## 8 Discussion  
This paper proposed ExpGen, a vulnerability exploitability evaluation solution for binary programs running in environments where the ASLR vulnerability-mitigation technique is adopted. Different from current AEG solutions, which generally follow an one-step exploit generation philosophy immediately crafting exploitable states that can directly hijack control flow when reaching a vulnerability-triggering state, ignoring the intermediate stages necessary to leak some address information from the target program's address space layout, ExpGen takes an iterative automation methodology employing three novel techniques, separately, partial-exploit-sensitive POC generation, exploitation-context-sensitive analysis-time exploit generation and dynamic runtime exploit relocation.  
The partial-exploit-sensitive POC-generation mechanism constructs a bidirectional enhancing hybrid fuzzer containing feedback-directed fuzzing and generation based symbolic execution. On the feedback-directed fuzzing engine side, we make address leakage an additional feedback source. On the generation-based symbolic-execution engine side, we only flip the path conditions not embodied by the partial exploit, while keep the remainder unchanged.  
The exploitation-context-sensitive analysis-time exploit generation actively records the leakage events happening during dynamic concolic execution, mimics known exploitation techniques and schedules them according to the specific exploitable state met during analysis, generating analysis-time exploit input that can carry out all the desired exploitation steps in the analysis-time environment. This analysis-time exploit is then fed to the runtime exploit-relocation engine, which by performing semantic aware payload relocation, makes analysis-time exploit dynamically adaptable to the runtime exploitation session.  
As demonstrated in Section 7, ExpGen obtains better results in partial-exploit generation than current test-case generation systems and is proven effective in automatically evaluating exploitability on vulnerable programs running in the ASLR environment. However, there are still improvements that can be made on ExpGen. We list them below for future works.  
* Semantic-aware payload generation. AEG systems generally takes shellcode or ROP sequence as payload to execute. When an exploitable state is discovered, the imitated exploitation techniques all try to direct the hijackable control flow onto these payload. However, as for current AEG systems, these payloads are often provided beforehand. This would often fail when the payload to be constructed must follow a specific constraint imposed by the program semantics. The automatic crafting of the desired payload in the exploitable state with program semantics information in mind is definitely a must for advanced AEG systems.
* Directed exploitable heap layout derivation. Automatic exploitable heap layout derivation is a critical problem for AEG systems when tackling heap-related vulnerabilities including heap overflow, use-after-free (abbr. UAF), double-free, etc., as exploitation of these vulnerabilities generally requires a specific POC input that can lead the program to reach an exact heap region layout. Though several works including RELAY [31], HAEPG [32], etc., have proposed some passive pattern-matching-based solutions selecting out the execution states met with the prerequisite of some exploitable pattern and then performing an AEG process upon them, directed automatic exploitable heap layout deduction, however, we believe, is an important researching topic that can enhance the efficiency in exploitable heap interaction sequence generation.
* Adaption onto multi-step exploitation automaton. Currently, ExpGen implements a two-step exploitation automaton, one step for address leakage, the other control flow hijack. This can, however, be easily adapted to multi-step exploitation automaton, upon which we may be able to evaluate the compositional exploitability with multiple vulnerabilities on hand.