Abstract: To solve the problem in dynamic analysis for binary program that not all program execution paths can be explored, a algorithm based on execution path driven was presented. The main idea of the algorithm is to run the program in a controllable simulation instrument environment, and drive it to execute the program paths that can't be executed under current input set by modifying the value of program counter(PC)，so that multiple execution paths can be explored. Based on this algorithm, a prototype system of dynamic analysis for binary based on execution path driven was designed and implemented. Experiments results illustrate that the algorithm is effective in exploring execution path from binary program.

Key words: Path driven, Dynamic analysis, Binary program, Simulation instrument environment