# Why backward symbolic execution is so unpopular?

Looking at the DARPA’s Cyber Grand Challenge, it seems that (forward) Symbolic Execution (SE) is the tool of choice for all the top teams. For example:

• Mayhem, the winner of the \$2 millions prize
• Driller, ranked 2nd or 3rd.

Maybe this is a stupid question, but if the purpose is to find the input that reach a location, e.g. the one that causes SIGSEGV, then intuitively going backward from that location is much easier that searching from forward. However, obviously those well-known scientists did not think so, and I wonder why.

Moreover, papers about forward SE appear in all software engineering conferences, and there is a survey every 2 or 3 years. But I don't remember the last time I read a paper about backward SE (that's why there is this possibly stupid question).

Are there any challenges that make backward SE either:

• significantly more difficult to implement than forward SE, or
• much less scalable than forward SE, or
• ...