# AEMB: An Automated Exploit Mitigation Bypassing Solution
## 5 Evaluation
### Benchmarks  
We applied _AEMB_ to six test programs and seven real-world applications from CVE (Common Vulnerabilities and Exposures) [21] and CNVD (China National Vulnerability Database) [22]. The details of benchmarks are shown in Table 2.  
The benchmark was constructed for the evaluation, mainly based on the following rules:  
* The test programs should be able to cover different types of vulnerabilities, different operating systems, and different security mechanisms. Among them, the bof, Fmt-3, and BabyCookie vulnerabilities are mainly stack-related vulnerabilities, and Heap-func, Heap-uaf, and Heap-fmt are mainly heap-related vulnerabilities. Furthermore, they can cover Windows and Linux operating systems and different security mechanisms. * The real-world applications are mainly from user-mode applications with public vulnerabilities and PoC. Current exploit mitigations automated bypassing method is for the user-mode, not the kernel-mode. The focus of this paper is the exploit mitigations automated bypassing, and vulnerabilities mining is not our main job. Therefore, this paper selects the software with open vulnerabilities. We use both test programs and real-world applications in the evaluation. The real-world applications and the details of their vulnerabilities can be searched through the name of the application, corresponding version, and vulnerability number. The test programs are introduced below. **bof** The _bof_ is an ELF file, which is mainly run on a Linux operating system. The interaction of the program is through the command line, and it mainly receives data from STDIO. The program contains a stack overflow vulnerability. When the length of the string received is greater than a buffer length, the stack frame metadata will be overwritten, which can hijack the control flow of the program. **BabyCookie** The _BabyCookie_ is a PE file, which is mainly run on the Windows operating system. The interaction of the program is through the command line, and mainly receives data from external files. Unlike the bof program, the program uses a test dynamic link library, which has been compiled. To simulate the behavior of much existing software considering compatibility, the dynamic link library is compiled with a low-version compiler, without SAFESEH or other compiling-related system safety mechanisms. **Fmt-3** The _Fmt-3_ is an ELF file, which is mainly run on the Linux operating system. The interaction of the program is through the command line, and it mainly receives data from STDIO. The program contains a format string vulnerability, and external input can directly affect the format string parameters on the stack memory, resulting in the occurrence of format string vulnerability. There is a loop structure, and the ending condition is inputting an \"exit\" string. In the loop, the program can trigger the format string vulnerability multiple times. **Heap-func** The _Heap-func_ is a PE file, which is mainly run on the Windows operating system. The interaction of the program is through the command line, and it mainly receives data from STDIO. The program contains a heap overflow vulnerability; the overflow data can overwrite the function pointer of the structure on the heap space. The program will call this function pointer during subsequent executions. **Heap-uaf** The _Heap-uaf_ is an ELF file, which is mainly run on the Linux operating system. The interaction of the program is through the command line, and it mainly receives data from STDIO. The program contains a use-after-free vulnerability. A vulnerable structure in the program can continue to be used after being freed, and the vulnerable structure contains function pointers, which will be called during subsequent executions. After the target vulnerability structure is freed, other heaps can reoccupy it through allocation functions, and overwriting the function pointer in the vulnerability structure.