I would like more information about the mathematical foundations of vulnerability and exploit development.online sources or books in the right direction will be helpful.


I would read up on static program analysis

Static program analysis is the analysis of computer software that is performed without actually executing programs (analysis performed on executing programs is known as dynamic analysis). In most cases the analysis is performed on some version of the source code and in the other cases some form of the object code.

dynamic program analysis,

Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. For dynamic program analysis to be effective, the target program must be executed with sufficient test inputs to produce interesting behavior

abstract interpretation,

In computer science, abstract interpretation is a theory of sound approximation of the semantics of computer programs, based on monotonic functions over ordered sets, especially lattices. It can be viewed as a partial execution of a computer program which gains information about its semantics (e.g. control-flow, data-flow) without performing all the calculations.

symbolic execution,

In computer science, symbolic execution (also symbolic evaluation) refers to the analysis of programs by tracking symbolic rather than actual values, a case of abstract interpretation. The field of symbolic simulation applies the same concept to hardware. Symbolic computation applies the concept to the analysis of mathematical expressions. Symbolic execution is used to reason about all the inputs that take the same path through a program.

symbolic computation,

In mathematics and computer science, computer algebra, also called symbolic computation or algebraic computation is a scientific area that refers to the study and development of algorithms and software for manipulating mathematical expressions and other mathematical objects

symbolic simulation,

In computer science, a simulation is a computation of the execution of some appropriately modelled state-transition system. Typically this process models the complete state of the system at individual points in a discrete linear time frame, computing each state sequentially from its predecessor.

model checking,

In computer science, model checking aka property checking refers to the following problem: Given a model of a system, exhaustively and automatically check whether this model meets a given specification.

might want to read System Assurance: Beyond Detecting Vulnerabilities.

Rolf probably has a ton of really good input on this subject. Read about his advice here


As it turns out, somebody asked roughly the same question on reddit about a year ago and I posted a rather extensive answer to it, and I have continued to edit it in the meantime.

  • 3
    Would you mind quoting the most important parts here in case Reddit goes offline for whatever reason? – Peter Andersson Apr 11 '13 at 19:07
  • Well ... I think it doesn't make sense to simultaneously maintain two copies of this. As I said, I still edit it from time to time, and duplicating it means that I would have to edit multiple copies of it in the future. But I suppose you are referring to StackExchange's "quote some relevant portion to demonstrate that the link pertains to the question" policy. – Rolf Rolles Apr 11 '13 at 19:16
  • Yeah I get why you wouldn't want to maintain two versions to be honest. Not sure how solve it "properly". Quote and copy the entire thing without the links? The list if really good imo. – Peter Andersson Apr 11 '13 at 19:22
  • 3
    The indexing and search is much better on Stack Overflow than on Reddit imo so I would recommend maintaining the list here. Just my 2cents. – ekse Apr 11 '13 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.