An Automated Identification Method for Controllable Memory-Related Fields in Proof-of-Concept Code

A Proof of Concept (PoC) exploit refers to a piece of code or input data designed to verify the existence of a vulnerability, which can be used to support the assessment of its exploitability. During the vulnerability exploitability analysis process, security researchers need to select appropriate exploitation methods based on vulnerability root causes and other relevant information, then write ROP chains, shellcode, parameters, and other payload data into controllable memory regions.At this stage, analyzing which input data in the PoC can control the existence, content, and length of controllable memory regions becomes crucial. However, existing vulnerability exploitability assessment methods lack sufficient attention to this aspect, resulting in risk evaluation approaches that are inapplicable or difficult to assess effectively. This paper proposes a novel identification method for PoC-relevant memory fields, specifically designed to analyze the correlation between input data and controllable memory regions. Unlike prior approaches that primarily focus on directly vulnerable memory fields, our technique identifies memory-associated fields based on exploitation requirements, particularly those storing critical payload components such as shellcode and ROP chains. This method is specifically tailored for vulnerability exploitability assessment scenarios. The method takes the program state sequence of the PoC as input, constructs byte-level inference and lightweight taint analysis techniques, and identifies fields in the PoC that affect the program control flow, influence the data values stored in controllable memory, and impact the size of data written to controllable memory. Experimental results demonstrate that the proposed method achieves higher identification accuracy compared to conventional field detection techniques when applied to real-world vulnerability PoCs.