Research of taint-analysis based API in-memory fuzzing tests

doi:10.16511/j.cnki.qhdxxb.2016.23.011

Abstract
Figures/Tables
References
Related Articles
Metrics

Download: PDF(1185 KB)
Export: BibTeX | EndNote | Reference Manager | ProCite | RefWorks

Abstract Fuzzing testing is widely utilized as an automatic solution to discover vulnerabilities in file-processing binary programs. Restricted by the high blindness and low code path coverage, fuzzing tests normally work quite inefficiently. An API in-memory fuzzing testing technique was developed to eliminate the blindness. The technique employs dynamic taint analysis to locate the routines and instructions which belong to the target binary executables and involve the input data parsing and processing. Within the testing phase, binary instrumentation was used to construct circulations around such routines, where the contained taint memory values were mutated in each loop. According to the experiments on the prototype tool, this technique can effectively detect defects such as stack overflows. The results also show that the API in-memory fuzzing testing eliminates the bottleneck of interrupting execution paths while gaining an over 95% enhancement of the execution speed in comparison with traditional fuzzing tools.

Keywords software testing fuzzing testing taint analysis control-flow hijacking

ZTFLH:

TP311

Issue Date: 15 January 2016

	Service

	E-mail this article
	E-mail Alert
	RSS
	Articles by authors

	CUI Baojiang
	WANG Fuwei
	GUO Tao
	LIU Benjin

Cite this article:

CUI Baojiang,WANG Fuwei,GUO Tao, et al. Research of taint-analysis based API in-memory fuzzing tests[J]. Journal of Tsinghua University(Science and Technology), 2016, 56(1): 7-13.

URL:

http://jst.tsinghuajournals.com/EN/10.16511/j.cnki.qhdxxb.2016.23.011 OR http://jst.tsinghuajournals.com/EN/Y2016/V56/I1/7

[1] Newsome J, Song D. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software [C]//Proceedings of the 12th Annual Network and Distributed System Security Symposium (NDSS 2005). New York: ACM, 2005.
[2] Schwartz E, Avgerinos T, Brumley T. All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask) [C]//Proceedings of the IEEE Symposium on Security and Privacy. Washington DC: IEEE Computer Society, 2010: 317-331.
[3] WANG Tielei, WEI Tao, GU Guofei, et al. TaintScope: A checksum-aware directed fuzzing tool for automatic software vulnerability detection [C]//ACM Transactions on Information and System Security (TISSEC). 2011, 14(2): 15:1-15:28.
[4] CUI Baojiang, WANG Fuwei, GUO Tao, et al. FlowWalker: A fast and precise off-line taint analysis framework [C]//Proceedings of the 2013 Fourth International Conference on Emerging Intelligent Data and Web Technologies. Washington DC: IEEE Computer Society, 2013: 583-588.
[5] Sutton M, Greene A, Amini P. Fuzzing: Brute Force Vulnerability Discovery [M]. Addison-Wesley Professional, 2007.
[6] Corelan Team.[EB/OL]. (2010-10-20). https://www.corelan.be/index.php/2010/10/20/in-memory-fuzzing/.
[7] Luk C, Cohn R, Muth R, et al. Pin: Building customized program analysis tools with dynamic instrumentation [C]//Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation. New York: ACM, 2005: 190-200.
[8] Oulu University Secure Programming Group. Radamsa[EB/OL].[2014-06-29]. https://www.ee.oulu.fi/research/ouspg/Radamsa.
[9] Eddington M. Peach Fuzzer[EB/OL]. (2014-06-07). http://sourceforge.net/projects/peachfuzz/.

[1]	CHEN Lele, HUANG Song, SUN Jinlei, HUI Zhanwei, WU Kaishun. Bug report quality detection based on the BM25 algorithm[J]. Journal of Tsinghua University(Science and Technology), 2020, 60(10): 829-836.
[2]	LIANG Bin, GONG Weigang, YOU Wei, LI Zan, SHI Wenchang. DTA technique for JavaScript optimizing compilation mode[J]. Journal of Tsinghua University(Science and Technology), 2017, 57(9): 932-938.
[3]	BAI Xiaoying, HUANG Jun. Case generation by constraints combinatorial testing[J]. Journal of Tsinghua University(Science and Technology), 2017, 57(3): 225-233.
[4]	XIN Wei, SHI Zhiwei, HAO Yongle, DONG Guowei. Approach ofgenerating vulnerability signature based on taint analysis and symbolic execution[J]. Journal of Tsinghua University(Science and Technology), 2016, 56(1): 28-34.
[5]	Jingzhe LI, Bin LIANG, Wei YOU, Peng WANG, Wenchang SHI. Control dependency analyses for detecting remote control Android malware[J]. Journal of Tsinghua University(Science and Technology), 2014, 54(1): 8-13.

Viewed

Full text

Abstract

Cited

Shared

Discussed