Two researchers from Microsoft’s Security Engineering Center (MSEC) gave an interesting presentation at the CanSecWest conference last week.  The researchers detailed a project created by MSEC that is supposed to help detect exploitable software.  The project, !exploitable (pronounced “bang exploitable”) Crash Analyzer, is a tool that helps automate the detection of bugs in an application and will assess the likelihood of those bugs being exploitable.  The !exploitable Crash Analyzer is an extension for the Windows Debugger (Windbg) and is open source.

Microsoft packed years of exploit knowledge into !exploitable and it appears that there is a lot of potential for this tool.  !exploitation can facilitate the discovery of exploitable bugs and should reduce the attack surface.  While the tool will not be useful on our field devices, it should be helpful to the different software vendors.  Any person using the tool should be aware an application is not guaranteed to be bug or exploit free even if an application passes the !exploitable Crash Analysis.

The tool, along with the Powerpoint presentation, is available here.