基于污点信息的函数内存模糊测试技术研究  

Research of taint-analysis based API in-memory fuzzing tests

作　　者：崔宝江[1] 王福维 郭涛[2] 柳本金[2] 

机构地区：[1]北京邮电大学计算机学院,北京100876 [2]中国信息安全测评中心,北京100085

出　　处：《清华大学学报（自然科学版）》2016年第1期7-13,共7页Journal of Tsinghua University(Science and Technology)

基　　金：国家自然科学基金资助项目(61170268;61100047;61272493)

摘　　要：针对二进制程序文件处理漏洞的挖掘,目前业界主流自动化方案为基于文件变异的模糊测试,但该方法盲目性高、代码覆盖率低、效率低下。为研究具有高针对性的测试方法,该文讨论了一种新型的函数内存模糊测试技术。该技术利用动态污点分析的结果,获取目标程序中处理输入数据流的函数与指令。测试中基于二进制插桩,对上述函数构造循环执行结构,并针对内存中的污点数据进行变异。原型系统实验表明:该测试方法可有效用于栈溢出等漏洞类型的挖掘;相比传统模糊测试,消除了因数据盲目测试造成的执行路径中断瓶颈,且在执行效率上具有95%以上的提升。Fuzzing testing is widely utilized as an automatic solution to discover vulnerabilities in file-processing binary programs. Restricted by the high blindness and low code path coverage, fuzzing tests normally work quite inefficiently. An API in-memory fuzzing testing technique was developed to eliminate the blindness. The technique employs dynamic taint analysis to locate the routines and instructions which belong to the target binary executables and involve the input data parsing and processing. Within the testing phase, binary instrumentation was used to construct circulations around such routines, where the contained taint memory values were mutated in each loop. According to the experiments on the prototype tool, this technique can effectively detect defects such as stack overflows. The results also show that the API in memory fuzzing testing eliminates the bottleneck of interrupting execution paths while gaining an over 95% enhancement of the execution speed in comparison with traditional fuzzing tools.

关 键 词：软件测试 模糊测试 污点分析 控制流劫持 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]