CRAX
CRAX copied to clipboard
CRAX: software CRash analysis for Automatic eXploit generation
Trun --use-concolic-taint on to not addConstraint while using single path concolic execution to speed up
Implement algorithm for exploit generation.
Rewrite the exploit plugin.
Find a proper place to detect if EIP is symbolic.
Make sure that the new single path method is working. Pay attention to constraint sizes especially.
EIP cannot be made symbolic by default. The first step is to make it able to be made symbolic.