一句话：提出灰盒 concolic 测试，用轻量插桩、无需 SMT 求解器地系统探索执行路径，覆盖率与缺陷发现均优于基线。
本文提出灰盒 concolic 测试（grey-box concolic testing），一种基于路径的测试用例生成方法，旨在结合白盒模糊测试与灰盒模糊测试的优点。与传统的 concolic 测试（白盒模糊测试）类似，该技术会系统性地探索被测程序的执行路径；但与白盒方法不同，它只依赖轻量级插桩，并且不使用 SMT 求解器，从而保留了灰盒模糊测试的简洁性。作者在名为 Eclipser 的系统中实现了该技术，并将其与当时最先进的灰盒模糊测试工具（包括 AFLFast、LAF-intel、Steelix 和 VUzzer）以及符号执行器 KLEE 进行了对比实验。实验结果表明，该技术取得了更高的代码覆盖率，并发现了比其他工具更多的缺陷。
We present grey-box concolic testing, a novel path-based test case generation method that combines the best of both white-box and grey-box fuzzing. At a high level, our technique systematically explores execution paths of a program under test as in white-box fuzzing, a.k.a. concolic testing, while not giving up the simplicity of grey-box fuzzing: it only uses a lightweight instrumentation, and it does not rely on an SMT solver. We implemented our technique in a system called Eclipser, and compared it to the state-of-the-art grey-box fuzzers (including AFLFast, LAF-intel, Steelix, and VUzzer) as well as a symbolic executor (KLEE). In our experiments, we achieved higher code coverage and found more bugs than the other tools.