Abstract: Currently,the problem of software security vulnerability becomes worse,and buffer overflow vulnerability still affects the current network and distributed system security．So it is very important to research the buffer overflow vulnerability discovering analysis and exploiting for the security of system software．In the paper,first of all,principle of buffer overflow and vulnerability discovering analysis and utilization techniques were discussed．Then one method of static analysis combined with the dynamic analysis of vulnerability discovering analysis was proposed,and a complete vulnerability discovering analysis process was presented,and the availability and effectiveness of the method were verified by actual Microsoft Office vulnerability．Finally,on the basis of the theory and technology,vulnerability discovering analysis system-VulAs was designed and realized under the Windows platform to assist the discovering and analysis of vulnerability,and the effectiveness of the tool was verified.

Key words: Vulnerability,Buffer overflow,Vulnerability discovering analysis,Shellcode,Vulas