Fuzzy testing debugging method and device based on record and replay technology

Abstract

The present application provides a fuzz test debugging method and device based on record and replay technology, which relates to the field of computer technology. The method includes: performing fuzz testing on a target object and recording first information during the test process; the first information includes: interaction information between test strategies used during the fuzz test process, and metadata related to the seed during the test process; after the fuzz test is completed, the first information is obtained, and the recorded fuzz test behavior is replayed based on the first information to obtain second information; the second information includes: the execution path of the seed, and information related to the test behavior. The fuzz test debugging method and device based on record and replay technology provided by the present application simplifies the analysis and improvement process of the fuzz tester by accurately recording and replaying the execution of key strategies during the fuzz test process, and is particularly suitable for optimizing coverage-guided gray-box fuzz testing.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a fuzzy testing and debugging method and device based on record and replay technology. Background Art

[0002] Fuzz testing is a software testing method that uses automated or semi-automated input of unusual or unexpected data into a system in order to discover security vulnerabilities, operating system crashes, or application errors. It simulates programming errors or malicious attacks, such as buffer overflows and SQL injections, and observes how the system handles noncompliant input.

[0003] In related technologies, in order to give full play to the domain knowledge of security experts, researchers have designed many methods to integrate artificial expert knowledge into the fuzz testing process. However, the fuzz testing methods in related technologies still have shortcomings in terms of versatility across different target programs and solving complex program constraints.

[0004] Based on this, there is an urgent need for a fuzz testing debugging method that can not only improve the overall efficiency of fuzz testing but also ensure its wide application in diverse program environments. Summary of the Invention

[0005] The purpose of this application is to provide a fuzz testing debugging method and device based on record and replay technology, which simplifies the analysis and improvement process of the fuzz tester by accurately recording and replaying the execution of key strategies during the fuzz testing process. It is particularly suitable for optimizing coverage-guided gray-box fuzz testing.

[0006] This application provides a fuzz testing debugging method based on record and replay technology, including:

[0007] Perform a fuzz test on a target object and record first information during the fuzz test process; the first information includes: interaction information between test strategies used during the fuzz test process, and metadata related to seeds during the fuzz test process; after the fuzz test is completed, obtain the first information, and replay the recorded fuzz test behavior based on the first information to obtain second information; wherein the metadata includes: information contained in the seed file name, and the creation time of the seed file; the second information includes: the execution path of the seed, and information related to the test behavior during the fuzz test process.

[0008] Optionally, the interactive information between the test strategies includes: seed generation information, seed scheduling information and test case execution information; the fuzz testing of the target object and recording the first information during the fuzz testing process includes: using the first function code added in the fuzz tester to record the seed generation information, seed scheduling information and test case execution information during the fuzz testing of the target object, and storing the seed-related metadata in the corpus.

[0009] Optionally, after the fuzz test is completed, obtaining the first information includes: obtaining the seed generation information, seed scheduling information and test case execution information recorded by the first function code during the test process, and extracting seed-related metadata from the corpus to obtain the first information.

[0010] Optionally, the fuzzy test behavior recorded based on the replay of the first information is used to obtain the second information, including: using the second function code added in the source code of the program under test corresponding to the target object and the first information, replaying the test behavior of the source code of the program under test corresponding to the target object, and obtaining the second information.

[0011] Optionally, after obtaining the second information by replaying the recorded fuzzy test behavior based on the first information, the method also includes: displaying the first information and / or the second information to the user through a visual interface, so that the user can browse the test behavior generated during the fuzzy testing process and the execution path of each seed through interactive behavior.

[0012] The present application also provides a fuzz testing and debugging device based on record and replay technology, comprising:

[0013] A recording module is used to perform a fuzz test on a target object and record first information during the fuzz test process; the first information includes: interaction information between test strategies used in the fuzz test process, and metadata related to seeds during the fuzz test process; a replay module is used to obtain the first information after the fuzz test is completed, and replay the recorded fuzz test behavior based on the first information to obtain second information; wherein the metadata includes: information contained in the seed file name, and the creation time of the seed file; the second information includes: the execution path of the seed, and information related to the test behavior during the fuzz test process.

[0014] Optionally, the interaction information between the test strategies includes: seed generation information, seed scheduling information and test case execution information; the recording module is specifically used to utilize the first function code added in the fuzz tester to record the seed generation information, seed scheduling information and test case execution information during the fuzz testing of the target object, and store the seed-related metadata in the corpus.

[0015] Optionally, the replay module is specifically used to obtain the seed generation information, seed scheduling information and test case execution information recorded using the first function code during the test after the fuzz test is completed, and extract seed-related metadata from the corpus to obtain the first information.

[0016] Optionally, the replay module is specifically used to replay the test behavior of the source code of the program under test corresponding to the target object using the second function code added in the source code of the program under test corresponding to the target object and the first information, and obtain the second information.

[0017] Optionally, the device also includes: a display module; the display module is used to display the first information and / or the second information to the user through a visual interface, so that the user can browse the test behavior generated during the fuzz testing process and the execution path of each seed through interactive behavior.

[0018] The present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of any of the above-mentioned fuzzy testing and debugging methods based on record and replay technology.

[0019] The present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the program, the steps of the fuzzy testing and debugging method based on the recording and replay technology as described above are implemented.

[0020] The present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the fuzzy testing and debugging method based on the record and replay technology as described above are implemented.

[0021] The fuzz test debugging method and device based on recording and replay technology provided in this application performs fuzz testing on the target object and records the first information in the fuzz test process; the first information includes: the interaction information between the test strategies used in the fuzz test process, and the metadata related to the seed in the fuzz test process; after the fuzz test is completed, the first information is obtained, and the recorded fuzz test behavior is replayed based on the first information to obtain the second information; wherein the metadata includes: the information contained in the seed file name, the creation time of the seed file; the second information includes: the execution path of the seed, and the information related to the test behavior in the fuzz test process. In this way, by accurately recording and replaying the execution of key strategies in the fuzz test process, the analysis and improvement process of the fuzz tester is simplified, which is particularly suitable for optimizing coverage-guided gray-box fuzz testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the present application or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0023] Figure 1 This is one of the flow charts of the fuzz testing and debugging method based on record and replay technology provided by this application;

[0024] Figure 2 This is the second flow chart of the fuzz testing and debugging method based on record and replay technology provided by this application;

[0025] Figure 3 This is a structural diagram of the fuzzy testing and debugging device based on record and replay technology provided by this application;

[0026] Figure 4 It is a structural diagram of the electronic device provided in this application. DETAILED DESCRIPTION

[0027] To make the objectives, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments of this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0028] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of this application can be implemented in an order other than that illustrated or described herein, and that the objects distinguished by "first," "second," and the like are generally of the same type, and do not limit the number of objects; for example, the first object can be one or more. In addition, the term "and / or" in the specification and claims refers to at least one of the connected objects, and the character " / " generally indicates that the objects connected are in an "or" relationship.

[0029] Fuzzing is an automated testing technique that discovers vulnerabilities in programs by generating large amounts of random or semi-random input data. Instrumentation inserts additional instructions or code into the code to collect information such as code coverage and execution paths while the program is running.

[0030] Fuzz testing methods have high practical value in improving vulnerability discovery efficiency and exploring complex code regions. To fully leverage the domain knowledge of security experts, researchers have designed numerous methods to integrate human expert knowledge into the fuzz testing process. These methods can be categorized into three categories: 1) visualizing the fuzz testing process to help experts better understand the testing dynamics; 2) performing bottleneck analysis on the target program to identify and resolve performance bottlenecks caused by the target program during testing; and 3) directly involving humans in runtime fuzz testing decisions to provide immediate guidance and optimize testing strategies. However, fuzz testing methods in related technologies still lack generalizability across different target programs and the ability to address complex program constraints.

[0031] Fuzz testing process visualization significantly enhances experts' intuitive understanding of test progress by providing real-time data and dynamic feedback. However, these methods often present excessively complex information, hindering quick identification of key insights. Because tools provide a large amount of real-time data and dynamic feedback, users can easily become overwhelmed by the sheer volume of details, making it difficult to quickly focus on the most important problem areas. This not only increases cognitive burden but can also lead to critical issues being overlooked, compromising testing efficiency and effectiveness.

[0032] Bottleneck analysis of the target program can quickly identify bottleneck branches that hinder current fuzz testing progress. However, because these methods primarily focus on the bottleneck code within the target program, users need to have a good understanding of the target program to extract insights for improving fuzz testing. This means that every time the target program is changed, human experts need to re-understand the new program's code, resulting in high labor costs.

[0033] Direct human involvement in runtime fuzz testing decisions can leverage expert knowledge and experience, providing immediate guidance and optimizing testing strategies, significantly improving the effectiveness and efficiency of fuzz testing. However, these methods also have drawbacks: they rely heavily on manual intervention, and the optimization results are limited to a single target program, resulting in poor transferability. This not only reduces the level of automation in the testing process but also requires experts to reanalyze and adjust strategies every time the target program changes, increasing the investment of time and resources.

[0034] Current methods often require extensive reanalysis and adjustments by experts when applied to new target programs. This dependency leads to poor performance when dealing with new programs. Existing methods often lack the ability to quickly adapt to programs of varying structure and complexity. Their optimization results are limited to a single target program, making it impossible to apply insights gained from analysis to the fuzz testing strategy itself to improve performance on other programs.

[0035] Therefore, it is necessary to develop new methods for debugging and analyzing fuzz testing strategies themselves. Such methods should be low-overhead, user-friendly, and able to apply newly discovered insights to cross-program optimization. This approach can better identify policy bottlenecks in the fuzz testing process, improve portability, and reduce the need for manual intervention and time costs. This will not only improve the overall efficiency of fuzz testing but also ensure its widespread application in diverse program environments.

[0036] like Figure 1 As shown, it is a flow chart of the fuzz test debugging method based on the record and replay technology provided by an embodiment of the present application. The method is implemented by two components, namely the recorder in the left half and the replayer in the right half. The recorder is responsible for recording the information required for subsequent user debugging strategies during and after the fuzz test operation. The dotted box is the process of recording debugging information during the fuzz test operation, and the outside of the dotted box is the recorder replaying the collected corpus to obtain the seed execution path. The replayer is responsible for replaying the collected content in a way that is easy for the user to understand and use, allowing the user to quickly browse the behaviors generated during the fuzz test process through simple interaction, and then proceed to the next step of analysis and find out the policy problems.

[0037] The following, in combination with the accompanying drawings, describes in detail the fuzzy testing and debugging method based on the recording and replay technology provided by the embodiment of the present application through specific embodiments and their application scenarios.

[0038] like Figure 2 As shown, an embodiment of the present application provides a fuzzy testing and debugging method based on record and replay technology, which may include the following steps 201 and 202:

[0039] Step 201: Perform a fuzzy test on a target object and record first information during the fuzzy test.

[0040] The first information includes: interaction information between test strategies used in the fuzzy testing process, and metadata related to seeds in the fuzzy testing process.

[0041] Exemplarily, the above steps are a recording stage for recording required data, and the required data, ie, the above first information, can be recorded by adding relevant codes in the simulation test.

[0042] Specifically, the interaction information between the above test strategies includes: seed generation information, seed scheduling information, and test case execution information. Based on this, the above step 201 may include the following steps 201a:

[0043] Step 201a: Utilize the first function code added in the fuzz tester to record seed generation information, seed scheduling information, and test case execution information during the fuzz testing of the target object, and store the seed-related metadata in the corpus.

[0044] Exemplarily, during the execution of fuzz testing, the interactions between internal fuzz testing strategies can be continuously monitored and recorded through the above-mentioned first functional code to capture key runtime behaviors. The interactive behaviors between internal strategies include: seed generation, seed scheduling, and test case execution. When the fuzz testing process is completed, the data record can be extended by two additional steps: collecting the seed execution path by re-executing the seed program, and extracting seed metadata from the corpus. The metadata can include: information encoded in the seed file name (for example, the ID of the current seed, the number of tests, timestamps, etc.), and the creation time of the seed file itself.

[0045] Exemplarily, the first function code is added to a fuzz tester, for example, using AFL (a fuzz testing tool) to test the libpng library (target program). This portion of the module code for logging is added by modifying the AFL code rather than modifying libpng.

[0046] Step 202: After the fuzzy test is completed, the first information is obtained, and the recorded fuzzy test behavior is replayed based on the first information to obtain second information.

[0047] The metadata includes: information contained in the seed file name, and the creation time of the seed file; the second information includes: the execution path of the seed, and information related to the test behavior during the fuzz testing process.

[0048] It should be noted that, in the embodiments of this application, Figure 1 As shown, first run the executable file obtained after being instrumented by the fuzz testing tool, record the first information needed for the replay phase, and then run the executable file obtained after being instrumented by the present application (including the above-mentioned second function code), use the obtained first information to replay the fuzz testing process, and obtain the second information.

[0049] In the embodiments of this application, the first functional code is collected by modifying the source code of the fuzz testing tool, without actively modifying the program under test. The second functional code is added to the target program by recompiling the target program and performing custom instrumentation on the code (i.e., the instrumentation implemented in the embodiments of this application) to collect execution paths. This collection step does not involve the fuzz testing tool, but rather the re-instrumented program under test.

[0050] Specifically, in the above step 202, the step of obtaining the first information may further include the following step 202a:

[0051] Step 202a: After the fuzzy test is completed, the seed generation information, seed scheduling information and test case execution information recorded by the first function code during the test are obtained, and seed-related metadata is extracted from the corpus to obtain the first information.

[0052] Exemplarily, by replaying the fuzzy testing process based on the above-mentioned first information, the second information displayed by the user to the user can be further obtained.

[0053] Specifically, in the above step 202, the step of obtaining the second information based on the fuzzy test behavior recorded by replaying the first information may further include the following step 202b:

[0054] Step 202b: Replay the test behavior of the source code of the program under test corresponding to the target object by using the second function code added in the source code of the program under test corresponding to the target object and the first information, and obtain the second information.

[0055] In one possible implementation, the embodiment of the present application further provides a visual interface for displaying relevant information to the user.

[0056] Illustratively, after the above step 202, the fuzzy testing and debugging method based on the record and replay technology provided in the embodiment of the present application may further include the following step 203:

[0057] Step 203: Display the first information and / or the second information to the user through a visual interface so that the user can browse the test behaviors generated during the fuzz testing process and the execution paths of each seed through interactive behaviors.

[0058] Exemplarily, during the replay phase, the implemented fuzz test replayer utilizes the collected data to replay recorded fuzz testing behaviors and provides a user-friendly web interface that enables users to analyze and interact with all collected data. Through this interface, users can track the evolution of the fuzz testing process, identify potential bottlenecks in the fuzz testing strategy, and understand the relationships between different fuzz testing behaviors, thereby facilitating effective debugging and optimization.

[0059] The fuzz testing and debugging method based on the record and replay technology provided in the embodiments of the present application has the following outstanding advantages:

[0060] 1. Novel debugging method: By innovatively migrating the record and replay mechanism to the fuzz testing field, the embodiments of the present application can provide systematic support for the improvement of fuzz testing strategies and provide a solid infrastructure for efficient debugging and optimization of the fuzz testing process.

[0061] 2. Low Cost: By modeling the fuzz testing process during the recording phase, optimizing the recording logic, and determining the key information to be recorded, the embodiments of the present application introduce only minimal performance overhead during the fuzz testing process. This low overhead ensures that the invention can be applied to other fuzz testers and run smoothly.

[0062] 3. Broad Application Potential: Unlike other work, the embodiments of this application focus on analyzing and debugging the behavior of fuzz testing strategies. This means that the problems identified and solved by the embodiments of this application are not highly coupled to a specific target program, but are optimized and fixed at the fuzz testing strategy level. Therefore, once improvements are made to the fuzz testing strategy, these optimizations can also work well in other tested programs, showing high versatility and portability.

[0063] It should be noted that the fuzz testing debugging method based on record and replay technology provided in the embodiments of the present application eliminates uncertainty in the debugging process and improves the efficiency and effectiveness of fuzz testing by systematically capturing and reproducing key fuzz testing behaviors. The method includes a recording phase and a replay phase, allowing users to analyze and optimize fuzz testing strategies. The core idea of ​​this method is to simplify the analysis and improvement process of the fuzz tester by accurately recording and replaying the execution of key strategies during the fuzz testing process. This method can effectively capture and reproduce the behavior of the three core fuzz testing strategies: seed scheduling, seed generation, and test case execution, thereby providing developers with detailed debugging information and support. By minimizing the amount of information required to be recorded and providing a user-friendly interface, the tool ensures efficiency and ease of use when performing complex fuzz testing tasks. Experimental results show that in the Magma benchmark test, the fuzz tester optimized using this method achieved a 3.3-fold performance improvement, demonstrating its practical application value and potential in optimizing the fuzz testing process. This method not only improves the accuracy and reliability of fuzz testing, but also provides new directions and ideas for subsequent fuzz testing technology research.

[0064] The fuzz test debugging method based on the record and replay technology provided in the embodiment of the present application performs fuzz testing on the target object and records the first information in the fuzz test process; the first information includes: the interaction information between the test strategies used in the fuzz test process, and the metadata related to the seed in the fuzz test process; after the fuzz test is completed, the first information is obtained, and the recorded fuzz test behavior is replayed based on the first information to obtain the second information; wherein the metadata includes: the information contained in the seed file name, the creation time of the seed file; the second information includes: the execution path of the seed, and the information related to the test behavior in the fuzz test process. In this way, by accurately recording and replaying the execution of key strategies in the fuzz test process, the analysis and improvement process of the fuzz tester is simplified, which is particularly suitable for optimizing coverage-guided gray box fuzz testing.

[0065] It should be noted that the fuzzy testing and debugging method based on record and replay technology provided in the embodiments of the present application can be executed by a fuzzy testing and debugging device based on record and replay technology, or a control module in the fuzzy testing and debugging device based on record and replay technology that is used to execute the fuzzy testing and debugging method based on record and replay technology. In the embodiments of the present application, the fuzzy testing and debugging device based on record and replay technology executing the fuzzy testing and debugging method based on record and replay technology is taken as an example to illustrate the fuzzy testing and debugging device based on record and replay technology provided in the embodiments of the present application.

[0066] It should be noted that in the embodiments of the present application, the fuzzy testing and debugging methods based on the record and replay technology shown in the drawings of the above methods are all illustrated by way of example in combination with one of the drawings in the embodiments of the present application. In specific implementation, the fuzzy testing and debugging methods based on the record and replay technology shown in the drawings of the above methods can also be implemented in combination with any other drawings that can be combined as shown in the above embodiments, and no further details will be given here.

[0067] The following describes the fuzzy testing and debugging device based on the recording and replay technology provided by the present application. The fuzzy testing and debugging method based on the recording and replay technology described below can be referenced to each other.

[0068] Figure 3 A structural diagram of a fuzzy test and debugging device based on record and replay technology provided in an embodiment of the present application is shown in FIG. Figure 3 As shown, specifically including:

[0069] The recording module 301 is used to perform fuzz testing on the target object and record the first information in the fuzz testing process; the first information includes: the interaction information between the test strategies used in the fuzz testing process, and the metadata related to the seed in the fuzz testing process; the replay module 302 is used to obtain the first information after the fuzz testing is completed, and replay the recorded fuzz testing behavior based on the first information to obtain the second information; wherein the metadata includes: the information contained in the seed file name, the creation time of the seed file; the second information includes: the execution path of the seed, and the information related to the test behavior in the fuzz testing process.

[0070] Optionally, the interaction information between the test strategies includes: seed generation information, seed scheduling information and test case execution information; the recording module 301 is specifically used to utilize the first function code added in the fuzz tester to record the seed generation information, seed scheduling information and test case execution information during the fuzz testing of the target object, and store the seed-related metadata in the corpus.

[0071] Optionally, the replay module 302 is specifically used to obtain the seed generation information, seed scheduling information and test case execution information recorded using the first function code during the test after the fuzz test is completed, and extract seed-related metadata from the corpus to obtain the first information.

[0072] Optionally, the replay module 302 is specifically used to replay the test behavior of the source code of the program under test corresponding to the target object using the second function code added in the source code of the program under test corresponding to the target object and the first information, and obtain the second information.

[0073] Optionally, the device also includes: a display module; the display module is used to display the first information and / or the second information to the user through a visual interface, so that the user can browse the test behavior generated during the fuzz testing process and the execution path of each seed through interactive behavior.

[0074] The fuzz test debugging device based on recording and replay technology provided in this application performs fuzz testing on the target object and records the first information in the fuzz test process; the first information includes: the interaction information between the test strategies used in the fuzz test process, and the metadata related to the seed in the fuzz test process; after the fuzz test is completed, the first information is obtained, and the recorded fuzz test behavior is replayed based on the first information to obtain the second information; wherein the metadata includes: the information contained in the seed file name, the creation time of the seed file; the second information includes: the execution path of the seed, and the information related to the test behavior in the fuzz test process. In this way, by accurately recording and replaying the execution of key strategies in the fuzz test process, the analysis and improvement process of the fuzz tester is simplified, which is particularly suitable for optimizing coverage-guided gray-box fuzz testing.

[0075] Figure 4 An example of a physical structure diagram of an electronic device is shown below. Figure 4 As shown, the electronic device may include: a processor 410, a communications interface 420, a memory 430, and a communications bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other via the communications bus 440. The processor 410 may call logic instructions in the memory 430 to execute a fuzz testing debugging method based on record-and-replay technology, the method comprising: performing a fuzz test on a target object and recording first information during the fuzz testing process; the first information comprising: interaction information between test strategies used during the fuzz testing process, and metadata related to the seed during the fuzz testing process; after the fuzz testing is completed, obtaining the first information and replaying the recorded fuzz testing behavior based on the first information to obtain second information; wherein the metadata comprises: information contained in the seed file name and the creation time of the seed file; and the second information comprises: the execution path of the seed and information related to the test behavior during the fuzz testing process.

[0076] In addition, the logical instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the existing technology, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0077] On the other hand, the present application also provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the fuzz testing debugging method based on recording and replay technology provided by the above methods, the method including: performing fuzz testing on the target object and recording first information during the fuzz testing process; the first information includes: interaction information between the test strategies used in the fuzz testing process, and metadata related to the seed during the fuzz testing process; after the fuzz testing is completed, obtaining the first information, and replaying the recorded fuzz testing behavior based on the first information to obtain second information; wherein the metadata includes: information contained in the seed file name, the creation time of the seed file; the second information includes: the execution path of the seed, and information related to the test behavior during the fuzz testing process.

[0078] On the other hand, the present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the above-mentioned fuzz testing and debugging methods based on recording and replay technology, the method comprising: performing a fuzz test on a target object and recording first information during the fuzz testing process; the first information comprises: interaction information between the test strategies used in the fuzz testing process, and metadata related to the seed during the fuzz testing process; after the fuzz test is completed, obtaining the first information, and replaying the recorded fuzz testing behavior based on the first information to obtain second information; wherein the metadata comprises: information contained in the seed file name, and the creation time of the seed file; the second information comprises: the execution path of the seed, and information related to the test behavior during the fuzz testing process.

[0079] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0080] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A fuzz testing and debugging method based on record and replay technology, characterized in that: include: Performing a fuzzy test on a target object and recording first information during the fuzzy test; The first information includes: interaction information between test strategies used in the fuzz testing process, and metadata related to the seed in the fuzz testing process; After the fuzz test is completed, obtaining the first information, and replaying the recorded fuzz test behavior based on the first information to obtain second information; The metadata includes: information contained in the seed file name, the creation time of the seed file; the second information includes: the execution path of the seed, and information related to the test behavior during the fuzz test; The interaction information between the test strategies includes: seed generation information, seed scheduling information and test case execution information; The performing of a fuzz test on the target object and recording first information during the fuzz test includes: Using the first function code added in the fuzz tester, during the process of performing fuzz testing on the target object, seed generation information, seed scheduling information, and test case execution information are recorded, and metadata related to the seeds is stored in a corpus; The replaying of the recorded fuzzy test behavior based on the first information to obtain the second information includes: The second function code added to the source code of the program under test corresponding to the target object and the first information are used to replay the test behavior of the source code of the program under test corresponding to the target object, and obtain the second information.

2. The method according to claim 1, characterized in that After the fuzz test is completed, obtaining the first information includes: After the fuzz test is completed, the seed generation information, seed scheduling information and test case execution information recorded by the first function code during the test are obtained, and the seed-related metadata are extracted from the corpus to obtain the first information.

3. The method according to claim 1 or 2, characterized in that After obtaining second information by replaying the recorded fuzzy test behavior based on the first information, the method further includes: The first information and / or the second information are displayed to the user through a visual interface so that the user can browse the test behaviors generated during the fuzz testing process and the execution paths of each seed through interactive behaviors.

4. A fuzzy testing and debugging device based on record and replay technology, characterized in that: The device comprises: A recording module, configured to perform a fuzz test on a target object and record first information during the fuzz test process; the first information includes: interaction information between test strategies used during the fuzz test process, and metadata related to the seed during the fuzz test process; a replay module, configured to obtain the first information after the fuzz test is completed, and replay the recorded fuzz test behavior based on the first information to obtain second information; The metadata includes: information contained in the seed file name, the creation time of the seed file; the second information includes: the execution path of the seed, and information related to the test behavior during the fuzz test; The interaction information between the test strategies includes: seed generation information, seed scheduling information and test case execution information; The recording module is specifically configured to utilize the first function code added in the fuzz tester to record seed generation information, seed scheduling information, and test case execution information during the fuzz testing of the target object, and store metadata related to the seeds in a corpus; The replay module is specifically used to replay the test behavior of the source code of the tested program corresponding to the target object using the second function code added in the source code of the tested program corresponding to the target object and the first information, and obtain the second information.

5. The fuzzy testing and debugging device based on record and replay technology according to claim 4 is characterized in that: The replay module is specifically used to obtain the seed generation information, seed scheduling information and test case execution information recorded by the first function code during the test after the fuzz test is completed, and extract seed-related metadata from the corpus to obtain the first information.

6. An electronic device, characterized in that: It includes a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of the fuzzy testing and debugging method based on the recording and replay technology as described in any one of claims 1 to 3 are implemented.

7. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the steps of the fuzzy testing and debugging method based on the record and replay technology as described in any one of claims 1 to 3 are implemented.

Images