## 2 Motivation Example
### Inspirations for AEG
#### 2.2.2 Principles for Automatic Multi-Step Generation  
Though current AEG systems can already generate exploits for memory-corruption vulnerabilities, including stack overflow, heap overflow, and format-string vulnerability, effectively under environments where exploitation-mitigation mechanisms, including NX and stack canary, are deployed, for the demo example shown in Figure 1, they often fail in exploit generation. However, we can derive some key insights from the example, which we believe could be used as principles for advanced AEG system design and implementation. These principles are listed below. principle 1. Formulation of 2-step exploitation automaton. As we can see in Section 2.1, the exploitation process for the example program consists of two steps, separately one for address leakage, the other for control-flow hijack. Though the target program has an evident stack-overflow vulnerability, we should not trigger it immediately when a crashing event happens, but forge an address-leakage event instead. Only when this prerequisite is met can we push forward the exploitation-evaluation session onto the next stage, where we generate an exploit able to pwn at analysis time. However, as mentioned earlier, current AEG systems generally follow a one-step exploitation philosophy. When reaching a crashing point, they would immediately seek an exploitable state, irrespective of the intermediate leakage step that must be completed before. Therefore, we can conclude that the formulation of a 2-step exploitation automaton is a must to solve this issue. Figure 2: The general workflow of current AEG systems. principle 2. An iterative POC-generation mechanism with a partial-exploitation context in mind. As the exploitation process for complex vulnerabilities usually consists of multiple steps, deriving the final exploitable state directly through a single POC input discovered immediately by some blind fuzzer becomes no longer feasible, as it is hard for such a POC input to trigger all the desired exploitation effects. Therefore, a new iterative POC-generation mechanism should be devised to discover new exploitation steps and accumulate them onto the POC invariant held during each iteration, driving the multi-step exploitation automaton to continuously move forward. principle 3. Semantic-information-based fix on the gap between analysis-time exploitation and runtime exploitation. As for exploitability evaluation on vulnerabilities in environments where ASLR is enabled, during manual exploitation, analysts should perform runtime relocation on the module-related payload after leaking some sensitive address, in order to ensure that the control flow of the target program can be hijacked gracefully without triggering a segmentation fault. To our knowledge, among current AEG solutions only [PERSON] [25] has paid attention to the automatic anatomy. Through the leaked address, [PERSON] calculates the load base of the module the leaked address resides in, and then adds it to the corresponding payload part. For brevity, we call this literal relocation as it works directly on the literal form of input words. However, for programs involving complex computations, literal relocation often fails due to a lack of semantic information. For demonstration, let us review on the example program. This time, we uncomment line 13 in Figure 1a, thus, the compiled program performs an extra exclusive or operation on the input content. We now focus on the payload part \(Exp_{EIP}\) that would overwrite EIP in runtime. To overwrite EIP with 0x55569181, which is _backdoor_'s analysis time address, \(Exp_{EIP}\) would be evaluated as \(\sminus\)x91\(\backslash\)x61\(\backslash\)x46\(\backslash\)x45' in little endian by the analysis engine. Now, assume that, at the exploitation time we derive the load base of the main executable to be 0x80480000 from the leaked address, using literal relocation, we should adjust \(Exp_{EIP}\) with \(\sminus\)x91\(\backslash\)x81\(\backslash\)x8e\(\backslash\)xc5'.