Greybox Automatic Exploit Generation for Heap Overflows

No ratings

Presented at RuhrSecBochum 2019 by

Sean Heelan

In this talk we will introduce a completely grey-box approach to automatic exploit generation for heap overflows. Heap overflows are difficult to generate exploits for as they require reasoning over another dimension not present when considering stack overflows, namely the layout of the heap. We will show how this problem can be compartmentalised and addressed separately from the remainder of the exploit generation task. Furthermore, we will show how dynamic analysis and learning from existing inputs can be used in place of expensive white-box techniques that are traditionally used for exploit generation.