Abstract: A system includes a memory, a processor in communication with the memory, and a scanner. The scanner is configured to execute a first simulation instructions and track a register value and/or a stack value while executing the simulation. Responsive to encountering a conditional branch, the scanner is configured to split the first simulation into a second simulation and a third simulation to follow respective legs of the conditional branch. The scanner is also configured to track a movement from a register and/or a stack associated with the memory, record the movement and instruction associated with the movement, and report potential vulnerabilities.

Abstract: A system includes a memory, a processor in communication with the memory, and a scanner. The scanner is configured to execute a first simulation instructions and track a register value and/or a stack value while executing the simulation. Responsive to encountering a conditional branch, the scanner is configured to split the first simulation into a second simulation and a third simulation to follow respective legs of the conditional branch. The scanner is also configured to track a movement from a register and/or a stack associated with the memory, record the movement and instruction associated with the movement, and report potential vulnerabilities.

Abstract: A system and method for identifying exploitable code sequences. In one implementation, a first processing device identifies an executable portion of a program and a set of registers of a second processing device, and stores a set of addresses in the set of registers. The first processing device allocates a region of memory populated with a set of values, and sets a stack pointer of the second processing device to point to a first location within the region of memory. The first processing device emulates an execution by the second processing device of an instruction at a first address of the executable portion. In response to determining that, after the emulating of the instruction at the first address, an address of a next instruction to execute after the instruction at the first address is in the set of addresses or the set of values, a signal is generated that indicates a potential exploitable code sequence.

Abstract: A system and method for identifying exploitable code sequences. In one implementation, a first processing device identifies an executable portion of a program and a set of registers of a second processing device, and stores a set of addresses in the set of registers. The first processing device allocates a region of memory populated with a set of values, and sets a stack pointer of the second processing device to point to a first location within the region of memory. The first processing device emulates an execution by the second processing device of an instruction at a first address of the executable portion. In response to determining that, after the emulating of the instruction at the first address, an address of a next instruction to execute after the instruction at the first address is in the set of addresses or the set of values, a signal is generated that indicates a potential exploitable code sequence.