# AEMB: An Automated Exploit Mitigation Bypassing Solution
## 5 Evaluation
### Analysis of Results  
_AEMB_ can bypass the common DEP, GS, and SAFESEH exploit mitigations and it can successfully exploit 29 cases that REX did not. Rex can generate ROP based on program context, but it cannot bypass the GS and SAFESEH mechanisms. However, _AEMB_ gives more consideration to other exploit mitigations. In addition, Rex does not fit well with Windows and therefore cannot generate code for Windows applications, but _AEMB_ has been adapted forWindows and Linux platforms. In summary, compared to Rex, _AEMB_ has stronger capability for exploit-mitigation bypassing and a wider application range. There are three main reasons for the failure of some cases: 1. symbolic execution platform and symbolic execution performance limitations; 2. the program running environment being unable to meet the exploit mitigations bypassing conditions; 3. functional limitation of _AEMB_. The failure cases due to the symbolic execution platform and symbolic execution performance limitations are _AudioCoder_ and _Nidesoft MP3 Converter_. The reasons are as follows:  
* _AudioCoder_ is complicated. When the system automatically exploits its vulnerability, it still cannot produce results until all memory resources are consumed. When symbolic execution analyzes this application, problems such as constraint explosions are caused due to the large program scale and complex business logic, so the system cannot generate EXP. * The input of _Nidesoft MP3 Converter_ vulnerabilities needs to be copied and pasted into the software window. Therefore, limited by the symbolic execution platform, the system cannot symbolize this type of inputs and cannot perform symbolic execution analysis on it, so it cannot generate EXP. At present, the system can only symbolize file-type input and STDIO input. Therefore, the input that triggers vulnerabilities such as network sending, mouse clicks, etc. cannot be analyzed by the system, and the system cannot automatically generate the EXP of the above-mentioned input methods. Since the program's operating environment cannot meet the exploit mitigation bypass conditions, some cases failed, such as _bof_ with GS, _Heap-func_ with DEP, and _Free WMA MP3 Converter_ with DEP + GS. Since the Linux system does not support the BEH mechanism, it cannot meet the GS bypassing conditions. Therefore, _AEMB_ cannot generate the EXP for _bof_ with GS. For heap-related vulnerability, DEP bypassing often involves stack-migration operations. However, at the moment of hijacking EIP, no ROP gadget conforms to the stack migration in the running environment of _Heap-func_, so _AEMB_ cannot generate the EXP for _Heap-func_ with DEP. Similar to _Heap-func_, the _Free WMA MP3 Converter_ failed because there is no suitable ROP gadget to adjust the stack. \begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline
**Program** & **bof** & **Fmt-3** & **BabyCookie** & **Heap-func** & **Heap-uaf** & **Heap-fmt** \\ \hline ASLR & Y & N & Y & Y & N & N \\ ASLR+DEP & Y & N & N & N & N & N \\ \hline \hline \end{tabular}
\end{table} 
Table 4: List of results evaluated with _AEMB_ with ASLR exploit mitigation. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Program** & **Solution** & **Null** & **DEP** & **GS** & **GS + SAFESEH** & **DEP + GS** & **DEP + GS + SAFESEH** \\ \hline Nidesoft MP3 Converter 2.6.18 & **AEMB** & - & - & N & N & **N** & **N** \\ \cline{2-7}  & Rex & - & - & N & N & N & N \\ \hline Mini-stream Ripper 2.7.7.100 & **AEMB** & **Y** & **Y** & - & - & - & - \\ \cline{2-7}  & Rex & **N** & **N** & - & - & - & - \\ \hline DNSTracer 1.9 & **AEMB** & **Y** & **Y** & **N** & - & N & - \\ \cline{2-7}  & Rex & Y & Y & N & - & N & - \\ \hline \hline \end{tabular}
\end{table} 
Table 3: _Cont._The case of exploit failure due to system function limitations is mainly reflected in the bypassing of the ASLR. However, the bypassing method for ASLR is mainly passive, using known addresses or using addresses in memory pages that are disabled for randomization.