# AEMB: An Automated Exploit Mitigation Bypassing Solution
## 1 Introduction  
With the advancement of cyber security, there is an increase in the study of software security, particularly software vulnerabilities [1; 2; 3]. Automated exploit generation (AEG) is one of the best ways to assess the exploitability of vulnerabilities and is drawing more and more attention. Software developers can utilize it to evaluate vulnerabilities and prioritize high-risk vulnerabilities to patch first, while defenders can generate security rules to block zero-day attacks through analyzing the yielded exploits. Given a proof-of-concept (PoC) sample that triggers a vulnerability, existing AEG solutions [4; 5; 6; 7; 8; 9] in general start exploring from the program state triggered by the PoC to generate exploits (EXPs). However, the above solutions have not separately discussed the exploit mitigations, which have become a standard security feature in modern systems due to the development of safe compilers and software security. Thus, it is demanded for AEG solutions to support automated bypassing of exploit mitigations. In general, there are several challenges in generating available EXPs that can bypass the exploit mitigations. Challenge 1: Modeling and automation of techniques for bypassing of exploit mitigation.In order to overcome the exploit mitigations, the EXP must deliver an attack payload in the program's operating memory. Generating a compliant payload necessitates modeling and automating the technique for bypassing the exploit mitigation. Therefore, a solution that can automate the implementation of techniques for bypassing existing exploit mitigation is required. Challenge 2: Modeling and automation of exploit techniques. The goal of AEG is to generate working EXPs, which should be able to satisfy the exploit constraints and payload constraints at the same time. The construction of exploit constraints need to refineand model the expert experience. Therefore, the automated exploit-mitigation bypassing solution needs to address the issue of modeling and automation of exploit techniques. Our solution: In this paper, we present an automated solution _AEMB_ to address the aforementioned challenges. It first generates payload constraints through exploit-mitigation bypassing model. Then, it constructs the exploit constraint based on the exploit experience and utilizes the solver to generate EXPs. The bypass of the exploit mitigation mechanism is divided into three stages: exploit mitigation identification, bypassing payload generation, and payload constraint construction. We analyze and research the features of the exploit mitigations and the bypassing method. Based on the above, _AEMB_ first automatically identifies the exploit mitigations. Then, the _AEMB_ conducts unified scheduling and generates the essential parameters of bypassing of exploit mitigations since there may be a combination of several exploit mitigations in the environment. Finally, _AEMB_ constructs exploit-mitigation-bypassing payload constraints and implements payload generation according to the key parameters ofbypassing exploit mitigations. After the payload constraint is constructed, generating proper EXPs is still difficult. It requires patience, sophisticated experience, and high precision. Even for an experienced human expert, it takes a long time to craft a working EXP sample. Regarding automated EXP generation, researchers manage to generate EXP samples that require high precision by sketching complex exploitation-related constraints via symbolic expressions and solving constraints to yield working EXPs. Previous work shows symbolic execution is one of the most effective approaches to do this work [4; 5; 6; 7; 9; 10; 11]. _AEMB_ also employs symbolic execution to generate EXPs. Through the analysis of existing exploit methods, _AEMB_ can automatically complete the generation of exploit constraints. Finally, through the solver, _AEMB_ can solve the exploit constraints and payload constraints to get the working EXP.