Constitution generation method, device, computer program product, and electronic device

Abstract

This application discloses a method, apparatus, computer program product, and electronic device for generating system call specifications. Relating to the fields of software testing or other related fields, the method includes: obtaining a first type of function for system calls and a second type of function for file operation processing from the kernel source code of an operating system, and determining the parameters in the first type of function to obtain call parameters; performing taint propagation analysis on the call parameters to obtain macro definition flags, and performing taint propagation analysis on the parameters in the second type of function to obtain system call prefixes; determining the specification parameter type of the call parameters, and generating a system call specification based on the system call prefix, specification parameter type, and macro definition flags, wherein the system call specification is used for fuzz testing of the operating system. This application solves the problems of low generation efficiency and low accuracy in generating system call specifications in related technologies.

Description

Technical Field

[0001] This application relates to the field of specification generation, or other related fields, and more specifically, to a method, apparatus, computer program product, and electronic device for generating a specification. Background Technology

[0002] Fuzzing, a widely used software testing technique in software security development processes, ensures the security and stability of the operating system's underlying layers. It generates random data automatically or semi-automatically and submits this random data as input to the software or system to detect potential vulnerabilities and errors, such as memory leaks and data processing anomalies. Fuzzing targets can include file formats, network protocols, operating system and environment variables, mouse and keyboard events, etc. When fuzzing the Linux kernel, kernel fuzzing tools such as syzkaller can be used. Syzkaller employs a coverage-guided approach to comprehensively cover the kernel code path, thereby improving the efficiency and effectiveness of fuzzing.

[0003] However, the aforementioned syzkaller tool relies on the syzlang programming language to describe system call conventions, that is, using the syzlang programming language to define the calling kernel functions and their parameter types and formats. Furthermore, the syzkaller tool uses different conventions to guide fuzzing, deeply exploring different execution paths in the kernel, thereby improving the comprehensiveness and specificity of the tests. However, writing syzlang conventions requires experts to have a deep understanding of the kernel code and analyze the functionality and details of different functions, which is a huge and time-consuming task. To solve the above problems, related technologies use interface recovery and fuzzing engines to perform fuzzing on the system kernel and kernel drivers, but this method is a system call convention generation and fuzzing tool specifically designed for a particular system, with strong customization but insufficient scalability. To address this issue, LLVM compilation tools can be used to generate IR intermediate language and LLVM bitcode. By parsing the IR language and LLVM bitcode, the function execution logic and parameter types can be obtained, thereby generating a call convention. However, this method can only handle explicit stream parameter types, resulting in an inaccurate generated convention.

[0004] There is currently no effective solution to the problems of low generation efficiency and low accuracy in generating system call specifications in related technologies. Summary of the Invention

[0005] The main objective of this application is to provide a method, apparatus, computer program product, and electronic device for generating specifications, in order to solve the problems of low generation efficiency and low accuracy in generating system call specifications in related technologies.

[0006] To achieve the above objectives, according to one aspect of this application, a method for generating a system call specification is provided. The method includes: obtaining a first type of function for system calls and a second type of function for file operation processing from the kernel source code of the operating system, and determining the parameters in the first type of function to obtain call parameters; performing taint propagation analysis on the call parameters to obtain macro definition flags, and performing taint propagation analysis on the parameters in the second type of function to obtain a system call prefix; determining the specification parameter type of the call parameters, and generating a system call specification based on the system call prefix, the specification parameter type, and the macro definition flags, wherein the system call specification is used for fuzz testing of the operating system.

[0007] Furthermore, the system obtains a first type of function for system calls and a second type of function for file operation processing from the kernel source code of the operating system, including: obtaining the file pointer data structure of the kernel source code and determining the device file associated with the file pointer data structure; obtaining a preset function name and extracting the first type of function from the file pointer data structure based on the preset function name; determining the function structure based on the device file and extracting the second type of function from the kernel source code based on the function structure.

[0008] Furthermore, taint propagation analysis is performed on the call parameters to obtain macro definition flags, including: processing the call parameters using an explicit flow analysis algorithm to obtain explicit taint variables, where explicit taint variables refer to function variables in the operating system whose values ​​are directly affected by the call parameters; processing the call parameters using an implicit flow analysis algorithm to obtain implicit taint variables, where implicit taint variables refer to function variables in the operating system whose values ​​are affected by the call parameters under a preset probability; and generating macro definition flags based on the explicit and implicit taint variables.

[0009] Furthermore, generating macro definition flags based on explicit and implicit contamination variables includes: obtaining the header file associated with the explicit contamination variable to obtain a first header file, and obtaining the header file associated with the implicit contamination variable to obtain a second header file; determining the definition of the explicit contamination variable in the first header file, and determining the definition of the implicit contamination variable in the second header file; if the definition of the explicit contamination variable in the first header file is a flag definition, generating macro definition flags based on the explicit contamination variable; if the definition of the implicit contamination variable in the second header file is a flag definition, generating macro definition flags based on the implicit contamination variable.

[0010] Furthermore, taint propagation analysis is performed on the parameters in the second type of functions to obtain the system call prefix, which includes: obtaining the function type of the second type of functions, where the function type is one of the following: a first function type or a second function type; if the function type is a first function type, the function name of the second type of functions is obtained to obtain the processing function name; the parameters in the processing function are extracted from the kernel source code based on the processing function name to obtain the processing function parameters, the processing function parameters are identified as tainted data, and the conditional statements associated with the tainted data are obtained; the definition of the tainted data in the conditional statements is determined, and if the tainted data is defined by a flag, the system call prefix is ​​determined based on the flag definition; if the tainted data is not defined by a flag, the tainted data is processed using an implicit flow analysis algorithm, and the system call prefix is ​​determined based on the processing result; if the function type is a second function type, a preset function is obtained, and the system call prefix is ​​generated based on the preset function.

[0011] Furthermore, determining the system call prefix based on the processing results includes: introducing tainted data into the sub-functions of the second type of function, performing taint analysis on the sub-functions, and obtaining taint analysis results; if the taint analysis results indicate that the parameters in the sub-functions are obtained from tainted data processing, determining whether the parameters in the sub-functions are macro definition flags; if the parameters in the sub-functions are flag definitions, determining the system call prefix based on the parameters in the sub-functions.

[0012] Further, determining the reduction parameter type of the calling parameters includes: using an explicit flow analysis algorithm to determine the parameters affected by the called parameters in the second type of function, obtaining M contaminated variables, and determining the contamination type of the M contaminated variables, where M is a positive integer; from the M contaminated variables, determining the contaminated variables with direct contamination type, obtaining N contaminated variables, and determining the reduction parameter type based on the parameter type of the N contaminated variables, where N is a positive integer less than or equal to M; from the M contaminated variables, determining the contaminated variables with indirect contamination type, obtaining MN contaminated variables, performing taint propagation analysis on the MN contaminated variables, obtaining the correlation data between the MN contaminated variables and the calling parameters, where the correlation data characterizes the degree of association between each contaminated variable and the calling parameters, and the correlation data includes a first correlation index and a second correlation index, where the first correlation index is an index greater than or equal to the correlation data threshold, and the second correlation index is an index less than the correlation data threshold; when the correlation data is the first correlation index, determining the reduction parameter type based on the parameter type of the MN contaminated variables.

[0013] To achieve the above objectives, according to another aspect of this application, a specification generation apparatus is provided. The apparatus includes: an acquisition unit, configured to acquire a first type of function for system calls and a second type of function for file operation processing from the kernel source code of an operating system, and determine the parameters in the first type of function to obtain call parameters; an analysis unit, configured to perform taint propagation analysis on the call parameters to obtain macro definition flags, and perform taint propagation analysis on the parameters in the second type of function to obtain a system call prefix; and a determination unit, configured to determine the specification parameter type of the call parameters, and generate a system call specification based on the system call prefix, the specification parameter type, and the macro definition flags, wherein the system call specification is used for fuzz testing of the operating system.

[0014] According to another aspect of the present invention, a computer storage medium is also provided for storing a program, wherein the program, when running, controls the device where the computer storage medium is located to execute a specification generation method.

[0015] According to another aspect of the present invention, an electronic device is also provided, comprising one or more processors and a memory; the memory stores computer-readable instructions, and the processor is configured to execute the computer-readable instructions, wherein the computer-readable instructions execute a specification generation method when executed.

[0016] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, performs a specification generation method.

[0017] This application employs the following steps: First-class functions for system calls and second-class functions for file operation processing are obtained from the operating system kernel source code; the parameters in the first-class functions are determined to obtain the call parameters; taint propagation analysis is performed on the call parameters to obtain macro definition flags; taint propagation analysis is also performed on the parameters in the second-class functions to obtain the system call prefix; the reduction parameter type of the call parameters is determined; and a system call specification is generated based on the system call prefix, reduction parameter type, and macro definition flags. The system call specification is used for fuzz testing of the operating system, solving the problems of low generation efficiency and low accuracy in related technologies when generating system call specifications. By obtaining the first-class and second-class functions and performing taint propagation analysis on their parameters, the system call prefix, reduction parameter type, and macro definition flag set are obtained. Finally, the system call specification is generated based on the above data, thereby improving the efficiency and accuracy of generating system call specifications. Attached Figure Description

[0018] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0019] Figure 1 This is a flowchart of a method for generating specifications according to embodiments of this application;

[0020] Figure 2 This is a schematic diagram of a method for generating a set of flag bits according to an embodiment of this application;

[0021] Figure 3 This is a schematic diagram of a method for generating system call prefixes according to an embodiment of this application;

[0022] Figure 4 This is a schematic diagram of a method for determining the type of specification parameters according to an embodiment of this application;

[0023] Figure 5 This is a schematic diagram of a system for generating an optional set of flag bits according to an embodiment of this application;

[0024] Figure 6 This is a schematic diagram of a generation apparatus according to the specifications provided in the embodiments of this application;

[0025] Figure 7 This is a schematic diagram of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0026] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0027] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are information and data authorized by the user or fully authorized by all parties. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving consent information from the aforementioned user or organization.

[0030] It should be noted that the information collected in this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize use or refuse use.

[0031] The present invention will now be described in conjunction with preferred implementation steps. Figure 1 This is a flowchart of a method for generating specifications according to embodiments of this application, such as... Figure 1 As shown, the method includes the following steps:

[0032] Step S101: Obtain the first type of function for system calls and the second type of function for file operation processing from the kernel source code of the operating system, determine the parameters in the first type of function, and obtain the call parameters.

[0033] In some examples, the operating system can be a Linux operating system, which includes the Linux kernel and GNU software (also known as GNU's Not Unix software, a Unix-like operating system). The first type of function can be a system call function, and the second type of function can be a file operation handling function. In order to iterate on the main thread and discover potential operating system vulnerabilities and errors, the operating system kernel can be fuzzed. When fuzzing the kernel, multiple system call specifications can be used to guide the fuzzing tool to cover more paths, thereby improving the depth of exploration of the Linux kernel code and the fuzzing coverage. In order to reduce the complexity of writing system call specifications, system call functions and file operation handling functions can be obtained from the kernel source code, and then static taint propagation analysis can be used to process the system call and file operation handling functions to obtain the corresponding system call specifications.

[0034] Understandably, the first type of function refers to the function called by the kernel when a user initiates a system call request to the kernel. The first function contains various parameters passed by the user and can be regarded as an "entry point" for a user to operate the operating system kernel. The "second function" refers to the specific processing function of the kernel when processing file processing requests initiated by the user.

[0035] Step S102: Perform taint propagation analysis on the call parameters to obtain macro definition flags, and perform taint propagation analysis on the parameters in the second type of function to obtain system call prefixes.

[0036] In some examples, when performing taint propagation analysis on the parameters of system call functions (i.e., first-type functions) and file operation handling functions (i.e., second-type functions), different branch codes are obtained from the conditional statements through which the taint propagation occurs. These different conditional statements and branch codes then determine different system call prefixes and macro definition flags. For example, the ioctl interface includes three branch codes: TUNGETFEATURES, TUNSETQUEUE, and SIOCGSKNS. Each branch code can generate different system call prefixes: ioctl$TUNGETFEATURES, ioctl$TUNSETQUEUE, and ioctl$SIOCGSKNS.

[0037] It should be noted that after extracting the system call functions and file operation handling functions from the kernel source code, it is also possible to obtain the set of macro-defined flags in the conditional statements associated with the system calls, and then generate a flag set. For example, let tun_setiff_flags represent multiple flag sets of syzlang syntax, where each element is separated by a comma, and in the kernel source code, they are represented as macro-defined flags: tun_setiff_flags = IFF_TUN, IFF_TAP, IFF_NAPI, IFF_NAPI_FRAGS, IFF_NO_PI, IFF_ONE_QUEUE, IFF_VNET_HDR, IFF_TUN_EXCL, IFF_MULTI_QUEUE, IFF_ATTACH_QUEUE, IFF_DETACH_QUEUE, IFF_PERSIST, IFF_NOFILTER.

[0038] Step S103: Determine the specification parameter type of the call parameter, and generate the system call specification based on the system call prefix, specification parameter type and macro definition flag. The system call specification is used to perform fuzz testing on the operating system.

[0039] In some examples, when performing taint propagation analysis on parameters of system call and file operation handling functions, these two types of parameters can be treated as tainted data. The data sets explicitly or implicitly tainted during the propagation of tainted data are marked, and then the data type definitions of the tainted data set elements in the kernel source code are parsed to obtain the reduction parameter types for call parameter management. Furthermore, a flag set is constructed using macro-defined flags, and a system call specification is generated based on the system call prefix, the reduction parameter types, and the flag set. This allows for fuzzing operations on the operating system using the system call specification.

[0040] Figure 2 This is a schematic diagram of a method for generating a set of flag bits according to an embodiment of this application, as shown below. Figure 2 As shown, when generating the set of flags for reduction parameters, macro definition flags in the corresponding header files can be obtained through explicit and implicit flow analysis algorithms. These flags are then combined to obtain the macro definition flag set. In some examples, parameters associated with identified system call functions are treated as tainted data. The associated system call function and the system call implementation function in the kernel code are used to determine whether the tainted data belongs to a user pointer type. Then, lvalues ​​explicitly and implicitly tainted by user pointers—that is, parameters that have undergone user pointer parameter assignment, copying, or other operations—are added to the set to be analyzed. Lvalues ​​not explicitly or implicitly tainted by user pointers are treated as invalid elements.

[0041] Furthermore, the position of each element in the analysis set within the kernel code can be obtained. If the position corresponds to a conditional statement and the condition is a macro definition flag, then the macro definition flag is added as a valid element to the valid set. The conditional statement can be an if-else statement or a switch-case statement. Conversely, if the condition is not a macro definition flag, then the macro definition flag is discarded as an invalid element. Finally, the macro definitions of the elements in the valid set are found in the kernel source code, and their macro definition flags are obtained. These flags are then converted into a syzlang-formatted set of reduction parameter flags.

[0042] The specification generation method provided in this application obtains a first type of function for system calls and a second type of function for file operation processing from the kernel source code of the operating system, and determines the parameters in the first type of function to obtain call parameters; performs taint propagation analysis on the call parameters to obtain macro definition flags, and performs taint propagation analysis on the parameters in the second type of function to obtain system call prefixes; determines the specification parameter type of the call parameters, and generates a system call specification based on the system call prefix, specification parameter type, and macro definition flags. The system call specification is used for fuzz testing of the operating system, solving the problems of low generation efficiency and low accuracy in related technologies when generating system call specifications. By obtaining the first and second types of functions and performing taint propagation analysis on the parameters of the first and second types of functions, the system call prefix, specification parameter type, and macro definition flag set are obtained. Finally, the system call specification is generated based on the above data, thereby improving the efficiency and accuracy of generating system call specifications.

[0043] Optionally, in the specification generation method provided in this application embodiment, obtaining a first type of function for system calls and a second type of function for file operation processing from the kernel source code of the operating system includes: obtaining a file pointer data structure from the kernel source code and determining the device file associated with the file pointer data structure; obtaining a preset function name and extracting the first type of function from the file pointer data structure according to the preset function name; determining the function structure according to the device file and extracting the second type of function from the kernel source code according to the function structure.

[0044] In this embodiment, the first type of function differs from the second type of function. The "first type of function" refers, for example, the specific function processed by the kernel when a user initiates a system call. For instance, if a user initiates an `open` system call, it might become a specific function like `do_open` in the kernel. The "second type of function" refers to the fact that different files may have different processing functions. For example, opening `file1` and `file2` both require the user to first open them using the `open` system call, but the specific implementations might differ; the implementation function could be `do_open_file1` or `do_open_file2`.

[0045] It's important to note that function calls are divided into direct and indirect calls. Kernel code contains numerous indirect calls, declared as function pointers. Before an indirect call, initialization occurs, setting the function pointer to the function to be called. Subsequent calls to these functions are then made through this pointer, enabling dynamic function calls. The file pointer data structure defined in the kernel source code contains the module's function structure, the current module's name, and the device file name. The module's function structure refers to the function pointer structure initialized during module initialization.

[0046] Therefore, during static code analysis of the kernel source code, file pointer structures can be associated with module function structures, and the module name and corresponding device file of the current module can be linked. When the corresponding device file is opened in the fuzzy test system call specification, the actual processing function of the indirect call can be obtained through the file pointer structure associated with the device file and the module function structure. That is, when determining the system call, the file pointer data structure in the source code can be obtained, and then the device file can be determined from it. Then, the system call can be extracted based on the preset function name set by the administrator. In the Linux kernel, the file pointer can be represented by the struct file structure. When determining the second type of function (i.e., file operation processing function), the function structure can be determined, and then the file operation processing function associated with the device file can be filtered out from the source code using the type of the structure. This embodiment uses the file pointer data structure to determine the first and second types of functions, laying the foundation for the subsequent generation of system call specifications.

[0047] Optionally, in the specification generation method provided in this application embodiment, performing taint propagation analysis on the call parameters to obtain macro definition flags includes: processing the call parameters using an explicit flow analysis algorithm to obtain explicit taint variables, wherein explicit taint variables refer to function variables in the operating system whose values ​​are directly affected by the call parameters; processing the call parameters using an implicit flow analysis algorithm to obtain implicit taint variables, wherein implicit taint variables refer to function variables in the operating system whose values ​​are affected by the call parameters under a preset probability; and generating macro definition flags based on the explicit and implicit taint variables.

[0048] In some examples, when using taint propagation analysis, the call parameters associated with system calls can first be treated as "taint data." Then, based on this "taint data," the analysis can reveal how taint markers propagate along with data dependencies between variables in the program. This involves processing the call parameters using explicit flow analysis algorithms to obtain explicit tainted variables. Further analysis can reveal how taint markers propagate along control dependencies between variables in the program to obtain implicit tainted variables. Implicit tainted variables are those that may be affected by tainted data but require function analysis to identify. For example, in "struct file*file", *file can be treated as "taint data." Based on this data, explicit tainted variables whose values ​​are directly affected by tainted data can be identified. Further, by determining the code associated with the explicit and implicit tainted variables, the corresponding parameter types are determined from the code. Based on the parameter types, the definitions in the header file are determined, and then the macro definition flags are identified.

[0049] Optionally, in the specification generation method provided in this application embodiment, generating macro definition flags based on explicit and implicit contamination variables includes: obtaining the header file associated with the explicit contamination variable to obtain a first header file, and obtaining the header file associated with the implicit contamination variable to obtain a second header file; determining the definition of the explicit contamination variable in the first header file, and determining the definition of the implicit contamination variable in the second header file; if the definition of the explicit contamination variable in the first header file is a flag definition, generating macro definition flags based on the explicit contamination variable; if the definition of the implicit contamination variable in the second header file is a flag definition, generating macro definition flags based on the implicit contamination variable.

[0050] In some examples, after identifying explicit and implicit contamination variables using explicit and implicit flow analysis, since implicit flow taint propagation can lead to under-contamination (i.e., the problem of not labeling variables that should be labeled) or over-contamination (i.e., the problem of too many labels causing taint spread), these contamination variables can first be specially processed when generating macro definition flags using explicit and implicit contamination variables. For example, these contamination variables can be added to a set, and their definitions in the header file can be found through the elements in the set, that is, the first header file and the second header file can be determined.

[0051] If the explicit contamination variable is defined as a flag bit definition in the first header file, that is, the explicit contamination variable is defined as a preset variable or constant in the first header file, or as a command for different data processing operations, then it is marked as a valid type set, and then a macro definition flag bit is generated based on the explicit contamination variable. The types of non-macro definition flag bits can be processed by the harmless processing module, thereby reducing the number of taint markings and improving analysis efficiency.

[0052] Figure 3 This is a schematic diagram of a system call prefix generation method provided in an embodiment of this application, such as... Figure 3 As shown, optionally, in the specification generation method provided in this application embodiment, performing taint propagation analysis on the parameters in the second type of function to obtain the system call prefix includes: obtaining the function type of the second type of function, wherein the function type is one of the following: a first function type or a second function type; if the function type is the first function type, obtaining the function name of the second type of function to obtain the processing function name; extracting the parameters in the processing function from the kernel source code according to the processing function name to obtain the processing function parameters, determining the processing function parameters as tainted data, and obtaining the conditional statement associated with the tainted data; determining the definition of the tainted data in the conditional statement, and if the definition of the tainted data is a flag definition, determining the system call prefix according to the flag definition; if the definition of the tainted data is not a flag definition, processing the tainted data using an implicit flow analysis algorithm, and determining the system call prefix based on the processing result; if the function type is the second function type, obtaining a preset function, and generating the system call prefix according to the preset function.

[0053] In some examples, the first function type can refer to the ioctl function, and the second function type can refer to a non-ioctl function. Non-ioctl functions handle basic file operations, such as `open` to open a file, `read` to read file content, and `write` to write file content. Ioctl functions, on the other hand, handle device-specific control operations, which are typically more complex than basic file operations, requiring more parameters and specific control commands. Therefore, concentrating these operations within ioctl functions allows for better code organization. For example, ioctl functions could be `ioctl$TUNGETFEATURES`, `ioctl$TUNSETQUEUE`, and `ioctl$SIOCGSKNS`, representing three different operations on device files, each accepting different parameters.

[0054] In this embodiment, the module's function structure is first located in the source code through static code analysis or text matching. By assigning values ​​to function pointers within the module's function structure, the actual function name corresponding to the ioctl function is obtained, which is the name of the file operation processing function (i.e., the second type of function). Then, the actual function is located in the source code through static code analysis or text matching, and its parameters are used as taint data for explicit taint propagation analysis.

[0055] In explicit flow taint propagation analysis, tainted data can be used as conditional statements. Treating tainted data as elements, static code analysis or text matching is used to determine if the element contains a macro definition flag in the header file. This means determining if the statement associated with the tainted data is a conditional statement, and consequently, whether the tainted data itself contains a macro definition flag. If the element contains a macro definition flag, it is considered a valid system call prefix; otherwise, implicit flow analysis is performed. During implicit flow analysis, it can be determined whether parameters potentially tainted by the data have undergone assignment, copying, or other operations related to the tainted data. Then, it can be checked whether the tainted parameters contain macro definition flags. Finally, a system call prefix is ​​generated based on the results of these checks.

[0056] When the function type is not an ioctl function, system call prefixes can be directly generated based on preset functions, such as open, read, write, poll, and close. It's important to note that these functions differ from ioctl functions in that they lack complex macro definitions, flags, and branch code; therefore, they don't require extensive system call prefixes and can be directly generated by parsing system calls. For example, the / dev / net / tun device file can generate the following system call prefixes: openat$tun, write$tun, and read$tun.

[0057] Optionally, in the specification generation method provided in the embodiments of this application, determining the system call prefix based on the processing result includes: introducing tainted data into a sub-function in a second type of function, and performing tainted analysis on the sub-function to obtain tainted analysis results; if the tainted analysis results indicate that the parameters in the sub-function are obtained by processing tainted data, determining whether the parameters in the sub-function are macro definition flags; if the parameters in the sub-function are flag definitions, determining the system call prefix based on the parameters in the sub-function.

[0058] In some examples, implicit stream analysis requires treating each parameter of the real function as tainted data. During the propagation of each tainted data point, taint analysis is performed by substituting potentially tainted parameters into sub-functions to check if they have been assigned, copied, or otherwise tainted. If such operations are found, the parameter is confirmed to be tainted, and it can be determined whether it is a macro definition flag. If it is, the macro definition flag is added to the set of valid system call prefixes as a valid system call prefix. If neither the tainted data nor the tainted parameter is a macro definition flag at the end of implicit stream analysis, the parameter is neutralized, treated as an irrelevant condition, and no system call prefix is ​​generated. All valid elements obtained from explicit and implicit stream analysis are then used to generate corresponding system call prefixes according to the syzlang syntax.

[0059] Figure 4 This is a schematic diagram illustrating a method for determining the type of specification parameters provided in an embodiment of this application, such as... Figure 4 As shown, optionally, in the specification generation method provided in this application embodiment, determining the specification parameter type of the calling parameter includes: using an explicit flow analysis algorithm to determine the parameters affected by the called parameter in the second type of function, obtaining M contaminated variables, and determining the contamination type of the M contaminated variables, where M is a positive integer; determining contaminated variables with direct contamination type from the M contaminated variables, obtaining N contaminated variables, and determining the specification parameter type according to the parameter type of the N contaminated variables, where N is a positive integer less than or equal to M; determining contaminated variables with indirect contamination type from the M contaminated variables, obtaining MN contaminated variables, performing taint propagation analysis on the MN contaminated variables, obtaining correlation data between the MN contaminated variables and the calling parameter, wherein the correlation data characterizes the degree of association between each contaminated variable and the calling parameter, the correlation data includes a first correlation index and a second correlation index, the first correlation index being an index greater than or equal to a correlation data threshold, and the second correlation index being an index less than the correlation data threshold; in the case where the correlation data is the first correlation index, determining the specification parameter type according to the parameter type of the MN contaminated variables.

[0060] In some examples, different parameters of the system call are treated as multiple taints. First, explicit flow taint analysis is performed to identify the lvalues ​​in the system call that are clearly tainted. These tainted data are added as valid elements to a set called the valid set. Implicit flow taint analysis is then performed on the lvalues ​​that are not clearly tainted, and the parameters that are implicitly tainted are added as suspicious elements to the suspicious set.

[0061] Further, the occurrence positions of each element in the suspicious set within the function are sequentially searched; these positions typically represent a sub-function call. The suspicious element is treated as a new taint and substituted into the sub-function for analysis, meaning the sub-function's parameters are treated as tainted data for explicit stream analysis. If the suspicious element does not contaminate any other lvalues ​​within the sub-function, it is neutralized and classified as an invalid parameter type. If the suspicious element contaminates lvalues ​​within the sub-function, the contaminated lvalues ​​are recorded, and their correlation with the system call parameters is analyzed. High correlation (i.e., the first correlation index) typically manifests as memory copying operations such as directly or indirectly copying or assigning data to the contaminated lvalues ​​from the system call parameters; low correlation (i.e., the second correlation index) manifests as references or dereferences of the system call parameters by the lvalues. Highly correlated contaminated variables are added to the valid set as valid elements, while low-correlation lvalues ​​are neutralized. Find the data structure of the elements in the valid set from the source port file, parse the data structure of the valid elements, combine all the valid data structures according to the minimum set, and generate the reduction parameter type of the syzlang syntax.

[0062] It should be noted that, in order to prevent suspicious elements from causing over-contamination, a sub-function iteration depth can be set in the implementation stage. Contaminated variables that are greater than the iteration depth are rendered harmless and are no longer considered as valid elements. Contaminated variables that are less than or equal to the iteration depth are judged to determine whether the contaminated variable has contaminated other lvalues. The contaminated lvalues ​​are recorded and then processed in the above manner to generate the reduction parameter type.

[0063] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0064] This application also provides a method for generating a specification. Figure 5 This is a schematic diagram of a system for generating an optional set of flag bits according to an embodiment of this application, such as... Figure 5As shown, the system includes: a static code analysis module, a specification prefix generation module, a specification parameter type identification module, and a specification parameter type flag generation module.

[0065] The static code analysis module retrieves all system calls by function name and finds all module names and their file processing function structures in the kernel source code by searching the module structure, thus associating module structures with their file operation processing functions. The reduction prefix generation module performs taint propagation analysis on the parameters of system calls and file operation processing functions to obtain commands that enter different branches of code and generate system call prefixes. The reduction parameter type identification module performs taint propagation analysis on the parameters of system calls and file operation processing functions and determines the reduction parameter type through the data type definitions in the source code. The reduction parameter type flag generation module obtains the macro definition flag set in the conditional statements, generates a flag set, and finally combines the above system call prefixes, reduction parameter types, and flag set to generate a complete system call reduction.

[0066] This embodiment obtains system call and file operation processing functions, performs taint propagation analysis on the parameters of these functions, and obtains the system call prefix, reduction parameter type, and macro definition flag set. Finally, based on the above data, a system call specification is generated, thereby improving the efficiency and accuracy of generating system call specifications.

[0067] This application also provides a specification generation apparatus. It should be noted that the specification generation apparatus of this application can be used to execute the specification generation method provided in this application. The specification generation apparatus provided in this application will be described below.

[0068] Figure 6 This is a schematic diagram of a generation apparatus according to the specifications provided in the embodiments of this application, such as... Figure 6 As shown, the device includes: an acquisition unit 60, an analysis unit 61, and a determination unit 62.

[0069] The acquisition unit 60 is used to obtain the first type of functions for system calls and the second type of functions for file operation processing from the kernel source code of the operating system, and to determine the parameters in the first type of functions to obtain the call parameters;

[0070] Analysis unit 61 is used to perform taint propagation analysis on the call parameters to obtain macro definition flags, and to perform taint propagation analysis on the parameters in the second type of function to obtain the system call prefix;

[0071] The determining unit 62 is used to determine the specification parameter type of the call parameters. It generates a system call specification based on the system call prefix, specification parameter type, and macro definition flag. The system call specification is used to perform fuzz testing on the operating system.

[0072] The protocol generation apparatus provided in this application embodiment obtains a first type of function for system calls and a second type of function for file operation processing from the kernel source code of the operating system through an acquisition unit 60, and determines the parameters in the first type of function to obtain call parameters; an analysis unit 61 performs taint propagation analysis on the call parameters to obtain macro definition flags, and performs taint propagation analysis on the parameters in the second type of function to obtain a system call prefix; a determination unit 62 determines the protocol parameter type of the call parameters, and generates a system call protocol based on the system call prefix, protocol parameter type, and macro definition flags. The system call protocol is used for fuzz testing of the operating system, solving the problems of low generation efficiency and low accuracy in related technologies when generating system call protocols. By obtaining the first type of function and the second type of function, and performing taint propagation analysis on the parameters of the first type of function and the second type of function, the system call prefix, protocol parameter type, and macro definition flag set are obtained. Finally, the system call protocol is generated based on the above data, thereby improving the efficiency and accuracy of generating system call protocols.

[0073] Optionally, in the specification generation apparatus provided in this application embodiment, the acquisition unit 60 includes: a first acquisition module, used to acquire the file pointer data structure of the kernel source code and determine the device file associated with the file pointer data structure; a second acquisition module, used to acquire a preset function name and extract a first type of function from the file pointer data structure according to the preset function name; and a first determination module, used to determine the function structure according to the device file and extract a second type of function from the kernel source code according to the function structure.

[0074] Optionally, in the specification generation apparatus provided in this application embodiment, the analysis unit 61 includes: a first processing module, used to process the call parameters using an explicit flow analysis algorithm to obtain explicit contamination variables, wherein the explicit contamination variables refer to function variables in the operating system whose values ​​are directly affected by the call parameters; a second processing module, used to process the call parameters using an implicit flow analysis algorithm to obtain implicit contamination variables, wherein the implicit contamination variables refer to function variables in the operating system whose values ​​are affected by the call parameters under a preset probability; and a first generation module, used to generate macro definition flags based on the explicit and implicit contamination variables.

[0075] Optionally, in the specification generation apparatus provided in the embodiments of this application, the analysis unit 61 includes: a third acquisition module, configured to acquire the header file associated with explicit contamination variables to obtain a first header file, and acquire the header file associated with implicit contamination variables to obtain a second header file; a second determination module, configured to determine the definition of explicit contamination variables in the first header file, and determine the definition of implicit contamination variables in the second header file; a second generation module, configured to generate macro definition flags based on explicit contamination variables when the definition of explicit contamination variables in the first header file is defined by flags; and a third generation module, configured to generate macro definition flags based on implicit contamination variables when the definition of implicit contamination variables in the second header file is defined by flags.

[0076] Optionally, in the specification generation apparatus provided in this application embodiment, the analysis unit 61 includes: a fourth acquisition module, used to acquire the function type of the second type of function, wherein the function type is one of the following: a first function type, a second function type; a fifth acquisition module, used to acquire the function name of the second type of function when the function type is the first function type, to obtain the processing function name; an extraction module, used to extract the parameters in the processing function from the kernel source code according to the processing function name, to obtain the processing function parameters, to determine the processing function parameters as tainted data, and to acquire the conditional statement associated with the tainted data; a third determination module, used to determine the definition of the tainted data in the conditional statement, and to determine the system call prefix according to the flag definition when the definition of the tainted data is a flag definition; a third processing module, used to process the tainted data using an implicit flow analysis algorithm when the definition of the tainted data is not a flag definition, and to determine the system call prefix based on the processing result; and a sixth acquisition module, used to acquire a preset function when the function type is the second function type, and to generate a system call prefix according to the preset function.

[0077] Optionally, in the specification generation apparatus provided in this application embodiment, the analysis unit 61 includes: an introduction module, used to introduce taint data into a sub-function of a second type of function and perform taint analysis on the sub-function to obtain taint analysis results; a judgment module, used to determine whether the parameter in the sub-function is a macro definition flag bit when the taint analysis results indicate that the parameter in the sub-function is obtained by processing taint data; and a fourth determination module, used to determine the system call prefix based on the parameter in the sub-function when the parameter in the sub-function is a flag bit definition.

[0078] Optionally, in the specification generation apparatus provided in this application embodiment, the determining unit 62 includes: a fifth determining module, used to determine the parameters affected by the called parameters using an explicit flow analysis algorithm, obtain M contaminated variables, and determine the contamination type of the M contaminated variables, where M is a positive integer; a sixth determining module, used to determine the contaminated variables with the contamination type of direct contamination from the M contaminated variables, obtain N contaminated variables, and determine the specification parameter type according to the parameter type of the N contaminated variables, where N is a positive integer less than or equal to M; a seventh determining module, used to determine the contamination type of direct contamination from the M contaminated variables. Indirectly contaminated variables are identified, resulting in MN contaminated variables. A taint propagation analysis is performed on these MN contaminated variables to obtain correlation data between them and the calling parameters. This correlation data characterizes the degree of association between each contaminated variable and the calling parameters. The correlation data includes a first correlation index and a second correlation index. The first correlation index is an index greater than or equal to a correlation data threshold, and the second correlation index is an index less than the correlation data threshold. An eighth determining module is used to determine the reduction parameter type based on the parameter type of the MN contaminated variables when the correlation data is the first correlation index.

[0079] The above-mentioned specification generation device includes a processor and a memory. The above-mentioned acquisition unit 60, analysis unit 61, determination unit 62, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0080] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can address the issues of low efficiency and accuracy in generating system call protocols in related technologies.

[0081] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0082] This invention provides a computer storage medium for storing programs, wherein the programs, when running, control the device where the computer storage medium is located to execute a specification generation method.

[0083] Figure 7 This is a schematic diagram of an electronic device provided according to an embodiment of this application, such as... Figure 7As shown, this embodiment of the invention provides an electronic device 70, which includes a processor, a memory, and a program stored in the memory and executable on the processor. The processor is used to execute computer-readable instructions, wherein the computer-readable instructions execute a specification generation method. The device described herein may be a server, PC, PAD, mobile phone, etc.

[0084] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of a specification generation method according to various embodiments of this application.

[0085] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0086] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0087] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0088] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0089] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0090] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0091] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0092] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0093] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method of generating a reduction, characterized by, The method comprises the following steps: obtaining a first type of function for system call and a second type of function for file operation processing from a kernel source code of an operating system, and determining parameters in the first type of function to obtain call parameters; performing a taint propagation analysis on the call parameters to obtain a macro definition flag, and performing a taint propagation analysis on parameters in the second type of function to obtain a system call prefix; determining a reduction parameter type of the call parameters, and generating a system call reduction according to the system call prefix, the reduction parameter type, and the macro definition flag, wherein the system call reduction is used for performing a fuzz test on the operating system; obtaining a first type of function for system call and a second type of function for file operation processing from a kernel source code of an operating system, comprising: obtaining a file pointer data structure of the kernel source code, and determining a device file associated with the file pointer data structure; obtaining a preset function name, and extracting the first type of function from the file pointer data structure according to the preset function name; determining a function structure body according to the device file, and extracting the second type of function from the kernel source code according to the function structure body; the taint propagation analysis on the call parameters to obtain a macro definition flag comprises: processing the call parameters by using an explicit flow analysis algorithm to obtain an explicit pollution variable, wherein the explicit pollution variable refers to a function variable in the operating system that is directly affected by the call parameters; processing the call parameters by using an implicit flow analysis algorithm to obtain an implicit pollution variable, wherein the implicit pollution variable refers to a function variable in the operating system that is affected by the call parameters under a preset probability; and generating the macro definition flag based on the explicit pollution variable and the implicit pollution variable.

2. The method of claim 1, wherein, generating the macro definition flag based on the explicit pollution variable and the implicit pollution variable comprises: obtaining a first header file associated with the explicit pollution variable, and obtaining a second header file associated with the implicit pollution variable; determining a definition of the explicit pollution variable in the first header file, and determining a definition of the implicit pollution variable in the second header file; in a case where the definition of the explicit pollution variable in the first header file is a flag definition, generating the macro definition flag according to the explicit pollution variable; in a case where the definition of the implicit pollution variable in the second header file is the flag definition, generating the macro definition flag according to the implicit pollution variable.

3. The method of claim 1, wherein, the taint propagation analysis on the parameters in the second type of function to obtain a system call prefix comprises: obtaining a function type of the second type of function, wherein the function type is one of the following: a first function type and a second function type; in a case where the function type is the first function type, obtaining a function name of the second type of function to obtain a processing function name; extracting a parameter in the processing function from the kernel source code according to the processing function name, obtaining a processing function parameter, determining the processing function parameter as a tainted data, and obtaining a conditional statement associated with the tainted data; determining a definition of the tainted data in the conditional statement, and determining the system call prefix according to the flag definition in a case where the definition of the tainted data is a flag definition; in a case where the definition of the tainted data is not the flag definition, processing the tainted data by using an implicit flow analysis algorithm, and determining the system call prefix based on a processing result; in a case where the function type is the second function type, obtaining a preset function, and generating the system call prefix according to the preset function.

4. The method of claim 3, wherein, determining the system call prefix based on a processing result includes: introducing the tainted data into a sub-function in the second type of function, and performing a taint analysis on the sub-function to obtain a taint analysis result; in a case where the taint analysis result indicates that a parameter in the sub-function is processed by the tainted data, determining whether the parameter in the sub-function is the macro definition flag; in a case where the parameter in the sub-function is the flag definition, determining the system call prefix according to the parameter in the sub-function.

5. The method of claim 1, wherein, determining the reduction parameter type of the call parameter includes: determining parameters in the second type of function that are affected by the call parameter by using an explicit flow analysis algorithm to obtain M contaminated variables, and determining a contamination type of the M contaminated variables, where M is a positive integer; determining contaminated variables with a direct contamination type from the M contaminated variables to obtain N contaminated variables, and determining the reduction parameter type according to a parameter type of the N contaminated variables, where N is a positive integer less than or equal to M; determining contaminated variables with an indirect contamination type from the M contaminated variables to obtain M-N contaminated variables, and performing a taint propagation analysis on the M-N contaminated variables to obtain related data of the M-N contaminated variables and the call parameter, where the related data represents an association degree between each contaminated variable and the call parameter, and the related data includes a first correlation index and a second correlation index, the first correlation index refers to an index greater than or equal to a related data threshold, and the second correlation index refers to an index less than the related data threshold; in a case where the related data is the first correlation index, determining the reduction parameter type according to the parameter type of the M-N contaminated variables.

6. An apparatus for generating a protocol, characterized by includes: an obtaining unit, configured to obtain a first type of function for a system call and a second type of function for file operation processing from kernel source code of an operating system, and determine a parameter in the first type of function to obtain a call parameter; an analysis unit, configured to perform a taint propagation analysis on the call parameter to obtain a macro definition flag, and perform a taint propagation analysis on a parameter in the second type of function to obtain a system call prefix. A determining unit is configured to determine a reduction parameter type of the calling parameter, and generate a system call reduction according to the system call prefix, the reduction parameter type, and the macro definition flag, wherein the system call reduction is used for fuzzy testing of the operating system. The obtaining unit comprises: a first obtaining module, configured to obtain a file pointer data structure of the kernel source code, and determine a device file associated with the file pointer data structure; a second obtaining module, configured to obtain a preset function name, and extract the first type of function from the file pointer data structure according to the preset function name; and a first determining module, configured to determine a function structure body according to the device file, and extract the second type of function from the kernel source code according to the function structure body. The analysis unit comprises: a first processing module, configured to process the calling parameter by using an explicit flow analysis algorithm to obtain an explicit pollution variable, wherein the explicit pollution variable refers to a function variable in the operating system that is directly affected by the calling parameter; a second processing module, configured to process the calling parameter by using an implicit flow analysis algorithm to obtain an implicit pollution variable, wherein the implicit pollution variable refers to a function variable in the operating system that is affected by the calling parameter under a preset probability; and a first generating module, configured to generate the macro definition flag based on the explicit pollution variable and the implicit pollution variable.

7. A computer program product comprising a computer program, characterized in that, The computer program, when executed by a processor, implements the reduction generation method of any one of claims 1 to 5.

8. An electronic device, comprising: The computer program, when executed by a processor, implements the reduction generation method of any one of claims 1 to 5. The computer program, when executed by a processor, implements the reduction generation method of any one of claims 1 to 5.

Images