Nothing is Unreachable: Automated Synthesis of Robust Code-Reuse Gadget Chains for Arbitrary Exploitation Primitives

Nicolas Bailluet, Univ Rennes, Inria, CNRS, Emmanuel Fleury, Univ Bordeaux, CNRS, Isabelle Puaut, Erven Rohou, Univ Rennes, Inria, CNRS

34th USENIX Security Symposium · Day 1

This groundbreaking paper introduces **ARCANIST**, a novel approach and proof-of-concept tool for the automated synthesis of code-reuse gadget chains. Addressing a critical gap in modern exploit development, ARCANIST distinguishes itself by supporting *arbitrary exploitation primitives and layouts*, a significant departure from existing tools that often impose strong requirements on an attacker's capabilities, such as direct control over the stack. The research acknowledges the evolving landscape of software vulnerabilities, where heap-based primitives like use-after-free and heap-overflow are increasingly prevalent, rendering traditional stack-centric exploitation tools ineffective.

AI review

This is the real deal — a genuine advancement in automated exploit generation that actually delivers on its claims. ARCANIST solves a problem the field has been dancing around for years: gadget chaining for non-stack exploitation primitives. The SMT formalization with robust reachability is elegant, the eval is thorough, and the tool works on real CVEs where competitors faceplant.