Initialize Exploit plugin

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Add onEipCorrupt callback to Exploit plugin

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Intercept EIP overriding and hook up Exploit plugin

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Find out all manipulatable memory region

A symbolic byte in memory suggests that it has
certain relationship with the symbolic input.

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Convert shellcode string to real shellcode

Shellcode string read from config file is escaped,
which means '\x61' becomes 'x61'. Store converted
shellcode into variable m_shellcode.

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Generate exploit

The only form of exploit we can generate now is:
[NOP sled][shellcode][EIP]

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Modify sample config.lua to use ExploitGenerator plugin

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Add m_eipValue variable to exploitGenerator plugin

Add m_eipValue variable instead of propagate eipValue everywhere.

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Terminate the state after all arrays are examined

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Create new states for exploit generation

Exploit generation does not really work, since exploit
constraints we add would conflict with input constraints.
To make exploit generation work, new states are generated
for each symbolic arraym. And input constraints inside
these states are removed before adding exploit constraints.

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Clean up long lines

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Make cross-objects symbolic array counts correctly

Symbolic array may spread across multiple memory
objects, so start address of a symbolic array
should not be reset under this condition.

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Do not search the kernel space for symbolic array

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Give the ability to generate more general exploit form

Add two features:
* Try to insert shellcode from the end of a symbolic
  array to the head of a symbolic array.
* Try to insert nop sled between the head of a symbolic
  array and the head of the shellcode array using binary
  search.

Signed-off-by: Lance Chen <cyen0312@gmail.com>