Option-aware directed grey-box fuzzing vulnerability concept verification automatic generation method

Abstract

This invention belongs to the field of software security testing technology, specifically a method for automatically generating vulnerability proof-of-concept (PoC) based on option-aware directed gray-box fuzzing. The invention includes: performing static analysis on the target program, extracting each configuration option and its directly affecting variables, analyzing the complete value space and control conditions of the variables, and inferring the constraint relationships between options; based on option knowledge, employing option validity inference technology based on taint analysis during the fuzzing phase to dynamically identify option combinations effective in reaching the target location; introducing an alternating guided fuzzing strategy, alternately executing option input fuzzing and file input fuzzing, systematically driving driver execution to approximate the target vulnerability location, and ultimately efficiently generating the target vulnerability PoC. This invention effectively solves the problems of traditional directed gray-box fuzzing tools ignoring the influence of program configuration options, the independence of options and file mutations, and the lack of coordination, significantly improving the efficiency and success rate of vulnerability PoC generation.

Description

Technical Field

[0001] This invention belongs to the field of software security testing technology, specifically relating to an automatic generation method for vulnerability proof-of-concept based on option-aware directed gray-box fuzzy testing. Background Technology

[0002] Static analysis tools can identify potential vulnerabilities in source code, but they often cannot provide concrete proof-of-concept (PoC) examples to verify their findings. Because static analysis tools generate a large number of false positives, the lack of PoC makes vulnerability verification time-consuming, laborious, and error-prone, ultimately delaying vulnerability disclosure. Even if a vulnerability is confirmed, the lack of PoC knowledge limits developers' understanding of the underlying security issues, increasing the difficulty of remediation.

[0003] Directed greybox fuzzing (DGF) [1-3] has become a powerful method to bridge this gap by systematically guiding program execution toward a suspicious target location and generating reproducible input to trigger a target vulnerability. However, DGF faces a fundamental but under-explored challenge: the critical role of configuration options in reaching the target location.

[0004] Real-world software systems typically expose a large number of configurable options (such as command-line flags, like "-a -l -R" in tiffcrop

[16] ), which can significantly affect program semantics. Options usually determine whether the execution path to the vulnerability is reachable, thus directly affecting the effectiveness and efficiency of DGF. For example, for a buffer overflow vulnerability in libtiff (libtiff-740

[15] ), the static analysis tool correctly identified the vulnerable code, but DGF using the default options failed to trigger the vulnerability because the default configuration completely disabled the execution path to the vulnerability. Only after enabling the specific "-D" option and providing the correct parameters can the execution path reach the vulnerability location. This shows that specific options are usually a necessary prerequisite for reaching the target location.

[0005] Although configuration options have been studied in coverage-based gray-box fuzzing (GF) [4-7], no previous work has investigated option awareness in DGF scenarios. Existing option-aware GF tools face two fundamental challenges when applied to DGF scenarios:

[0006] Challenge 1: Insufficient extraction of options for target location. Current option-aware GF tools lack effective reasoning on which options are relevant to reaching the target location. Document-based tools [4-6] extract options from developer documentation, but the documentation may be incomplete and irrelevant to the target location. Code-based tools [7] extract options directly from source code to alleviate the incompleteness problem, but may still contain a large number of irrelevant options that do not affect the semantics of the target location. These tools waste a lot of computational resources on selecting and mutating invalid options that have no effect on triggering the target vulnerability. In addition, when selecting two or more options, these tools do not consider the validity relationship between different options to the target location, resulting in inefficient option combination exploration.

[0007] Challenge 2: Insufficient coordination between option and file fuzzing. Existing option-aware GF [5-9] tools struggle to effectively coordinate option and file fuzzing, resulting in inefficient exploration. Their limitations manifest in two ways: First, some tools [8] mutate both options and files simultaneously, which, while improving path coverage, obfuscates the source of contribution, failing to distinguish whether progress is driven by option mutation or file mutation, thus preventing the fuzzer from providing meaningful feedback to guide subsequent scheduling. Second, subsequent tools [5-7,9] separate option and file mutation, allowing for more precise identification of the source of coverage growth, but fail to transfer knowledge between the two domains; option-level feedback is not used to guide file mutation, and file-level feedback is not used to optimize option selection and mutation. This one-way reasoning keeps exploration at a shallow level, often trapping GF tools in local optima and missing deeper execution paths that require coordinated interaction between option and file mutation.

[0008] In summary, a new approach is needed to achieve effective and efficient option-aware oriented gray-box fuzzing in order to reliably generate reproducible PoC inputs for potential vulnerabilities. Summary of the Invention

[0009] The purpose of this invention is to provide an option-aware, targeted gray-box fuzzing method for generating vulnerability PoCs, which overcomes the shortcomings of traditional DGF tools in ignoring the influence of configuration options and the shortcomings of existing option-aware GF tools in target-oriented option extraction and option-file coordination, thereby significantly improving the efficiency and success rate of vulnerability PoC generation.

[0010] The option-aware, directional gray-box fuzzing vulnerability PoC generation method provided by this invention first redefines the PoC input as a combination of option input (OI) and file input (FI), rather than the traditional DGF which only treats the PoC as file input. This invention is divided into two stages: (1) Static analysis stage, which systematically analyzes how options affect program semantics, including: performing static analysis on the target program, extracting each program option and its directly affected variables, and inferring option constraint relationships; and using option validity inference technology based on taint analysis to dynamically identify valid option combinations; (2) Option-aware fuzzing stage, which closely coordinates OI fuzzing and FI fuzzing, specifically adopting an alternating guided fuzzing strategy, alternately executing option input fuzzing and file input fuzzing, and using a mutual feedback driver to approximate the target vulnerability location and efficiently generate vulnerability PoC; the specific steps are as follows:

[0011] (i) Perform static analysis on the target program to extract all configuration options and their directly-impact variables from the program's option parsing function. Analyze each The complete value space and the corresponding control conditions for assignment are used to establish options to... The mapping relationship;

[0012] (ii) When multiple options have the same effect Enabling these options simultaneously may lead to subsequent issues. An assignment overwrites a previous assignment, rendering the former option invalid. To resolve this issue, [the following is an example of a different approach]. A comprehensive analysis of the coverage relationships is conducted. Based on... The coverage relationship is used to infer the constraints between options and identify the potential consequences of enabling them simultaneously. Assign values ​​to the set of options that are overridden, and extract the set of option constraints;

[0013] (iii) Selectively instrument the target program, only instrumenting basic blocks that can reach the target vulnerability location, in order to provide focused coverage feedback;

[0014] (iv) In the Options Input (OI) fuzzing module, perform a fuzz test on the current seed based on... Sensitive dynamic taint analysis identifies options that affect the current execution path, infers valid options based on option constraints, and allocates mutation energy based on option-oriented energy scheduling to generate new test cases through option mutation.

[0015] (v) In the File Input (FI) fuzz testing module, based on dynamic taint analysis, file bytes that affect the execution path related to the target location are identified, and combined with file-oriented energy scheduling to allocate mutation energy, new test cases are generated by executing file mutation;

[0016] (vi) The OI fuzzing module and FI fuzzing module are executed alternately. The execution progress of one side guides the mutation of the other side through the alternating guidance strategy, forming a collaborative feedback loop. The driver execution is systematically driven to approach the target vulnerability location until a PoC input that triggers the vulnerability crash is generated.

[0017] Furthermore:

[0018] Step (one) includes the following sub-steps:

[0019] (1) Using code-based option extraction tools, identify option parsing functions (such as getopt and getopt_long) from the source code of the target program and extract the set of all configuration options. (Options) and the set of variables that directly affect them (Directly-Impact Variables, DIVs), and simultaneously configure the set of options. With the set of directly affected variables The relationship between them is a many-to-many mapping;

[0020] (2) The intermediate representation (IR) of the parsing program directly affects the set of variables. Each directly affecting variable in Locate all assignment instructions and collect the possible values ​​they can be assigned;

[0021] (3) From each Starting from the assignment instruction, a static value flow analysis tool is used to perform inverse control dependency analysis, extract the branch predicate conditions that control the assignment, and combine the control conditions of each layer into the branch conditions of the assignment. ;

[0022] (4) Set each possible value Its corresponding branch conditions Pairing, forming value space set ,here These are the possible values. The value is The assignment condition at time, followed by the value space set Establish a mapping from options to DIVs and their value spaces. .

[0023] Step (II) includes the following sub-steps:

[0024] (1) For each option Extract its gather ;

[0025] (2) For the set of options Enumerate all subsets, for any two option subsets OPT j and OPT k If its combination If the sets are identical and do not contain each other, then a conflict exists between them.

[0026] (3) Record the conflicting subset of options as option constraints. This forms a complete set of option constraints. This is used to filter out invalid option combinations during the subsequent fuzzing phase.

[0027] Step (four) includes the following sub-steps:

[0028] (1) Select a seed from the file input (FI) priority queue and execute the command on that seed. Sensitive inter-process reverse slicing and taint analysis, tracking each Starting from its earliest definition point, runtime usage propagates taint markings along the execution path through all affected variables, building... Impurity mapping to variables;

[0029] (2) Based on taint mapping and options to The mapping determines whether each option affects the current execution, and collects all options that affect the current execution as the affected options set. ;

[0030] (3) Combining option constraints ,right Filter the options to remove those that conflict with existing options in the current seed, thus obtaining a set of valid options. ;

[0031] (4) For each valid option Compare the execution path differences before and after FI mutation, calculate the average distance from the basic block marked with the option taint to the target location, and allocate mutation energy based on the simulated annealing algorithm;

[0032] (5) Perform structured mutation on each valid option, adding only one new option to the current option input each time, utilizing... The value space guides the mutation of option parameters, and terminates the mutation early and reclaims the remaining energy when all possible values ​​have been covered.

[0033] Step (5) includes the following sub-steps:

[0034] (1) Select a seed from the Option Input (OI) priority queue, perform file input-aware taint analysis, identify file bytes that affect variables on newly discovered execution paths after OI mutation, and collect them into an efficient byte set. ;

[0035] (2) Calculate the average distance difference between the execution path and the target location before and after OI mutation, and use it as an efficiency score. When the efficiency score is positive, it means that OI mutation makes the execution path closer to the target location.

[0036] (3) Calculate the normalized weight based on the efficiency score and the proportion of efficient bytes to the total bytes. The total energy is allocated to the mutation of the efficient byte according to this weight, and the remaining energy is used for the mutation of regular file input.

[0037] (4) Use fine-grained mutation strategies for efficient bytes, including bit-by-bit flipping and small-range arithmetic modifications, to maintain the structural integrity of the seed, while performing regular mutations on the remaining file bytes.

[0038] The alternating guidance strategy described in step (vi) is as follows:

[0039] (1) After the OI fuzz test module is executed, record the execution path before and after the mutation, and analyze the path differences to determine whether a new execution path closer to the target location has been found;

[0040] (2) If a new execution path is found, taint analysis is used to determine whether the path is related to FI. If it is related, the mutated seed is sent to the priority queue of the FI fuzz test module to guide FI mutation to explore the new path.

[0041] (3) After the FI fuzz test module is executed, the path differences are also recorded and analyzed. If the new path is related to OI, the mutated seed is sent to the priority queue of the OI fuzz test module to guide the OI mutation to explore the new path.

[0042] (4) Through the above-mentioned alternating guidance mechanism, OI fuzzing and FI fuzzing form a collaborative feedback loop. The mutation progress of each side can provide the other side with accurate mutation direction guidance, and the iterative driver execution approaches the target vulnerability location.

[0043] The main technical features and performance advantages of this invention are as follows:

[0044] (1) Redefining PoC input as a combination of option input (OI) and file input (FI) breaks through the limitation of traditional DGF focusing only on file input, enabling fuzzing to explore execution paths that are disabled due to option configuration.

[0045] (2) By extracting the direct influencing variables and their value space of the options through static analysis, and inferring the covering constraint relationship between the options, we can provide accurate prior knowledge for the inference of the validity of the options in the fuzzy testing stage.

[0046] (3) Adopt DIV-sensitive taint analysis technology to dynamically identify valid options and efficient file bytes that affect the current execution path at runtime, and avoid invalid mutations of irrelevant options and bytes.

[0047] (4) An innovative alternating guidance fuzzing strategy is proposed, which establishes a two-way feedback mechanism between OI fuzzing and FI fuzzing. The mutation progress of each side can accurately guide the mutation direction of the other side, solving the problem that the options and file mutations in existing tools are independent and lack coordination.

[0048] This invention can effectively improve the efficiency and success rate of targeted gray-box fuzzing in vulnerability PoC generation, and is especially suitable for complex vulnerability scenarios that require specific option configurations to trigger. Attached Figure Description

[0049] Figure 1 This is a flowchart of the option-aware, directional gray-box fuzzy testing vulnerability Proof-of-Concept (PoC) generation method of the present invention.

[0050] Figure 2 Parse code snippets for some options in libtiff. Detailed Implementation

[0051] The following is a detailed implementation process for automatically generating a Proof-of-Concept (PoC) input to trigger a potential vulnerability identified by a static analysis tool in a given target program. The main process can be found in [link to relevant documentation]. Figure 1 The details are as follows:

[0052] (a) Static analysis stage: The purpose of this stage is to use static analysis of the program to extract the option knowledge of the target program under test to guide the subsequent fuzzy testing stage.

[0053] (1) Analysis of variables directly affected by options: Using Osmart[7], an open-source option extraction tool based on code, the source code of the target program is analyzed to identify option parsing functions (such as getopt and getopt_long) and extract the set of all configuration options. and the set of variables directly affected Build options and The relationship between them is many-to-many, meaning that a single option may affect multiple options. ,one It may also be affected by multiple options.

[0054] The image processing tool tiffcrop

[16] uses the option to parse functions ( Figure 2 For example, the extracted options DIV collection In fact, tiffcrop has 38 options and 71 DIVs.

[0055] (2) DIV value space analysis. For each The LLVM intermediate representation (IR) of the parser is used to locate all assignment instructions (such as store, memcpy, memset) and collect them. All possible values ​​that can be assigned. Since these assignments are typically subject to control dependency constraints, from each Starting from the assignment instruction, SVF

[10] is used to perform reverse control dependency analysis, extract the predicate conditions of the control branches (such as br conditions and switch cases), and combine the conditions of each layer into branch conditions. Connect each value v with its branch condition. Pairing together to form a value space set Ultimately, this establishes the connection between options and their relationships. Mapping of value space The div here is the div corresponding to opt.

[0056] Using the options -f and in tiffcrop

[16] For example, deffillorder ( Figure 2 The -f option compares the optarg parameter using strncmp. When optarg = "lsb2msb", it assigns the value 2 to deffillorder (due to FILLORDER_LSB2MSB macro expansion), and when optarg = "msb2lsb", it assigns the value 1 (due to FILLORDER_MSB2LSB macro expansion). Therefore, M(-f) = {(deffillorder, {(2, optarg = lsb2msb), (1, optarg = msb2lsb)})}.

[0057] (3) Option constraint inference. When multiple options have the same effect... Enabling these options simultaneously may lead to subsequent issues. An assignment overwrites a previous assignment, rendering the former option invalid. To resolve this issue, [the following is an example of a different approach]. A comprehensive analysis of the coverage relationships is performed. For each option... Extract its gather .consider All subsets For any subset of options their combination A set is defined as When two option subsets and combination If the sets are identical and do not contain each other, a conflict is determined to exist between them. All option constraints are collected to form a constraint set. Formalized as:

[0058] .

[0059] Take tiffcrop

[16] as an example ( Figure 2 This tool observes that both the parameters -s and -t assign values ​​to the same dependency variable (DIV) outtiled. Therefore, when both parameters are enabled simultaneously, the later-configured parameter will override the earlier-configured parameter. This leads to the conflict relationship: C({−s}) = {−t}. It's important to note that although the parameter -l also modifies outtiled, in this scenario, it does not conflict with -s or -t because -l also configures an additional dependency variable deftilelength. The behavior of the target program caused by modifying both outtiled and deftilelength is significantly different from the behavior caused by modifying only outtiled. Based on this, the conflict rule is defined as follows: if the dependency variable sets of two parameters only have an intersection or containment relationship, they are not considered to be in conflict; only parameters with completely identical dependency variable sets are considered to be in conflict.

[0060] (4) Selective instrumentation. Instrumentation is performed only on the basic blocks (BBs) that can reach the target vulnerability location in the target program to provide focused coverage feedback and reduce interference from irrelevant basic blocks.

[0061] (II) Option-Aware Fuzzy Testing Phase: This phase utilizes the option knowledge extracted in phase (I) to perform fuzzy testing. The overall algorithm flow for this phase is as follows: The input is the instrumented target program. Initial seed set with default options Target vulnerability location Options mapping and option constraint set .seed Defined as a combination of Option Input (OI) and File Input (FI), i.e. .

[0062] First, a pre-exploration is performed using the initial seed and default options to discover as many potential paths as possible to the target location. The discovered file inputs are then stored in a file input priority queue. Sort by distance to the target location. Option input priority queue. Initialize to empty.

[0063] The main loop alternately executes the Option Input (OI) fuzzing module and the File Input (FI) fuzzing module:

[0064] (1) OI Fuzzing Module: This module aims to utilize the favorable execution paths discovered by the current seed FI fuzzing module to reach deeper or more diverse target paths through fuzzing effective OI.

[0065] Impact options extraction based on taint analysis: From Select a seed and execute. Sensitive blemish analysis. For each Tracing back to its earliest definition point (through inter-process reverse slicing), at that definition point is Assign a unique stain marker During execution, monitoring The use of this variable and its taint mark propagates along the execution path through all affected variables until the program terminates. This ultimately forms... Tag mapping to variables .

[0066] For each option If all its associations taint mapping All are empty (for any) If the option is true, then the current execution has no effect and it can be skipped in subsequent mutations; otherwise... Considered as an influence option. Collect all influence options for... .

[0067] Valid option extraction: Extraction of all influencing options Each option in This checks whether it conflicts with existing options in the current seed. Because a single option affects all... Not every single one will actually be used during program execution, so it is necessary to further exclude unused ones. Interference. For any valid parameter Define its effective set of dependent influence variables as The tool of this invention only selects parameters containing such effective dependent variables to construct refined constraints, and uses them in conjunction with existing constraints. A completely consistent constraint extraction process generates refined constraints. .make This is the set of options that are currently enabled in the seed. If... All meet ,but The option was determined to be valid. Collect all valid options. .

[0068] Take tiffcrop

[16] as an example ( Figure 2 When the parameters -s and -l are used together, -l initially appears to have a valid effect because it can act on the unique dependency variable deftilelength. However, after performing taint analysis, this tool found that deftilelength was not used in the current execution path. Therefore, the system generated refined constraints. If parameter -s is already enabled, parameter -l must be excluded.

[0069] Option-driven energy scheduling: Compare the execution paths before and after FI mutation and calculate the differences in execution paths. For each valid option Define two sets: for China The new set of basic blocks that cover taint markings The current execution path China The set of all basic blocks marked with taint.

[0070]

[0071] Formula (1) is used to calculate the distance metric from the option to the target location. :like If not empty, then it is From middle basic block to target basic block The average distance; otherwise, the average distance. middle basic blocks to The average distance. The smaller this metric, the greater the variability. The more likely it is to help reach the goal, the more energy should be allocated. The simulated annealing algorithm of AFLGo[1] is used for energy scheduling.

[0072] OI Mutation: Add only one valid option to the current OI at a time. Keep the existing options unchanged. Each OI is represented as a tuple. .Add to Then, its parameters are mutated. Using... Value space-guided mutation: enumeration All possible values ,like If the energy budget is less than the allocated energy budget, the mutation is terminated early after all values ​​have been explored, and unused energy is reclaimed. For control conditions resolved by configurable parameters (such as optarg or argv[1]) through functions like atoi or strtol... Actively synchronize mutation-related parameters to meet feasible conditions.

[0073] (2) FI Fuzzing Module: This module aims to leverage the favorable execution paths discovered by the current seed OI part to reach deeper or more diverse target paths by fuzzing the effective file bytes.

[0074] Efficient Byte Inference Based on Tag Analysis: From Select a seed and perform FI-aware dynamic taint analysis. Compare the execution path differences before and after OI mutation. Identify file bytes that affect variables on these newly discovered paths and collect them into an efficient byte set. .

[0075] File input-oriented energy scheduling: Calculate the current execution path ( ) and the execution path before OI mutation ( Average distance to the target location:

[0076]

[0077]

[0078] in, Refers to the basic block To the target basic block distance, This refers to the execution path of seed s.

[0079] Computational efficiency score .when When OI mutation makes the execution path closer to the target, it indicates that the OI mutation makes the execution path closer to the target.

[0080] Calculate the normalized weights:

[0081]

[0082] Total energy Divided into two parts: Used for efficient byte mutation Used for regular FI variations.

[0083] FI mutation: against The efficient bytes in the seed employ a fine-grained mutation strategy, namely bit-by-bit flipping and small-range arithmetic modifications. This strategy maintains the structural integrity of the seed, preserves the progress made through OI mutation, and allows for targeted exploration. The remaining bytes are processed using a conventional mutation strategy.

[0084] (3) Alternating guidance and collaborative strategy: The OI fuzzing module and the FI fuzzing module are executed alternately through a priority queue. The OI fuzzing module starts from... Seeds were extracted and subjected to OI mutation. After mutation, seeds showing progress were placed into... For use by the FI fuzz testing module. The FI fuzz testing module is from... Seeds are extracted and subjected to FI mutation. After mutation, seeds that show progress are placed into... This is used by the OI fuzzing module. After each side undergoes mutation, the differences in execution paths and taint analysis are compared to determine whether the newly discovered path is related to the other side's input. If related, the module precisely guides the other side to perform targeted mutations.

[0085] This alternating guidance mechanism allows OI and FI to adapt and benefit from each other's progress, forming a collaborative feedback loop that systematically drives the driver execution to approach the target position. When a mutated seed triggers a crash at the target position, that seed is recorded as the PoC output.

[0086] Experimental verification:

[0087] Dataset construction: 26 vulnerabilities selected from static analysis reports. 220 versions of 15 widely recognized benchmark programs were selected, and 979 static vulnerability reports were generated using CodeQL

[13] . After random sampling and review by security experts, 37 confirmed vulnerability reports were obtained. Finally, 26 vulnerabilities with PoC triggerable were obtained through fuzz testing.

[0088] Baseline tools: Comparison with three state-of-the-art DGF tools (DAFL

[14] , WindRanger[2], AFLGo[1]) and two state-of-the-art option-aware GF tools (ProphetFuzz[5], ZigZagFuzz[9]).

[0089] Evaluation Metric: Time to Exposure (TTE) was used as the primary evaluation metric. Each tool was allocated a 24-hour time budget, and each tool was repeated 10 times with the average value taken. In Table 1 of the experimental results, TO indicates that no PoC for the target vulnerability was successfully generated within 24 hours, CE indicates a compilation error, and OE indicates an option extraction error.

[0090] Experimental Results: The tool of this invention generated 22 (59%) PoCs, a 3.1-fold improvement over the best DGF baseline DAFL (7). The tool achieved best performance in 15 cases; in the 9 cases where all other tools failed, only the tool of this invention successfully generated PoCs. The tool of this invention discovered 13 zero-day vulnerabilities, of which 6 were confirmed by developers, and 1 was assigned a CVE number.

[0091] Table 1. Experimental results of directional fuzzy testing

[0092] .

[0093] References

[0094] [1].Marcel Böhme, Van-Thuan Pham, Manh-Dung Nguyen, and AbhikRoychoudhury. 2017. Directed greybox fuzzing. In Proceedings of the 2017 ACMSIGSAC Conference on Computer and Communications Security. 2329-2344.

[0095] [2].Zhengjie Du, Yuekang Li, Yang Liu, and Bing Mao. 2022.Windranger: A directed graybox fuzzer driven by deviation basic blocks. InProceedings of the 44th International Conference on Software Engineering.2440-2451.

[0096] [3]. Hongxu Chen, Yinxing Xue, Yuekang Li, Bihuan Chen, Xiaofei Xie, Xiuheng Wu, and Yang Liu. 2018. Hawkeye: Towards a desired directed grey-boxfuzzer. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. 2095-2108.

[0097] [4].Dawei Wang, Ying Li, Zhiyu Zhang, and Kai Chen. 2023. CarpetFuzz:Automatic program option constraint extraction from documentation forfuzzing. In 32nd USENIX Security Symposium. 1919-1936.

[0098] [5].Dawei Wang, Geng Zhou, Li Chen, Dan Li, and Yukai Miao. 2024.ProphetFuzz: Fully automated prediction and fuzzing of high-risk optioncombinations with only documentation via large language model. In Proceedingsof the 2024 ACM SIGSAC Conference on Computer and Communications Security.735-749.

[0099] [6].Ahcheong Lee, Irfan Ariq, Yunho Kim, and Moonzoo Kim. 2022.POWER: Program Option-Aware Fuzzer for High Bug Detection Ability. In ICST.220-231.

[0100] [7].Kelin Wang, Mengda Chen, Liang He, Purui Su, Yan Cai, JiongyiChen, Bin Zhang, Chao Feng, and Chaojing Tang. 2024. OSmart: Whitebox ProgramOption Fuzzing. In Proceedings of the 2024 ACM SIGSAC Conference on Computerand Communications Security. 705-719.

[0101] [8].Zenong Zhang, George Klees, Eric Wang, Michael Hicks, and ShiyiWei. 2022. Registered report: Fuzzing configurations of program options. InInternational Fuzzing Workshop (FUZZING).

[0102] [9].Ahcheong Lee, Youngseok Choi, Shin Hong, Yunho Kim, Kyutae Cho,and Moonzoo Kim. 2025. ZigZagFuzz: Interleaved Fuzzing of Program Options andFiles. ACM Transactions on Software Engineering and Methodology 34, 2 (2025),1-31.

[0103]

[10] .Yulei Sui and Jingling Xue. 2016. SVF: interprocedural staticvalue-flow analysis in LLVM. In Proceedings of the 25th InternationalConference on Compiler Construction. 265-266.

[0104]

[11] .American Fuzzy Lop. 2024. https: / / github.com / google / AFL.

[0105]

[12] .DataFlowSanitizer. 2024. https: / / clang.llvm.org / docs / DataFlowSanitizerDesign.html.

[0106]

[13] .CodeQL. 2025. https: / / codeql.github.com / .

[0107]

[14] .Tae Eun Kim, Jaeseung Choi, Kihong Heo, and Sang Kil Cha. 2023.DAFL: Directed Grey-box Fuzzing guided by Data Dependency. In 32nd USENIXSecurity Symposium. 4931-4948.

[0108]

[15] .Libtiff. 2025. A buffer overflow Vulnerability in‘combineSeparateSamplesBytes‘ of libtiff. Retrieved Sep 6, 2025 from https: / / gitlab.com / libtiff / libtiff / - / issues / 740

[0109]

[16] .Libtiff. 2025. tiffcrop.c. Retrieved Sep 6, 2025 from

[0110] https: / / gitlab.com / libtiff / libtiff / - / blob / master / tools / tiffcrop.c?ref_ type=heads。

Claims

1. An option-aware based directed grey-box fuzzing vulnerability PoC automatic generation method, characterized in that, First, the PoC input is redefined as a combination of option input (OI) and file input (FI); it is divided into two stages: (1) Static analysis stage, which systematically analyzes how options affect program semantics, including: static analysis of the target program, extracting each program option and its directly affected variables, and inferring option constraint relationships; using option validity inference technology based on taint analysis to dynamically identify valid option combinations; (2) Option-aware fuzzing stage, which closely coordinates OI fuzzing and FI fuzzing, specifically adopting an alternating guided fuzzing strategy, alternately executing option input fuzzing and file input fuzzing, and using a mutual feedback driver to approximate the target vulnerability location and efficiently generate vulnerability PoC; the specific steps are as follows: (I) Static analysis of target program, extracting all configuration options and their direct impact variables from the program's option parsing function ), analyzing the complete value space of each and the control conditions corresponding to the assignment, and establishing a mapping relationship from options to ; (ii) Based on The coverage relationship is used to infer the constraints between options and identify the potential consequences of enabling them simultaneously. Assign values ​​to the set of options that are overridden, and extract the set of option constraints; (iii) Selectively instrument the target program, only instrumenting basic blocks that can reach the target vulnerability location, in order to provide focused coverage feedback; (iv) In the Options Input (OI) fuzzing module, perform a fuzz test on the current seed based on... Sensitive dynamic taint analysis identifies options that affect the current execution path, infers valid options based on option constraints, and allocates mutation energy based on option-oriented energy scheduling to generate new test cases through option mutation. (v) In the File Input (FI) fuzz testing module, based on dynamic taint analysis, file bytes that affect the execution path related to the target location are identified, and combined with file-oriented energy scheduling to allocate mutation energy, new test cases are generated by executing file mutation; (vi) The OI fuzzing module and FI fuzzing module are executed alternately. The execution progress of one side guides the mutation of the other side through the alternating guidance strategy, forming a collaborative feedback loop. The driver execution is systematically driven to approach the target vulnerability location until a PoC input that triggers the vulnerability crash is generated.

2. The method according to claim 1, characterized in that, Step (one) includes the following sub-steps: (1) Using a code-based option extraction tool, identify the option parsing function from the source code of the target program and extract the set of all configuration options. and the set of variables directly affected At the same time, configure the set of options. With the set of directly affected variables The relationship between them is a many-to-many mapping; (2) The intermediate representation of the parsing program directly affects the set of variables. Each directly affecting variable in Locate all assignment instructions and collect the possible values ​​they can be assigned; (3) From each Starting from the assignment instruction, reverse control dependency analysis is performed to extract the branch predicate conditions that control the assignment, and the control conditions of each layer are combined into the branch conditions of the assignment. (4) Pair each possible value with its corresponding branch condition to form value space set ,here These are the possible values. The value is The assignment condition at time, followed by the value space set Establish a mapping from options to DIVs and their value spaces. .

3. The method according to claim 2, characterized in that, Step (II) includes the following sub-steps: (1) For each option Extract its gather ; (2) For the set of options Enumerate all subsets, for any two option subsets OPT j and OPT k If its combination If the sets are identical and do not contain each other, then a conflict exists between them. (3) Record the conflicting subset of options as option constraints. This forms a complete set of option constraints. This is used to filter out invalid option combinations during the subsequent fuzzing phase.

4. The method according to claim 3, characterized in that, Step (four) includes the following sub-steps: (1) Select a seed from the file input (FI) priority queue and execute the command on that seed. Sensitive inter-process reverse slicing and taint analysis, tracking each Starting from its earliest definition point, runtime usage propagates taint markings along the execution path through all affected variables, building... Impurity mapping to variables; (2) Based on taint mapping and options to The mapping determines whether each option affects the current execution, and collects all options that affect the current execution as the affected options set. ; (3) Combining option constraints ,right Filter the options to remove those that conflict with existing options in the current seed, thus obtaining a set of valid options. ; (4) For each valid option Compare the execution path differences before and after FI mutation, calculate the average distance from the basic block marked with the option taint to the target location, and allocate mutation energy based on the simulated annealing algorithm; (5) Perform structured mutation on each valid option, adding only one new option to the current option input each time, utilizing... The value space guides the mutation of option parameters, and terminates the mutation early and reclaims the remaining energy when all possible values ​​have been covered.

5. The method according to claim 4, characterized in that, Step (5) includes the following sub-steps: (1) Select a seed from the Option Input (OI) priority queue, perform file input-aware taint analysis, identify file bytes that affect variables on newly discovered execution paths after OI mutation, and collect them into an efficient byte set. ; (2) Calculate the average distance difference between the execution path and the target location before and after OI mutation, and use it as an efficiency score. When the efficiency score is positive, it means that OI mutation makes the execution path closer to the target location. (3) Calculate the normalized weight based on the efficiency score and the proportion of efficient bytes to the total bytes. The total energy is allocated to the mutation of the efficient byte according to this weight, and the remaining energy is used for the mutation of regular file input. (4) Use fine-grained mutation strategies for efficient bytes, including bit-by-bit flipping and small-range arithmetic modifications, to maintain the structural integrity of the seed, while performing regular mutations on the remaining file bytes.

6. The method according to claim 5, characterized in that, The alternating guidance strategy described in step (vi) is as follows: (1) After the OI fuzz test module is executed, record the execution path before and after the mutation, and analyze the path differences to determine whether a new execution path closer to the target location has been found; (2) If a new execution path is found, taint analysis is used to determine whether the path is related to FI. If it is related, the mutated seed is sent to the priority queue of the FI fuzz test module to guide FI mutation to explore the new path. (3) After the FI fuzz test module is executed, the path differences are also recorded and analyzed. If the new path is related to OI, the mutated seed is sent to the priority queue of the OI fuzz test module to guide the OI mutation to explore the new path. (4) Through the above-mentioned alternating guidance mechanism, OI fuzzing and FI fuzzing form a collaborative feedback loop. The mutation progress of each side can provide the other side with accurate mutation direction guidance, and the iterative driver execution approaches the target vulnerability location.

Images