An anti-fuzzing test method integrated into the original program data stream

Abstract

This invention proposes an anti-fuzzing testing method that integrates with the original program's data flow. The technical solution involves: generating multi-branch recursive function code, mapping function code, and operational function code, and inserting them into the source code; selecting an unselected function from the inserted source code file (excluding the three inserted functions); extracting function parameters and function code from the selected function; replacing constants in the function code with mapping function code; replacing expressions in the function code with operational function code; and performing fuzzing testing on the compiled program from the replaced source code file. This invention can generate a large number of code branches, integrate them with the original program's data flow, and exhibits strong anti-fuzzing testing effectiveness, robustness, and security, while maintaining low time and storage overhead.

Description

Technical Field

[0001] This invention belongs to the field of information processing technology, and further relates to an anti-fuzzing testing method integrated into the original program data flow within the field of information security technology. This invention can be used in software security protection to prevent malicious actors from using fuzzing to find software vulnerabilities. Background Technology

[0002] Fuzzing is an automated software testing technique widely used in industry to discover potential software vulnerabilities, thereby improving software security. It involves inputting fuzz-generated anomaly data into the program under test, observing the program's state and feedback, such as crashes, anomalies, and code coverage, to analyze and find errors and vulnerabilities. The execution process of fuzzing can be mainly divided into the following steps: First, define the input format and generate valid or invalid random input data; then, provide this input data to the software under test; next, monitor the software's behavior, especially abnormal behavior, crashes, or memory leaks; finally, record and analyze anomalies to identify potential problems. In this way, fuzzing can effectively discover many vulnerabilities and defects that are difficult to detect using traditional testing methods. However, malicious actors can also use this technique to find vulnerabilities to launch more complex attacks or sell vulnerabilities as commodities, increasing the risk of vulnerability abuse. Therefore, a program protection measure is needed to reduce the effectiveness of fuzzing and prevent program vulnerabilities from being exploited by malicious actors.

[0003] Program data flow describes the path of data transmission from input to output within a program. It involves how data is passed and processed between different parts of the program. Program data flow includes how the values ​​of variables and data structures flow between various functions, conditional statements, loops, and other control structures. These data flow paths can be dynamically managed and controlled through program code branches. During program execution, the logic of code branches determines different data flow paths. When the program encounters a conditional branch, data will flow along different paths depending on the input data or the current state. In this way, program data flow and code branches are tightly integrated, forming complex program behavior.

[0004] Anti-fuzzing is a technique designed to counter and circumvent fuzzing tools. It enhances software's resistance to attacks and reduces the likelihood of fuzzing tools discovering vulnerabilities by detecting fuzzing tools, inserting delayed code, adding code branches, interfering with crash detection, and using hash comparisons. These techniques aim to improve software security, making it more difficult for automated testing tools to find potential vulnerabilities and defects, thereby protecting software from unauthorized attacks and testing.

[0005] Jinho Jung et al. proposed a method to protect binary software from fuzzing attacks in their paper "Fuzzification: Anti-Fuzzing Techniques" (28th USENIX Security Symposium (USENIX Security 19), 2019, pp. 1913-1930). This method, named FUZZIFICATION, is implemented by introducing three techniques: (1) SpeedBump, which slows down fuzzing by amplifying latency in cold paths by hundreds of times; (2) BranchTrap, which interferes with feedback logic by hiding paths and polluting coverage graphs; and (3) AntiHybrid, which hinders dynamic taint analysis and symbolic execution commonly used in hybrid fuzzing through hash comparisons and block cipher encryption / decryption. These techniques effectively reduce the number of paths and vulnerabilities discovered by fuzzing tools while maintaining normal program performance within a user-specified overhead budget. However, this method still has shortcomings. The anti-fuzzing strategy that interferes with coverage feedback is independent of the original program's data flow, making it easily removed automatically, and it incurs significant time and storage overhead. The hash comparison and block cipher encryption / decryption methods related to the original program data stream generate a limited number of code branches, thus limiting the effectiveness of anti-fuzzing tests.

[0006] In their paper "VALL-NUT: Principled Anti-Greybox-Fuzzing" (2021 IEEE 32nd International Symposium on Software Reliability Engineering (ISSRE), 2021, pp. 288-300), Yuekang Li et al. proposed an anti-greybox fuzzing method called VALL-NUT. This method weakens the effectiveness of greybox fuzzing by injecting fuzzy obstacle code into the target program using an obstacle generator. The steps of VALL-NUT include: (1) generating edge-level frequency curves of the target program to determine error handling paths; (2) injecting fuzzy obstacle code that disrupts seed evaluation, seed mutation, and feedback collection mechanisms; and (3) compiling and generating a self-protected binary file. This method performed well in experiments with multiple real-world programs, reducing code coverage by an average of 34% and crashes by 76%. However, a limitation of this method is that the inserted fuzzy obstacle code is unrelated to the original program's data flow and is easily deleted by data flow analysis.

[0007] Zhengxiang Zhou et al. proposed an efficient and automatic anti-fuzzing method called No-Fuzz in their paper "No-Fuzz: Efficient Anti-fuzzing Techniques" (Security and Privacy in Communication Networks, 2023, pp. 731-751). This method is implemented through the following steps: (1) Passive detection method: A mechanism is developed to accurately identify whether the protected program is undergoing binary fuzzing (BOF) and trigger mitigation strategies, such as introducing delays or terminating program execution, when fuzzing is detected; (2) Active interference method: By designing minimal fake blocks, the basic assumptions of fuzzing are attacked, thereby hindering the normal operation of the fuzzer. These fake blocks are optimized to achieve minimal storage overhead and utilize random byte instructions to disrupt the fuzzer's code coverage graph; (3) Landing Space technique: A special code region is introduced into the program's functions. When this region is executed, the control flow is randomly redirected to an instruction within the region, thereby generating false code coverage information to confuse the fuzzer. While this method excels at reducing fuzzing branch coverage and hindering vulnerability discovery, it still has shortcomings. The dummy blocks and landing spaces it introduces are not integrated into the original program's data flow, making them easily analyzed and deleted.

[0008] Beijing Electronic Science and Technology Institute proposed an anti-fuzzing method in its patent application "A Novel Anti-Fuzzing Test Method and Device" (Patent Application No.: CN20231036096.5, Publication No.: CN 116383066 A). The method includes the following steps: Step S1, writing a template program, which can be written using any programming language that provides injection functionality; Step S2, reading the binary program to be hardened, converting it into the corresponding variable format of the template program in Step S1, and replacing the corresponding variable positions in the template program in Step S1; Step S3, compiling the template program to obtain the anti-fuzzing hardened binary program. This method can prevent all fuzzers built based on instrumentation techniques from performing fuzzing tests, and even if they can run, their efficiency will be reduced, and there will be no crash feedback. It effectively prevents attackers from performing unauthorized fuzzing tests on the target program. Furthermore, because it targets a lower level, it has a wider range of applications and is more effective than other types of anti-fuzzing techniques. However, the method still has shortcomings, as it only provides a template program injection method and does not provide a way to write a template program integrated into the original code data flow. Furthermore, copying the binary program to other memory areas may cause the program's original software protection measures to fail, such as address space randomization (ASLR) and data execution protection (DEP), and may also introduce new vulnerabilities, thereby compromising the program's security measures. Summary of the Invention

[0009] The purpose of this invention is to address the shortcomings of the prior art by proposing an anti-fuzzing test method that integrates with the original program's data flow. This method addresses the problems of current passive defense-based anti-fuzzing test strategies being unrelated to the original program's data flow and easily deleted automatically; existing methods related to the original program's data flow generating a limited number of code branches, resulting in limited anti-fuzzing effectiveness; existing anti-fuzzing test methods incurring high time overhead and consuming significant storage space; and existing anti-fuzzing test devices struggling to maintain the program's original security measures.

[0010] The idea behind this invention is as follows: This invention employs a carefully constructed multi-branch recursive function, resulting in numerous and varied code branches when different data values ​​are processed. Existing fuzzing techniques, such as coverage feedback-based fuzzing and fuzzing combined with symbolic execution or taint analysis, require significant time to traverse these code branches, and the number of branches that can be traversed is limited. This invention addresses this weakness by avoiding the limitations of coverage feedback-based fuzzing and fuzzing combined with symbolic execution or taint analysis, which generate a limited number of code branches, thus limiting the effectiveness of anti-fuzzing. This invention designs a constrained recursive function instead of randomly generated code branches, entering different branch paths based on different input data. The constrained recursive function guides the fuzzing test to select longer and more redundant input seeds as superior seeds. This results in less time overhead on the original program while achieving the same anti-fuzzing effect. Using recursive functions reuses code, reducing code storage overhead. This solves the problems of high time and storage overhead in existing anti-fuzzing techniques. This invention replaces the constants and expressions in the original program's data flow with complex function call forms. This results in newly added code that has the same semantics as the original code but with a broader execution path, participating in the program's input and output streams. This solves the problem that current passive defense-based anti-fuzzing strategies are often unrelated to the original program's data flow and easily deleted by automated analysis. This invention designs a device that only replaces the source code. A code analysis module reads and analyzes the source code information, a code generation module generates the functions required for the protection measures, and a code replacement module replaces the original target code with more complex code that has the same meaning. It does not make significant modifications to sensitive areas such as memory, thus solving the problem that existing anti-fuzzing methods undermine the original program's software protection measures.

[0011] The technical solution steps to achieve the purpose of this invention are as follows:

[0012] Step 1: Generate the code for the multi-branch recursive function, the mapping function, and the operation function, respectively;

[0013] Step 2: Insert the three function codes into the source code to obtain the inserted source code file;

[0014] Step 3: Select a function from the inserted source code file that was not previously selected, excluding the three inserted function codes;

[0015] Step 4: Determine if the selected function has comments. If it does, proceed to step 3; otherwise, proceed to step 5.

[0016] Step 5: Extract the function parameters and function code from the selected function;

[0017] Step 6: Replace the constants in the function code with the mapped function code;

[0018] Step 7: Replace the expression in the function code with the expression in the arithmetic function code;

[0019] Step 8: Perform fuzz testing on the compiled program of the replaced source code file.

[0020] Compared with the prior art, the present invention has the following advantages:

[0021] First, the present invention employs a carefully constructed multi-branch recursive function, which generates different and numerous code branches when data of different values ​​pass through it. This misleads fuzz testing based on coverage feedback and fuzz testing combined with symbolic execution or taint analysis. It solves the problem that the number of code branches generated by existing methods related to the original program data flow is limited, which affects the anti-fuzzing effect. Therefore, the present invention has the advantage of improving the anti-fuzzing effect of the target program.

[0022] Secondly, this invention designs a constrained recursive function instead of randomly generated code branches, entering different branch paths based on different input data. This overcomes the problems of high time and storage overhead in existing anti-fuzzing techniques, giving this invention the advantages of low time and low storage overhead.

[0023] Third, this invention replaces the constants and expressions of the original program's data stream with complex function call forms, overcoming the shortcomings of existing anti-fuzzing test strategies based on passive defense, which are usually unrelated to the original program's data stream and are easily deleted by automated analysis. This gives the invention the advantage of improving the robustness of anti-fuzzing test technology.

[0024] Fourth, this invention designs a method that only replaces the source code. By reading and analyzing the source code information through a code analysis module, it generates the functions required for protection measures and replaces the original target code with code that has the same meaning but is more complex. It does not make significant modifications to sensitive areas such as memory, thus solving the defect of existing anti-fuzzing testing methods that destroy the original program software protection measures. This invention has the advantages of protecting program integrity and improving program security. Attached Figure Description

[0025] Figure 1 This is a flowchart of the present invention;

[0026] Figure 2 This is a flowchart of the constants in the mapping function code replacement function code of the present invention;

[0027] Figure 3 This is an expression flowchart for replacing function code with arithmetic function code in this invention. Detailed Implementation

[0028] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments.

[0029] Reference Figure 1 The implementation steps of the embodiments of the present invention will be further described below.

[0030] Step 1: Generate the code for the multi-branch recursive function, the mapping function, and the operation function, respectively.

[0031] Step 1.1, the steps to generate multi-branch recursive function code are as follows:

[0032] The first step is to divide the mapping value into defined mapping ranges according to the maximum value that the mapping value can reach, and generate corresponding branch structures based on different mapping value ranges to obtain the integer mapping value of the mapping function.

[0033] The second step is to assign a decreasing step size parameter to each branch that is greater than or equal to 1 and less than the difference in the mapping range, thus obtaining the multi-branch logic used to control the depth of recursion and the convergence process.

[0034] The third step is to generate recursive call logic for each branch: within the range of the mapping value of the corresponding branch, the function can recursively call itself and gradually reduce the value of the mapping value parameter according to the decreasing step size of the current branch until it reaches the preset fixed constant value.

[0035] The fourth step is to generate the boundary conditions and return value logic of the recursive function, ensuring that in all branches, when the mapped value parameter meets a specific condition, the recursion stops and returns a fixed constant value.

[0036] The fifth step is to integrate all the generated branch code, boundary conditions, and return value logic according to the code function form to obtain the multi-branch recursive function code.

[0037] The pseudocode of the multi-branch recursive function Deep_F generated in this embodiment of the invention is as follows:

[0038]

[0039]

[0040] The recursive function Deep_F takes an integer mapping value `mapped_value` as input, recursively calls the Deep_F function, assigns the return value of Deep_F to `result`, and finally returns the value of `result`. Specifically, if `mapped_value` is 0, a fixed constant is returned; otherwise, a decrement_step value is assigned based on the range of `mapped_value`. The larger `mapped_value` is, the larger the decrement step. Without loss of generality, the following settings can be made: when `mapped_value` is between 1 and A, the step `decrement_step` is 1; when `mapped_value` is between A+1 and B, the step `decrement_step` is a; when `mapped_value` is between B+1 and C, the step is b; when `mapped_value` is between X+1 and Y, the step is z. When `mapped_value` is in other ranges, other step sizes are set. Where A, B, C, X, and Y are continuously increasing positive integer values ​​that will not exceed MaxHashValue, which is the maximum mapping value set by the system. a, b, and z are values ​​greater than 1 and less than the minimum range of the corresponding judgment condition, such as a less than A+1. The above operations ensure that the return value of the Deep_F recursive function converges to a fixed constant. The Deep_F function is recursively called, and its input parameter is mapped_value minus the recursion step size decrement_step.

[0041] Step 1.2, the steps to generate the code for the mapping function are as follows:

[0042] The first step is to determine the number and type of input parameters of the mapping function based on the number and type of input parameters of the function in the source code, and to generate a mapping rule for each input parameter.

[0043] The second step is to combine all the input parameters, map them to a fixed range, and generate an integer mapping value.

[0044] The third step is to use the integer mapping value as the input parameter of the multi-branch recursive function, call the multi-branch recursive function, and use the return value of the multi-branch recursive function as the return value of the mapping function.

[0045] The pseudocode of the mapping function Fk generated in this embodiment of the invention is as follows:

[0046]

[0047] The mapping function Fk accepts one or more input parameters, where k is a variable value representing the number of inputs. For example, if the number of input variables is 1, the corresponding mapping function is F1. All input parameters are mapped to the range 0 to MaxHashValue, and this mapped value is denoted as mapped_value, where MaxHashValue is the maximum mapped value set by the system. The mapped_value is then used as the input parameter for Deep_F, the Deep_F function is called, and the return value of Deep_F is assigned to result. Finally, the result value is returned.

[0048] Step 1.3, the steps to generate the operation function code are as follows:

[0049] The first step is to determine the type of operation to be generated. Based on the numerical type of the expression, determine the parameter type of the input parameters of the operation function, including the two numerical parameters to be operated on and the recursion depth parameter.

[0050] The second step is to generate multi-branch logic, set multiple branches based on the numerical range of the two calculated parameters, and reduce the recursion depth by one to control the number of recursions.

[0051] The third step is to generate a long expression for each branch logic. The function of the generated long expression is the same as the determined operation type.

[0052] The fourth step is to replace the long expressions generated for each branch with function call forms. This allows the replaced long expressions to recursively call the generated functions.

[0053] The fifth step is to generate the boundary conditions and return value logic of the operation function to ensure that the operation result can be returned normally when the recursion depth is zero.

[0054] The sixth step is to integrate all branch code, boundary conditions, and return value logic according to the code function form to generate the final operation function code.

[0055] The operation function code in the embodiments of the present invention takes the addition operation Add as an example, and its pseudocode is as follows:

[0056]

[0057]

[0058] Taking addition as an example, the function `Add` takes the values ​​X and Y on both sides of the addition operator in the expression, as well as the recursion depth `Deep`, where `Deep` is the maximum acceptable recursion depth for the user. Depending on the different ranges of values ​​for X and Y, it enters different branches and calls expressions composed of functions equivalent to `X+Y`. The actual call is Add(Xor(X,Y,Deep-1),Mul(2,x∧y,Deep-1),Deep-1). Here, A, B, C, D, E, F, G, and H are integer values. In addition, there are other alternative operator functions, including the subtraction function Sub, the bitwise OR function Or, the bitwise AND function And, the bitwise XOR function Xor, and the multiplication function Mul.

[0059] Step 2: Insert the three function codes into the source code to obtain the inserted source code file.

[0060] The code for multi-branch recursive functions, mapping functions, and operation functions is inserted sequentially into the source code, preceding the original functions and following their definitions and global variable declarations. This allows these three types of functions to be called by other functions within the source code.

[0061] Step 3: Select a function from the inserted source code file that was not previously selected, excluding the three inserted function codes.

[0062] Iterate through all functions in the inserted source code file. Excluding the three inserted function codes, select one function that has never been selected before, and use it as the object for subsequent processing steps.

[0063] Step 4: Determine if the selected function has comments. If it does, proceed to Step 3; otherwise, proceed to Step 5.

[0064] Whether the extracted function has comments refers to determining whether the extracted function contains comments that require that anti-fuzzing testing not be performed.

[0065] In embodiments of the present invention, it is determined whether the extracted function contains the comment " / / Do not perform anti-fuzzing test". If it does, step 3 is executed; otherwise, step 5 is executed. Since using the anti-fuzzing test strategy inevitably increases the execution time of the selected function, users can choose not to perform anti-fuzzing test protection for functions with low security and low latency requirements.

[0066] Step 5: Extract the function parameters and function code from the selected function.

[0067] Extract the function parameters and use them as input parameters for the mapping function. The function code is used for code replacement in steps 6 and 7.

[0068] Step 6: Replace the constants in the function code with the mapping function code. That is, traverse the function code, find the constants or defined constants in the code, and change the found constants or constants into the mapping function code. The input parameters of the mapping function code are the input parameters of the function code plus random values.

[0069] Reference Figure 2The steps for replacing constants in function code with mapping function code in this embodiment of the invention are described as follows:

[0070] The first step is to iterate through the function code.

[0071] The second step is to use regular expressions to find constants or defined constants in the code.

[0072] The third step is to change the found constants or constant values ​​into the mapping function code.

[0073] The fourth step is to generate random values.

[0074] The fifth step is to add random values ​​to the input parameters of the mapping function code.

[0075] Step 6: Output the replaced function code.

[0076] Adding random values ​​can prevent compiler optimizations, which can reduce multiple calls to the mapping function to a single call, thus weakening the effectiveness of anti-fuzzing tests.

[0077] Step 7: Replace the expression in the function code with the operation function code. That is, traverse the function code, find the expression in the code, and convert the found expression into a Reverse Polish Notation (RPN) expression. Use the stack to access the binary subexpression in the RPN expression, and replace the binary subexpression with the same operation function code. The parameters of the operation function code are the two parameters of the binary subexpression and the depth of recursion.

[0078] Reference Figure 3 The steps for replacing function code expressions with arithmetic function code in embodiments of the present invention are described as follows:

[0079] The first step is to iterate through the function code.

[0080] The second step is to determine if it is an expression. If not, skip to the first step; if it is, continue to the third step.

[0081] The third step is to convert the expression into Reverse Polish Notation.

[0082] The fourth step is to initialize an empty stack.

[0083] Fifth step: Traverse the elements in the Reverse Polish Notation from left to right.

[0084] Step 6: Determine if the current element is an operator or arithmetic function. If it is, jump to step 5; otherwise, continue to step 7.

[0085] Step 7: Determine that the current element is an operator.

[0086] Step 8: Pop two elements from the stack.

[0087] The ninth step is to find the corresponding operator's operation function, take the two elements as parameters, and generate a new function call.

[0088] Step 10: Push the new function call onto the stack.

[0089] Step 11: Determine if the end has been reached. If not, jump to step 5; if so, jump to step 12.

[0090] Step 12: Output the top element of the stack as the replaced function code.

[0091] Step 8: Perform fuzz testing on the compiled program after replacing the source code files. The steps are as follows:

[0092] The first step is to compile the replaced source code files to generate an executable program;

[0093] The second step is to construct test cases based on the program's functionality;

[0094] The third step is to use a fuzzing tool, taking the test cases as input and the generated executable program as the test target, to perform fuzzing.

[0095] The fourth step is to observe the status and feedback of the executable program after performing the fuzz test for 48 hours.

Claims

1. A method for unfuzzing tests integrated into the original program data stream, characterized in that, This method generates complex functions containing multi-branch recursive function code, mapping function code, and arithmetic function code. These complex functions are then inserted into the source code, replacing constants and expressions in the original program. Finally, the compiled program from the replaced source code file undergoes fuzz testing. The steps of this anti-fuzz testing method are as follows: Step 1: Generate the code for the multi-branch recursive function, the mapping function, and the operation function, respectively; The steps for generating the code for the multi-branch recursive function are as follows: The first step is to divide the mapping value into a defined mapping range according to the maximum value that the mapping value can reach, and generate corresponding branch structures according to different mapping value ranges to obtain the integer mapping value of the mapping function; The second step is to assign a decreasing step size parameter, which is greater than or equal to 1 and less than the difference in the mapping range, to each branch, thereby obtaining the multi-branch logic used to control the depth of recursion and the convergence process. The third step is to generate recursive call logic for each branch: within the range of the mapping value of the corresponding branch, the function can recursively call itself and gradually reduce the value of the mapping value parameter according to the decreasing step size of the current branch until the preset fixed constant value is reached. The fourth step is to generate the boundary conditions and return value logic of the recursive function, ensuring that in all branches, when the mapped value parameter meets a specific condition, the recursion stops and returns a fixed constant value. The fifth step is to integrate all the generated branch code, boundary conditions, and return value logic according to the code function form to obtain the multi-branch recursive function code; Step 2: Insert the three function codes into the source code to obtain the inserted source code file; Step 3: From the source code file after insertion, select one function that has not been selected, in addition to the three inserted function codes; Step 4: Determine if the selected function has comments. If it does, proceed to step 3; otherwise, proceed to step 5. Step 5: Extract the function parameters and function code from the selected function; Step 6: Replace the constants in the function code with the mapped function code; Step 7: Replace the expression in the function code with the expression in the arithmetic function code; Step 8: Perform fuzz testing on the compiled program of the replaced source code file.

2. The anti-fuzzing test method integrating the original program data stream according to claim 1, characterized in that, The code generation steps for the mapping function mentioned in step 1 are as follows: The first step is to determine the number and type of input parameters of the mapping function based on the number and type of input parameters of the function in the source code, and to generate a mapping rule for each input parameter; The second step is to combine all the input parameters, map them to a fixed range, and generate an integer mapping value. The third step is to use the integer mapping value as the input parameter of the multi-branch recursive function, call the multi-branch recursive function, and use the return value of the multi-branch recursive function as the return value of the mapping function.

3. The anti-fuzzing test method integrating the original program data stream according to claim 1, characterized in that, The steps for generating the operation function code described in step 1 are as follows: The first step is to determine the type of operation to be generated. Based on the numerical type of the expression, determine the parameter type of the input parameters of the operation function, including the two numerical parameters to be operated on and the recursion depth parameter. The second step is to generate multi-branch logic, set multiple branches based on the numerical range of the two calculated parameters, and reduce the recursion depth by one to control the number of recursions. The third step is to generate a long expression for each branch logic. The function of the generated long expression is the same as the determined operation type. The fourth step is to replace the long expressions generated for each branch with function calls. This enables the replaced long expression to recursively call the generated operation function; The fifth step is to generate the boundary conditions and return value logic of the operation function to ensure that the operation result can be returned normally when the recursion depth is zero. The sixth step is to integrate all branch code, boundary conditions, and return value logic according to the code function form to generate the final operation function code.

4. The anti-fuzzing test method integrating the original program data stream according to claim 1, characterized in that, Step 2, which involves inserting the three types of function code into the source code, refers to inserting the multi-branch recursive function code, the mapping function code, and the operation function code into the source code in sequence. The insertion position is before the original functions in the source code and after the source code definition and global variable declaration.

5. The anti-fuzzing test method integrating the original program data stream according to claim 1, characterized in that, The question of whether the selected function has comments in step 4 refers to determining whether the selected function contains comments that require that anti-fuzz testing not be performed.

6. The anti-fuzzing test method integrating the original program data stream according to claim 1, characterized in that, The step 6 of replacing constants in the function code with mapping function code refers to: traversing the function code, searching for constants or defined constants in the code, and changing the found constants or constants into mapping function code. The input parameters of the mapping function code are the input parameters of the function code plus random values.

7. The anti-fuzzing test method integrating the original program data stream according to claim 1, characterized in that, The expression in step 7 that replaces the function code with the arithmetic function code refers to: traversing the function code, finding the expression in the code, converting the found expression into a Reverse Polish Notation (RPN) expression; retrieving the binary subexpression from the RPN expression through stack access, and replacing the binary subexpression with the same arithmetic function code, where the parameters of the arithmetic function code are the two parameters of the binary subexpression and the recursion depth.

8. The anti-fuzzing test method integrating the original program data stream according to claim 1, characterized in that, The steps described in step 8 for performing fuzz testing on the compiled program after replacing the source code file are as follows: The first step is to compile the replaced source code files to generate an executable program; The second step is to construct test cases based on the program's functionality; The third step is to use a fuzzing tool, taking the test cases as input and the generated executable program as the test target, to perform fuzzing. The fourth step is to observe the status and feedback of the executable program after performing the fuzz test for 48 hours.

Images