## 8 Discussion  
This paper presents CanaryExp, an automatic exploitability evaluation scheme for vulnerable binary programs that are protected by StackGuard. To solve the canary bypassing issue generally ignored by current AEG systems, CanaryExp employs three novel techniques: separate canary leakage POC generation, canary leakage sensitive fuzzing and dynamic canary relocation. The canary leakage POC generation mechanism monitors the execution trace along a vulnerability triggering input, with some canary leaking state intentionally forged through \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Program** & **Engine** & **Exploit Generation** & **PWN Ability** \\ \hline stack1 & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline intovf & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline fmt1 & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline fmt2 & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline heap1 & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline heap2 & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline babyrop2 & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline baby\_canary & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline canary & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline microwave & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline babypie & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline scv & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline Mary\_Morton & babyrop2 & ok & success \\  & REX & ok & fail \\ \hline babystack & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline proftpd 1.3.1 & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline iwconfig v26 & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline dnsq 2.77 & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline rsync 2.5.7 & CanaryExp & ok & success \\  & REX & ok & fail \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Experimental results of exploit generation. output analysis. Upon the constructed canary leaking state, some canary leaking samples are derived. The canary leaking analysis time exploit generation takes the canary leaking samples generated above as input, progressively pushing forward the multi-step exploitation automaton by firstly generating some incremental POC that can trigger some new vulnerability after leaking the runtime canary, then constructing an analysis time exploit that can not only leak the canary but also complete the exploitation in analysis time environment. The dynamic canary-relocation-based exploitability evaluation firstly collects metadata related to the desired canary, then with this information and the analysis time exploit in mind, constructs the exploitation session that can adapt to the runtime environment by intelligently leaking the canary and performing automatic relocation on the input exploit stream. As shown in Section 7, CanaryExp performs better in canary leakage test case generation, proven an effective solution in the automatic exploitation of vulnerable programs protected by StackGuard. However, there is still some room for improvement for CanaryExp, as discussed below. * **Automatic Exploitable Heap Layout Generation. ** Automatic generating exploitable heap layout is the most critical issue when evaluating the exploitability of heap-related vulnerabilities. Though some pattern-based solutions including [11; 13] have been proposed working as a per-state evaluation method in the blind exploration process on the path space of the target program, it is necessary to devise some directed analysis to improve the efficiency in exploit generation for heap vulnerabilities. * **Support on Multi-Threading Vulnerabilities. ** Current AEG systems generally calculate the semantics of program instructions in sequential execution order. However, this does not fit for case when the vulnerability arises only in multi-threading environments, e.g., concurrency vulnerabilities.