This document discusses CRAX, an automatic exploit generating system built by members of the Software Quality Laboratory (SQLab) at NCTU. It provides background on Lance Chen and the SQLab, which takes the approach that bugs are backdoors. It then explains the symbolic execution techniques used by CRAX to reason about program crashes and generate exploits, such as using the S2E platform combining concrete and symbolic execution. The document shows placeholder slides on the progress of generating exploits and challenges like ASLR and non-executable stack protections. It concludes by asking if there are any questions.

1. CRAX
An Automatic Exploit Generating System
Lance Chen
Software Quality Laboratory, NCTU
Aug 21, 2014

2. Disclaimer
CRAX is not my personal project,
but built by many members of the SQLab.

3. About me
Lance Chen
▶ MS in Computer Science
and Engineering Institute
of NCTU
▶ A System and Network
Administrator in NCTU
CSCC for four years

4. About SQLab
▶ Advisor: Prof. Shih-kun Huang
▶ Current members:
▶ Ph.D student * 2
▶ MS student * 8
▶ Central Idea: Bugs are Backdoors

5. How do you feel?

6. Figure 1: A) Rage

7. Figure 2: B) Excited...

8. Figure 3: A) Rage Figure 4: B) Excited...

9. Unclear relation between input and crashes

10. Symbolic Execution
x : X
PC : true
x : X
PC : X ≥ 0
x : X
PC : X < 0
x : X y : X+100
PC : (X ≥ 0) ∧ (X+100 = 2011)
x : X y : X+100
PC : (X ≥ 0) ∧ (X+100 ≠ 2011)
x : X y : X+100
PC : (X < 0) ∧ (X+100 = 2011)
x : X y : X+100
PC : (X < 0) ∧ (X+100 ≠ 2011)
Infeasible!

11. S2E
http://s2e.epfl.ch/
X86
Instructions
(32-bit)
TCG IRs
X86
Instructions
(64-bit)
LLVM IRs
(bitcode)
CPU
(Concrete execution)
KLEE
(Symbolic execution)
QEMU

12. Exploit Generating Progress
▶ Symbolic data propagating and constraints
collecting
▶ process crashed and symbolic eip detected
▶ Reasoning out exploit

13. Exploit Generating Progress

14. Exploit Generating Progress

15. Exploit Generating Progress

16. Exploit Generating Progress

17. Exploit Generating Progress

18. Exploit Generating Progress

19. Exploit Generating Progress

20. Exploit Generating Progress

21. Exploit Generating Progress

22. Exploit Generating Progress

23. Exploit Generating Progress

24. Exploit Generating Progress

25. Exploit Generating Progress

26. MUST Live Demo

27. Good ol’ 90s - return to stack

28. FancyˆHˆHˆHˆHˆH protections
▶ ASLR
▶ Non-executable stack

29. ROP for CRAX
Work In Progress

30. Questions?