From TinyGo to gc Compiler: Extending Zorya's Concolic Framework to Real-World Go Binaries

2026-05-05

AI Summary

This work addresses the limitation of the existing Zorya framework, which supports only single-threaded TinyGo binaries and thus cannot analyze real-world, multithreaded Go programs compiled by the standard gc compiler. The authors extend Zorya to handle gc-compiled multithreaded Go binaries by leveraging GDB to dump and reconstruct operating system thread states, neutralizing the Go runtime’s preemption mechanism, and introducing a novel path coverage analysis method grounded in copy-on-write semantics to effectively uncover silent vulnerabilities hidden in unexecuted branches. Their approach integrates Ghidra’s P-Code intermediate representation with the Z3 SMT solver and is evaluated on 11 real-world vulnerabilities from projects such as Kubernetes, Go-Ethereum, and CoreDNS, successfully detecting seven binary-level flaws—including a silent integer overflow missed by other tools.

Abstract

Zorya is a concolic execution framework that lifts compiled binaries to Ghidra's P-Code intermediate representation and uses the Z3 SMT solver to detect vulnerabilities by reasoning over both concrete and symbolic values. Previous versions supported only single-threaded TinyGo binaries. In this paper, we extend Zorya to multi-threaded binaries produced by Go's standard gc compiler. This is achieved by restoring OS thread states from gdb dumps, neutralizing runtime preemption, and introducing overlay path analysis with copy-on-write semantics to detect silent vulnerabilities on untaken branches. We rigorously assess Zorya on 11 real-world vulnerabilities from production Go projects such as Kubernetes, Go-Ethereum, and CoreDNS. Our evaluation shows that Zorya detects seven bugs at the binary level, including a silent integer overflow detects no other evaluated tool finds without a manually written oracle.

Problem

• concolic execution
• Go binaries
• vulnerability detection
• multi-threaded programs
• binary analysis

Innovation

• concolic execution
• multi-threaded Go binaries
• overlay path analysis
• copy-on-write semantics
• binary-level vulnerability detection