Automated Vulnerability Detection in Go: Concolic Execution for Multi-Threaded Binaries

Settings

Always show controls

Qualities

UbiCast player

Keyboard shortcuts

Action

Key

Play / Pause

K or space

Mute / Unmute

Toggle fullscreen mode

Select next subtitles

Select next audio track

Toggle automatic slides maximization

Seek 5s backward

left arrow

Seek 5s forward

right arrow

Seek 10s backward

shift + left arrow or J

Seek 10s forward

shift + right arrow or L

Seek 60s backward

control + left arrow

Seek 60s forward

control + right arrow

Seek 1 frame backward

alt + left arrow

Seek 1 frame forward

alt + right arrow

Decrease volume

shift + down arrow

Increase volume

shift + up arrow

Decrease playback rate

Increase playback rate

Seek to end

end

Seek to beginning

beginning

Loading Click here to add:

Information on this media

15 views

Go powers critical infrastructure, but analyzing compiled Go binaries for security issues remains difficult in practice. In this talk, we present Zorya, an open-source concolic analysis framework designed to detect vulnerabilities directly at the binary level, including bugs that do not immediately crash the program. We will show how Zorya combines runtime state recovery, symbolic reasoning, and constraint solving with the Z3 SMT solver to analyze real-world Go targets. Attendees will learn where traditional approaches fall short, how Zorya helps uncover exploit-relevant paths, and how this can improve real security audit workflows.

Creation date: June 30, 2026

Speakers: Karolina Gorna (Security Researcher, Ledger)