RELEASE: Generating exploits using loop-aware concolic execution

Automatically finding vulnerabilities and even generating exploits are desirable for software testing. For the protection of intellectual property and copyright programs being tested may be lack of source code and symbol table information. Concolic execution is a novel technique which takes advantage of the rapid executing speed of concrete execution and the wide testing coverage of symbolic execution to discover and identify software bugs including vulnerabilities. However a serious limitation of concolic execution inherited from symbolic execution is its poor analysis result with loops a common programming construct. For instance when the number of iterations depends on the inputs the analysis cannot determine possible execution paths of the program. In this paper we propose a new concolic execution technique loop-aware concolic execution for testing software and analyzing loop-related variables with fewer execution steps. With the novel technique not only linear relations but also some polynomial recurrence relations in a loop can be handled. To demonstrate effectiveness of the novel technique we developed a concolic analyzer called RELEASE to discover buffer-overflow vulnerabilities in the testing benchmarks.