A grey-box fuzz testing method for embedded firmware based on word weight mutation and virtual instrumentation

Abstract

The present invention proposes an embedded firmware gray box fuzzy testing method based on word weight mutation and virtual plug-in technology for embedded firmware vulnerability mining, which can effectively improve the speed and effect of embedded firmware vulnerability mining. The method includes the following steps: 1) word weight mutation: using a test case mutation strategy based on field weights to generate new test cases; 2) virtual plug-in: using the plug-in method during the translation of the embedded firmware QEMU virtual simulation environment to obtain the code coverage information of the embedded firmware under test. The test case mutation strategy based on field weights can improve the quality and speed of test case iterative updates, and the plug-in method during the translation of the embedded firmware QEMU virtual simulation environment can reduce the execution overhead of the embedded firmware under test when statistically analyzing code coverage information. The combination of the two can greatly improve the efficiency of embedded firmware vulnerability mining.

Description

Technical Field

[0001] The present invention relates to an embedded firmware grey box fuzzy testing method based on word weight variation and virtual plugging technology, which is suitable for vulnerability mining in embedded device firmware and does not rely on embedded devices. It has the characteristics of high vulnerability mining efficiency and low dependence on manual analysis. Background Art

[0002] Embedded devices are widely used in various industries due to their low power consumption and low cost. In recent years, with the development of basic supporting technologies such as communication technology, smart terminals, and cloud computing, the functions of embedded devices have become more and more abundant. Embedded devices are gradually replacing traditional non-embedded devices (such as sockets, lights, water meters, electricity meters, etc.), which has brought great convenience to our work and life. Due to the lack of unified specifications for the development of embedded devices, there are likely to be vulnerabilities in embedded firmware. However, embedded devices generally lack security protection capabilities, so the vulnerabilities in embedded firmware pose a great threat to the personal privacy, property and life safety of users. Vulnerability mining of embedded firmware, discovery and timely repair of firmware vulnerabilities are of great practical significance to improving the security of embedded devices.

[0003] Most of the existing embedded firmware vulnerability mining methods are based on embedded devices or static analysis of embedded firmware. Firmware vulnerability mining methods based on embedded devices interact directly with physical devices and cannot obtain internal information of firmware programs. They need to obtain embedded devices first. Static analysis of embedded firmware has serious false positive problems, and the results of static analysis still need to rely on manual verification. To solve the above problems, gray box fuzz testing technology represented by AFL (American FuzzyLop) has been widely used in the field of embedded firmware vulnerability mining in recent years. This technology solves the problem that the internal code execution information of the firmware program cannot be obtained during the fuzz testing process through code instrumentation, so that the generation of high-quality test cases can be guided without manual analysis. However, the existing AFL code instrumentation technology needs to repeatedly track the virtualized instructions of the code during the code translation and execution process in a virtualized environment (such as QEMU), which greatly reduces the execution efficiency of fuzz testing. In addition, AFL also lacks a means of analyzing the variation of embedded firmware input fields, resulting in a lack of guidance in the generation and variation of test cases, which also affects the efficiency of fuzz testing from another aspect.

[0004] Therefore, in order to improve the efficiency of AFL gray-box fuzz testing technology in mining embedded firmware vulnerabilities, the present invention proposes an embedded firmware gray-box fuzz testing method based on word weight mutation and virtual plug-in technology. The mutation of field weights is used to guide the generation of test cases in a targeted manner. At the same time, the virtual plug-in technology is combined to perform tracking code solidification plug-in in the first virtualization instruction translation, thereby further improving the efficiency of fuzz testing. Summary of the invention

[0005] The present invention is aimed at the problem of embedded firmware vulnerability mining, and proposes a gray box fuzz testing method based on word weight variation and virtual plugging technology. The method builds a virtual operating environment (such as QEMU) for the embedded firmware program under test, and performs fuzz testing based on virtual plugging and test case generation based on word weight variation on the embedded firmware program in the virtual operating environment. The method does not rely on embedded device hardware, has the characteristics of high fuzzy test execution efficiency and good test case generation quality, and can effectively mine vulnerabilities in embedded firmware on the basis of efficiently obtaining embedded firmware code coverage information.

[0006] In order to achieve the above-mentioned object of the invention, the present invention is implemented through the following specific technical solutions:

[0007] A gray box fuzz testing method for embedded firmware based on word weight mutation and virtual plugging includes the following steps:

[0008] 1) Word weight mutation: Generate new test cases based on the test case mutation strategy of field weights;

[0009] 2) Virtual instrumentation: When translating embedded firmware, the instrumentation method obtains the execution information of the embedded firmware under test.

[0010] Preferably, a gray box fuzz testing method for embedded firmware based on word weight mutation and virtual plugging technology comprises the following steps:

[0011] 1) Word weight mutation: Generate new test cases based on the test case mutation strategy of field weights, specifically:

[0012] Step 1.1, collect and filter test cases, delete redundant test cases, score the remaining test cases and add them to the test case library of the embedded firmware program under test;

[0013] Step 1.2: Select a test case T from the test case library i , determine the test case T i Whether it has been split by field. If it has been split by field, go to step 1.4;

[0014] Step 1.3: Select the test case T iDivide the input format of the firmware program under test into different fields and assign mutation weights to each field;

[0015] Step 1.4: Test case T i Scoring, based on test case T i The score is determined by T i The number of new test cases generated;

[0016] Step 1.5: Randomly generate a mutation number M c , M c The number of mutations required to generate new test cases for this round;

[0017] Step 1.6: Randomly generate a mutation probability P and randomly select a test case T i If the mutation weight of field f is greater than or equal to the mutation probability P, field f is mutated and the mutated field f is recorded. This operation is repeated until the test case is compiled M. c Output the new test case T generated by the mutation i ';

[0018] 2) Virtual stub: When translating embedded firmware, the stub method obtains the execution information of the embedded firmware under test, specifically:

[0019] Step 2.1: Generate the mutated test case T i 'Run the tested firmware program in the embedded firmware virtual running environment as input data of the tested firmware program, and use the embedded firmware translation plug-in method to record the execution information of the tested embedded firmware;

[0020] Step 2.2: Check the end status of the firmware program under test. If the firmware under test ends abnormally, the test case T that will cause the firmware program under test to end abnormally i 'Save to the exception test case library.

[0021] Preferably, in the step 1.1, the method for screening test cases is: taking the edge execution information of the embedded firmware program under test as the standard, the edge of the embedded firmware program under test is the jump from one basic block to another basic block, and selecting test cases from the test case library in turn as input data of the embedded firmware program under test, recording the edge execution information of the embedded firmware program under test, and if the embedded firmware program under test executes a new edge, adding this test case to the test case library, otherwise discarding this test case.

[0022] Preferably, in step 1.3, the test cases are divided according to the input data format of the embedded firmware program under test, and the input data of the embedded firmware program under test is regarded as data composed of n fields, then the test case T iIt can be regarded as f1,f2,...f n The data consists of n fields, namely where f j is the jth field in the input data format.

[0023] Preferably, in step 1.4, the method for scoring the test case is: i Score S i The calculation method is as follows:

[0024]

[0025] where e j Represents a test case T i The jth edge hit, For the hit side j The number of test cases.

[0026] Preferably, in the step 2.1, the execution information of the embedded firmware under test is obtained by using the stub method during embedded firmware translation. The specific method is as follows: when executing the embedded firmware program, QEMU will first translate the instructions of the embedded firmware program into local instructions according to basic blocks, and the translation is completed by the tb_gen_code function in QEMU. Therefore, in the tb_gen_code function, the stub code recording the execution information of the embedded firmware program under test is inserted into the translation result of the firmware instruction. When the translated embedded firmware program is executed, the stub code instruction will be executed, and the stub code instruction will save the execution information of the firmware under test to the memory recording the firmware program code coverage.

[0027] Compared with the prior art, the present invention has the following obvious outstanding substantive features and significant advantages:

[0028] 1. The embedded firmware gray box fuzzy testing method based on word weight variation and virtual plugging in the present invention can effectively improve the speed and effect of embedded firmware vulnerability mining;

[0029] 2. The test case mutation strategy based on field weights of the present invention can improve the quality and speed of test case iterative updates, and the plugging method during translation of the embedded firmware QEMU virtual simulation environment can reduce the execution overhead of the tested embedded firmware when statistically analyzing code coverage information. The combination of the two can greatly improve the efficiency of embedded firmware vulnerability mining. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a schematic diagram of the present invention.

[0031] Figure 2 This is a flow chart of the test case mutation algorithm based on field weights of the present invention.

[0032] Figure 3(a) shows the workflow of QEMU.

[0033] Figure 3(b) The principle of AFL's QEMU mode dynamically instrumenting the program under test.

[0034] FIG3( c ) shows the principle of the present invention for dynamically inserting the embedded firmware program under test.

[0035] Figure 4 The present invention compares the execution speed of embedded firmware programs when using the plugging method of the present invention and the plugging method of the fuzz testing tool AFL to execute different embedded firmware programs.

[0036] Figure 5 Embedded firmware vulnerabilities mined using the method of the present invention. DETAILED DESCRIPTION

[0037] The present invention will be described in detail below with reference to preferred embodiments and accompanying drawings.

[0038] Embodiment 1:

[0039] See also Figure 1 The embedded firmware gray box fuzz testing method based on word weight mutation and virtual plugging technology is characterized by the following steps:

[0040] 1) Word weight mutation: Generate new test cases based on the test case mutation strategy of field weights;

[0041] 2) Virtual stub: When translating embedded firmware, stub is used to obtain the code execution information of the embedded firmware under test.

[0042] A virtual operating environment is built for the embedded firmware program under test, and fuzz testing based on virtual instrumentation and test case generation based on word weight mutation are performed on the embedded firmware program in the virtual operating environment. This can effectively discover vulnerabilities in the embedded firmware based on the efficient acquisition of embedded firmware code coverage information.

[0043] Embodiment 2:

[0044] This embodiment is basically the same as the first embodiment, with the following special features:

[0045] See also Figure 1 to Figure 5 , the step 1) specifically comprises the following steps:

[0046] Step 1.1, collect and filter test cases, delete redundant test cases, score the remaining test cases and add them to the test case library of the embedded firmware program under test;

[0047] Step 1.2: Select a test case T from the test case library i , determine the test case T iWhether it has been split by field. If it has been split by field, go to step 1.4;

[0048] Step 1.3: Select the test case T i Divide the input format of the firmware program under test into different fields and assign mutation weights to each field;

[0049] Step 1.4: Test case T i Scoring, based on test case T i The score is determined by T i The number of new test cases generated;

[0050] Step 1.5: Randomly generate a mutation number M c , M c The number of mutations required to generate new test cases for this round;

[0051] Step 1.6: Randomly generate a mutation probability P and randomly select a test case T i If the mutation weight of field f is greater than or equal to the mutation probability P, field f is mutated and the mutated field f is recorded. This operation is repeated until the test case is compiled M. c Output the new test case T generated by the mutation i ';

[0052] Preferably, in step 1.1, the method for screening test cases is: taking the edge execution information (i.e., the jump from one basic block to another basic block) of the embedded firmware program under test as the standard, sequentially selecting test cases as input data, executing and recording the edge execution information of the embedded firmware program under test, and if the embedded firmware program under test executes a new edge, adding this test case to the test case library, otherwise discarding this test case;

[0053] Preferably, in step 1.3, the test cases are divided according to the input data format of the embedded firmware program under test, and the input data of the embedded firmware program under test is regarded as data composed of n fields, then the test case T i It can be seen as f1, f2, ... f n The data consists of n fields, namely where f j is the jth field in the input data format; the initial mutation weight of each field can be set based on experience or set to a default value, the default value of which is 1;

[0054] Preferably, in step 1.4, the method for scoring the test case is: i Score S i The calculation method is as follows:

[0055]

[0056] where e j Represents a test case T i The jth edge hit, For the hit side j The number of test cases;

[0057] The step 2) specifically comprises the following steps:

[0058] Step 2.1: Generate the mutated test case T i 'Run the tested firmware program in the embedded firmware virtual running environment as input data of the tested firmware program, and use the embedded firmware translation plug-in method to record the execution information of the tested embedded firmware;

[0059] Step 2.2: Check the end status of the firmware program under test. If the firmware under test ends abnormally, the test case T that will cause the firmware program under test to end abnormally i 'Save to the exception test case library;

[0060] Preferably, the step 2.1 uses the stub method during embedded firmware translation to obtain the execution information of the embedded firmware under test. The specific method is as follows: when QEMU executes the embedded firmware program, it will first translate the instructions of the embedded firmware program into local instructions according to basic blocks. The translation is completed by the tb_gen_code function in QEMU. Therefore, in the tb_gen_code function, the stub code that records the execution information of the embedded firmware program under test is inserted into the translation result of the firmware instruction. When the translated embedded firmware program is executed, the stub code instructions will be executed. The stub code instructions will save the execution information of the firmware under test to the memory that records the firmware program code coverage.

[0061] Figure 3(a) shows the process of executing a binary program in the QEMU environment. QEMU uses the tb_find function to find the basic block of the binary program to be executed. If this basic block has been translated, it is executed directly. Otherwise, the tb_gen_code function is called to translate the basic block of the binary program to be executed into local instructions and then executed.

[0062] Figure 3(b) shows the principle diagram of the QEMU mode of the fuzz testing tool AFL (American Fuzzy Lop) for inserting the tested program. In order to record the code information of the tested program, AFL adds a statistical code to the tb_find function of QEMU to record the information of the tested program. When QEMU wants to execute a basic block code of the tested program, it will first call the tb_find function. The statistical code in the tb_find function will record the execution information of the tested program. Since QEMU needs to call tb_find for translation every time the same code of the tested program is executed, this insertion method requires repeated translation and insertion every time the same program is executed, which greatly affects the execution efficiency of the fuzz test.

[0063] FIG3( c ) is a schematic diagram of the stub principle for recording the code information of the tested firmware program of the present invention. In order to improve the running speed of the tested embedded firmware program in the QEMU virtual environment, the present invention directly inserts the stub code recording the code execution information of the tested firmware program into the front of the local instruction translated by the tested firmware program through the tb_gen_code function. Therefore, for the same section of code, it is only necessary to perform the stub operation at the first execution, and there is no need to switch the program control from the tested embedded firmware program to QEMU to record the code execution information of the tested firmware program every time the same section of code is executed.

[0064] Figure 4 To compare the speed of executing embedded firmware programs using the instrumentation method of this embodiment and using the fuzz testing tool AFL, for different embedded firmware programs, the execution speed under the instrumentation method of this embodiment is faster than the execution speed under the AFL instrumentation method.

[0065] Figure 5 The vulnerability discovered by fuzz testing the lighttpd program in a smart socket firmware using the method of this embodiment proves the effectiveness of the method of the present invention.

[0066] The above-mentioned embodiment proposes an embedded firmware gray box fuzz testing method based on word weight mutation and virtual plug-in technology for embedded firmware vulnerability mining, which can effectively improve the speed and effect of embedded firmware vulnerability mining. The method includes the following steps: 1) Word weight mutation: Generate new test cases using a test case mutation strategy based on field weights; 2) Virtual plug-in: Use the plug-in method during the translation of the embedded firmware QEMU virtual simulation environment to obtain the code coverage information of the embedded firmware under test. The test case mutation strategy based on field weights can improve the quality and speed of test case iterative updates, and the plug-in method during the translation of the embedded firmware QEMU virtual simulation environment can reduce the execution overhead of the embedded firmware under test when statistically analyzing code coverage information. The combination of the two can greatly improve the efficiency of embedded firmware vulnerability mining.

[0067] The above describes the embodiments of the present invention in conjunction with the accompanying drawings, but the present invention is not limited to the above embodiments. Various changes can be made according to the purpose of the invention. Any changes, modifications, substitutions, combinations or simplifications made according to the spirit and principle of the technical solution of the present invention should be equivalent replacement methods. As long as they meet the purpose of the invention and do not deviate from the technical principles and inventive concepts of the present invention, they belong to the protection scope of the present invention.

Claims

1. A gray box fuzz testing method for embedded firmware based on word weight mutation and virtual instrumentation, characterized in that: The steps include: 1) Word weight mutation: Generate new test cases based on the test case mutation strategy of field weights; 2) Virtual stub: When translating embedded firmware, the stub method obtains the execution information of the embedded firmware under test; The step 1) specifically comprises the following steps: Step 1.1, collect and filter test cases, delete redundant test cases, score the remaining test cases and add them to the test case library of the embedded firmware program under test; Step 1.2: Select a test case T from the test case library i , determine the test case T i Whether it has been split by field. If it has been split by field, go to step 1.4; Step 1.3: Select the test case T i Divide the input format of the firmware program under test into different fields and assign mutation weights to each field; Step 1.4: Test case T i Scoring, based on test case T i The score is determined by T i The number of new test cases generated; Step 1.5: Randomly generate a mutation number M c , M c The number of mutations required to generate new test cases for this round; Step 1.6: Randomly generate a mutation probability P and randomly select a test case T i If the mutation weight of field f is greater than or equal to the mutation probability P, field f is mutated and the mutated field f is recorded. This operation is repeated until the test case is compiled M. c Output the new test case T generated by the mutation i '; The step 2) specifically comprises the following steps: Step 2.1: Generate the mutated test case T i 'Run the tested firmware program in the embedded firmware virtual running environment as input data of the tested firmware program, and use the embedded firmware translation plug-in method to record the execution information of the tested embedded firmware; Step 2.2: Check the end status of the firmware program under test. If the firmware under test ends abnormally, the test case T that will cause the firmware program under test to end abnormally i 'Save to the exception test case library.

2. The embedded firmware gray box fuzz testing method based on word weight variation and virtual plugging according to claim 1 is characterized in that: In the step 1.1, the method for screening test cases is: taking the edge execution information of the embedded firmware program under test as the standard, the edge of the embedded firmware program under test is the jump from one basic block to another basic block, selecting test cases from the test case library in turn as input data of the embedded firmware program under test, recording the edge execution information of the embedded firmware program under test, if the embedded firmware program under test executes a new edge, then adding this test case to the test case library, otherwise discarding this test case.

3. The embedded firmware gray box fuzz testing method based on word weight variation and virtual plugging according to claim 1 is characterized in that: In step 1.3, the test cases are divided according to the input data format of the embedded firmware program under test, and the input data of the embedded firmware program under test is regarded as data composed of n fields. Then the test case T i It can be regarded as f1,f2,...f n The data consists of n fields, namely where f j is the jth field in the input data format.

4. The embedded firmware gray box fuzz testing method based on word weight variation and virtual plugging according to claim 1 is characterized in that: In step 1.4, the method for scoring the test case is: Test case T i Score S i The calculation method is as follows: where e j Represents a test case T i The jth edge hit, For the hit side j The number of test cases.

5. The embedded firmware gray box fuzz testing method based on word weight variation and virtual plugging according to claim 1 is characterized in that: In the step 2.1, the execution information of the embedded firmware under test is obtained by using the stub method during embedded firmware translation. The specific method is as follows: when QEMU executes the embedded firmware program, it will first translate the instructions of the embedded firmware program into local instructions according to the basic blocks. The translation is completed by the tb_gen_code function in QEMU. Therefore, in the tb_gen_code function, the stub code recording the execution information of the embedded firmware program under test is inserted into the translation result of the firmware instruction. When the translated embedded firmware program is executed, the stub code instruction will be executed. The stub code instruction saves the execution information of the firmware under test into the memory recording the firmware program code coverage.

Images