Anti-fuzz testing method integrated with original program data stream

Abstract

The invention provides an anti-fuzz testing method integrated with an original program data stream. According to the technical scheme, the method comprises the steps that a multi-branch recursive function code, a mapping function code and an operation function code are generated respectively, and source codes are inserted into the multi-branch recursive function code, the mapping function code and the operation function code; selecting an unselected function except the three inserted function codes from the inserted source code file; extracting function parameters and function codes from the selected functions; replacing constants in the function codes with mapping function codes; replacing the expression of the function code with the operation function code; and performing fuzz testing on the program compiled by the replaced source code file. According to the method, a large number of code branches can be generated and fused with the original program data stream, and the method has a high anti-fuzzy test effect, high robustness and safety and low time overhead and storage overhead.

Description

Technical Field

[0001] The present invention belongs to the field of information processing technology, and further relates to an anti-fuzzy testing method integrated into the original program data stream in the field of information security technology. The present invention can be used in software security protection to prevent malicious personnel from using fuzzy testing to find software vulnerabilities. Background Art

[0002] Fuzz testing is an automated software testing technology that is widely used in the industry to discover potential software vulnerabilities and improve software security. By inputting the abnormal data generated by fuzz testing into the program being tested, the status of the program and feedback, such as its crash, abnormal situation, code coverage, etc., are observed to analyze and find program errors and vulnerabilities. The execution process of fuzz testing can be mainly divided into the following steps: first, define the input format and generate valid or invalid random input data; then, provide these input data to the software being tested; then, monitor the behavior of the software, especially abnormal behavior, crash or memory leak, etc.; finally, record and analyze abnormal situations to find potential problems. In this way, fuzz testing can effectively discover many vulnerabilities and defects that are difficult to capture with traditional testing methods. However, malicious personnel can also use this technology to find vulnerabilities to launch more complex attacks or sell vulnerabilities as commodities, increasing the risk of vulnerabilities being abused. Therefore, a program protection measure is needed to reduce the effectiveness of fuzz testing and prevent program vulnerabilities from being exploited by malicious personnel.

[0003] Program data flow describes the path that data takes from input to output in a program. It involves how data is passed and processed between different parts of a program. Program data flow includes how the values ​​of variables and data structures flow between various functions, conditional judgments, loop bodies, and other control structures. These data flow paths can be dynamically managed and controlled through the program's code branches. During the execution of the program, the logic of the code branches determines different data flow paths. When the program encounters a conditional branch, the data will flow along different paths depending on the input data or current state. In this way, program data flow is closely integrated with code branches to form complex program behavior.

[0004] Anti-fuzz testing is a technology designed to counter and circumvent fuzz testing tools. It enhances the software's anti-attack capabilities and reduces the possibility of fuzz testing tools discovering vulnerabilities by detecting fuzz testing tools, inserting delay code, adding code branches, interfering with crash detection, and using hash comparisons. These technologies are designed to improve software security, making it more difficult for automated testing tools to discover potential vulnerabilities and defects, thereby protecting the software from unauthorized attacks and testing.

[0005] Jinho Jung et al. proposed a method to protect binary software from fuzzing techniques in their paper "Fuzzification: Anti-Fuzzing Techniques" (28th USENIX Security Symposium (USENIX Security 19), 2019, pp. 1913-1930). The method is called FUZZIFICATION and is implemented by introducing three technologies: (1) SpeedBump, which makes fuzz testing slower by amplifying the delay in cold paths by hundreds of times; (2) BranchTrap, which interferes with the feedback logic by hiding paths and polluting coverage graphs; (3) AntiHybrid, which hinders dynamic taint analysis and symbolic execution commonly used in hybrid fuzz testing through hash comparison and block cipher encryption and decryption. These technologies effectively reduce the number of paths and vulnerabilities found by fuzz testing tools, and maintain the normal operation performance of the program under the user-specified overhead budget. However, the method still has the disadvantage that the anti-fuzz testing strategy that interferes with coverage feedback is irrelevant to the data flow of the original program, so it is easy to be automatically deleted, and it has a large time overhead and occupies a large amount of storage. However, the hash comparison and block cipher encryption and decryption methods related to the original program data flow produce a limited number of code branches, which limits the effectiveness of anti-fuzz testing.

[0006] Yuekang Li et al. proposed an anti-greybox fuzzing method called VALL-NUT in their paper "VALL-NUT: Principled Anti-Greybox-Fuzzing" (2021IEEE 32nd International Symposium on Software Reliability Engineering (ISSRE), 2021, pp. 288-300). This method uses an obstacle generator to implant fuzzy barrier code in the target program to weaken the effect of graybox fuzzing. The steps of VALL-NUT include: (1) generating edge-level frequency curves of the target program to determine the error handling path; (2) injecting fuzzy barrier code that disrupts seed evaluation, seed mutation, and feedback collection mechanisms; (3) compiling and generating self-protected binaries. The method performed well in experiments on multiple real programs, reducing code coverage by 34% and crashes by 76% on average. However, the limitation of this method is that the fuzzy barrier code it inserts is irrelevant to the data flow of the original program and can be easily deleted by data flow analysis.

[0007] Zhengxiang Zhou et al. proposed an efficient and automatic anti-fuzzing method named No-Fuzz in their paper "No-Fuzz: Efficient Anti-fuzzing Techniques" (Security and Privacy in Communication Networks, 2023, pp. 731-751). The method is implemented through the following steps: (1) Passive detection method: A mechanism is developed to accurately identify whether the protected program is undergoing binary fuzzing (BOF) and trigger mitigation strategies when fuzzing is detected, such as introducing delays or terminating program execution; (2) Active interference method: By designing minimized fake blocks, the basic assumptions of fuzz testing are attacked, thereby hindering the normal operation of the fuzz tester. These fake blocks are optimized to achieve minimal storage overhead and use random byte instructions to disrupt the code coverage map of the fuzz tester; (3) Landing Space technology: A special code area is introduced in the function of the program. When executing to this area, the control flow will be randomly redirected to an instruction in the area, thereby generating false code coverage information to confuse the fuzz tester. Although this method performs well in reducing fuzz testing branch coverage and hindering fuzz testing from finding vulnerabilities, it still has shortcomings. The fake blocks and landing spaces introduced by it are not integrated into the data flow of the original program, making them easy to be deleted by analysis.

[0008] Beijing University of Electronic Science and Technology proposed an anti-fuzzy testing method in its patent document "A New Anti-Fuzzy Testing Method and Device" (patent application number: CN20231036096.5, application publication number: CN 116383066 A). The method includes the following steps: step S1, writing a template program, which can be written in any programming language that can provide injection function; step S2, reading the binary program to be reinforced, and converting it into the corresponding variable format of the template program in step S1, and replacing the corresponding variable position of the template program in step S1; step S3, compiling the template program to obtain the binary program that has been reinforced with anti-fuzziness. This method can prevent all fuzz testers built on the plug-in technology from performing fuzz testing. Even if they can run, their efficiency will be reduced, and there will be no crash feedback, which effectively prevents attackers from performing unauthorized fuzz testing on the target program. Moreover, because the target is at a lower level, it is more applicable and more effective than other types of anti-fuzzy testing technologies. However, the method still has the disadvantage that it only provides a way to inject the template program, and does not provide a way to write a template program that integrates the original code data flow. Moreover, the device copies the binary program to other memory areas, which may cause the original software protection measures of the program to become invalid, such as address space randomization (ASLR), data execution protection (DEP), etc., and it is also easy to introduce new vulnerabilities, thereby destroying the security measures of the program. Summary of the invention

[0009] The purpose of the present invention is to address the deficiencies in the above-mentioned prior art and propose an anti-fuzzification testing method that integrates the original program data stream to solve the problems that the current anti-fuzzification testing strategy based on passive defense is usually irrelevant to the data stream of the original program and is easily deleted automatically; the existing methods related to the original program data stream generate a limited number of code branches, which makes the anti-fuzzification testing effect limited; the existing anti-fuzzification testing methods have a large time overhead and occupy a large amount of storage; and the existing anti-fuzzification testing devices are difficult to maintain the original security measures of the program.

[0010] The idea of ​​achieving the purpose of the present invention is: the present invention adopts a carefully constructed multi-branch recursive function so that different and large numbers of code branches will be generated when data of different values ​​pass through. Fuzzy testing based on coverage feedback and fuzzy testing combined with symbolic execution or taint analysis need to spend a lot of time to traverse code branches, and the number of code branches that can be traversed is limited. The present invention aims at misleading fuzzy testing based on coverage feedback and fuzzy testing combined with symbolic execution or taint analysis, and solves the problem that the method related to the data flow of the original program generates a limited number of code branches, which makes the anti-fuzz test effect limited. The present invention designs a recursive function with constraints instead of randomly generated code branches, and enters different branch paths according to different input data. The recursive function with constraints can guide the fuzzy test to select longer and more redundant input seeds as excellent seeds. Under the same effect of anti-fuzz testing, the present invention adds less time overhead to the original program. Use recursive functions to reuse code and reduce code storage overhead. Solve the problems of high time overhead and high storage overhead of existing anti-fuzz testing technology. The present invention replaces the constants and expressions of the original program data stream with complex function call forms, so that the newly added code has the same semantics as the original code, but the execution path is more extensive and participates in the input and output streams of the program, solving the problem that the current anti-fuzzy testing strategy based on passive defense is usually irrelevant to the data stream of the original program and is easily deleted by automated analysis. The present invention designs a device that only replaces the source code, reads and analyzes the source code information through a code analysis module, generates a function required for protection measures through a code generation module, and replaces the original target code with a more complex code with the same meaning, without making significant operational modifications to sensitive areas such as memory, solving the problem that the existing anti-fuzzy testing method destroys the original program software protection measures.

[0011] The technical solution steps for achieving the purpose of the present invention are as follows:

[0012] Step 1, respectively generate multi-branch recursive function code, mapping function code, and operation function code;

[0013] Step 2, insert the three function codes into the source code to obtain the source code file after insertion;

[0014] Step 3, selecting a function other than the three inserted function codes from the inserted source code file;

[0015] Step 4, determine whether the selected function has a comment, if yes, execute step 3, otherwise, execute step 5;

[0016] Step 5, extracting function parameters and function codes from the selected function;

[0017] Step 6, replace the constants in the function code with the mapping function code;

[0018] Step 7, replace the expression of the function code with the operation function code;

[0019] Step 8, perform fuzz testing on the program compiled from the replaced source code file.

[0020] Compared with the prior art, the present invention has the following advantages:

[0021] First, the present invention adopts a carefully constructed multi-branch recursive function, so that when data of different values ​​pass through, different and large numbers of code branches will be generated, which will mislead the fuzzy test based on coverage feedback and the fuzzy test combined with symbolic execution or taint analysis. It solves the problem that the number of code branches generated by the existing methods related to the original program data flow is limited, which affects the anti-fuzzy test effect, so that the present invention has the advantage of improving the anti-fuzzy test effect of the target program.

[0022] Second, the present invention designs a constrained recursive function instead of a randomly generated code branch, and enters different branch paths according to different input data. This overcomes the problem of high time and storage overhead of existing anti-fuzzy testing technologies, making the present invention have the advantages of low time and storage overhead.

[0023] Third, the present invention replaces the constants and expressions of the original program data flow with complex function call forms, thereby overcoming the defects of the existing anti-fuzzy testing strategies based on passive defense, which are usually irrelevant to the data flow of the original program and can be easily deleted by automated analysis, making the present invention have the advantage of improving the robustness of anti-fuzzy testing technology.

[0024] Fourth, the present invention designs a method for replacing only the source code, reads and analyzes the source code information through the code analysis module, generates the functions required for the protection measures, replaces the original target code with the code with the same meaning but more complex, and does not make significant operational modifications to sensitive areas such as memory, thereby solving the defect that the existing anti-fuzzy testing method destroys the original program software protection measures. The present invention has the advantages of protecting program integrity and improving program security. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 is a flow chart of the present invention;

[0026] Figure 2 It is a flowchart of replacing constants in a function code with a mapping function code of the present invention;

[0027] Figure 3 It is an expression flow chart of replacing function code with operation function code of the present invention. DETAILED DESCRIPTION

[0028] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0029] Reference Figure 1 , further describing the implementation steps of the embodiment of the present invention.

[0030] Step 1, generate multi-branch recursive function code, mapping function code, and operation function code respectively.

[0031] Step 1.1, the steps to generate multi-branch recursive function code are as follows:

[0032] In the first step, the mapping value is divided into certain mapping ranges according to the maximum value that the mapping value can reach, and corresponding branch structures are generated according to different mapping value ranges to obtain the integer mapping value of the mapping function.

[0033] In the second step, a decreasing step size parameter greater than or equal to 1 and less than the difference in the mapping range is assigned to each branch to obtain a multi-branch logic for controlling the depth of the recursion and the convergence process.

[0034] The third step is to generate recursive call logic for each branch: so that within the range of the mapping value of the corresponding branch, the function can recursively call itself and gradually reduce the value of the mapping value parameter according to the decreasing step size of the current branch until it reaches the preset fixed constant value.

[0035] The fourth step is to generate boundary conditions and return value logic of the recursive function to ensure that in all branches, when the mapped value parameter meets specific conditions, the recursion stops and returns a fixed constant value.

[0036] The fifth step is to integrate all generated branch codes, boundary conditions, and return value logic in the form of code functions to obtain multi-branch recursive function codes.

[0037] The pseudo code of the multi-branch recursive function code Deep_F generated in the embodiment of the present invention is as follows:

[0038]

[0039]

[0040] Among them, the input parameter of the recursive function Deep_F is the integer mapped value mapped_value, recursively calls the Deep_F function, and assigns the return value of Deep_F to result, and finally returns the result value. In particular, if mapped_value is 0, a fixed constant is returned, otherwise the decrement step parameter decrement_step is assigned according to the range of mapped_value. The larger the mapped_value, the larger the decrement step. Without loss of generality, the following settings can be made: when the mapped_value value is between 1 and A, the step decrement_step is 1; when the mapped_value value is between A+1 and B, the step decrement_step is a; when the mapped_value value is between B+1 and C, the step is set to b; when the mapped_value value is between X+1 and Y, the step is set to z. When the mapped_value value is in other ranges, other step sizes are set. A, B, C, X, and Y are positive integers that are increasing and will not exceed MaxHashValue, where MaxHashValue is the maximum mapping value set by the system. A, b, and z are values ​​greater than 1 and less than the minimum range of the corresponding judgment conditions, such as a less than A+1. The above operations ensure that the return value of the Deep_F recursive function can converge to a fixed constant. The Deep_F function is recursively called, and its input parameter is mapped_value minus the recursive step length decrement_step.

[0041] Step 1.2, the steps to generate the code for the mapping function are as follows:

[0042] In the first step, the number and type of input parameters of the mapping function are determined according to the number and type of input parameters of the function in the source code, and a mapping rule is generated for each input parameter.

[0043] In the second step, all input parameters are combined and mapped into a fixed range to generate an integer mapping value.

[0044] The third step is to use the integer mapping value as the input parameter of the multi-branch recursive function, call the multi-branch recursive function, and use the return value of the multi-branch recursive function as the return value of the mapping function.

[0045] The pseudo code of the mapping function Fk generated in the embodiment of the present invention is as follows:

[0046]

[0047] The mapping function Fk receives one or more input parameters, k is a variable value indicating the number of inputs. If the number of input variables is 1, it corresponds to the mapping function F1. All input parameters are mapped in the range of 0 to MaxHashValue, and the mapping value is recorded as mapped_value, where MaxHashValue is the maximum mapping value set by the system. Mapped_value is used as the input parameter of Deep_F, the Deep_F function is called, and the return value of Deep_F is assigned to result, and finally the result value is returned.

[0048] Step 1.3, the steps to generate the operation function code are as follows:

[0049] The first step is to determine the type of operation to be generated, and determine the parameter type of the input parameter of the operation function according to the numerical type of the expression, including two numerical parameters to be operated and the recursive depth parameter.

[0050] The second step is to generate multi-branch logic, set multiple branches according to the numerical range of the two numerical parameters being operated, and reduce the recursive depth by one to control the number of recursions.

[0051] The third step is to generate a long expression for each branch logic, and the function of the generated long expression is the same as the determined operation type.

[0052] The fourth step is to replace the long expression generated for each branch with the operation function call form, so that the replaced long expression can recursively call the generated operation function.

[0053] The fifth step is to generate the boundary conditions and return value logic of the operation function to ensure that the operation results can be returned normally when the recursive depth is zero.

[0054] The sixth step is to integrate all branch codes, boundary conditions and return value logic in the form of code functions to generate the final operation function code.

[0055] The operation function code in the embodiment of the present invention takes the addition operation Add as an example, and its pseudo code is as follows:

[0056]

[0057]

[0058] Taking addition as an example, the operation function Add takes the values ​​X and Y on both sides of the addition operator of the expression and the recursive depth Deep as input, where the recursive depth Deep is the recursive depth when the user can accept the maximum delay. According to the different value ranges of X and Y, different branches are entered to call the expression composed of the operation function equivalent to X+Y. The actual call is Add(Xor(X,Y,Deep-1),Mul(2,x∧y,Deep-1),Deep-1). A, B, C, D, E, F, G, and H are integer values. In addition, there are other operation functions that replace operators, including subtraction function Sub, bitwise OR function Or, bitwise AND function And, bitwise XOR function Xor, multiplication function Mul, etc.

[0059] Step 2: Insert the three function codes into the source code to obtain the source code file after insertion.

[0060] Insert the multi-branch recursive function code, mapping function code, and operation function code into the source code in sequence, in front of the original function in the source code and behind the source code definition and global variable declaration, so that the three functions can be called by other functions in the source code.

[0061] Step 3, select an unselected function other than the three inserted function codes from the inserted source code file.

[0062] Traverse all functions of the source code file after insertion. Except for the three inserted function codes, select a function that has never been selected each time as the object for subsequent step processing.

[0063] Step 4, determine whether the selected function has a comment, if so, execute step 3, otherwise, execute step 5.

[0064] Whether the extracted function has comments refers to: determining whether the extracted function has comments requiring not to perform anti-fuzz testing.

[0065] In the embodiment of the present invention, it is determined whether the extracted function has a comment " / / do not perform anti-fuzz testing", if so, step 3 is executed, otherwise, step 5 is executed. Since the use of the anti-fuzz testing strategy will inevitably increase the execution time of the selected function, the user can choose not to perform anti-fuzz testing protection for functions with low security and low latency requirements.

[0066] Step 5: Extract function parameters and function code from the selected function.

[0067] Extract function parameters as input parameters of the mapping function. The function code is used to replace the code in steps 6 and 7.

[0068] Step 6, replace the constants in the function code with the mapping function code, that is, traverse the function code, find the constants existing in the code or the defined constants, and change the found constants or constants into the mapping function code, and the input parameters of the mapping function code are the input parameters of the function code plus random values.

[0069] Reference Figure 2The steps of replacing constants in function codes with mapping function codes in the embodiment of the present invention are described as follows:

[0070] The first step is to traverse the function code.

[0071] The second step is to use regular expressions to find constants or defined constants in the code.

[0072] The third step is to change the found constant or constants into the mapping function code.

[0073] The fourth step is to generate random values.

[0074] The fifth step is to map the input parameters of the function code to the input parameters of the function code plus the random value.

[0075] Step 6: Output the replaced function code.

[0076] Adding random values ​​can prevent compiler optimization, which will optimize multiple mapping function calls into one call, which will weaken the effect of anti-fuzz testing.

[0077] Step 7, replace the expression of the function code with the operation function code, that is, traverse the function code, find the expression existing in the code, and convert the found expression into a reverse Polish notation; obtain the binary sub-expression in the reverse Polish notation by accessing the stack, and replace the binary sub-expression with the operation function code with the same function, where the parameters of the operation function code are the two parameters of the binary sub-expression and the depth of recursion.

[0078] Reference Figure 3 The steps of calculating the function code and replacing the function code expression in the embodiment of the present invention are described as follows:

[0079] The first step is to traverse the function code.

[0080] The second step is to determine whether it is an expression. If not, jump to the first step. If so, continue to the third step.

[0081] The third step is to convert the expression into Reverse Polish Notation.

[0082] The fourth step is to initialize an empty stack.

[0083] Step 5: Traverse the elements in the reverse Polish notation from left to right.

[0084] Step 6: Determine whether the current element is an operator or a calculation function. If so, jump to step 5; otherwise, continue to step 7.

[0085] Step 7: Find the current element as an operator.

[0086] Step 8. Pop two elements from the stack.

[0087] The ninth step is to find the operation function of the corresponding operator, take the two elements as parameters, and generate a new function call.

[0088] Step 10. Push the new function call onto the stack.

[0089] Step 11: Determine whether the traversal has reached the end. If not, jump to step 5. If yes, jump to step 12.

[0090] Step 12: Output the top element of the stack as the replaced function code.

[0091] Step 8: Perform fuzz testing on the program compiled from the replaced source code file. The steps are as follows:

[0092] The first step is to compile the replaced source code file to generate an executable program;

[0093] The second step is to construct test cases based on program functions;

[0094] The third step is to use the fuzz testing tool, take the test case as input, and the generated executable program as the test target to perform fuzz testing;

[0095] Step 4: After executing the fuzz test for 48 hours, observe the status and feedback of the executable program.

Claims

1. An anti-fuzzy testing method integrated into the original program data stream, characterized in that: Generate a complex function of multi-branch recursive function code, mapping function code, and operation function code, insert the complex function into the source code, replace the constants and expressions of the original program with the complex function, and perform fuzz testing on the program compiled from the replaced source code file; the steps of the anti-fuzz testing method include the following: Step 1, respectively generate multi-branch recursive function code, mapping function code, and operation function code; Step 2, insert the three function codes into the source code to obtain the source code file after insertion; Step 3, selecting an unselected function from the inserted source code file except the three inserted function codes; Step 4, determine whether the selected function has a comment, if yes, execute step 3, otherwise, execute step 5; Step 5, extracting function parameters and function codes from the selected function; Step 6, replace the constants in the function code with the mapping function code; Step 7, replace the expression of the function code with the operation function code; Step 8, perform fuzz testing on the program compiled from the replaced source code file.

2. The anti-fuzzy testing method integrated into the original program data stream according to claim 1, characterized in that: The steps for generating the multi-branch recursive function code described in step 1 are as follows: The first step is to divide the mapping value into certain mapping ranges according to the maximum value that the mapping value can reach, and generate corresponding branch structures according to different mapping value ranges to obtain the integer mapping value of the mapping function; The second step is to give each branch a decreasing step size parameter that is greater than or equal to 1 and less than the difference in the mapping range, and obtain a multi-branch logic for controlling the depth of the recursion and the convergence process; The third step is to generate recursive call logic for each branch: so that within the range of the mapping value of the corresponding branch, the function can recursively call itself and gradually reduce the value of the mapping value parameter according to the decreasing step size of the current branch until it reaches the preset fixed constant value; The fourth step is to generate boundary conditions and return value logic of the recursive function to ensure that in all branches, when the mapping value parameter meets specific conditions, the recursion stops and returns a fixed constant value; The fifth step is to integrate all generated branch codes, boundary conditions, and return value logic in the form of code functions to obtain multi-branch recursive function codes.

3. The anti-fuzzy testing method integrated into the original program data stream according to claim 1, characterized in that: The code generation steps for the mapping function described in step 1 are as follows: The first step is to determine the number and type of input parameters of the mapping function according to the number and type of input parameters of the function in the source code, and generate a mapping rule for each input parameter; The second step is to combine all input parameters and map them into a fixed range to generate an integer mapping value; The third step is to use the integer mapping value as the input parameter of the multi-branch recursive function, call the multi-branch recursive function, and use the return value of the multi-branch recursive function as the return value of the mapping function.

4. The anti-fuzzy testing method integrated into the original program data stream according to claim 1, characterized in that: The steps for generating the operation function code described in step 1 are as follows: The first step is to determine the type of operation to be generated. According to the numerical type of the expression, the parameter type of the input parameter of the operation function is determined, including two numerical parameters to be operated and the recursive depth parameter; The second step is to generate multi-branch logic, set multiple branches according to the numerical range of the two numerical parameters being operated, and reduce the recursion depth by one to control the number of recursions; The third step is to generate a long expression for each branch logic, and the function of the generated long expression is the same as the determined operation type; The fourth step is to replace the long expression generated for each branch with the operation function call form; Enable the replaced long expression to recursively call the generated operation function; Step 5: Generate boundary conditions and return value logic of the operation function to ensure that the operation result can be returned normally when the recursive depth is zero; The sixth step is to integrate all branch codes, boundary conditions and return value logic in the form of code functions to generate the final operation function code.

5. The anti-fuzzy testing method integrated into the original program data stream according to claim 1, characterized in that: Inserting the multi-branch recursive function code, mapping function code, and operation function code into the source code in step 2 means: inserting the multi-branch recursive function code, mapping function code, and operation function code into the source code in sequence, and the insertion position is located in front of the original function of the source code and after the source code definition and global variable declaration.

6. The anti-fuzzy testing method integrated into the original program data stream according to claim 1, characterized in that: Whether the extracted function has comments in step 4 refers to: determining whether the extracted function has comments requiring not to perform anti-fuzz testing.

7. The anti-fuzzy testing method integrated into the original program data stream according to claim 1, characterized in that: Replacing the constants in the function code with the mapping function code in step 6 refers to: traversing the function code, looking for constants existing in the code or defined constants, and changing the found constants or constants to the mapping function code, where the input parameters of the mapping function code are the input parameters of the function code plus random values.

8. The anti-fuzzy testing method integrated into the original program data stream according to claim 1, characterized in that: Replacing the expression of the function code with the operation function code described in step 7 refers to: traversing the function code, finding the expression existing in the code, and converting the found expression into a reverse Polish notation; obtaining the binary sub-expression in the reverse Polish notation by accessing the stack, and replacing the binary sub-expression with an operation function code with the same function, wherein the parameters of the operation function code are the two parameters of the binary sub-expression and the depth of recursion.

9. The anti-fuzzy testing method integrated into the original program data stream according to claim 1, characterized in that: The steps for fuzz testing the program compiled from the replaced source code file described in step 8 are as follows: The first step is to compile the replaced source code file to generate an executable program; The second step is to construct test cases based on program functions; The third step is to use the fuzz testing tool, take the test case as input, and the generated executable program as the test target to perform fuzz testing; Step 4: After executing the fuzz test for 48 hours, observe the status and feedback of the executable program.

Images