Towards Systematic, Comprehensive Trace Generation for Behavioral Pattern Detection through Symbolic Execution

In reverse engineering, dynamic pattern detection is accomplished by collecting execution traces and comparing them to expected behavioral patterns. The traces are collected by manually executing the program in question and therefore represent only part of all relevant program behavior. This can lead to false conclusions about the detected patterns. In this paper, we propose to generate all relevant program traces by using symbolic execution. In order to reduce the created trace data, we allow to limit the trace collection to a user-selectable subset of the statically detected pattern candidates.