Software Crash Analysis for Automatic Exploit Generation on Binary Programs
All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask)