# AEMB: An Automated Exploit Mitigation Bypassing Solution
## 5 Evaluation
### Overview of Results  
We evaluated based on the above benchmark and conducted 54 sets of experimental evaluations for different software and different exploit mitigations and compared them with the **Rex**[8], which is one of the state-of-the-art open-source AEG solutions.  
In the evaluation, some security mechanisms in the specific application were not considered. For example, Bof, Fmt-3, Heap-uaf, and Heap-fmt were not tested to bypass the SAFESEH mechanism, which is not supported by Linux. Free MP3 CD Ripper 2.6, Free WMA MP3 Converter 1.8, etc. were not tested on the environment without GS safety mechanism, and Mini-stream Ripper 2.7.7.100 was not tested on the environment with the GS safety mechanism because the software is not open source and only the binary program can be obtained. Therefore, the security mechanism cannot be turned off or on after the source binary program is compiled.  
The overview of the evaluation is shown in Table 3. _AEMB_ was able to successfully generate the EXP in 11 applications and successfully bypassed 31 groups of exploit mitigation combinations, 24 of which were failed to bypass by Rex.  
In addition, we also tried to bypass the ASLR exploit mitigation for the test programs, which was not considered by Rex. The results are shown in Table 4. A total of 12 experiments were conducted, and SZMAB was able to successfully generate EXP in five of them.  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Program** & **Solution** & **Null** & **DEP** & **GS** & **GS + SAFESEH** & **DEP + GS** & **DEP + GS + SAFESEH** \\ \hline bof & **AEMB** & **Y** & **Y** & **N** & - & **N** & - \\ \cline{2-8}  & **Rex** & **Y** & **Y** & **N** & - & **N** & - \\ \hline Fmt-3 & **AEMB** & **Y** & **Y** & **Y** & - & **Y** & - \\ \cline{2-8}  & **Rex** & **N** & **N** & **N** & - & **N** & - \\ \hline BabyCookie & **AEMB** & **Y** & **Y** & **Y** & **Y** & **Y** & **Y** \\ \cline{2-8}  & **Rex** & **N** & **N** & **N** & **N** & **N** & **N** \\ \hline Heap-func & **AEMB** & **Y** & **N** & **Y** & **Y** & **N** & **N** \\ \cline{2-8}  & **Rex** & **N** & **N** & **N** & **N** & **N** & **N** \\ \hline Heap-uaf & **AEMB** & **Y** & **Y** & **Y** & **- & **Y** & **-** \\ \cline{2-8}  & **Rex** & **Y** & **Y** & **Y** & - & **Y** & - \\ \hline Heap-fmt & **AEMB** & **Y** & **Y** & **Y** & - & **Y** & - \\ \cline{2-8}  & **Rex** & **N** & **N** & **N** & - & **N** & **-** \\ \hline Free MP3 CD Converter 1.8 & **AEMB** & - & - & **Y** & **Y** & **Y** \\ \cline{2-8}  & **Rex** & - & - & **N** & **N** & **N** & **N** \\ \hline Free WMA MP3 Converter 1.8 & **AEMB** & - & - & **Y** & **Y** & **N** & **N** \\ \cline{2-8}  & **Rex** & - & - & **N** & **N** & **N** & **N** \\ \hline Adrenalin Player 2.2.5.3 & **AEMB** & - & - & **Y** & **Y** & **Y** \\ \cline{2-8}  & **Rex** & - & - & **N** & **N** & **N** & **N** \\ \hline AudioCoder 0.8.18 & **AEMB** & - & - & **N** & **N** & **N** & **N** \\ \cline{2-8}  & **Rex** & - & - & N & **N** & **N** & **N** \\ \hline \hline \end{tabular}
\end{table}
Table 3: List of results evaluated with _AEMB_ and open-source approach Rex on benchmarks. The first row of each column represents the experimental results of _AEMB_, the second row represents the experimental results of Rex, and the gray entries represent the cases where _AEMB_ can be exploited but Rex cannot.