A x86 black box collection coverage method and system based on inline-hook patch

Abstract

The present application discloses an x86 black box coverage collection method and system based on inline-hook patch, the method comprising: disassembling instructions one by one from the beginning of the current basic block until the cumulative length of the disassembled instructions is greater than 5; recording the original content of the basic block of the disassembled instructions as the starting instruction of the basic block; replacing the starting instruction of the current basic block with a jmp instruction that can jump to the end of a binary file; writing a code that marks that the current basic block is covered at the end of the binary file; writing a starting instruction at the end of the binary file in which the code that marks that the current basic block is covered is written, and writing a jmp instruction that can jump to the next instruction of the starting instruction of the current basic block; by performing the above processing on all basic blocks, the system performance overhead can be reduced when collecting coverage.

Description

Technical Field

[0001] The present application relates to the field of testing technology, and in particular to a method and system for collecting coverage. Background Art

[0002] The existing fuzz testing coverage collection methods are divided into gray box and black box, that is, with source code and without source code. In the gray box case, because there is source code, the target project is usually instrumented during compilation through compiler extension, so that coverage can be collected during runtime. For black box projects, due to the lack of source code, simulation execution technology, such as qemu or dynamorio, is usually used to execute the target binary file to obtain the project coverage.

[0003] However, when black-box projects use simulated execution technology to obtain coverage, since each simulated executor has its own startup method and operating principle, it is usually necessary to adapt the selected simulated executor and fuzzer system when using simulated executors to obtain coverage. When using simulated execution to collect black-box coverage, it is necessary to develop the corresponding executor according to the selected simulated execution scheme, and simulated execution itself has a large performance overhead, which is several to dozens of times higher than the gray-box source code instrumentation technology. Summary of the invention

[0004] Based on this, in order to solve the above technical problems, a method and system for collecting coverage of x86 black box based on inline-hook patch is provided to solve the problem of high performance overhead when obtaining the coverage of black box projects in the prior art.

[0005] In a first aspect, an x86 black box coverage collection method based on inline-hook patch is provided, the method comprising:

[0006] Step S1: Select a basic block in the received binary file as the current basic block;

[0007] Step S2: starting from the beginning of the current basic block, disassemble the instructions one by one until the cumulative length of the disassembled instructions is greater than 5 bytes; recording the original content of the basic block of the disassembled instructions as the starting instruction of the basic block;

[0008] Step S3: replacing the start instruction of the current basic block with a jmp instruction that can jump to the end of the binary file;

[0009] Step S4: writing a code to mark the current basic block as being overwritten at the end of the binary file;

[0010] Step S5: writing the start instruction of the current basic block and a jmp instruction capable of jumping to the next instruction of the start instruction of the current basic block in sequence at the end of the binary file in which the code marking the current basic block is overwritten is written;

[0011] Step S6: Select a basic block without adding a jmp instruction as the current basic block, and repeat steps S2 to S5; until all basic blocks in the binary file complete steps S2 to S5;

[0012] Step S7: Write the initialization code required to interact with the gray-box fuzzer at the end of the binary file after performing steps S2-S5 on all basic blocks;

[0013] Step S8: replacing the starting address of the binary file with the starting address of the adaptation code;

[0014] Step S9: Run the binary file and collect the coverage of the binary file.

[0015] In the above solution, optionally, before step S1, the method further includes:

[0016] Use the disassembly tool to analyze the binary file, obtain the address and size of all basic blocks in the target binary file, and filter out basic blocks with a size greater than 5 bytes.

[0017] In the above solution, optionally, before step S3, the start instruction of the current basic block is saved.

[0018] In a second aspect, an x86 black box coverage collection system based on inline-hook patch is provided, the system comprising:

[0019] Current basic block selection module: used to select a basic block without adding a jmp instruction in the received binary file as the current basic block;

[0020] Disassembly module: used for disassembling instructions one by one from the beginning of the current basic block until the cumulative length of the disassembled instructions is greater than 5 bytes; recording the original content of the basic block of the disassembled instructions as the starting instruction of the basic block;

[0021] A basic block inserting jmp instruction module is used to replace the start instruction of the current basic block with a jmp instruction that can jump to the end of the binary file;

[0022] Coverage collection code writing module: used for writing a code marking that the current basic block is covered at the end of the binary file;

[0023] The basic block code writing module is used to write the start instruction of the current basic block and the jmp instruction capable of jumping to the next instruction of the start instruction of the current basic block in sequence at the end of the binary file of the code for writing the mark that the current basic block is overwritten;

[0024] Initialization code writing module: used for all basic block execution disassembly modules, basic block insertion jmp instruction modules, coverage collection code writing modules, and the initialization code required to interact with the gray box fuzzer at the end of the binary file after executing the basic block code writing module;

[0025] Address replacement module: used to replace the starting address of the binary file with the starting address of the adaptation code;

[0026] Coverage collection module: used to run binary files and collect the coverage of binary files.

[0027] In the above scheme, optionally, the disassembly module is also used to filter basic blocks in the binary file, including: using a disassembly tool to analyze the binary file, obtaining the addresses and sizes of all basic blocks in the target binary file, and filtering out basic blocks with a size greater than 5 bytes.

[0028] The above solution may optionally further include a storage module: used to store the start instruction of the current basic block.

[0029] In a third aspect, a computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the black box coverage collection method based on inline-hook patch described in the first aspect are implemented.

[0030] In a fourth aspect, a computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the black-box coverage collection method based on inline-hook patch described in the first aspect.

[0031] This application has at least the following beneficial effects:

[0032] The present application performs the following plugging on all basic blocks of the binary file in sequence: replacing the initial instruction of the basic block with a jmp instruction that can jump to the end, writing a code at the end of the binary file to mark that the current basic block has been overwritten; and then adding the initial instruction and the jmp instruction that jumps to the next instruction of the initial instruction at the end of the binary file. In this way, the technical solution proposed by the present invention has no additional adaptation cost, and the performance overhead is only less than twice that of the gray box plugging solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A flowchart of a black box coverage collection method based on inline-hook patch is provided for one embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0035] In one embodiment, Figure 1 As shown, an x86 black box coverage collection method based on inline-hook patch is provided, including the following steps:

[0036] Step S1: Select a basic block in the received binary file as the current basic block.

[0037] In step S1, the first basic block of the received binary file can be used as the current basic block in the order of basic blocks from front to back; or a basic block can be randomly selected as the current basic block in a random selection manner; of course, the method proposed in this application is not limited to the listed methods.

[0038] Step S2: starting from the beginning of the current basic block, disassemble the instructions one by one until the cumulative length of the disassembled instructions is greater than 5 bytes; the original content of the basic block of the disassembled instructions is recorded as the starting instruction of the basic block.

[0039] Step S3: Replace the start instruction of the current basic block with a jmp instruction that can jump to the end of the binary file.

[0040] Step S4: Write the code for marking the current basic block in the coverage collection table at the end of the binary file.

[0041] Step S5: writing the start instruction of the current basic block and the jmp instruction capable of jumping to the next instruction of the start instruction of the current basic block in sequence at the end of the binary file in which the code marking the current basic block being covered is written.

[0042] Step S6: Select a basic block without adding a jmp instruction as the current basic block, and repeat steps S2 to S5; until all basic blocks in the binary file complete steps S2 to S5.

[0043] In step S6, steps S2 to S5 are repeatedly executed for all basic blocks until the last pre-selected basic block in the binary file completes steps S2 to S5.

[0044] Step S7: Write the initialization code required to interact with the grey-box fuzzer at the end of the binary file after performing steps S2-S5 for all basic blocks.

[0045] In step S7, writing the initialization code required by the gray-box fuzzer to the end of the file means adding a specific code segment to the end of the binary file of the target program so that these initialization codes can be executed when the program starts. These initialization codes are usually used to interact with the gray-box fuzzer (such as AFL) to achieve code coverage collection, feedback and analysis. Specifically, the initialization code may include the following:

[0046] 1) Get the grey-box fuzzer settings and parameters from environment variables or other sources.

[0047] 2) Initialize the coverage statistics function, such as obtaining the ID of the coverage table from __AFL_SHM_ID and calculating the address and size of the coverage table; __AFL_SHM_ID is an environment variable that stores the ID of the table used by AFL for coverage statistics.

[0048] 3) Start the corresponding components of the gray-box fuzzer, such as coverage collector, feedback mechanism, etc.

[0049] Step S8: Replace the starting address of the binary file with the starting address of the adaptation code.

[0050] In this step, you can ensure that the code is executed when the program starts, so as to interact with the gray-box fuzzer and enable code coverage monitoring and analysis capabilities;

[0051] Step S9: Run the binary file and collect the coverage of the binary file.

[0052] In the above-mentioned black box coverage collection method based on inline-hook patch, all basic blocks of the binary file are plugged in sequence as follows: the initial instruction of the basic block is replaced with a jmp instruction that can jump to the end, and the code marking that the current basic block has been covered is written at the end of the binary file; then the initial instruction and the jmp instruction that jumps to the next instruction of the initial instruction are added to the end of the binary file. In this way, the technical solution proposed by the present invention has no additional adaptation cost, and the performance overhead is only less than twice that of the gray box plugging solution.

[0053] In one embodiment, before step S1, the method further includes:

[0054] Use the disassembly tool to analyze the binary file, obtain the address and size of all basic blocks in the target binary file, and filter out basic blocks with a size greater than 5 bytes.

[0055] In one embodiment, before step S3, the start instruction of the current basic block is saved.

[0056] Specifically, the black box coverage collection method based on inline-hook patch described in this application includes the following steps:

[0057] (1) Use a disassembly tool (such as Ghidra) to analyze the binary file, obtain the addresses and sizes of all basic blocks in the target binary file, and select the basic blocks whose size is greater than 5 (that is, the length of an x86 JMP instruction).

[0058] (2) Inline-hook all selected basic blocks. The specific steps are as follows.

[0059] (3) Start disassembling instructions one by one from the beginning of the basic block until the cumulative length of the disassembled instructions is greater than 5 (that is, the length of an x86 jmp instruction).

[0060] (4) Replace the beginning content of the basic block with a jmp instruction, and the jump target is the end of the binary file.

[0061] (5) Write the coverage collection code to the end of the target file. Taking AFL as an example, the way to collect coverage is to mark the corresponding position in the coverage table. These codes will be executed together when the basic block is executed.

[0062] (6) Write the instruction that is overwritten in the basic block header to the end of the target file and append a jmp instruction, the target of which is the next instruction after the instruction that is overwritten in the basic block.

[0063] (7) Repeat steps 3 to 6 until all basic block stubbing is completed.

[0064] (8) Write the initialization code required by the gray-box fuzzer to the end of the file. Taking AFL as an example, obtain the ID of the coverage table set by AFL from __AFL_SHM_ID to obtain the address and size of the coverage table.

[0065] (9) Change the starting address of the target binary file to the address of the initialization function of the adaptation code.

[0066] The idea of ​​this application can also be used in other instruction sets, such as ARM.

[0067] In one embodiment, an x86 black box coverage collection system based on inline-hook patch includes:

[0068] Current basic block selection module: used to select a basic block without adding a jmp instruction in the received binary file as the current basic block;

[0069] Disassembly module: used for disassembling instructions one by one from the beginning of the current basic block until the cumulative length of the disassembled instructions is greater than 5 bytes; recording the original content of the basic block of the disassembled instructions as the starting instruction of the basic block;

[0070] A basic block inserting jmp instruction module is used to replace the start instruction of the current basic block with a jmp instruction that can jump to the end of the binary file;

[0071] Coverage collection code writing module: used for writing a code marking that the current basic block is covered at the end of the binary file;

[0072] The basic block code writing module is used to write the start instruction of the current basic block and the jmp instruction capable of jumping to the next instruction of the start instruction of the current basic block in sequence at the end of the binary file of the code for writing the mark that the current basic block is overwritten;

[0073] Initialization code writing module: used for all basic block execution disassembly modules, basic block insertion jmp instruction modules, coverage collection code writing modules, and the initialization code required to interact with the gray box fuzzer at the end of the binary file after executing the basic block code writing module;

[0074] Address replacement module: used to replace the starting address of the binary file with the starting address of the adaptation code;

[0075] Coverage collection module: used to run binary files and collect the coverage of binary files.

[0076] In one embodiment, the disassembly module is also used to filter basic blocks in the binary file, including: using a disassembly tool to analyze the binary file, obtaining the addresses and sizes of all basic blocks in the target binary file, and filtering out basic blocks with a size greater than 5 bytes.

[0077] In one embodiment, a storage module is also included: used to save the starting instruction of the current basic block.

[0078] For the specific definition of an x86 black box coverage collection system based on inline-hook patch, please refer to the definition of an x86 black box coverage collection method based on inline-hook patch above, which will not be repeated here. Each module in the above-mentioned x86 black box coverage collection system based on inline-hook patch can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above-mentioned modules.

[0079] In one embodiment, a computer device is provided, which may be a server. The computer device includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the above-mentioned black box coverage collection method based on inline-hook patch is implemented.

[0080] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which involves all or part of the processes in the above-mentioned embodiment method.

[0081] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0082] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0083] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. An x86 black box coverage collection method based on inline-hook patch, characterized in that: The method comprises: Step S1: Select a basic block in the received binary file as the current basic block; Step S2: starting from the beginning of the current basic block, disassemble the instructions one by one until the cumulative length of the disassembled instructions is greater than 5 bytes; recording the original content of the basic block of the disassembled instructions as the starting instruction of the basic block; Step S3: replacing the start instruction of the current basic block with a jmp instruction that can jump to the end of the binary file; before step S3, saving the start instruction of the current basic block; Step S4: writing the code for marking the current basic block in the coverage collection table at the end of the binary file; Step S5: writing the start instruction of the current basic block and a jmp instruction capable of jumping to the next instruction of the start instruction of the current basic block in sequence at the end of the binary file in which the code marking the current basic block is overwritten is written; Step S6: Select a basic block without adding a jmp instruction as the current basic block, and repeat steps S2 to S5; until all basic blocks in the binary file complete steps S2 to S5; Step S7: Write the initialization code required to interact with the gray-box fuzzer at the end of the binary file after performing steps S2-S5 on all basic blocks; Step S8: replacing the starting address of the binary file with the starting address of the adaptation code; Step S9: Run the binary file and collect the coverage of the binary file.

2. The x86 black box coverage collection method based on inline-hook patch according to claim 1 is characterized in that: Before step S1, the method further includes: Use the disassembly tool to analyze the binary file, obtain the address and size of all basic blocks in the target binary file, and filter out basic blocks with a size greater than 5 bytes.

3. An x86 black box collection coverage system based on inline-hook patch, characterized in that: The system comprises: Current basic block selection module: used to select a basic block without adding a jmp instruction in the received binary file as the current basic block; Disassembly module: used for disassembling instructions one by one from the beginning of the current basic block until the cumulative length of the disassembled instructions is greater than 5 bytes; recording the original content of the basic block of the disassembled instructions as the starting instruction of the basic block; A basic block inserting jmp instruction module is used to replace the start instruction of the current basic block with a jmp instruction that can jump to the end of the binary file; Storage module: used for storing the starting instruction of the current basic block; Coverage collection code writing module: used for writing a code marking that the current basic block is covered at the end of the binary file; The basic block code writing module is used to write the start instruction of the current basic block and the jmp instruction capable of jumping to the next instruction of the start instruction of the current basic block in sequence at the end of the binary file of the code for writing the mark that the current basic block is overwritten; Initialization code writing module: used for all basic block execution disassembly modules, basic block insertion jmp instruction modules, coverage collection code writing modules, and the initialization code required to interact with the gray box fuzzer at the end of the binary file after executing the basic block code writing module; Address replacement module: used to replace the starting address of the binary file with the starting address of the adaptation code; Coverage collection module: used to run binary files and collect the coverage of binary files.

4. The x86 black box coverage collection system based on inline-hook patch according to claim 3, characterized in that: The disassembly module is also used to filter basic blocks in the binary file, including: using a disassembly tool to analyze the binary file, obtaining the addresses and sizes of all basic blocks in the target binary file, and filtering out basic blocks with a size greater than 5 bytes.

5. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 2 are implemented.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 2 are implemented.

Images