (https://en.wikipedia.org/wiki/Symbolic_execution) is to allow the same exploration of state space, but without random probing. Searching for program crashes is one area of application, but it can also be used with proof tools. Symbolic execution, in a carefully written program, can let you demonstrate that your program can never reach error states. Rust has a partially implemented symbolic execution tool, seer (https://github.com/dwrensha/seer). The project uses z3, a constraint solver, to generate branching ...
Seer, a symbolic execution engine for Rust
Get Hands-On Concurrency with Rust now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
