Theoretically it should be possible for a binary analysis tool such as IDA to generate an input that will trigger a specific branch patch. So for example an executable that takes in a command line parameter, analyses the input and ventures down a specific branch path.

Is anyone aware of any tools/plugins that will generate me an input necessary to venture down a specific path? Inputs may be from a command line argument, network IO (I guess this is the most difficult, as it may require lots of protocol handshaking before interesting communication takes place), DLL export call parameters, file on disk.

It does seem like a difficult problem as lots of graph traversing would be necessary, but totally possible for an automated tool?


there are some projects working on it. The most prominent one may be angr. Please note that each of this projects (as of now) is not to be used in production, since they are mostly unstable, work only for corner cases (most SMT implementation) or take ages to return anything (dynamic symbolic execution).

Sadly, the use case you describe is not awfully trivial. Finding these inputs requires data flow analysis, which relies on semantic architecture information and a correctly recovered Control Flow Graph.

A program doing this needs to support most calling conventions and know the registers accessed by library functions (or analyse them as well). Graph traversal is not the issue here, but there are problems with handling loops etc.

  • Yup, an SMT solver is what you are looking for. And it's a slow, limited and unstable piece of software :) If you're interested in its internals, this guy knows what he is talking about sean.heelan.io/category/smt-solving Oct 7 '16 at 3:23

Check Out Ponce, winner of this year's Hex-Rays plugin context:


It's not quite "one-click" (you need to at least mark the inputs manually) but it does seem to work quite well. It uses Triton (with Z3) to do the heavy lifting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.