Log why the check fails. :param str reason: A reason for why the check fails. :return: None

Test if a self's crash has one of the vulnerabilities described in crash_types

Initialize an exploit factory, with which you can build exploits. :return: An initialized ExploitFactory instance. :rtype

Test a POV

exploit an ip overwrite using rop :param chain: rop chain to use :param state: an optionally state to work off of :pa

find the address of a function given it's name @symbol :param symbol: function name to lookup :return: the function's address

Test the binary generated

windup of the state of the crash to the first unconstrained successor

Convert an arch ID or an archinfo.Arch instance to an archinfo.Arch instance.

Test a POV

How this action should be translated in standalone exploits How to translate this action into standalone exploit

This function is used to generate the equations which are inserted inside C exploits

Applies the exploit technique to the crashing state, returns a working Exploit object or raises a CannotExploit exception :r

:param aslr: Analyze the crash with aslr on or off. :param use_crash_input: if a byte is not constrained by the ge

[CGC only] Create a test case which points an arbitrary-read crash at the flag page.

call a read with with rop into globally addressable memory

[CGC only] Constrain data in the flag page.

write @data into globally addressable memory :return: tuple of the address of the string and the constraint which adds the string

default behavior for payload dumper

Determine if the crash is exploitable. :return: True if the crash's type is generally considered exploitable, False otherwise

Determine if the crash can be explored with the 'crash explorer'. :return: True if the crash's type lends itself to exploring, only

grab a shellcode with a known name

return a raw string representing the shellcode, subclasses which more sophisticated shellcodes will want to take options here.

Return a TCP port that is currently free.

run the target once to identify crash_addr

exploit an ip overwrite with shellcode. This is HIGHLY CGC-specific. :param shellcode: shellcode to call :param variables: v

translate pov_file or input to channel and test_case

Given a set of addresses, group into a dict mapping from address to length :param Iterable memory_writes: Addresses in memory

Determine the amount of symbolic bits in an AST, useful to determining how much control we have over registers. :param st:

explore a crash further to find new bugs

retrieve the default shellcode as a raw string

determine what symbolic memory we control which is at a constant address TODO: be able to specify that we want to know about things

determine what symbolic memory we control on the stack. :param bool below_sp: True if we only want to find the number of symbolic

Test the binary generated