Add travis-ci build configuration

Provide the ability to perform continuous integration using travis-ci.

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Initialize Exploit plugin

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Add onEipCorrupt callback to Exploit plugin

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Intercept EIP overriding and hook up Exploit plugin

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Find out all manipulatable memory region

A symbolic byte in memory suggests that it has
certain relationship with the symbolic input.

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Convert shellcode string to real shellcode

Shellcode string read from config file is escaped,
which means '\x61' becomes 'x61'. Store converted
shellcode into variable m_shellcode.

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Generate exploit

The only form of exploit we can generate now is:
[NOP sled][shellcode][EIP]

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Modify sample config.lua to use ExploitGenerator plugin

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Add m_eipValue variable to exploitGenerator plugin

Add m_eipValue variable instead of propagate eipValue everywhere.

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Terminate the state after all arrays are examined

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Create new states for exploit generation

Exploit generation does not really work, since exploit
constraints we add would conflict with input constraints.
To make exploit generation work, new states are generated
for each symbolic arraym. And input constraints inside
these states are removed before adding exploit constraints.

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Make cross-objects symbolic array counts correctly

Symbolic array may spread across multiple memory
objects, so start address of a symbolic array
should not be reset under this condition.

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Do not search the kernel space for symbolic array

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Give the ability to generate more general exploit form

Add two features:
* Try to insert shellcode from the end of a symbolic
  array to the head of a symbolic array.
* Try to insert nop sled between the head of a symbolic
  array and the head of the shellcode array using binary
  search.

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Ignore kernel space constraints

Kernel space constraints may be useless. And
could possibly prevent exploit from generating.

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Write exploit to file instead of stdout

Naming convention: exploit-[symbolicArrayStartAddress].bin

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Improve messages

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Output constraints to debug.txt for debugging purpose

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Add a timer to profile exploit generating performance

startTime: when Klee is first assigned to execute a block
exploreTime: when EIP is found tainted
endTime: when the state is terminated

Signed-off-by: Lance Chen <cyen0312@gmail.com>
Merge pull request #8 from Lance0312/bof

Add ExploitGenerator plugin for generating basic stack overflow exploit