A WebAssembly Engine Fuzzing Method and System
By using an attribute abstract syntax tree and a pre-validated WebAssembly module mutation method, the problem of generating legal structures and types in traditional fuzzing is solved, achieving efficient fuzzing coverage and error correction, and improving the security and stability of the WebAssembly engine.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHANDONG UNIV
- Filing Date
- 2023-07-11
- Publication Date
- 2026-05-26
AI Technical Summary
Traditional fuzzing methods struggle to generate binary inputs for WebAssembly modules with valid structures and types, and cannot effectively correct validity checks for mutated modules during validator testing, resulting in low code coverage.
By using an attribute abstract syntax tree-based and pre-validated WebAssembly module mutation method, module mutations with correct format and security constraints are generated. Type-aware and structure-aware mutation strategies, combined with fast correction techniques, ensure that the mutated modules can pass the engine's validator.
The code coverage of the WebAssembly engine's fuzzing has been improved, ensuring that the generated input can deeply execute the logic, thus improving the effectiveness and accuracy of fuzzing.
Smart Images
Figure CN116701231B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of software testing, and in particular relates to a fuzz testing method and system for WebAssembly engines. Background Technology
[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.
[0003] In 2017, the four major web browser manufacturers released the low-level bytecode WebAssembly to address JavaScript performance limitations and accelerate the computational performance of web applications. Since its release, it has become widely adopted in web browsers. The WebAssembly system interface, released in 2018, allows WebAssembly to communicate with the operating system, enabling its widespread application in non-browser domains, including for isolating edge computing, IoT devices, blockchain, and web proxies to run user-uploaded code that may contain security risks.
[0004] WebAssembly's security guarantees rely on the WebAssembly engine's effective validation of WebAssembly modules, requiring security checks to be inserted at all correct points. These guarantees need to be added by developers when implementing the WebAssembly engine, and errors in implementation can easily break these guarantees, leading to significant security risks. In the issue feedback and tracking lists of 31 open-source WebAssembly engines, security researchers have reported over 300 different bugs. These bugs have caused WebAssembly engines to crash and affect the execution of other programs, and have even been exploited to bypass WebAssembly sandbox restrictions and gain system privileges.
[0005] Fuzzing is widely used for automated vulnerability discovery. Its basic idea is to inject a large amount of random data into the input and simulate possible attack scenarios to discover potential vulnerabilities and security issues in the target program. In fuzzing, test cases are automatically generated by the fuzzing program, containing various possible combinations of input data. These cases are then executed on the target program to detect the presence of potential vulnerabilities and security issues. If the target program malfunctions or crashes, it indicates a potential vulnerability or security problem, and the testing tool records the relevant information for analysis and remediation.
[0006] However, when traditional fuzzing methods fuzz test the WebAssembly engine, the inputs generated by mutations often fail to reach the deep logic of the WebAssembly engine. This is mainly due to two reasons:
[0007] 1) WebAssembly module binaries have specific formats and structures.
[0008] Traditional fuzzing methods use byte-level mutation strategies to mutate the seed. However, the binary files of WebAssembly modules have strict format requirements. This means that when mutating WebAssembly modules with complex file formats, it often destroys their unique structure, resulting in the generated input being difficult to pass through the format parsing module of the WebAssembly engine and being discarded before execution.
[0009] 2) The WebAssembly engine performs correctness checks and security boundary checks before executing the input.
[0010] Traditional instruction-level mutation methods ignore the strict type constraints of WebAssembly instructions. Although the generated WebAssembly module binary files can pass the format parsing module of the WebAssembly engine, the input generated is still difficult to reach the execution stage due to the existence of the correctness and security verifier of the WebAssembly engine. This makes it difficult to explore the deep logic of the virtual machine, resulting in very low code coverage. Summary of the Invention
[0011] To overcome the shortcomings of the prior art, this invention provides a WebAssembly engine fuzzing method and system. By using an attribute abstract syntax tree and a WebAssembly module mutation method with pre-validation and fast correction, it more effectively generates WebAssembly module mutations with correct WebAssembly binary format, legality, and compliance with security constraints, thereby performing efficient fuzzing on the WebAssembly engine.
[0012] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions:
[0013] The first aspect of this invention provides a fuzz testing method for a WebAssembly engine.
[0014] A WebAssembly engine fuzzing method includes:
[0015] Obtain a large number of WebAssembly binary samples as initial seed samples;
[0016] The initial seed sample is parsed into an attribute abstract syntax tree with node location information and node type information;
[0017] By applying mutation methods to the attribute abstract syntax tree with type-aware mutation strategy and structure-aware instruction mutation method, a new attribute abstract syntax tree with legal structure and type is generated.
[0018] The mutated attribute abstract syntax tree is pre-validated to check the legality of the mutation and quickly correct the positions of invalid nodes.
[0019] The pre-validated attribute abstract syntax tree is used to generate a WebAssembly binary sample, which is then input into the target engine for fuzz testing.
[0020] Furthermore, the acquisition of a large number of WebAssembly binary samples was carried out using two methods: internet search and self-compilation of open-source code.
[0021] Furthermore, the step of parsing the initial seed sample into an attribute abstract syntax tree with node position and node type information specifically involves:
[0022] The entire initial seed sample is mapped into the process memory space via the mmap system call to provide random access to the file;
[0023] The initial seed sample is parsed into an extended abstract syntax tree using an event-driven streaming parsing method.
[0024] Specifically, the top-down streaming parsing method is as follows:
[0025] The overall information of the 12 segment structures is analyzed separately, and 12 AST segment nodes are generated;
[0026] Each segment structure is parsed separately. Each segment is read in using a streaming method and parsed according to the parsing rules for each segment.
[0027] Furthermore, the node position information is obtained by adding a position attribute field to each generated node. This position attribute contains two integer member variables: offset and size. Offset represents the offset of the node from the first byte of its parent node in the WebAssembly module binary file, and size represents the number of bytes occupied by the node element in the binary file.
[0028] The node type information is obtained by constructing two mapping tables: <parameter type, node array> and <return type, node array>. For each instruction, the instruction node is added to the array corresponding to the relevant entry in each of the two mapping tables according to the parameter type and return type of the instruction.
[0029] Furthermore, the type-aware mutation strategy includes seven mutation operations: deleting a node sequence, inserting a node, swapping nodes of the same type, changing the control flow structure, modifying the type, changing the function signature, and modifying global variables and exported functions.
[0030] Furthermore, the structure-aware instruction mutation method divides instruction mutation into opcode mutation and operand mutation.
[0031] The opcode mutation method involves using entries from a predefined list of WebAssembly instructions as candidates and randomly selecting an opcode from them each time. This method can prevent mutations into illegal instructions.
[0032] The operand mutation refers to applying different mutation strategies to operands based on their types after the opcode of a new instruction is determined.
[0033] Furthermore, the application of different mutation strategies to operands based on their types is specifically as follows:
[0034] If the operand is a dynamic operand, then only its opcode needs to be generated by mutation, without generating the corresponding operand;
[0035] If the operand is a static immediate parameter, then the type and structure information of its static immediate parameter are perceived, and a structure-aware instruction mutation method is recursively applied to it.
[0036] Furthermore, the pre-validation is achieved by modifying the wasm-parser tool to support a validity validation process based on the structure of the attribute abstract syntax tree, and by adding additional node position information so that when an error is encountered during the validation process, the erroneous attribute abstract syntax tree node is returned as the position of the invalid node.
[0037] Furthermore, the rapid correction of invalid node positions specifically involves:
[0038] Select the erroneous Attribute Abstract Syntax Tree (API) node as the node to be mutated, and then repeatedly apply the mutation method to mutate the node to be mutated, regenerating the API until the number of repairs meets the preset condition.
[0039] A second aspect of the present invention provides a fuzz testing system for a WebAssembly engine.
[0040] A WebAssembly engine fuzz testing system includes an acquisition module, a parsing module, a mutation module, a verification module, and a testing module.
[0041] The acquisition module is configured to acquire a large number of WebAssembly binary samples as initial seed samples.
[0042] The parsing module is configured to parse the initial seed sample into an attribute abstract syntax tree with node position information and node type information;
[0043] The mutation module is configured to apply mutation methods to the attribute abstract syntax tree through a type-aware mutation strategy and a structure-aware instruction mutation method, thereby generating a new attribute abstract syntax tree with valid structure and type.
[0044] The validation module is configured to: pre-validate the mutated attribute abstract syntax tree, detect the legality of the mutation, and quickly correct the positions of invalid nodes;
[0045] The testing module is configured to generate WebAssembly binary samples from the pre-validated attribute abstract syntax tree and input them into the target engine for fuzz testing.
[0046] The above one or more technical solutions have the following beneficial effects:
[0047] This invention extends the abstract syntax tree structure, uses a custom parser to construct an attribute abstract syntax tree, and adds position and type information to the syntax tree nodes, thereby effectively guiding mutation work.
[0048] This invention effectively mutates the attribute syntax tree structure through a type-aware mutation strategy, while preserving the legality of the structure and type during the mutation process, thereby effectively generating WebAssembly module mutations with legal structure and type.
[0049] This invention effectively generates new instructions that conform to format constraints by applying a structure-aware instruction mutation method to the WebAssembly function code segment.
[0050] This invention pre-validates the attribute abstract syntax tree of the WebAssembly module through a custom validator, adds error location feedback to guide the mutant to quickly repair the erroneous nodes, thereby making the generated mutations more likely to pass the legality verification of the target WebAssembly engine validator, thus allowing the input to penetrate into the execution logic of the WebAssembly engine.
[0051] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description
[0052] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.
[0053] Figure 1 This is a flowchart of the method in the first embodiment.
[0054] Figure 2 This is a schematic diagram of the attribute abstract syntax tree for the first embodiment.
[0055] Figure 3 This is a schematic diagram of the structure of the <type, node array> mapping table in the first embodiment.
[0056] Figure 4 This is a system structure diagram of the second embodiment. Detailed Implementation
[0057] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.
[0058] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.
[0059] The technical problem to be solved by this invention is:
[0060] (1) Traditional fuzzing mutation methods struggle to generate binary inputs for WebAssembly modules with valid structures and types. On one hand, WebAssembly modules have specific binary structures, and traditional bit-based random mutation methods lack knowledge of these structures, making it difficult to generate mutation files with correct structures. On the other hand, WebAssembly modules have specific syntax and types, making it difficult for traditional fuzzing mutation methods to generate WebAssembly modules with correct syntax and types.
[0061] (2) Existing WebAssembly fuzzing methods cannot correct validity errors encountered by mutated WebAssembly modules when facing the validator. On the one hand, existing WebAssembly fuzzing processes do not check the validity constraints of the input before execution, making it difficult to pass the WebAssembly engine's validator. On the other hand, existing WebAssembly engine fuzzing methods cannot capture the location of validation errors, making it difficult to specifically correct the errors.
[0062] Example 1
[0063] In one or more embodiments, a fuzz testing method for a WebAssembly engine is disclosed, such as Figure 1 As shown, it includes the following steps:
[0064] Step S1: Obtain a large number of WebAssembly binary samples as initial seed samples.
[0065] We obtained WebAssembly binary samples using two methods: internet searching and compiling open-source code ourselves.
[0066] (1) Obtaining via the Internet
[0067] WebAssembly binary files have the .wasm extension. You can download sample WebAssembly module binary files by searching for keywords such as WebAssembly\wasm on GitHub.
[0068] (2) Obtain by compiling open-source code
[0069] Search for popular open-source C / C++ code repositories on GitHub, such as ffmpeg, and compile them into WebAssembly binary format files using the clang and emscripten toolchains.
[0070] Step S2: Parse the initial seed sample into an attribute abstract syntax tree with node position information and node type information.
[0071] A custom parser is used to parse the WebAssembly binary module into an attribute abstract syntax tree. The attribute abstract syntax tree is an extended structure of the abstract syntax tree. Its main feature is that the abstract syntax tree nodes have additional attribute information on the basis of the original. In this invention, the added attribute information is the node's position information in the WebAssembly binary file and the node's type information. This information guides subsequent mutations.
[0072] Specifically, the WebAssembly binary sample obtained in step S1 is used as input, and a custom WebAssembly binary format parser is used to generate an attribute abstract syntax tree, such as... Figure 2 As shown, the traditional WebAssembly abstract syntax tree is extended into an attribute abstract syntax tree, with additional attribute fields added to each node of the abstract syntax tree to store additional attribute information for that node.
[0073] When parsing the WebAssembly module binary file, the entire WebAssembly binary file is first mapped into the process memory space through the mmap system call to provide random access to the file. Then, the WebAssembly module is parsed into an extended abstract syntax tree through an event-driven streaming parsing method.
[0074] Top-down streaming parsing method
[0075] The WebAssembly module contains a maximum of 12 segment structures: type definition segment, import table segment, export table segment, function type segment, table segment, memory segment, global variable segment, start function segment, element segment, code segment, data segment, and user-defined segment. The top-down streaming parsing first parses the overall information of these 12 segments, generating 12 AST segment nodes. Then, it parses each segment individually, reading each segment in a streaming manner and parsing it according to the parsing rules for each segment.
[0076] The two added attribute information are: first, node position information, which represents the node's offset relative to its segment in the original binary file and the number of bytes the node occupies in the original binary file; second, the node's type information, specifically:
[0077] Node location information
[0078] When parsing the module, a position attribute field is added to each generated node. This position attribute contains two integer member variables: offset and size. Offset represents the offset of the node from the first byte of its parent node in the WebAssembly module binary file, and size represents the number of bytes occupied by the node element in the binary file.
[0079] Node type information
[0080] The code segments within the 12 segment structures store each function and its function body. After creating a function node, the instruction sequence within the function body needs to be type-parsed. The instruction type is represented as a set of types consisting of the instruction's parameter types and return types. This set of types comprises combinations of types defined in the WebAssembly specification, including nine types: Number, Vector, Reference, Value, Function, Limits, Memory, Table, and Global.
[0081] By analyzing instruction types, node type information is constructed, specifically as follows:
[0082] First, construct two empty <type identifier, node array> mapping tables: <parameter type, node array> and <return type, node array>. Each entry in <parameter type, node array> represents a set of nodes with that type parameter. Figure 3 This is a structural diagram of the <type, node array> mapping table, such as... Figure 3 As shown, each entry in <Return type, Array of nodes> represents a set of nodes that are returned by that type.
[0083] Then, iterate through each function in the code segment, and then through each instruction in the function body. By consulting the WebAssembly specification for instructions, extract the parameter type and return type of each instruction; for example, the instruction "i32.add" pops one i32 value 'a' and one i32 value 'b' from the top of the stack, calculates the value of a+b, and pushes it onto the stack, thus having...<i32,i32> Parameter types and <i32>The return type; for instructions that require no parameters, the parameter type is specified as... <null>For types that do not return a value, their return type is specified as follows: <null>.
[0084] By iterating through each instruction, the instruction node is added to the array corresponding to the relevant entry in the two mapping tables, <parameter type, node array> and <return type, node array>, to obtain the node type information of each node.
[0085] Step S3: Apply the mutation method to the attribute abstract syntax tree using a type-aware mutation strategy and a structure-aware instruction mutation method to generate a new attribute abstract syntax tree with a valid structure and type.
[0086] By employing a type-aware mutation strategy and a structure-aware instruction mutation method based on the attribute abstract syntax tree (API), WebAssembly module mutations with correct format and syntax are generated. During fuzz testing of the WebAssembly engine, the input needs to have a valid WebAssembly module binary format and valid syntax. To generate binary inputs with valid format and syntax, a node type analysis algorithm is applied to construct a mapping table of <parameter type, node set> and <return type, node set> based on the API structure. Then, seven type-aware mutation strategies and structure-aware instruction mutation methods are applied to effectively mutate the API, thereby generating WebAssembly module binary files with valid types and formats.
[0087] Type-aware mutation strategy
[0088] The attribute abstract syntax tree is a structured representation of a WebAssembly module. By mutating the attribute abstract syntax tree, the WebAssembly module can be effectively mutated while preserving its structural and semantic information, thereby generating a WebAssembly module binary with a valid structure and type.
[0089] On top of the attribute abstract syntax tree structure, the following seven type-aware mutation strategies are applied to generate new attribute abstract syntax trees with valid structures and types.
[0090]
[0091]
[0092] Structure-aware instruction mutation method
[0093] When mutating WebAssembly instructions, the validity of the instructions should not be compromised. WebAssembly instructions consist of two parts: the opcode and the operands. The opcode occupies a fixed length of one byte, while the operands fall into two categories: 1) static immediate parameters; 2) dynamic operands. For each of these categories, the newly generated instructions should conform to the corresponding structural requirements.
[0094] The structure-aware instruction mutation method is used to mutate both types of instructions simultaneously, specifically as follows:
[0095] Instruction mutation is divided into opcode mutation and operand mutation. Opcode mutation uses entries from the defined WebAssembly instruction list as candidates, randomly selecting one opcode each time. This method avoids mutations into illegal instructions. After determining the opcode of a new instruction, different mutation strategies are applied to its operands based on their types.
[0096] Operands are dynamic operands
[0097] Instructions with dynamic operands store their operands at the top of the stack, and no additional data needs to be generated when the instruction is executed. For example, the instruction "i32.add" has dynamic operands. During execution, the top and second elements of the execution stack are popped as input, and the calculation result is pushed onto the stack. This instruction only needs to generate its opcode and does not need to generate the corresponding operands.
[0098] Operands are static immediate parameters
[0099] For instructions with static immediate parameters as operands, it is necessary to understand the type and structure information of the static immediate parameters based on the instruction structure, and then recursively apply a structure-aware mutation method. Static immediate parameters are further divided into two types: primitive types and reference types.
[0100] For instructions whose static immediate parameters are of basic types, such as i32, i64, f32, and f64, it is necessary to generate corresponding operand mutations based on the parameter type. For example, for the i32.const x instruction, in addition to generating the corresponding opcode, it is also necessary to randomly generate an int32 type instruction static immediate parameter as the operand.
[0101] For instructions whose static immediate arguments are reference types, such as local variables, global variables, and tables, it is necessary to recursively sense the subtypes of the parameter members based on the parameter's type and generate a compliant mutation by querying the corresponding segment table information. For example, for the `local.get x` instruction, in addition to generating the corresponding opcode, it is also necessary to generate a static immediate argument of type index or alias. Because its type is index or alias, it is necessary to search the local variable table and randomly select an index or alias as the operand of the instruction.
[0102] Step S4: Perform pre-validation on the mutated attribute abstract syntax tree to check the legality of the mutation and quickly correct the positions of invalid nodes.
[0103] By applying a pre-validator to the mutated attribute abstract syntax tree, the legality of the mutation is detected in advance, and the obtained error node information is used for rapid correction, thereby generating a legal WebAssembly module mutation.
[0104] After mutating the attribute abstract syntax tree, a pre-validation process is performed using a modified WebAssembly module validator. This pre-validation process occurs before the attribute abstract syntax tree is serialized to generate the WebAssembly module binary. Its purpose is to pre-validate the legality of the mutation before it is used as input to execute the WebAssembly engine, thereby increasing the probability that the mutation will pass the target WebAssembly engine validator.
[0105] By modifying the wasm-parser tool to support the validity validation process based on the attribute abstract syntax tree structure, and by adding additional position information, it can return the attribute abstract syntax tree node that caused the error when an error is encountered during the validation process.
[0106] If the pre-validation process passes, the attribute abstract syntax tree is encoded into a WebAssembly module binary file, and then proceeds to the subsequent fuzzing process. If the pre-validation process fails, the validator returns the erroneous attribute abstract syntax tree node, and the fuzzing process enters a fast-correction phase.
[0107] In the rapid correction process, the erroneous attribute abstract syntax tree (API) node is first selected as the node to be mutated. Then, the mutation method is repeated to mutate the erroneous node and regenerate the API. For example, if a verification error occurs in an instruction during validation, it is selected as the mutation target node, and a type-aware mutation strategy is applied. Here, we assume that a mutation strategy that swaps nodes of the same type is applied. After re-mutating the erroneous node, the process re-enters the pre-validation process.
[0108] Reapply the pre-verification process to new mutations. If the number of repairs meets any of the following conditions, discard the mutation: 1. A single node fails to pass the pre-verifier after more than 30 repairs; 2. A mutation of the same seed fails to pass the pre-verifier after more than (number of mutation locations x 10).
[0109] By applying a pre-validation process and returning the location of the error node through a modified validator, targeted repair work can be carried out, which speeds up the error correction and increases the probability of generating a validator that passes the target WebAssembly engine.
[0110] Step S5: Generate WebAssembly binary samples from the pre-validated attribute abstract syntax tree and input them into the target engine for fuzz testing.
[0111] An attribute abstract syntax tree (API) adds attribute information to an abstract syntax tree (API). This added attribute information is only used to guide the mutation process and does not affect the process of generating WebAssembly binaries. Therefore, the process of generating WebAssembly binaries from an API is essentially the same as the process of generating WebAssembly binaries from an API. For example, an existing wasm-encoder tool can be modified to support inputting an API, thereby generating WebAssembly binaries.
[0112] Example 2
[0113] In one or more embodiments, a WebAssembly engine fuzzing system is disclosed, such as Figure 4 As shown, it includes an acquisition module, a parsing module, a mutation module, a verification module, and a testing module:
[0114] The acquisition module is configured to acquire a large number of WebAssembly binary samples as initial seed samples.
[0115] The parsing module is configured to parse the initial seed sample into an attribute abstract syntax tree with node position information and node type information;
[0116] The mutation module is configured to apply mutation methods to the attribute abstract syntax tree through a type-aware mutation strategy and a structure-aware instruction mutation method, thereby generating a new attribute abstract syntax tree with valid structure and type.
[0117] The validation module is configured to: pre-validate the mutated attribute abstract syntax tree, detect the legality of the mutation, and quickly correct the positions of invalid nodes;
[0118] The testing module is configured to generate WebAssembly binary samples from the pre-validated attribute abstract syntax tree and input them into the target engine for fuzz testing.
[0119] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.< / null> < / null>
Claims
1. A WebAssembly engine fuzz testing method, characterized in that, including: Obtain a large number of WebAssembly binary samples as initial seed samples; Parse the initial seed samples into an attribute abstract syntax tree with node position information and node type information; Apply mutation methods to the attribute abstract syntax tree through type-aware mutation strategies and structure-aware instruction mutation methods to generate new attribute abstract syntax trees with legal structures and types; Perform pre-verification on the mutated attribute abstract syntax tree to detect the legality of the mutation and quickly correct illegal node positions; Generate WebAssembly binary samples from the pre-verified attribute abstract syntax tree and input them into the target engine for fuzz testing; The parsing of the initial seed samples into an attribute abstract syntax tree with node positions and node type information is specifically as follows: Map the entire initial seed sample into the process memory space through the mmap system call to provide random access to the file; Parse the initial seed samples into an extended abstract syntax tree through an event-driven streaming parsing method according to the top-down streaming parsing method; Among them, the top-down streaming parsing method is specifically as follows: Parse the overall information of 12 segment structures respectively and generate 12 AST segment nodes; Parse each segment structure respectively, read each segment according to the streaming method and parse it according to the parsing rules of each segment respectively; The node position information is to add a position attribute field to each generated node, and this position attribute contains two integer member variables: offset and size; where offset represents the offset of this node relative to the first byte of the position of its parent node in the WebAssembly module binary file, and size represents the number of bytes occupied by this node element in the binary file; The node type information is to construct two mapping tables <parameter type, node array> and <return type, node array>, traverse each instruction, and add the instruction node to the arrays corresponding to the corresponding entries in the two mapping tables according to the parameter type and return type of this instruction; The structure-aware instruction mutation method divides instruction mutation into opcode mutation and operand mutation; Among them, the opcode mutation is to use the entries in the defined WebAssembly instruction list as candidates and randomly select an opcode from them each time, which can avoid mutating into illegal instructions; The operand mutation is to apply different mutation strategies to its operands according to different operand types after determining the opcode of the new instruction.
2. The WebAssembly engine fuzz testing method according to claim 1, wherein The obtaining of a large number of WebAssembly binary samples is carried out in two ways: Internet search and self-compiling open-source code.
3. The WebAssembly engine fuzz testing method according to claim 1, wherein The type-aware mutation strategy includes 7 mutation operations: deleting a node sequence, inserting a node, swapping nodes of the same type, changing the control flow structure, modifying types, changing function signatures, and modifying global variables and exported functions.
4. The fuzz testing method for a WebAssembly engine according to claim 1, wherein The application of different mutation strategies to its operands according to different operand types is specifically as follows: If the operand belongs to a dynamic operand, only its opcode needs to be mutated, and there is no need to generate the corresponding operand; If the operand belongs to a static immediate parameter, the type and structure information of the static immediate parameter are sensed, and the instruction mutation method with structure awareness is recursively applied to it.
5. The WebAssembly engine fuzz testing method according to claim 1, wherein The pre-verification is to modify the wasm-parser tool to support the legal verification process based on the structure of the attribute abstract syntax tree, and add additional node position information to it, so that when an error is encountered during the verification process, the node of the attribute abstract syntax tree where the error occurs is returned as the illegal node position.
6. The WebAssembly engine fuzz testing method according to claim 5, wherein The rapid correction of the illegal node position is specifically as follows: The node of the attribute abstract syntax tree where the error occurs is selected as the node to be mutated, and then the mutation method is repeatedly applied to mutate the node to be mutated and regenerate the attribute abstract syntax tree until the number of repair times meets the preset conditions.
7. A WebAssembly engine fuzz testing system, characterized in that, A WebAssembly engine fuzz testing method according to any one of claims 1-6, comprising an acquisition module, a parsing module, a mutation module, a verification module and a testing module: The acquisition module is configured to: acquire a large number of WebAssembly binary samples as initial seed samples; The parsing module is configured to: parse the initial seed samples into an attribute abstract syntax tree with node position information and node type information; The mutation module is configured to: apply a mutation method to the attribute abstract syntax tree through a type-aware mutation strategy and an instruction mutation method with structure awareness to generate a new attribute abstract syntax tree with a legal structure and type; The verification module is configured to: perform pre-verification on the mutated attribute abstract syntax tree, detect the legality of the mutation, and rapidly correct the illegal node positions; The testing module is configured to: generate a WebAssembly binary sample from the pre-verified attribute abstract syntax tree and input it into the target engine for fuzz testing.