Crash analysis method and system for binary program

Abstract

The invention discloses a crash analysis method and system for a binary program, and the method comprises the steps: S1, information collection and processing: carrying out the code instrumentation of a plurality of key positions and basic blocks through an instrumentation module, then running the program, and recording the information; the taint module takes program input as taints, tracks propagation of the taints in a program execution process, performs symbolization operation on each executed instruction, and finally performs reverse slicing and information recording from a crash point according to symbolization content; and S2, performing analysis on the basis of the data processed in the step S1 to obtain an execution trajectory diagram, a stain propagation trajectory diagram, crash causes and the like of a program; according to the method, the program can be analyzed, the crash information during program running can be collected, crash backtracking, crash point positioning, crash cause determination and the like can be carried out under the condition of passive codes, the cost of manual analysis is greatly reduced, and vulnerability analysts can be assisted to quickly determine a program crash mechanism and the like.

Description

technical field [0001] The present invention relates to the field of computer information security, and more specifically, to a crash analysis method and system for binary programs. Background technique [0002] With the exponential growth of the number of programs, the security of programs has attracted more and more attention. A program crash often means that the code of the program itself is unreasonable, or there are some potential loopholes in the program itself. Fuzz testing technology has developed rapidly in recent years. The principle of fuzz testing is a method to find software vulnerabilities by providing unexpected input to the target system and monitoring abnormal results. It can effectively cause a large number of program crashes. However, , a large number of crashes also requires a lot of manpower to evaluate the effectiveness of the crashes. How to analyze these crashes more automatically, evaluate the cause of the crash, and judge whether it is a vulnerabi...

AI Technical Summary

Problems solved by technology

This method of first recording the program execution track, and then performing virtual replay of the program according to the program execution track file is an offline analysis method, but the disadvantage is that it takes too long; the other is to use tools such as pin and dynamoRIO for instrumentation. Analyzing while the program is running belongs to an online analysis method. Because online analysis records and analyzes the tested program, there are problems such as large memory consumption and long time consumption.

Images