Learn, hack!

URL

http://recon.cx/2013/slides/Recon2013-Richard%20Johnson-Taint%20Nobody%20Got%20Time%20for%20Crash%20Analysis%20-%20slides.pdf

File name

Recon2013-Richard%20Johnson-Taint%20Nobody%20Got%20Time%20for%20Crash%20Analysis%20-%20slides.pdf

File size

1.2 MB

MD5

2f22f127f244193880490ad5b9efbe15

SHA1

7216901b83106877e9bfcd393b3d9d4d98b971ec

The last decade has seen a large focus on vulnerability discovery automation with various methods of fuzzing and input generation, however little has been said about crash analysis or triage. This talk will discuss a powerful toolchain for crash analysis that incorporates the best available approaches for automated reasoning about memory access violation exceptions and overcomes limitations in currently available tools such as !exploitable and crashwrangler. In particular, we will discuss three key areas: dynamic taint analysis to track areas of memory that are influenced by user-controlled data, forward and backward taint slicing to isolate input bytes that lead to the crashing state, and finally forward symbolic execution to determine if the input can be modified to reach an alternate state giving more control over the execution of the program. In other words, our system will isolate the input bytes causing the crash and try to determine if your ReadAV can actually be turned into a WriteAV or code execution.