Artifact for Automated Design-level Fragility Testing of Memory Error Exploit Mitigations

This repository provides a detailed graph model of how memory error exploits progress from initial pointer manipulations to attacker goals like information disclosure or arbitrary code execution. Nodes in the graph represent attacker capabilities, such as "attacker-controlled code pointer in memory". Edges represent operations that leverage certain capabilities into other capabilities, such as how dereferencing an "attacker-controlled data pointer" may yield an "attacker-controlled code pointer in memory". A wide range of previously proposed defenses (50+) are modeled on this graph. The graph is detailed: the subtle differences between CFI implementations readily show up, but generic: it can model both enforcement- and randomization-based defenses at every level of the exploit chain. The goal is to systematize the implicit knowledge about memory error exploitation and improve security analyses from human-driven thinking exercises to machine-checked threat modeling.