Input discovery for unknown program binaries

A method to determine a valid input sequence for an unknown binary program, the method comprising:

• obtaining a first input sequence for an unknown binary program;
• performing a plurality of executions of the unknown binary program, each of the plurality of executions using a different one of a plurality of different mutations of the first input sequence as an input and each of the plurality of executions resulting in generation of a branch count and an execution trace;
• selecting one of the plurality of different mutations of the first input sequence when a first branch count, which is from the execution using the one of the plurality of different mutations as the input to the unknown binary program, is different from a second branch count from the execution of the unknown binary program using the first input sequence as the input to the unknown binary program;
• negating a branch condition in the execution trace corresponding to the selected one of the plurality of different mutations of the first input sequence;
• creating a symbolic path condition corresponding to the execution trace with the negated branch condition;
• and
• solving the symbolic path condition to obtain a second input sequence.

One or more non-transitory computer readable media that include instructions that when executed by one or more processors perform operations to determine a valid input sequence for an unknown binary program, the operations comprising:

• obtain a first input sequence for an unknown binary program;
• perform a plurality of executions of the unknown binary program, each of the plurality of executions using a different one of a plurality of different mutations of the first input sequence as an input and each of the plurality of executions resulting in generation of a branch count and an execution trace;
• select one of the plurality of different mutations of the first input sequence when a first branch count, which is from the execution using the one of the plurality of different mutations as the input to the unknown binary program, is different from a second branch count from the execution of the unknown binary program using the first input sequence as the input to the unknown binary program;
• negate a branch condition in the execution trace corresponding to the selected one of the plurality of different mutations of the first input sequence;
• creating a symbolic path condition corresponding to the execution trace with the negated branch condition;
• and
• solve the symbolic path condition to obtain a second input sequence.