关键词: 模糊测试, 污点推断, 污点分析, 程序插桩, 漏洞挖掘

Abstract:

In view of the problem that the current fuzzing based on taint inference mainly focuses on the analysis of a single code branch in the target code block， but does not fully consider the correlation between context branches， which leads to the inaccurate inference of the relevant byte position of the code branch in the face of nested branches， an integrated method of inference and taint analysis for nested branch breakthrough was proposed. Firstly， the stage coverage information was used to evaluate the obstacle points that needed to be broken， and the priorities of the obstacle points were evaluated according to the coverage information of the obstacle points during the execution of the test cases， so as to focus on the test cases with more potential. Secondly， the taint inference algorithm was optimized， which meant that combined with the control flow information， the position of input bytes related to the nested branch were inferred more accurately， and the pre-order branch inference information was reused to speed up the inference. Finally， a lightweight taint analysis was performed to the inferred obstacle point related positions to guide the mutation process， so as to avoid the nested branch unreachable problem caused by random mutation. The prototyping tool DTFuzz was evaluated in 6 popular applications. Experimental results show that DTFuzz's node coverage rate is 9.85% higher than that of the existing fuzzing tools REDQUEEN averagely， and 5 unknown vulnerabilities are found by this tool. At the same time， compared with the benchmark tool， all of different modules have the coverage rate improved， and the highest improvement is 29.23%. It can be seen that the proposed method can breakthrough the complex nested branches effectively and improve the test coverage rate， as well as improves the efficiency of vulnerability mining.

Key words: fuzzing, taint inference, taint analysis, program instrumentation, vulnerability mining