Fuzzing system and method for wasm module in JavaScript engine

Abstract

The application provides a kind of fuzzy testing system and method for WASM module in JavaScript engine, the system is cooperatively constituted by seed generation module, target engine adaptation module and fuzzy testing module, seed generation module combines the new features of WASM, seed generation algorithm is designed.This algorithm not only strengthens the coverage of WASM and JavaScript interaction, but also ensures the semantic correctness of the test sample generated by dynamic parameter adjustment and syntax constraint.Target engine adaptation module adopts weighted coverage feedback and additional correctness checking mechanism to accurately identify potential boundary access and type confusion vulnerabilities.Fuzzy testing module efficiently discovers and reproduces security issues in the engine.The application can quickly locate the vulnerabilities such as memory corruption and boundary access in WASM module of JavaScript engine, providing key protection for web security, helping JavaScript engine developers and security researchers quickly identify security risks, improving testing efficiency and the number of vulnerability discovery, and enhancing the security of JavaScript engine.

Description

Technical Field

[0001] The present invention relates to the field of computer network space security, and in particular to a fuzzy testing system and method for detecting WASM module vulnerabilities in a JavaScript engine. Background Art

[0002] With the rapid development of internet technology, web browsers have become an indispensable tool for modern users. Over the past few decades, the web has evolved from simple, static web pages to a highly dynamic, interactive application platform. Modern web applications rely heavily on JavaScript to handle client-side logic, such as user interaction, data validation, and dynamic content rendering.

[0003] As the core component that interprets and executes JavaScript code, the JavaScript engine is an essential part of modern web browsers. Almost all major browsers have their own JavaScript engine. Furthermore, JavaScript engines are widely used in many other areas beyond traditional web browsers. For example, Node.js is a server-side runtime environment built on Google's V8 engine that allows developers to write server-side applications using JavaScript.

[0004] Today's JavaScript engines are no longer just simple interpreters. By using various compilation and optimization technologies, they can efficiently process complex JavaScript code, thereby providing developers and users with high-performance and highly reliable services in multiple fields such as browsers, servers, desktop applications, and mobile applications.

[0005] WASM (WebAssembly) is a low-level bytecode format originally developed by the W3C WebAssembly Working Group to improve the performance and cross-platform compatibility of web applications. It allows developers to compile programming languages ​​such as C, C++, and Rust into bytecode and execute it directly in the browser, delivering near-native performance. WASM was designed to overcome performance bottlenecks faced by JavaScript in certain high-performance computing tasks while enhancing the flexibility of web development.

[0006] WASM works closely with JavaScript, running in the same environment and sharing resources such as memory and the execution environment. This close relationship makes WASM a crucial component of JavaScript engines. WASM and JavaScript share memory, meaning that WASM modules can manipulate data using memory buffers passed by JavaScript, while JavaScript can directly read and write this data. While this memory sharing mechanism improves performance, it also carries potential security risks. For example, if a memory corruption vulnerability exists in a WASM module, an attacker could exploit it to manipulate shared memory and subsequently attack structures within JavaScript.

[0007] The WASM standard is undergoing rapid iterative evolution, with new proposals constantly being proposed and implemented, expanding WASM's capabilities. While these new proposals enrich WASM's functionality and application scope, they also provide attackers with more potential attack surfaces. Take the WebAssembly GC proposal, for example. This proposal aims to achieve a tighter integration between WASM and the JavaScript engine's garbage collection mechanism to improve interoperability between the two. While this feature enables WASM to manage complex data structures more efficiently, it also increases the complexity of shared memory between WASM and JavaScript, which may lead to new problems.

[0008] As JavaScript engines' implementations of parsing, compiling, optimizing, and executing JavaScript code gradually stabilize, the rapidly iterating and updating WASM modules has become a significant security risk for JavaScript engines. Therefore, identifying vulnerabilities in WASM modules has become a critical step in ensuring JavaScript engine security. However, a universal vulnerability discovery method currently exists that covers new WASM proposals, new features, and the interaction between WASM and JavaScript.

[0009] A search of patent documents revealed an invention patent with publication number CN116436644A, which discloses a multi-engine-based large-scale network vulnerability rapid scanning method and system. First, the system combines the scanning features of the Masscan port scanner, Nmap scanner, and Nessus vulnerability scanner to build a vulnerability scanning tool chain. Then, through automated control of the vulnerability scanning engine, multiple task instances are run simultaneously using Docker technology to achieve multi-vulnerability scanning engine fusion. Finally, multi-source heterogeneous data fusion technology is used to analyze and store the scan data, thereby providing rapid vulnerability scanning for the network. This patent focuses on network vulnerability scanning, using multiple engines and multiple technologies for scanning and management. It does not involve fuzz testing of the WASM module in the JavaScript engine and related complex vulnerability mining techniques.

[0010] To sum up, in response to the above-mentioned problems of the existing technology, studying a fuzz testing system and method for the WASM module in the JavaScript engine has become a key task that needs to be solved urgently. Summary of the Invention

[0011] In view of the defects in the prior art, the purpose of the present invention is to provide a fuzz testing system and method for the WASM module in the JavaScript engine.

[0012] According to the present invention, a fuzz testing system for a WASM module in a JavaScript engine includes: a seed generation module, a target engine adaptation module, and a fuzz testing module;

[0013] The seed generation module is used to generate an initialization seed set;

[0014] The target engine adaptation module adds coverage collection function and correctness detection mechanism to the JavaScript engine of the test target to obtain a modified new engine;

[0015] The fuzz testing module is used to screen, mutate, and perform fuzz testing on the initialization seed set, and output vulnerability reports;

[0016] The seed generation and mutation module, the target engine adaptation module and the fuzz testing module operate in coordination with each other through a data interface.

[0017] Preferably, the seed generation module first generates a WASM seed based on the characteristics of the WASM module, then generates a JavaScript seed based on the WASM seed, and finally concatenates the WASM seed and the JavaScript seed to generate an initialization seed set for fuzz testing. The seed generation module includes WASM seed generation and JavaScript seed generation.

[0018] Preferably, in WASM seed generation, by analyzing the latest WASM specifications and related proposal documents, a syntax tree and semantic model supporting the above-mentioned new features are constructed, and code snippets covering the latest features are automatically generated based on the syntax tree and semantic model. Complex structures, nested types, and shared memory operations are introduced during the generation process to expand the code logic coverage and output WASM seeds with high syntactic and semantic correctness.

[0019] Preferably, in JavaScript seed generation, the WASM seed is used as input to generate a JavaScript seed that interacts with the WASM seed using different methods such as exception handling, function calls, and shared memory.

[0020] Preferably, the target engine adaptation module accepts the JavaScript engine of the test target as input, and adds coverage feedback code and correctness detection code to the test target program through the instrumentation technology.

[0021] Preferably, the process of adding coverage feedback code through instrumentation technology is as follows: using the JavaScript engine of the test target as input, adding code at control flow transfer points such as jump function calls, and outputting an intermediate engine after modification. The intermediate engine automatically collects the program's running path during runtime and assigns weights to different functional modules to guide test focus;

[0022] The process of adding correctness detection code through instrumentation technology is as follows: using the intermediate engine as input, adding code at the memory reading and writing and variable modification locations, and outputting a new engine after modification. When the new engine is executed, it will automatically check the size and type of the buffer and shared memory when encountering memory reading and writing operations. If any problems are encountered, an exception will be triggered, and the program's running path will be automatically collected.

[0023] Preferably, the fuzz testing module takes the initialization seed set as input, uses the seed mutator to screen and mutate the initialization seed set, then executes the seed in the new engine, records the anomalies of the program operation, and finally verifies the vulnerability of the abnormal seed and outputs a vulnerability report. The fuzz testing module includes a seed screening algorithm, a seed mutation algorithm, a fuzz tester and a vulnerability verification.

[0024] Preferably, the seed screening algorithm takes the initialization seed set as input, screens the seeds based on their semantic correctness, the instructions they contain, and other indicators, and outputs a high-quality seed set;

[0025] The seed mutation algorithm takes seeds randomly selected from the high-quality seed set as input, adopts a local mutation strategy based on the syntax tree, mutates the seeds in a small range, and outputs the seeds to be tested;

[0026] The fuzz tester takes the seed to be tested as input and runs the new engine for fuzz testing. The fuzz test runs in fork mode. When a program exception occurs during the execution of the new engine, the seed that caused the exception is output.

[0027] Vulnerability verification takes the seed that causes the anomaly as input, executes the new engine multiple times for testing, verifies the reproducibility of the anomaly, and outputs a vulnerability report if the anomaly is reproducible.

[0028] The present invention also provides a vulnerability detection method for the WASM module in the JavaScript engine, comprising the following steps:

[0029] Step S1: Generate a WASM seed using a syntax tree and semantic model that supports WASM module features, and record the functions, shared memory, and objects in the WASM seed according to the corresponding semantics, and output the WASM seed set;

[0030] Step S2: randomly select a seed from the WASM seed set as input, use a JavaScript sample generator to generate JavaScript seeds that interact with the WASM module in different ways such as exception handling, function call, and shared memory, and output a JavaScript seed set;

[0031] Step S3: Concatenate the WASM seed set and the JavaScript seed set to form a combined sample, randomly select the optimization level for each combined sample, and output a test seed set for fuzz testing.

[0032] Step S4: Take the JavaScript engine of the test target as input, add code at the jump function call control flow transfer point to implement the coverage feedback code, and obtain an intermediate engine. The intermediate engine will automatically collect the program's running path when running;

[0033] Step S5: Using the intermediate engine as input, correctness checking code is added to memory read / write and variable modification operations. When the code is executed, if any memory read / write operation is encountered, the size and type of the buffer and shared memory are automatically checked. If any problem is encountered, an exception is triggered and a new engine is output.

[0034] Step S6: Taking the test seed set as input, screening the seeds in the test seed set, retaining the seeds that can trigger more branch paths, verifying the semantic correctness of the seeds, and outputting a high-quality seed set;

[0035] Step S7: Using the high-quality seed set as input, randomly select seeds from it for mutation to obtain mutated seeds. The mutated seeds are submitted to the new engine for execution. The coverage feedback code added by the instrumentation automatically calculates the code coverage when the new engine runs. If the coverage increases, the corresponding seeds are added to the high-quality seed set. The correctness detection code added by the instrumentation automatically checks whether there are any problems when the new engine runs. If there are any problems, an exception is triggered. If a seed triggers an exception during execution, the exception is recorded and the seed that caused the exception is output.

[0036] In step S8, the seeds that caused the anomaly recorded in step S7 are used as a test set. Each time, one of the seeds that caused the anomaly is taken and executed multiple times in the new engine. If the anomaly is triggered again, the record is compiled into a report, and finally all reports, i.e., vulnerability reports, are fed back to the user.

[0037] Preferably, in step S8, a seed causing anomaly is taken each time and executed five times in the new engine.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] 1. The system of the present invention conducts effective and guided mining of potential vulnerabilities in the Web Assembly (WASM) module in the JavaScript engine, solving the problem of other solutions being unable to analyze or having poor analysis results when analyzing such vulnerabilities.

[0040] 2. The system of this invention innovatively introduces a fuzz testing method, fully integrating the new proposals and new features of WASM, strengthening the interaction effect between WASM and JavaScript, and greatly improving the efficiency and accuracy of vulnerability mining.

[0041] 3. The method of the present invention has good versatility and extensibility, and can be smoothly extended to any newly developed or existing JavaScript engine, thereby expanding its application scope and being able to play a role in more different scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments with reference to the following drawings:

[0043] Figure 1 A structural diagram of a vulnerability detection system for WASM modules in JavaScript engines provided in an embodiment of the present invention;

[0044] Figure 2 This is a flowchart of a vulnerability detection system for a WASM module in a JavaScript engine provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The present invention will be described in detail below with reference to specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those skilled in the art, several changes and improvements can be made without departing from the scope of the present invention. These all fall within the scope of protection of the present invention.

[0046] This paper proposes a fuzz testing system and method for the JavaScript engine WASM module, focusing on detecting vulnerabilities in the JavaScript engine and the WASM module it contains, covering a series of new features of the WASM module, and strengthening the interaction between the WASM module and the JavaScript engine, which can quickly discover vulnerabilities and provide vulnerability reports.

[0047] Example 1:

[0048] Figure 1 This is a structural diagram of a fuzz testing system for the WASM module in the JavaScript engine.

[0049] This embodiment provides a fuzz testing system for the WASM module in the JavaScript engine, including: a seed generation module, a target engine adaptation module and a fuzz testing module.

[0050] The seed generation module is used to generate the initialization seed set.

[0051] Specifically, the seed generation module first generates a WASM seed based on the characteristics of the WASM module, then generates a JavaScript seed based on the WASM seed, and finally concatenates the WASM seed and JavaScript seed to generate an initialization seed set for fuzz testing. The seed generation module includes WASM seed generation and JavaScript seed generation.

[0052] Specifically, during the WASM seed generation process, a new seed generation algorithm is designed by combining the characteristics of WASM modules such as single instruction multiple data (SIMD), tail calls, Wasm garbage collection (WasmGC), and tail recursion, aiming to improve semantic correctness and fully cover the critical path of memory sharing between WASM modules and JavaScript engines.

[0053] Specifically, by analyzing the latest WASM specifications and related proposal documents, we build syntax trees and semantic models that support the aforementioned new features. Based on these syntax trees and semantic models, we automatically generate code snippets that cover the latest features. During the generation process, we introduce complex structures, nested types, and shared memory operations to expand the code logic coverage and output WASM seeds with high syntactic and semantic correctness.

[0054] More specifically, in JavaScript seed generation, the WASM seed is taken as input to generate a JavaScript seed that interacts with the WASM seed using different methods such as exception handling, function calls, and shared memory.

[0055] The initialization seed set includes WASM seeds and JavaScript seeds to simulate actual operation scenarios. The three logics of splicing the two and the corresponding generated seeds are as follows:

[0056] Exception handling logic: Create exceptions in WASM and generate corresponding JavaScript exception handling code. It will randomly trigger runtime exceptions in WASM and generate JavaScript code that can catch these exceptions. It will also tamper with WASM objects in the code.

[0057] Function call logic: Generates JavaScript call code with different parameter types based on the function exported by WASM, covering different parameter types and boundary value tests.

[0058] Shared memory logic: Generates JavaScript code for operating the shared memory of the WASM module, including code that implements data sharing and interactive operations between JavaScript and WASM, especially the dynamic expansion and modification of shared memory.

[0059] The target engine adaptation module adds coverage collection function and correctness detection mechanism to the JavaScript engine of the test target to obtain a modified new engine.

[0060] Specifically, the target engine adaptation module accepts the JavaScript engine of the test target as input, and adds coverage feedback code and correctness detection code to the test target program through the instrumentation technology.

[0061] The process of adding coverage feedback code through instrumentation is as follows: The target JavaScript engine is used as input, code is added at control flow transfer points such as jump function calls, and after modification, an intermediate engine is output. The intermediate engine automatically collects the program's execution path at runtime. During this process, different functional modules are assigned weights to guide testing focus. Given the complex interaction between WASM and JavaScript involved in the JavaScript engine, the importance and feature coverage requirements of each module vary. New WASM features are given higher weights, while common JavaScript operations are given lower weights, or even excluded from coverage collection, to minimize the impact of useless operations on coverage.

[0062] The process of adding correctness detection code through instrumentation technology is as follows: using the intermediate engine as input, adding code at the memory reading and writing and variable modification locations, and outputting a new engine after modification. When the new engine is executed, it will automatically check the size and type of the buffer and shared memory when encountering memory reading and writing operations. If any problems are encountered, an exception will be triggered, and the program's running path will be automatically collected.

[0063] Among them, the correctness check code is used to track the types and sizes of shared objects, memory, etc. in different contexts (JavaScript context, WASM context, and both) in real time. When performing memory access, table indexing, and type constraint operations, it checks whether the types and sizes of shared objects, memory, etc. in different contexts are consistent. If they are inconsistent, an exception will be triggered, thereby detecting potential type confusion and out-of-bounds vulnerabilities.

[0064] The fuzz testing module is used to screen, mutate, and perform fuzz testing operations on the initialization seed set and output vulnerability reports.

[0065] Specifically, the fuzz testing module takes an initial set of seeds as input, uses a seed mutator to filter and mutate them, then executes the seeds in a new engine, records any exceptions, and finally verifies vulnerabilities in the abnormal seeds, generating a vulnerability report. The fuzz testing module includes a seed screening algorithm, a seed mutation algorithm, a fuzz tester, and vulnerability verification.

[0066] The seed screening algorithm takes the initialized seed set as input, screens the seeds based on their semantic correctness, the instructions they contain, and other indicators, and outputs a high-quality seed set.

[0067] Specifically, the seed screening algorithm uses coverage-oriented, feature priority sorting, and semantic integrity checking methods to screen high-quality seeds from the initial seed set. At the same time, it regularly cleans up seeds that are duplicated in coverage or path contribution, thereby reducing the size of the seed pool and obtaining a high-quality seed set.

[0068] The seed mutation algorithm takes seeds randomly selected from the high-quality seed set as input, adopts a local mutation strategy based on the syntax tree, mutates the seeds in a small range, and outputs the seeds to be tested.

[0069] To ensure that the mutated seed complies with the specifications of the WASM module and the JavaScript language, two strategies are used during the mutation process to improve the semantic correctness of the mutated seed: the syntax and semantic constraint strategy and the specific interaction mutation operation strategy. The syntax and semantic constraint strategy uses a local mutation strategy based on the syntax tree during mutation, mutating the seed within a small range to ensure that the overall structure and semantics of the code are not damaged. The specific interaction mutation operation strategy designs special mutation operations for the interaction between the WASM module and the JavaScript engine, including:

[0070] Dynamic parameter adjustment operation: Modify the parameter type and number when the JavaScript engine calls the WASM module function;

[0071] Memory access modification operations: Add read and write operations on the WASM module shared memory in the mutated JavaScript engine code to try to trigger more potential vulnerabilities.

[0072] The fuzz tester takes the seed to be tested as input and runs a new engine for fuzz testing. Fuzz testing operates in a fork mode. Specifically, the seed to be tested is used as input, the new engine is run, and coverage information is collected. If coverage increases, the seed is added to the input queue. A random seed is then selected from the input queue and used as the next input through the seed mutator. If a program anomaly such as a crash, assertion failure, or undefined behavior occurs during the execution of the new engine, the seed that caused the anomaly is output.

[0073] Vulnerability verification takes the seed that causes the anomaly as input, executes the new engine multiple times for testing, verifies the reproducibility of the anomaly, and outputs a vulnerability report if the anomaly is reproducible.

[0074] Specifically, the vulnerability verification executes the seed that causes the exception once to verify the reproducibility of the exception. If the seed that causes the exception can still cause the program exception, the relevant program exception report and the seed that causes the exception are sorted out, and the vulnerability report is output to the user for manual confirmation.

[0075] Based on the generated vulnerability report, vulnerabilities in the WASM module in the JavaScript engine can be quickly located, which helps JavaScript engine developers and security researchers quickly discover security issues in the JavaScript engine, greatly improving testing efficiency and vulnerability discovery, thereby improving the security of the JavaScript engine.

[0076] The seed generation and mutation module, the target engine adaptation module and the fuzz testing module operate in coordination with each other through a data interface.

[0077] Example 2:

[0078] Figure 2 This is a flow chart of a fuzz testing method for a JavaScript engine WASM module in an embodiment of the present invention.

[0079] As shown in Figure 2, this embodiment provides a vulnerability detection method for the WASM module in the JavaScript engine. Based on the vulnerability detection system for the WASM module in the JavaScript engine described in Example 1 above, the method includes the following steps:

[0080] Step S1: Generate a WASM seed using a syntax tree and semantic model that supports WASM module features, and record the functions, shared memory, and objects in the WASM seed according to the corresponding semantics, and output the WASM seed set;

[0081] Step S2: randomly select a seed from the WASM seed set as input, use a JavaScript sample generator to generate JavaScript seeds that interact with the WASM module in different ways such as exception handling, function call, and shared memory, and output a JavaScript seed set;

[0082] Step S3: Concatenate the WASM seed set and the JavaScript seed set to form a combined sample, randomly select their respective optimization levels for the combined sample, and output a test seed set for fuzz testing.

[0083] In step S4, the JavaScript engine of the test target is used as input, and code is added at the jump function call control flow transfer point to implement the insertion of coverage feedback code to obtain an intermediate engine. The intermediate engine will automatically collect the program's running path when running.

[0084] In step S5, the intermediate engine is used as input, and correctness check code is added to the memory read and write and variable modification. When the code is executed, if it encounters memory read and write operations, the size and type of the buffer and shared memory are automatically checked. If a problem is encountered, an exception is triggered and a new engine is output.

[0085] Step S6: Taking the test seed set as input, screening the seeds in the test seed set, retaining the seeds that can trigger more branch paths, verifying the semantic correctness of the seeds, and outputting a high-quality seed set;

[0086] In step S7, the high-quality seed set is used as input, and seeds are randomly selected from the set for mutation to obtain mutated seeds. The mutated seeds are submitted to the new engine for execution. The coverage feedback code added by the instrumentation automatically counts the code coverage when the new engine is running. If the coverage increases, the corresponding seeds are added to the high-quality seed set. The correctness detection code added by the instrumentation automatically checks whether there are any problems when the new engine is running. If there are any problems, an exception is triggered. If a seed triggers an exception during execution, the exception is recorded and the seed that caused the exception is output.

[0087] In step S8, the seeds that caused the anomaly recorded in step S7 are used as a test set. Each time, one of the seeds that caused the anomaly is taken and executed multiple times in the new engine. If the anomaly is triggered again, the record is compiled into a report, and finally all reports, i.e., vulnerability reports, are fed back to the user.

[0088] In this embodiment, a seed that causes an exception is taken each time and executed five times in a new engine.

[0089] Those skilled in the art will appreciate that, in addition to implementing the system and its various devices, modules, and units provided by the present invention in purely computer-readable program code, it is entirely possible to implement the same functions of the system and its various devices, modules, and units provided by the present invention in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; the devices, modules, and units for implementing various functions can also be considered as both software modules implementing the method and structures within the hardware component.

[0090] The above describes specific embodiments of the present invention. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. The embodiments of this application and the features in the embodiments may be combined with each other in any manner unless there is a conflict.

Claims

1. A fuzz testing system for WASM modules in JavaScript engines, characterized by: include: Seed generation module, target engine adaptation module and fuzz testing module; The seed generation module is used to generate an initialization seed set; The target engine adaptation module adds coverage collection function and correctness detection mechanism to the JavaScript engine of the test target to obtain a modified new engine; The fuzz testing module is used to screen, mutate and perform fuzz testing operations on the initialization seed set, and output a vulnerability report; The seed generation and mutation module, the target engine adaptation module and the fuzz testing module operate in coordination with each other through a data interface; in, The seed generation module first generates a WASM seed based on the characteristics of the WASM module, then generates a JavaScript seed based on the WASM seed, and finally concatenates the WASM seed and the JavaScript seed to generate an initialization seed set for fuzz testing. The seed generation module includes WASM seed generation and JavaScript seed generation; In the WASM seed generation process, by analyzing the latest WASM specifications and related proposal documents, a syntax tree and semantic model supporting new features are constructed. Based on this syntax tree and semantic model, code snippets covering the latest features are automatically generated. Complex structures, nested types, and shared memory operations are introduced during the generation process to expand the scope of code logic coverage and output WASM seeds with high syntactic and semantic correctness. In the JavaScript seed generation, the WASM seed is used as input to generate a JavaScript seed that interacts with the WASM seed using exception handling, function calls, and shared memory; The target engine adaptation module accepts the JavaScript engine of the test target as input and adds coverage feedback code and correctness detection code to the test target program through the instrumentation technology; The process of adding coverage feedback code through instrumentation is as follows: using the target JavaScript engine as input, adding code at the jump function call control flow transfer point, and then outputting an intermediate engine after modification. The intermediate engine automatically collects the program's execution path at runtime and assigns weights to different functional modules to guide test focus. The process of adding correctness detection code through instrumentation technology is as follows: taking the intermediate engine as input, adding code at the memory read and write and variable modification locations, and outputting a new engine after modification. When the new engine is executed, it will automatically check the size and type of the buffer and shared memory when encountering memory read and write operations. If any problems are encountered, an exception will be triggered and the program's execution path will be automatically collected. The fuzz testing module takes the initialization seed set as input, uses a seed mutator to screen and mutate the initialization seed set, then executes the seed in the new engine, records the anomalies obtained in the program operation, and finally verifies the vulnerabilities of the abnormal seeds and outputs a vulnerability report. The fuzz testing module includes a seed screening algorithm, a seed mutation algorithm, a fuzz tester and a vulnerability verification.

2. A fuzz testing system for WASM modules in JavaScript engines according to claim 1, characterized in that: The seed screening algorithm takes the initialization seed set as input, screens the seeds based on their semantic correctness and the instruction indicators they contain, and outputs a high-quality seed set; The seed mutation algorithm takes a randomly selected seed from the high-quality seed set as input, adopts a local mutation strategy based on a syntax tree, mutates the seed in a small range, and outputs a seed to be tested; The fuzz tester takes the seed to be tested as input and runs the new engine to perform fuzz testing. The fuzz testing is run based on a fork mode. When a program exception occurs during the execution of the new engine, the seed that caused the exception is output; The vulnerability verification takes the seed that causes the exception as input, executes the new engine multiple times for testing, verifies the reproducibility of the exception, and outputs a vulnerability report if the exception is reproducible.

3. A vulnerability detection method for a WASM module in a JavaScript engine, based on a fuzz testing system for a WASM module in a JavaScript engine according to any one of claims 1 to 2, characterized in that: The steps include: Step S1: Generate a WASM seed using a syntax tree and semantic model that supports WASM module features, and record the functions, shared memory, and objects in the WASM seed according to the corresponding semantics, and output a WASM seed set; Step S2: randomly selecting a seed from the WASM seed set as input, using a JavaScript sample generator to generate JavaScript seeds that interact with the WASM module in different ways such as exception handling, function call, and shared memory, and outputting a JavaScript seed set; Step S3: concatenate the WASM seed set and the JavaScript seed set to form a combined sample, randomly select the optimization level for each of the combined samples, and output a test seed set for fuzz testing; Step S4: Using the JavaScript engine of the test target as input, adding code at the jump function call control flow transfer to implement the instrumentation and coverage feedback code, thereby obtaining an intermediate engine. The intermediate engine automatically collects the program's running path when running. Step S5: Using the intermediate engine as input, correctness checking code is added to memory read / write and variable modification operations. When the code is executed, if a memory read / write operation is encountered, the size and type of the buffer and shared memory are automatically checked. If a problem is encountered, an exception is triggered and a new engine is output. Step S6: taking the test seed set as input, screening the seeds in the test seed set, retaining seeds that can trigger more branch paths, verifying the semantic correctness of the seeds, and outputting a high-quality seed set; Step S7: Using the high-quality seed set as input, randomly selecting seeds from the set for mutation to obtain mutated seeds. The mutated seeds are submitted to the new engine for execution. The coverage feedback code added by the instrumentation automatically calculates the code coverage when the new engine is running. If the coverage increases, the corresponding seeds are added to the high-quality seed set. The correctness detection code added by the instrumentation automatically checks whether there are any problems when the new engine is running, and triggers an exception if there are any problems. If a seed triggers an exception during execution, the exception is recorded and the seed that caused the exception is output; In step S8, the seeds causing the exception recorded in step S7 are used as a test set. One of the seeds causing the exception is taken each time and executed multiple times in the new engine. If the exception is triggered again, the record is compiled into a report, and finally all reports, i.e., vulnerability reports, are fed back to the user.

4. A vulnerability detection method for WASM modules in JavaScript engines according to claim 3, characterized in that: In step S8, each time a seed causing an anomaly is taken and executed five times in the new engine.

Images