CRAXAn Automatic Exploit Generating System

Lance Chen

Software Quality Laboratory, NCTU

Aug 21, 2014

Disclaimer

CRAX is not my personal project,but built by many members of the SQLab.

About me

Lance Chen

▶ MS in Computer Scienceand Engineering Instituteof NCTU

▶ A System and NetworkAdministrator in NCTUCSCC for four years

About SQLab

▶ Advisor: Prof. Shih-kun Huang▶ Current members:

▶ Ph.D student * 2▶ MS student * 8

▶ Central Idea: Bugs are Backdoors

How do you feel?

Figure 1: A) Rage

Figure 2: B) Excited...

Figure 3: A) Rage Figure 4: B) Excited...

Unclear relation between input and crashes

Symbolic Execution

x : X

PC : true

x : X

PC : X ≥ 0

x : X

PC : X < 0

x : X y : X+100

PC : (X ≥ 0) ∧ (X+100 = 2011)

x : X y : X+100

PC : (X ≥ 0) ∧ (X+100 ≠ 2011)

x : X y : X+100

PC : (X < 0) ∧ (X+100 = 2011)

x : X y : X+100

PC : (X < 0) ∧ (X+100 ≠ 2011)

Infeasible!

S2E

http://s2e.epfl.ch/

X86 Instructions

(32-bit)

TCG IRs

LLVM IRs (bitcode)

X86 Instructions

(64-bit)

KLEE (Symbolic execution)

CPU (Concrete execution)

QEMU

Exploit Generating Progress

▶ Symbolic data propagating and constraintscollecting

▶ process crashed and symbolic eip detected▶ Reasoning out exploit

Exploit Generating Progress

Exploit Generating Progress

Exploit Generating Progress

Exploit Generating Progress

Exploit Generating Progress

Exploit Generating Progress

Exploit Generating Progress

Exploit Generating Progress

Exploit Generating Progress

Exploit Generating Progress

Exploit Generating Progress

Exploit Generating Progress

Exploit Generating Progress

MUST Live Demo

Good ol’ 90s - return to stack

FancyˆHˆHˆHˆHˆH protections

▶ ASLR▶ Non-executable stack

ROP for CRAX

Work In Progress

Questions?