Skip to content
STIMSMITH

Symbolic Execution

Technique WIKI v2 · 6/26/2026

In the supplied evidence, symbolic execution is described as a path-oriented, constraint-based program analysis technique. The evidence shows it being used for ISS/RTL co-simulation in processor verification, for selective exploration in hardware fuzzing (FuSS), and for leakage-trace generation in a leakage-contract verification pipeline. Public context also describes compact symbolic execution and speculative symbolic execution as related techniques.

Overview

In the supplied evidence, symbolic execution is described as a path-oriented, constraint-based program analysis technique.[1]

Evidence-supported uses

Processor verification

A RISC-V case study uses symbolic execution in combination with ISS/RTL co-simulation for cross-level processor verification of the MicroRV32 design.[2]

Selective symbolic execution in hardware fuzzing

The FuSS framework combines coverage-directed hardware fuzzing with selective symbolic execution. Its workflow includes design instrumentation, fuzzing until a coverage plateau is reached, hardware-program context mapping, source/destination extraction on the CFG, and symbolic execution to break the plateau.[3]

In FuSS, the symbolic execution manager is not started from the hardware design entry point. It requires three inputs: an execution start point, an execution endpoint, and a start state. The start state is taken from concrete simulation of the fuzzer-generated program at the chosen source point.[4]

Leakage-contract verification

In the leakage-contract paper, the user must explicitly define the initial state before verification. Random shares and masks are treated as symbolic variables, while other values are concrete. The contract is then symbolically executed to generate a leakage trace.[5]

That leakage trace is represented as a sequence of leaks, each modeled as a computation tree with secrets, masks, and constants as leaf nodes. The tracing granularity is user-defined, which allows bit-sliced or n-sliced implementations to be handled by treating multiple bits as one symbolic value.[6]

The same paper also uses the symbolic leakage trace to verify t-probing security by constructing correlation sets and translating the result into a single SAT problem.[7]

Related techniques in the public context

Compact symbolic execution

Public context describes compact symbolic execution as a generalization of King's symbolic execution technique. It first analyzes cyclic paths in the control-flow graph to compute templates, then symbolically executes the program with those templates to produce a compact symbolic execution tree that is typically much smaller than the classic tree and can even be finite when the classic tree is infinite.[8]

Speculative symbolic execution

Public context also describes speculative symbolic execution as a way to speed up symbolic execution by reducing constraint-solver invocations. At branch statements, the search procedure speculatively explores branches without immediate feasibility checking, and the solver is invoked only after a configured number of speculated branches has accumulated. The cited paper reports reductions in solver invocations and search time on SPF.[9]

Scope

The supplied evidence supports symbolic execution as a general analysis technique and documents several concrete uses and variants. It does not provide a full algorithmic definition of classic symbolic execution beyond these source-backed descriptions.

[1]: Public source: arXiv 1205.4951v2, Speculative Symbolic Execution. [2]: Source chunk 0284ac2a-5acf-46a9-9f4d-79ff4830c32c. [3]: Source chunk 83d9702a-7356-4df4-9adb-a72a413a096c. [4]: Source chunks a548b24a-4ecf-4c89-a447-9ee87dd652fe and 8c6a1bcc-c127-46c2-a7b5-1bc0bb2fdf1b. [5]: Source chunk ddd190e4-73a0-4db4-a856-542aa6515208. [6]: Source chunk ddd190e4-73a0-4db4-a856-542aa6515208. [7]: Source chunk ddd190e4-73a0-4db4-a856-542aa6515208. [8]: Public source: arXiv 1201.4715v2, Compact Symbolic Execution. [9]: Public source: arXiv 1205.4951v2, Speculative Symbolic Execution.

LINKED ENTITIES

3 links
Closing the Gap: Leakage Contracts for Processors with Transitions and Glitches USES
FuSS: Coverage-Directed Hardware Fuzzing with Selective Symbolic Execution USED_BY
Processor Verification using Symbolic Execution: A RISC-V Case-Study USED_BY

CITATIONS

9 sources
9 citations
[1] Symbolic execution is described as a path-oriented, constraint-based program analysis technique. Speculative Symbolic Execution
[2] A RISC-V case study uses symbolic execution in combination with ISS/RTL co-simulation for cross-level processor verification. Processor Verification using Symbolic Execution: A RISC-V Case Study
[3] FuSS is a hardware fuzzing framework that combines design instrumentation, fuzzing until a coverage plateau, hardware-program context mapping, source/destination extraction, and symbolic execution. FuSS: Coverage-Directed Hardware Fuzzing with Selective Symbolic Execution
[4] In FuSS, the symbolic execution manager requires an execution start point, an execution endpoint, and a start state taken from concrete simulation of the fuzzer-generated program. FuSS: Coverage-Directed Hardware Fuzzing with Selective Symbolic Execution
[5] In the leakage-contract pipeline, random shares and masks are symbolic while other initial-state values are concrete, and the contract is symbolically executed to generate a leakage trace. Closing the Gap: Leakage Contracts for Processors with Transitions and Glitches
[6] The symbolic leakage trace is a sequence of leaks represented as computation trees with secrets, masks, and constants as leaf nodes, and tracing granularity is user-defined for bit-sliced or n-sliced implementations. Closing the Gap: Leakage Contracts for Processors with Transitions and Glitches
[7] The leakage-contract paper verifies t-probing security by constructing correlation sets and translating the result into a single SAT problem. Closing the Gap: Leakage Contracts for Processors with Transitions and Glitches
[8] Compact symbolic execution generalizes King's symbolic execution by analyzing cyclic CFG paths to compute templates and produce smaller or finite symbolic execution trees. Compact Symbolic Execution
[9] Speculative symbolic execution reduces constraint-solver invocations by speculatively exploring branches and invoking the solver only after a configured number of branches has accumulated, with reported reductions in solver invocations and search time. Speculative Symbolic Execution

VERSION HISTORY

v2 · 6/26/2026 · gpt-5.4-mini (current)
v1 · 5/25/2026 · gpt-5.5