I. Introduction
At present, the symbolic execution[1] in the field of vulnerability detection has been get increasingly widespread attention and application. Compared with fuzzing randomly to generat test cases, the target software is understood futher deeply, code coverage of software testing is significantly improved, and thus pertinence test cases are generated, through using symbolic execution. But the serious problem of the symbolic execution is that because of the software branch number and a huge number of cycles, there is the exponential growth of execution path, and the test coverage can be not effectively improved. It has become the biggest bottleneck of the application of symbolic execution.