  Automatic exploit generation is a relatively new area of research. Work in
this area aims to automate the manual and labor intensive task of finding
exploits in software. In this paper we present a novel program logic to support
automatic exploit generation. We develop a program logic called Reachability
Logic, which formally defines the relation between reachability of an assertion
and the preconditions which allow them to occur. This relation is then used to
calculate the search space of preconditions. We show that Reachability Logic is
a powerful tool in automatically finding evidence that an assertion is
reachable. We verify that the system works for small litmus tests, as well as
real-world algorithms. An implementation has been developed, and the entire
system is proven to be sound and complete in a theorem prover. This work
represents an important step towards formally verified automatic exploit
generation.
