moflow-0.8
This version is compatible with BAP-0.8 which includes x86/x64 target support
MOFLOW FRAMEWORK
Moflow is a software security framework containing tools for vulnerability, discovery, and triage. Moflow is focused on providing automated solutions based upon the latest research to assist in building more secure software. The vulnerability discovery tools include an automated test generation engine based on concolic execution combining dynamic taint tracing and symbolic execution, which is considered state of the art for zero-configuration parser fuzzing. The triage tools include the ability to automatically determine input bytes related to an exception using dynamic trace slicing algorithms as well as a forward symbolic execution based exploitability analysis. Mitigations include a novel use-after-free exploit prevention technique that is implemented as a LLVM compiler plugin.
EGAS
EGAS is an automated test generation tool based on concolic execution. EGAS leverages dynamic binary instrumentation to modify ELF binaries to enable dataflow tracking for taint analysis. New tests are generated by analyzing dataflow paths for nearby constraints and solving for new inputs by translating the binary for symbolic execution.
This plugin is essentially a clone of Microsoft SAGE. Usage documentation and code can be found in moflow/bap/custom_utils/egas
SLICER
SLICER is a tool that assists with root cause analysis by slicing forward or backward from arbitrary points in a dataflow trace. Graph slicing allows the user to determine dependencies between a selected point of execution and previous or future instructions. This is used in crash analysis to slice from the corrupted value causing an exception back to the specific input bytes that caused the exception, greatly reducing the total number of instructions needed to be analyzed to determine root cause.
This plugin can be found in moflow/bap/custom_utils
INSTALL
First, build the BAP framework following the instructions in moflow/bap/INSTALL Next, run 'make' in moflow/bap/custom_utils Next, run 'make' in moflow/bap/custom_utils/egas
USAGE
Individual tool usage is documented in the tool subdirectories.