Abstract:

In view of the problem that the current fuzzing based on taint inference mainly focuses on the analysis of a single code branch in the target code block， but does not fully consider the correlation between context branches， which leads to the inaccurate inference of the relevant byte position of the code branch in the face of nested branches， an integrated method of inference and taint analysis for nested branch breakthrough was proposed. Firstly， the stage coverage information was used to evaluate the obstacle points that needed to be broken， and the priorities of the obstacle points were evaluated according to the coverage information of the obstacle points during the execution of the test cases， so as to focus on the test cases with more potential. Secondly， the taint inference algorithm was optimized， which meant that combined with the control flow information， the position of input bytes related to the nested branch were inferred more accurately， and the pre-order branch inference information was reused to speed up the inference. Finally， a lightweight taint analysis was performed to the inferred obstacle point related positions to guide the mutation process， so as to avoid the nested branch unreachable problem caused by random mutation. The prototyping tool DTFuzz was evaluated in 6 popular applications. Experimental results show that DTFuzz's node coverage rate is 9.85% higher than that of the existing fuzzing tools REDQUEEN averagely， and 5 unknown vulnerabilities are found by this tool. At the same time， compared with the benchmark tool， all of different modules have the coverage rate improved， and the highest improvement is 29.23%. It can be seen that the proposed method can breakthrough the complex nested branches effectively and improve the test coverage rate， as well as improves the efficiency of vulnerability mining.

Key words: fuzzing, taint inference, taint analysis, program instrumentation, vulnerability mining

摘要：

针对当前基于污点推断的模糊测试主要集中于目标代码块内单一代码分支的分析，而未充分考虑上下文分支间的关联关系，导致面对嵌套分支时对代码分支相关字节位置推断不够精确的问题，提出一种面向嵌套分支突破的推断与污点分析融合的方法。首先，利用阶段覆盖信息评估需要突破的障碍点，并根据测试用例执行时障碍点的覆盖信息评估障碍点的优先级，从而聚焦更有潜力的测试用例；其次，优化污点推断算法，即结合控制流信息更精确地推断嵌套分支相关输入字节的位置，并重用前序分支推断信息以提升推断速度；最后，对推断出的障碍点相关位置进行轻量级的污点分析以指导变异过程，从而避免随机变异导致的嵌套分支不可达问题。在6个流行的应用中评估原型工具DTFuzz。实验结果表明，DTFuzz的节点覆盖率比现有模糊测试工具REDQUEEN平均提高了9.85%，并且DTFuzz发现了5个未知漏洞；同时，DTFuzz不同模块的节点覆盖率相较于基准工具均有所提高，最高提高了29.23%。可见，所提方法能有效突破复杂嵌套分支并实现测试覆盖率的提升，提升漏洞挖掘的效率。

关键词: 模糊测试, 污点推断, 污点分析, 程序插桩, 漏洞挖掘