RELEASE: Generating Exploits Using Loop-Aware Concolic Execution

Abstract

Automatically finding vulnerabilities and even generating exploits are desirable for software testing. For the protection of intellectual property and copyright, programs being tested may be lack of source code and symbol table information. Concolic execution is a novel technique, which takes advantage of the rapid executing speed of concrete execution and the wide testing coverage of symbolic execution, to discover and identify software bugs, including vulnerabilities. However, a serious limitation of concolic execution inherited from symbolic execution is its poor analysis result with loops, a common programming construct. For instance, when the number of iterations depends on the inputs, the analysis cannot determine possible execution paths of the program. In this paper, we propose a new concolic execution technique, loop-aware concolic execution, for testing software and analyzing loop-related variables with fewer execution steps. With the novel technique, not only linear relations but also some polynomial recurrence relations in a loop can be handled. To demonstrate effectiveness of the novel technique, we developed a concolic analyzer, called RELEASE, to discover buffer-overflow vulnerabilities in the testing benchmarks.