binary programs. This method starts with a bounded symbolic execution of the target
program so as to explore as many paths as possible. Constraints of the explored paths are
collected and solved for inputs. The inputs will then be fed to the following interleaved
coverage-based fuzzing and concolic execution. As the paths explored by the bounded
symbolic execution may cover some unique paths that can be rarely reached by random …