Taint Analysis

Taint analysis is used to know at each program point what part of memory or register are controllable by the user input. According to the instruction semantics the taint is spread over the execution.

Dynamic Symbolic Execution

The symbolic execution engine transforms the control flow and the data flow of the program into symbolic expressions. These expressions may be used to know at each program point what values can hold a register or part of memory.

SMT Solver Interface

This component allows you to solve symbolic expressions. As all expressions are on the SMT2-LIB representation, you can plug any SMT solver which support this format. By default, Triton is interfaced with the Z3 SMT solver.