I'm looking for research on the topic if at all possible or readings about efforts into this.
Drilling down into binaries via fuzzing/fingerprinting for known vulnerable binary patterns and a little boilerplate shellcode to insert into binary when found seems doable.
I envision it working in layered steps.
Look for fingerprints of known vulnerable binary.
Vulnerable? loop
Yes: Insert shellcode at vulnerability. Continue searching.
No: Fuzz application, use collected errors as fitness rating.
If exploitation successful, add to fingerprints, append
shellcode, continue searching.
This comes with the assumption of having a binary "DNA database" for vulnerability fingerpriting. Fuzzing errors trying to crash in a specific way that can be exploited, which ranks them in the genepool. Some crashes are more valuable than others.
