Computer systems, methods, and devices for analyzing exploitability of memory safety vulnerabilities

A system, comprising:

• at least one hardware processor;
• and
• at least one non-transitory memory storing instructions that, when executed by the at least one hardware processor, cause the system to:
• analyze a first executable by scanning a binary of the first executable to identify one or more first sequences of instructions ending with a return instruction, each first sequence of instructions situated at a fixed memory address;
• analyze the one or more sequences of machine instructions to detect one or more usable sequences in a Return Oriented Programming (ROP) chain;
• monitor a second executable during runtime of the second executable to identify at least one pattern corresponding to a known or suspected ROP chain, wherein the second executable comprises the first executable augmented with code comprising one or more memory safety mitigation technologies;
• identify, based at least in part on the at least one pattern, one or more second sequences of instructions during runtime of the second executable;
• compare the one or more first sequences with the one or more second sequences;
• calculate based on the comparison, a change in exploitation risk between the first executable and the second executable;
• and
• generate a report including the calculated change in exploitation risk between the first executable and the second executable.

A non-transitory, computer-readable storage medium comprising instructions recorded thereon, wherein the instructions, when executed by at least one data processor of a system, cause the system to:

• analyze a first executable by scanning a binary of the first executable to identify one or more first sequences of instructions ending with a return instruction, each first sequence of instructions situated at a fixed memory address;
• analyze the one or more sequences of machine instructions to detect one or more usable sequences in a Return Oriented Programming (ROP) chain;
• monitor a second executable during runtime of the second executable to identify at least one pattern corresponding to a known or suspected ROP chain, wherein the second executable comprises the first executable augmented with code comprising one or more memory safety mitigation technologies;
• identify, based at least in part on the at least one pattern, one or more second sequences of instructions during runtime of the second executable;
• compare the one or more first sequences with the one or more second sequences;
• calculate based on the comparison, a change in exploitation risk between the first executable and the second executable;
• and
• generate a report including the calculated change in exploitation risk between the first executable and the second executable.