Binary program vulnerability automatic exploitation method for constructing state transition graph

Abstract

This invention relates to an automated vulnerability exploitation method for constructing state transition graphs, belonging to the field of software security technology. First, the binary program is disassembled to extract information such as protection mechanism types and high-risk functions, which serve as the starting node state information of the state transition graph. Then, based on the node state information, exploitation methods are selected from a vulnerability exploitation library to attempt to bypass protection mechanisms. Exploitation methods that can bypass protection mechanisms are used as edges in the state transition graph, and new nodes are created. This process is repeated to continuously create nodes until all protection mechanisms are bypassed. Based on the latest node state information, an exploitation method that can obtain a shell is selected, and a termination node is created. Finally, the state transition graph is traversed using the Depth-First Search (DFS) algorithm, and symbolic execution and constraint solving techniques are used to generate payloads. This invention addresses the problem that existing methods rely on fixed exploitation methods to generate payloads, making it difficult to cope with complex protection mechanisms. By constructing a state transition graph to gradually bypass multiple protection mechanisms, the success rate of automated vulnerability exploitation is improved.

Images