## 9 Related Work
### Automatic Exploit Generation  
[PERSON] et al. [40] introduced an automatic patch-based solution that can generate exploit input for programs where patches for some vulnerabilities are available. Though effective in five Microsoft programs, its exploitation automaton is only able to cover a small fraction of vulnerability exploitation cases. In 2011, [PERSON] et al. proposed AEG [41]. AEG is, to our knowledge, the first end-to-end system for automatic exploit generation. By implementing preconditioned symbolic execution and targeting symbolic execution, it can automatically generate exploits for control-flow hijacking vulnerabilities. One year later, MAYHEM [14] was proposed, enhancing AEG in hybrid symbolic execution and index-based memory modeling. [PERSON] et al. proposed CRAX [12]. Based on the open-source binary symbolic execution engine SZE [18], CRAX dynamically monitors a POC input for a specific vulnerability in a concolic execution way. By collecting the path constraint and crafting the exploitable constraint, CRAX is able to generate exploits for vulnerabilities including format string, stack overflow, etc.  
Automatic exploit generation for heap-related vulnerabilities has also become a hot research topic nowadays. [PERSON] et al. proposed SHRIKe [42], a pseudo-random black-box search algorithm that searches for the inputs required to place the source of a heap-based buffer overflow or underflow next to heap-allocated objects that an exploit developer, or automatic exploit-generation system, wishes to read or corrupt. However, SHRIKe is only applicable to PHP programs. For binary programs, [PERSON] et al. proposed a pattern-based exploitability evaluation framework RELAY [31] capable of generating an exploit input to evaluate metadata corruption vulnerabilities. [PERSON] et al. proposed revers [43], a system able to generate exploits on heap-related vulnerabilities with POC input that cannot lead to the exploitable state provided. A novel layout-oriented fuzzing technique and a control-flow stitching solution were also introduced in revers. Based on revers, maze [44] was also proposed, modeling the heap-layouts techniques (such as heap feng shui), and implementing automated heap-layout manipulation. [PERSON] et al. proposed propose HAEPG [32], an automatic exploit framework that can utilize known exploitation techniques to guide exploit generation.  
However, none of the above AEG solutions make separate discussions and studies on vulnerability exploitation in an ASLR environment. [PERSON] proposed Marten [25], which is, to our knowledge, the first attempt on this issue. However, as mentioned inSection 2.2.2, we find the relocation Marten performs on an analysis-time exploit is only in a literal form, ignoring the complex semantic information imposed by the execution of the target program; therefore it would fail in circumstances where the execution of a program imposes complex constraint on the to-be-relocated parts of the analysis-time exploit. Our method, however, because of the semantic aware runtime exploit relocation technique it implements, can tackle this issue properly, providing solution much more complete than Marten's.