4

Assuming I have the following scenario: I have spotted a vulnerability in a specific function deep inside of an executable (DLL). To get that code path executed (in a vulnerable context) I need to feed the program with very specific input that depends on the flow paths and checked performed at different phases in the program.

What I'm looking for are some guidelines, books, material I could research which can explain me what approaches exist and how to get there.

Thanks and Regards, Daniel

  • When you say "I need to feed the program with a very specific output" do you really mean a very specific input? In other words, does a specific input to the program result in the vulnerable function being called? – julian Jun 8 '18 at 1:05
  • @SYS_V I think OP is asking for a method to get the input needed in order for the program to reach the vulnerable function. – NirIzr Jun 8 '18 at 2:08
  • @NirIzr This sounds fuzzing-related to me. What do you think? I'm trying to understand how this is related to reverse engineering. – julian Jun 8 '18 at 2:11
  • @SYS_V Well, I posted an answer assuming I'm correct. ¯\_(ツ)_/¯ – NirIzr Jun 8 '18 at 2:25
2

One common method of finding out the needed input to reach a specific execution flow (or a target instruction/function) is done using SMT solvers.

SMT solvers are programs that accept a set of symbols, potentially conflicting conditions and a set of defined operations between them, as well as a desired outcome/target. An SMT solver will attempt to provide a "solution" to the given constraints, in the defined domain space.

As mentioned, this topic is tightly related to and symbolic execution, of course. That is also the main context in which SMT solvers (and similar techniques/approaches) are used in the security industry. Couple folks in the industry have also spent a lot of their time on that, namely Rolf Rolles.

There are a few SMT solvers that are commonly used in the security industry community (that I'm aware of):

  1. Z3 by Microsoft is a widely known one.
  2. Triton is another.
  3. angr is a library focused on lifting assembly to IR and solving constraints.

Additionally, there are a bunch ton of solvers over at the wiki page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.