QSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing

on YouTube ↗24m

" summary

A fast concolic engine called QSYM implements instruction-level symbolic emulation by removing the IR layer and tightly integrating symbolic emulation with native execution via dynamic binary translation, using Intel Pin and the d3 solver. It loosens soundness (optimistic solving of the last path constraint), uses concrete environment re-execution to avoid syscall modeling, and runs ~16K LOC. Evaluation shows 14× more bugs than VUzzer on LAVA-M, outperforms Driller on 104/126 binaries, and finds 13 previously unknown bugs in real-world software.

AI-written summary · about

" chapters (23)

1. 0:00Intro
2. 0:33Two popular ways to find security bugs: Fuzzing & Concolic execution
3. 1:08Hybrid fuzzing can address their problems
4. 1:32Hybrid fuzzing has achieved great success in small- scale study
5. 2:03However, current hybrid fuzzing suffers from problems to scale to real-world applications
6. 2:28Our system, QSYM, addresses these issues by introducing several key ideas
7. 3:34Overview: Hybrid fuzzing in general
8. 6:22Intermediate representations (IR) are good to make implementations easier
9. 7:36Execute instructions directly without using intermediate layer
10. 7:56QSYM reduces the number of instructions to execute symbolically
11. 8:25State forking can reduce re-execution overhead for constraint generation
12. 10:01Re-execute to use concrete environment instead of kernel state forking
13. 10:30Models minimal system calls and uses concrete values
14. 11:04incomplete constraints
15. 14:07Solve constraints optimistically
16. 14:23Our decision: Solve only the last constraint in the path
17. 14:48In hybrid fuzzing, generating incorrect inputs are fine due to fuzzing
18. 16:12Evaluation questions
19. 16:37QSYM scales to real-world software
20. 17:13QSYM can generate test cases that fuzzing is hard to find
21. 17:53Compare QSYM with Driller, a state-of-the-art hybrid fuzzing
22. 18:48QSYM achieved more code coverage due to its better performance
23. 19:21Driller achieved more code coverage if nested branches exist

" related talks

• 19mSYZOS: Practical KVM fuzzingAlexander Potapenko · Linux Plumbers Conference 2025
• 50mWhat the FuzzCornelius Aschermann, Sergej Schumilo · Black Hat Europe 2019
• 29mVirtual Device Fuzzing Support in QEMUAlexander Bulekov, Bandan Das · KVM Forum 2020
• 32mFuzzing Zephyr Apps - Struggles of Dynamic Analysis on Embedded ApplicationsJayashree Srinivasan · Open Source Summit North America 2026
• 24mSymbiotic: finding bugs in C programsMarek Chalupa · DevConf.CZ 2019
• 16mELFuzz: Efficient Input Generation via LLM-driven Synthesis Over Fuzzer SpaceBrendan Dolan-Gavitt, Chuyang Chen · USENIX Security '25
• 42mCPU Fuzzing: Automatic Discovery of...Daniel Weber, Michael Schwarz · RuhrSec 2023
• 52mStructure aware fuzzingRéka Kovács · Meeting C++ 2018