T. Avgerinos, A. Rebert, S. K. Cha, and D. Brumley, Enhancing symbolic execution with VeriTesting, Proceedings of the 36th International Conference on Software Engineering, ICSE '14, 2014.
DOI : 10.1145/2568225.2568293

D. Babic, L. Martignoni, S. Mccamant, and D. Song, Statically-directed dynamic automated test generation, ISSTA. ACM, 2011.

G. Balakrishnan and T. Reps, WYSINWYX, ACM Transactions on Programming Languages and Systems, vol.32, issue.6, 2010.
DOI : 10.1145/1749608.1749612

S. Bardin, P. Baufreton, N. Cornuet, P. Herrmann, and S. Labbé, Binary-Level Testing of Embedded Programs, 2013 13th International Conference on Quality Software, 2013.
DOI : 10.1109/QSIC.2013.49

S. Bardin, O. Chebaro, M. Delahaye, and N. Kosmatov, An All-in-One Toolkit for Automated White-Box Testing, Tests and Proofs -8th International Conference, 2014.
DOI : 10.1007/978-3-319-09099-3_4

S. Bardin, M. Delahaye, R. David, N. Kosmatov, M. Papadakis et al., Sound and Quasi-Complete Detection of Infeasible Test Requirements, 2015 IEEE 8th International Conference on Software Testing, Verification and Validation (ICST), 2015.
DOI : 10.1109/ICST.2015.7102607

S. Bardin and P. Herrmann, Osmose: Automatic structural testing of executables. Software Testing, Verification Reliability, 2011.

S. Bardin, P. Herrmann, J. Leroux, O. Ly, R. Tabary et al., The BINCOA Framework for Binary Code Analysis, Computer Aided Verification -23rd International Conference, CAV 2011, 2011.
DOI : 10.1007/978-3-642-14295-6_27
URL : https://hal.archives-ouvertes.fr/hal-01006499

S. Bardin, P. Herrmann, and F. Védrine, Refinement-Based CFG Reconstruction from Unstructured Programs, Verification, Model Checking, and Abstract Interpretation -12th International Conference, VMCAI 2011, 2011.
DOI : 10.1007/978-3-642-14295-6_27

A. Bessey, K. Block, B. Chelf, A. Chou, B. Fulton et al., A few billion lines of code later, Communications of the ACM, vol.53, issue.2, p.2010
DOI : 10.1145/1646353.1646374

D. Brumley, P. Poosankam, D. Song, and J. Zheng, Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications, 2008 IEEE Symposium on Security and Privacy (sp 2008), 2008.
DOI : 10.1109/SP.2008.17
URL : http://www.cs.cmu.edu/~dbrumley/pubs/apeg.pdf

R. Brummayer and A. Biere, Boolector: An Efficient SMT Solver for Bit-Vectors and Arrays, TACAS, 2009.
DOI : 10.1007/978-3-540-78800-3_24
URL : http://fmv.jku.at/papers/BrummayerBiere-TACAS09.pdf

J. Caballero, G. Grieco, M. Marron, and A. Nappa, Undangle: early detection of dangling pointers in use-after-free and double-free vulnerabilities, Proceedings of the 2012 International Symposium on Software Testing and Analysis, ISSTA 2012, 2012.
DOI : 10.1145/2338965.2336769

C. Cadar, D. Dunbar, D. Engler, and . Klee, Unassisted and automatic generation of high-coverage tests for complex systems programs, Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation, OSDI'08. USENIX Association, 2008.

C. Cadar, V. Ganesh, P. M. Pawlowski, D. L. Dill, and D. R. Engler, Exe: Automatically generating inputs of death, Proceedings of the 13th ACM Conference on Computer and Communications Security, CCS '06, 2006.

C. Cadar and K. Sen, Symbolic execution for software testing, Communications of the ACM, vol.56, issue.2, p.2013
DOI : 10.1145/2408776.2408795

S. Cesare, Bugalyze.com -detecting bugs using decompilation and data flow analysis, BlackHatUSA, 2013.

S. K. Cha, T. Avgerinos, A. Rebert, and D. Brumley, Unleashing Mayhem on Binary Code, 2012 IEEE Symposium on Security and Privacy, 2012.
DOI : 10.1109/SP.2012.31
URL : http://doi.org/10.1109/sp.2012.31

O. Chebaro, P. Cuoq, N. Kosmatov, B. Marre, A. Pacalet et al., Behind the scenes in SANTE: a combination of static and dynamic analyses, Automated Software Engineering, vol.25, issue.7, p.2014
DOI : 10.1145/1146238.1146255
URL : https://hal.archives-ouvertes.fr/hal-00818147

V. Chipounov, V. Kuznetsov, and G. Candea, The S2E Platform, ACM Transactions on Computer Systems, vol.30, issue.1
DOI : 10.1145/2110356.2110358

H. Cui, G. Hu, J. Wu, and J. Yang, Verifying systems rules using rule-directed symbolic execution, Architectural Support for Programming Languages and Operating Systems, ASPLOS, 2013.
DOI : 10.1145/2451116.2451152

. Darpa, Cyber grand challenge

R. David, S. Bardin, J. Feist, J. Marion, L. Mounier et al., Specification of concretization and symbolization policies in symbolic execution, Proceedings of the 25th International Symposium on Software Testing and Analysis, ISSTA 2016, 2016.
DOI : 10.1109/ASE.2004.1342749
URL : https://hal.archives-ouvertes.fr/hal-01721492

R. David, S. Bardin, J. Feist, J. Marion, M. Potet et al., BINSEC/SE: A Dynamic Symbolic Execution Toolkit for Binary-Level Analysis, 2016 IEEE 23rd International Conference on Software Analysis, Evolution, and Reengineering (SANER), 2016.
DOI : 10.1109/SANER.2016.43
URL : https://hal.archives-ouvertes.fr/hal-01721502

A. Djoudi and S. Bardin, BINSEC: Binary Code Analysis with Low-Level Regions, TACAS 2015, 2015.
DOI : 10.1007/978-3-662-46681-0_17

T. Dullien and S. Porst, Reil: A platform-independent intermediate representation of disassembled code for static code analysis. CanSecWest, 2009.

P. Emanuelsson and U. Nilsson, A Comparative Study of Industrial Static Analysis Tools, Electronic Notes in Theoretical Computer Science, vol.217, 2008.
DOI : 10.1016/j.entcs.2008.06.039

J. Feist, L. Mounier, and M. Potet, Statically detecting use after free on binary code, Journal of Computer Virology and Hacking Techniques, vol.89, issue.3, p.2014
DOI : 10.1016/S1571-0661(04)81042-9

J. Feist, L. Mounier, and M. Potet, Guided Dynamic Symbolic Execution Using Subgraph Control-Flow Information, Proceedings of SEFM, 2016.
DOI : 10.1109/ICSE.2015.80

P. Godefroid, Higher-order test generation, Proceedings of the 32nd ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2011, 2011.
DOI : 10.1145/1993498.1993529
URL : http://research.microsoft.com/en-us/um/people/pg/public_psfiles/pldi2011.pdf

P. Godefroid, N. Klarlund, and K. Sen, Dart: Directed automated random testing, SIGPLAN Not, vol.40, issue.6, 2005.

P. Godefroid, M. Y. Levin, and D. A. Molnar, Automated whitebox fuzz testing, Proceedings of the Network and Distributed System Security Symposium, NDSS 2008, 2008.

P. Godefroid, M. Y. Levin, and D. A. Molnar, SAGE, Communications of the ACM, vol.55, issue.3, p.2012
DOI : 10.1145/2093548.2093564

P. Goodman, Pointsto: Static use-after-free detector for c/c++. https://blog.trailofbits.com/2016/03/09/the- problem-with-dynamic-program-analysis

I. Haller, A. Slowinska, M. Neugschwandtner, and H. Bos, Dowsing for overflows: A guided fuzzer to find buffer boundary violations, Proceedings of the 22Nd USENIX Conference on Security, SEC'13. USENIX Association, 2013.

. Hex-rays, Hex-rays decompiler

W. Landi, Undecidability of static analysis, ACM Letters on Programming Languages and Systems, vol.1, issue.4, 1992.
DOI : 10.1145/161494.161501

B. Lee, C. Song, Y. Jang, T. Wang, T. Kim et al., Preventing Use-after-free with Dangling Pointers Nullification, Proceedings 2015 Network and Distributed System Security Symposium, 2015.
DOI : 10.14722/ndss.2015.23238

M. Li, Y. Chen, L. Wang, and G. Xu, Dynamically validating static memory leak warnings, Proceedings of the 2013 International Symposium on Software Testing and Analysis, ISSTA 2013, 2013.
DOI : 10.1145/2483760.2483778
URL : http://www.ics.uci.edu/~guoqingx/papers/li-issta13.pdf

R. Majumdar and K. Sen, Hybrid Concolic Testing, 29th International Conference on Software Engineering (ICSE'07), 2007.
DOI : 10.1109/ICSE.2007.41

S. Nagarakatte, J. Zhao, M. M. Martin, and S. Zdancewic, Softbound: highly compatible and complete spatial memory safety for c, PLDI, pp.245-258, 2009.

S. Nagarakatte, J. Zhao, M. M. Martin, and S. Zdancewic, CETS, Proceedings of the 2010 international symposium on Memory management, ISMM '10, 2010.
DOI : 10.1145/1806651.1806657

N. Nethercote and J. Seward, Valgrind: A framework for heavyweight dynamic binary instrumentation. SIGPLAN Not, 2007.

K. Sen, D. Marinov, and G. Agha, Cute: A concolic unit testing engine for C. SIGSOFT Softw, Eng. Notes, issue.5, p.30, 2005.

K. Serebryany, D. Bruening, A. Potapenko, and D. Vyukov, Addresssanitizer: A fast address sanity checker, Proceedings of the 2012 USENIX Conference on Annual Technical Conference, USENIX ATC'12. USENIX Association, 2012.

N. Stephens, J. Grosen, C. Salls, A. Dutcher, R. Wang et al., Driller: Augmenting Fuzzing Through Selective Symbolic Execution, Proceedings 2016 Network and Distributed System Security Symposium, 2016.
DOI : 10.14722/ndss.2016.23368
URL : https://doi.org/10.14722/ndss.2016.23368

M. Sutton, A. Greene, and P. Amini, Fuzzing: Brute Force Vulnerability Discovery, 2007.

N. Williams, B. Marre, and P. Mouy, On-the-fly generation of K-path tests for C functions, Proceedings. 19th International Conference on Automated Software Engineering, 2004., 2004.
DOI : 10.1109/ASE.2004.1342749

T. Xie, N. Tillmann, J. De-halleux, and W. Schulte, Fitness-guided path exploration in dynamic symbolic execution, 2009 IEEE/IFIP International Conference on Dependable Systems & Networks, 2009.
DOI : 10.1109/DSN.2009.5270315

C. Zamfir and G. Candea, Execution synthesis, Proceedings of the 5th European conference on Computer systems, EuroSys '10, 2010.
DOI : 10.1145/1755913.1755946

Y. Zhang, Z. Clien, J. Wang, W. Dong, and Z. Liu, Regular Property Guided Dynamic Symbolic Execution, 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering, 2015.
DOI : 10.1109/ICSE.2015.80