Zorya: Automated Concolic Execution of Single-Threaded Go Binaries

2025-12-11

AI Summary

Symbolic execution tools for vulnerability detection in Go binaries suffer from high runtime complexity and poor scalability, rendering them ineffective for practical use. Method: This paper proposes the first lightweight symbolic execution framework tailored to Go panics. It introduces a panic-reachability gating mechanism and a multi-layer path filtering strategy to focus analysis exclusively on panic-related execution paths. A function-level analysis mode avoids costly global context modeling. Efficiency is further enhanced through synergistic optimizations: Ghidra P-Code–based binary translation, branch-sensitive concolic execution, and explicit panic-triggering path modeling. Results: Evaluated on five real-world Go vulnerabilities, the framework achieves 1.8–3.9× average speedup, filters 33–70% of irrelevant branches, and attains 100% panic detection—surpassing existing tools (which detect at most two). Under function-level mode, analysis speed improves by approximately two orders of magnitude.

Technology Category

• Search and Optimization: Evaluation and Analysis
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Reasoning under Uncertainty: Stochastic Optimization

Application Category

• Security and Privacy: Large-scale security measurements
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods

Abstract

Go's adoption in critical infrastructure intensifies the need for systematic vulnerability detection, yet existing symbolic execution tools struggle with Go binaries due to runtime complexity and scalability challenges. In this work, we build upon Zorya, a concolic execution framework that translates Go binaries to Ghidra's P-Code intermediate representation to address these challenges. We added the detection of bugs in concretely not taken paths and a multi-layer filtering mechanism to concentrate symbolic reasoning on panic-relevant paths. Evaluation on five Go vulnerabilities demonstrates that panic-reachability gating achieves 1.8-3.9x speedups when filtering 33-70% of branches, and that Zorya detects all panics while existing tools detect at most two. Function-mode analysis proved essential for complex programs, running roughly two orders of magnitude faster than starting from main. This work establishes that specialized concolic execution can achieve practical vulnerability detection in language ecosystems with runtime safety checks.

Problem

• Detects vulnerabilities in Go binaries via concolic execution
• Addresses scalability and runtime complexity in symbolic execution
• Filters paths to focus on panic-relevant bugs efficiently

Innovation

• Concolic execution framework for Go binaries
• Multi-layer filtering for panic-relevant paths
• Function-mode analysis for complex programs