## 7 Evaluation
### Effectiveness in Partial Exploit Input Generation  
To answer RQ1, we compared ExpGen to open-sourced test-case generation engines. These engines include AFL, AFL++, which are systems based on fuzzing, S2E, a state-of-art symbolic execution engine, and QSYM, a well-known hybrid fuzzer. To determine whether ExpGen could perform better than current systems in generating a partial exploit that can successfully leak some runtime address information when fed to the target program, we evaluated these systems under benchmarks whose leakage type is 'forge-needed' in Table 2.  
We provide the same initial seed corpus to each engine in the conducted experiments. We also allocate for each engine the same computation resources including the processor cores, the memory limit, the time limit, etc. As ExpGen combines one AFL instance and two S2E instances to generate partial exploits, we customized the other engines mentioned above with the same computation capability including three logical processors, 64 GB memory with a time quota lasting for 2 h. The specific configuration for each engine is demonstrated in Table 3. We also provide an introspection process to check whether the generated test cases can execute the same path executed by the desired partial exploit, or, \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Dataset** & **Program** & **Vulnerability Type** & **Leakage Type** \\ \hline \multirow{4}{*}{test programs} & vul1 & integer overflow & forge-needed \\  & vul2 & integer overflow & explicit \\  &fmt1 & format string vulnerability & explicit \\  &fmt2 & format string vulnerability & explicit \\  & heap1 & use after free & explicit \\  & heap2 & heap overflow & explicit \\ \hline \multirow{4}{*}{RHG 2021 ljb} & question5 & stack overflow & explicit \\  & question6 & stack overflow & explicit \\  & question8 & format string vulnerability & forge-needed \\  & question13 & stack overflow & forge-needed \\ \hline \multirow{4}{*}{RHG 2021} & prob1 & stack overflow & forge-needed \\  & prob8 & format string vulnerability & forge-needed \\ \hline \multirow{4}{*}{plaidcft-2013} & ropasaurusrex & stack overflow & forge-needed \\ \hline \multirow{2}{*}{bambooforx} & ret2 libc3 & stack overflow & forge-needed \\ \hline \multirow{2}{*}{pwnable.tw} & start & stack overflow & forge-needed \\  & unexploitable & stack overflow & forge-needed \\ \hline \multirow{4}{*}{real applications} & ncompress 4.2.4 & stack overflow & forge-needed \\  & (CVE-2001-1413) & stack overflow & forge-needed \\  & iwconfig v26 (BID-8901) & stack overflow & forge-needed \\  & DNSTracer 1.9 & stack overflow & forge-needed \\  & (CVE-2017-9430) & stack overflow & forge-needed \\  & rsync 2.5.7 (CVE-2004-2093) & stack overflow & forge-needed \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Evaluation Benchmark. what is more, leak some address information when fed to the target program. For the latter case, the time cost in partial exploit generation was also calculated at runtime. Figure 8 demonstrates the results. We can see that ExpGen is able to generate partial exploits for the all list programs much more efficiently than other test-case generation engines. We believe the main reason for this phenomenon lies in the exploitation awareness uniquely exhibited by ExpGen. As for fuzzers such as AFL and AFL++, they generally generate cluster-program inputs by the branch-coverage statistics. They often represent a branch coverage by the first test case they encountered during generation time, discarding other test cases that exhibit the same branch coverage. This philosophy does not work for partial-exploit generation. As we can see from Figure 1, the path taken by the desired partial exploit can be covered easily by test cases generated through some simple data mutation. Thereby though carrying out an evident address-leakage feature, the exact partial exploit would simply not be viewed as promising, missing the opportunity to participate in the further round of test case generation.