Hybrid analysis combines static analysis and dynamic analysis.
Coverage Measures
- Statement coverage
The percentage of statements executed by some test. - Branch coverage
The percentage of branch outcomes taken.
Both reveal untested paths but cannot warn about missing code.
Concolic Testing
Concolic testing is concrete plus symbolic execution. It walks the program path by path instead of guessing inputs, getting past checks random fuzzing almost never hits, such as magic values, checksums, and parser keywords.
- Run the program on a real input.
- Track the branch conditions symbolically along the path taken, forming the path constraint.
- Negate one condition to target a new path, and pass the constraint set to an SMT solver.
- The solver returns a concrete input satisfying the new set.
- Run that input and repeat.
The costs are expensive solver queries and path explosion.
Examples:
- SAGE
- KLEE
- fuzzgrind
Penetration Testing
Penetration testing has testers act as adversaries and try to break in. Effectiveness depends on tester skill and realistic rules of engagement. Kali Linux bundles the common tools.
