语义感知的JavaScript引擎模糊测试技术研究  

Research on Semantic-Aware Fuzzing for JavaScript Engine

作　　者：王允超 王清贤 丁文博 WANG Yunchao;WANG Qingxian;DING Wenbo(State Key Laboratory of Mathematical Engineering and Advanced Computing,Zhengzhou 450001,China)

机构地区：[1]数学工程与先进计算国家重点实验室,河南郑州450001

出　　处：《信息工程大学学报》2020年第3期316-324,共9页Journal of Information Engineering University

基　　金：河南省软科学研究计划资助项目(192102210128)。

摘　　要：模糊测试是一种高效的漏洞挖掘技术,但该方法很难适用于一些处理结构化输入的程序,例如JavaScript引擎。传统的模糊测试方法采用低级别的变异策略(比特/字节翻转)生成的测试用例,由于无法通过严格的语法、语义检查而被过早丢弃,导致难以发现程序深层的漏洞。提出一种语义感知的模糊测试方法并实现原型工具SaFuzzer,通过基于语法规则的语法树变异及语义修复,保证了样本的执行成功率。通过选择真实的软件进行测试,实验结果表明,SaFuzzer相比当前先进的AFL和Superion工具可以实现更高的代码覆盖并发现更多的bug。Fuzzing is an efficient vulnerability discovery technique.However,it is difficult to be applied to programs that process highly structured input,such as JavaScript engines.Testcases generated by traditional fuzzing methods which rely on low-level mutation strategies(bit/byte flipping)struggle to pass the strict syntax and semantic checks and will be rejected early,which makes it difficult to find deep bugs in the program.This paper proposes a semantic-aware fuzzing method and implements one prototype tool named SaFuzzer.The syntax tree mutation based on syntax rule and error semantic repairing guarantee the success rate of sample generation.Through testing real software,the experimental results show that SaFuzzer can achieve higher code coverage and find more bugs than the current advanced fuzzers such as AFL and Superion.

关 键 词：模糊测试 JAVASCRIPT 语义感知 语法树变异 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]