PMCMA: Determining if you're exploitable at the binary level

We all face them far more frequently that we'd like: bugs! But which ones are exploitable? Which ones are actually security vulnerabilities? How hard would it be for an attacker to turn a lame PoC for a given bug into a weaponized exploit targetting your own server?

Answering those questions used to require weeks of work from the best reverse engineers in order to determine a way to exploit vulnerabilities. Not anymore! Jonathan Brossard from Toucan System has just released their PMCMA tool. This tool, which stands for Post Memory Corruption Memory Analysis was first presented at the recent Blackhat conference, and will be demonstrated in much greater detail at #HITB2011KUL. In particular, the trainees of Jonathan Brossard's Linux Exploitation course will have a hands on session with the tool in order to exploit real vulnerabilities in GNU/Linux servers.

Unlike normal debuggers, PMCMA forces the processes it traces to fork, creating exact copies of themselves in memory. By then overwriting different memory addresses with carefully chosen values, PMCMA can determine precisely and fully automatically how to turn an invalid memory write operation into a full control flow hijack, and eventually, arbitrary code execution. The tool currently works on any GNU/Linux and Android machine with either x86 or x86_64 Intel cpus. Future work will focus on porting to Mac OSX, *BSD and ARM CPUs (https://github.com/toucan-system/pmcma/blob/master/TODO)