Exploit自动生成引擎：Rex

# triage a crash
>>> crash = rex.Crash("./legit_00003", b"\x00\x0b1\xc1\x00\x0c\xeb\xe4\xf1\xf1\x14\r\rM\r\xf3\x1b\r\r\r~\x7f\x1b\xe3\x0c`_222\r\rM\r\xf3\x1b\r\x7f\x002\x7f~\x7f\xe2\xff\x7f\xff\xff\x8b\xc7\xc9\x83\x8b\x0c\xeb\x80\x002\xac\xe2\xff\xff\x00t\x8bt\x8bto\x00t\x8b\xc7\xdd\x83\xc2t~n\xac\xe2\xff\xffk\x00t\x8b\xc7\xdd\x83\xc2t~n\xac\xe2\xff\xff\x00t\x8bt\x8b\xac\xf1\x83\xc2t~c\x00\x00\x00~~\x7f\xe2\xff\xff\x00t\x9e\xac\xe2\xf1\xf2@\x83\xc3t")
>>> crash.crash_types
['write_what_where']
>>> crash.explorable()
True
explore the crash by setting segfaulting pointers to sane values and re-tracing
>>> crash.explore()
now we can see that we control instruction pointer
>>> crash.crash_types
'ip_overwrite'
generate exploits based off of this crash
it may take several minutes
>>> arsenal = crash.exploit()
we generated a type 1 POV for every register
>>> len(arsenal.register_setters) # we generate one circumstantial register setter, one shellcode register setter
2
and one Type 2 which can leak arbitrary memory
>>> len(arsenal.leakers)
1
exploits are graded based on reliability, and what kind of defenses they can
bypass, the two best exploits are put into the 'best_type1' and 'best_type2' attributes
>>> arsenal.best_type1.register
'ebp'
exploits can be dumped in C, Python, or as a compiled POV
>>> arsenal.best_type2.dump_c('legit3_x.c')
>>> arsenal.best_type2.dump_python('legit3_x.py')
>>> arsenal.best_type2.dump_binary('legit3_x.pov')
also POVs can be tested against a simulation of the CGC architecture
>>> arsenal.best_type1.test_binary()
True

tracer_args={
'ld_linux': os.path.join(bin_location, 'tests/i386/ld-linux.so.2'),'library_path': os.path.join(bin_location, 'tests/i386')}
r = tracer.QEMURunner(binary=binary, input=input_data, argv=argv, trace_timeout=trace_timeout, **tracer_args)

def _triage_crash(self):
    ip = self.state.regs.ip
    bp = self.state.regs.bp
    # any arbitrary receives or transmits
    # TODO: receives
    zp = self.state.get_plugin('zen_plugin') if self.os == 'cgc' else None
    if zp is not None and len(zp.controlled_transmits):
        l.debug("detected arbitrary transmit vulnerability")
        self.crash_types.append(Vulnerability.ARBITRARY_TRANSMIT)
    # we assume a symbolic eip is always exploitable
    if self.state.solver.symbolic(ip):
        # how much control of ip do we have?
        if self._symbolic_control(ip) >= self.state.arch.bits:
            l.info("detected ip overwrite vulnerability")
            self.crash_types.append(Vulnerability.IP_OVERWRITE)
        else:
            l.info("detected partial ip overwrite vulnerability")
            self.crash_types.append(Vulnerability.PARTIAL_IP_OVERWRITE)
        return
    if self.state.solver.symbolic(bp):
        # how much control of bp do we have
        if self._symbolic_control(bp) >= self.state.arch.bits:
            l.info("detected bp overwrite vulnerability")
            self.crash_types.append(Vulnerability.BP_OVERWRITE)
        else:
            l.info("detected partial bp overwrite vulnerability")
            self.crash_types.append(Vulnerability.PARTIAL_BP_OVERWRITE)
        return
    # if nothing obvious is symbolic let's look at actions
    # grab the all actions in the last basic block
    symbolic_actions = [ ]
    if self._t is not None and self._t.last_state is not None:
        recent_actions = reversed(self._t.last_state.history.recent_actions)
        state = self._t.last_state
        # TODO: this is a dead assignment! what was this supposed to be?
    else:
        recent_actions = reversed(self.state.history.actions)
        state = self.state
    for a in recent_actions:
        if a.type == 'mem':
            if self.state.solver.symbolic(a.addr):
                symbolic_actions.append(a)
    # TODO: pick the crashing action based off the crashing instruction address,
    # crash fixup attempts will break on this
    #import ipdb; ipdb.set_trace()
    for sym_action in symbolic_actions:
        if sym_action.action == "write":
            if self.state.solver.symbolic(sym_action.data):
                l.info("detected write-what-where vulnerability")
                self.crash_types.append(Vulnerability.WRITE_WHAT_WHERE)
            else:
                l.info("detected write-x-where vulnerability")
                self.crash_types.append(Vulnerability.WRITE_X_WHERE)
             self.violating_action = sym_action
            break
        if sym_action.action == "read":
            # special vulnerability type, if this is detected we can explore the crash further
            l.info("detected arbitrary-read vulnerability")
            self.crash_types.append(Vulnerability.ARBITRARY_READ)
            self.violating_action = sym_action
            break
    return