I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it give me a set of inputs to the program that would result in that state. Can Ghidra do this? Or does anyone know if there are any other tools which can?

  • 2
    I think what you want is rather forward symbolic execution. Angr can do it. You would execute the program from starting state to the goal state while marking the inputs as symbolic. You can add the constraints to the goal state such as the value of this register must be equal to this value. – 0xec Aug 2 '19 at 9:50

Looks like you also asked the question over on the Ghidra GitHub page and the answer there is the same.

Essentially, no, Ghidra does not do that. But you should investigate Angr, Klee, Bitblaze, or others.

Your Answer

