Given a large set of crashes, all resulting from access violations, is it possible to (with or without access to symbols and source code) programmatically determine whether the crashes resulted from a bad read from crashes caused by a bad write? My ultimate goal is distinguish buffer overruns from other crashing conditions.
Even more specifically, I would like to be able to separate corruptions of EIP (or similar instruction pointers in other architectures) from other forms of crashes so that I might better separate buffer overflows from a corpus of crashing input files.
What tool would you use to instrument this or otherwise automate this process?
I suspect that this is not possible since the ultimate source of the crash will be dereferencing a bad address in all cases. Walking back, maybe it is possible to mark all memory allocated to buffers and check whether the crashing address is within a reasonable offset to a buffer. Perhaps I am missing a much simpler way of checking.
For the record I am doing this on a userland program in a *nix environment. A general purpose answer would be awesome, but I would also be happy to see an array of platform specific answers.
Edit: Don't be afraid to move this to SecuritySE or elsewhere if you think it doesn't belong on RE.