Binary directional grey box fuzzy test method and system based on regional probability accessibility

Abstract

The invention discloses a binary directional grey box fuzzy test method and system based on regional probability accessibility. The method comprises the following steps: S1, recovering a potentially missing indirect edge according to memory layout characteristics of a binary file; s2, obtaining a matching similarity score for each indirect edge, taking the matching similarity score as a corresponding prior probability, and calculating an accuracy probability of each indirect edge; s3, clustering into different regions according to the degree that the accessibility is influenced by the indirect edge, and constructing a region graph; s4, calculating the depth in the region and the connectivity between the regions according to the probability that each indirect edge is correctly recovered, and calculating the probabilistic reachability score of each path; and S5, performing optimal configuration on the fuzzy test according to the probabilistic reachability score of each path. According to the method, the directional fuzzy test based on reachability analysis under the binary condition can be effectively realized, the test strategy is adaptively adjusted when the control flow diagram dynamically changes, and the test efficiency and precision are balanced.

Description

Technical Field

[0001] The present invention relates to the technical field of computer program testing, and in particular to a binary directed grey box fuzz testing method and system based on regional probabilistic reachability. Background Art

[0002] Target-guided directed gray-box fuzzing (DGF), a variant of fuzzing, is essentially an optimization problem. The key to this optimization problem is to search the input space to find the optimal solution to reach the target code block. The optimization goal is to maximize the probability that the fuzz test will reach the target code block. Existing directed gray-box fuzzing (DGF) techniques are typically implemented using static analysis methods. These methods rely on precise structural information, such as constructing an inter-procedural control flow graph (ICFG) using a control flow graph (CFG) and a call graph (CG). This allows the fuzz test to be directed towards the intended target code during testing. However, when targeting binary files such as COTS software, traditional static methods struggle to accurately recover indirect control flow transitions, significantly reducing their effectiveness.

[0003] Existing static analysis tools for binary programs (such as Angr, BPA, and CALLEE) can exhibit significant inaccuracies when resolving indirect calls and jumps. Some indirect edges formed by indirect function calls cannot be accurately recovered by binary-level static methods, resulting in inaccurate and incomplete constructed ICFG structures. This structural incompleteness causes missing indirect edges to sever legitimate paths to the target, while forged edges create illusory reachable regions, fundamentally undermining traditional reachability analysis and path-prioritization strategies. Inaccurate structural information can impact the effectiveness of DGF in multiple dimensions. For example, when DGF is tested based on inaccurate ICFGs, distance metrics can provide misleading guidance, selective instrumentation may fail to identify the true critical path, and path pruning mechanisms may incorrectly prune feasible routes to the target.

[0004] Using a dynamic binary translation framework for real-time CFG optimization incurs prohibitive overhead. For example, for a medium-sized binary file, each reachability update can take nearly ten minutes, making it impossible to directly reuse source-level solutions when testing binary programs. Existing binary compatibility methods fail to balance accuracy and efficiency, requiring either coarse-grained function-level analysis at the expense of basic block details or fine-grained CFG reconstruction at an unsustainable computational cost. Summary of the Invention

[0005] The technical problem to be solved by the present invention is: in response to the technical problems existing in the prior art, the present invention provides a binary directed gray-box fuzz testing method and system with simple implementation method, low cost, high testing efficiency and based on regional probabilistic reachability. It can utilize the recovery of indirect edges to effectively realize the reachability analysis of directed fuzz testing, solve the problem of incompleteness of control flow graph, and at the same time utilize the accurate confidence of indirect edge recovery to adaptively adjust the test strategy when the control flow graph changes dynamically, so as to balance the efficiency and accuracy of the test.

[0006] In order to solve the above technical problems, the technical solution proposed by the present invention is: A binary directed grey-box fuzz testing method based on region probabilistic reachability, comprising the following steps: Step S1. Indirect edge recovery: Scan all code segments of the binary file under test and build a CFG. Create dangling nodes in the CFG for valid basic blocks. Recover potentially missing indirect edges for the dangling nodes based on the memory layout characteristics of the binary file. Step S2. Calculate the probability of indirect edge recovery: Obtain a matching similarity score for each indirect edge and use it as the corresponding prior probability. During the fuzz test run, calculate the accuracy probability of each indirect edge based on the execution counts of the source and target basic blocks of each indirect edge and the corresponding prior probability, to represent the probability of each indirect edge being correctly recovered. Step S3. Region division and region graph construction: cluster the basic blocks of the control flow graph into different regions according to the degree to which their reachability is affected by the same set of indirect edges, and construct a region graph from the classified regions; Step S4. Probabilistic reachability analysis: Calculate the intra-region depth and inter-region connectivity index in the region graph based on the probability of correct recovery of each indirect edge to evaluate the reachability between regions, and calculate the probabilistic reachability score of each path in the region graph based on the intra-region depth and inter-region connectivity index. The intra-region depth is used to measure the difficulty of reaching a specific basic block from an entry basic block in the same region, and the inter-region connectivity index is used to measure the difficulty of transitioning from a region to a target reachable region. Step S5. Fuzzy test optimization: Optimize the fuzzy test configuration according to the probabilistic reachability score of each path in the region graph.

[0007] Furthermore, in step S1, recovering the potentially missing indirect edges for the dangling nodes according to the memory layout characteristics of the binary file includes: if the predecessor code segment of the current dangling node is added as a node in the CFG and is associated with a function, the boundary of the current dangling node is inferred by the disassembler; if the address of the current dangling node falls within the boundary of the target function, an indirect edge is added from the entry block of the target function to the root node of the dangling area as an intra-function indirect edge; if the address of the current dangling node exceeds the function boundary, the current dangling node is regarded as the entry point of a new function, and an indirect edge is added between the current dangling node and the program entry as an inter-function indirect edge.

[0008] Furthermore, in step S2, the accuracy probability of each indirect edge is calculated by constructing a Bayesian statistical model, and the calculation expression is:

[0009] in, S and D Respectively represent the execution times of the source and target basic blocks of the current indirect edge, s and d Represents S and D Related specific statistical values, B Indicates that the current indirect edge is correctly restored. P ( B | S = s , D = d ) represents the accuracy probability corresponding to the current indirect edge, which is used to represent the accuracy of S and D equal s and d The probability of event B occurring when Represents the prior probability corresponding to the current indirect edge; Marginal probability The calculation expression is:

[0010] in, and Respectively in the event B The source basic block S The number of executions is s and the target basic block D The number of executions is d The conditional probability of is calculated as follows:

[0011]

[0012] in, and Respectively expressed in B The average number of executions of S and D when correct, and Respectively expressed in B The average number of executions of S and D when incorrect.

[0013] Furthermore, in step S3, the basic blocks of the control flow graph are classified into target reachable areas, potential target reachable areas and target unreachable areas, wherein the target reachable area is an area where all basic blocks have paths to the target location and the reachability is not affected by indirect edges, the target unreachable area is an area where no basic block has a path to the target location and the reachability is not affected by indirect edges, and the potential target reachable area is an area where all basic blocks have paths to the target location but the reachability is affected by indirect edges.

[0014] Furthermore, in the target reachable region, the root node is the entry basic block, the exit node is the target basic block, the target basic block has the maximum depth in the region, and the basic blocks in the target reachable region are m Depth within the region The calculation formula is:

[0015] in, represents the depth of the target basic block, Represents a basic block m Depth; The exit node of the potential reachable area is connected to the source basic block of the current potential reachable area and the target reachable area or other potential reachable areas through an indirect edge. m Depth within the region The calculation formula is:

[0016] in, represents the exit basic block in each region, Represents the set of all exit basic blocks that m can reach.

[0017] Furthermore, for any two adjacent regions ri and rj , if present n The indirect edges connected to each other correspond to the connectivity between the regions ci,j The calculation expression is:

[0018] in, Indicates connection ri and rj No. k The accuracy probability of the indirect edge; represents the probability of error recovery of all indirect edges; Contains basic blocks m Area rm The target reachable region containing the target basic block rt The calculation expression of the probabilistic reachability score between is:

[0019] in Indicates from the area rm arrive rt The set of all possible inter-region paths, p express A path in the collection.

[0020] Furthermore, calculating the probabilistic reachability score of each path in the region graph according to the depth within the region and the connectivity between regions includes: For basic blocks in target unreachable regions m , the corresponding probability reachability score is set to 0; For basic blocks in the potentially reachable region m , the depth in the area Rdepth and inter-regional connectivity Rcnct The corresponding probability accessibility score is obtained by weighted calculation, and the weight of regional connectivity is configured to be higher than the weight of depth in the region. The basic blocks in the potential reachable region m The calculation expression of the probability accessibility score is:

[0021] in, score ( m ) is a basic block m The probabilistic accessibility score of is the cross-region connectivity weight, defined as the total number of edges in the control flow graph CFG Eall and the number of cross-region edges Ei r The ratio of For basic blocks in the reachable region m , the depth in the area Rdepth With basic blocks m The maximum value of regional connectivity maxRcnct The corresponding probability accessibility score is obtained by weighted calculation, and the calculation expression is:

[0022] According to the reachability score of the basic block, the reachability score calculation formula of each seed is obtained as follows:

[0023] in, ξ ( s ) indicates a seed s The set of all basic blocks covered in the execution path of ξ ( s )∣ represents a set ξ ( s ) is the number of basic blocks in .

[0024] Furthermore, in step S5, a triple guidance mechanism is used to optimize the configuration of the fuzz test according to the probabilistic reachability score of each path in the region graph, and the triple guidance mechanism includes: a seed priority optimization strategy, a seed power scheduling optimization strategy, and a reachability-guided mutation strategy, wherein the seed priority optimization strategy sets the priority of the seed according to the probabilistic reachability score, and preferentially retains historical seeds pointing to regions with probabilistic reachability scores higher than a preset threshold. The seed power scheduling optimization strategy implements energy suppression on seeds covering regions with probabilistic reachability scores lower than a preset threshold based on a region heat feedback mechanism. In the mutation phase, the reachability-guided mutation strategy constructs a mutation weight matrix according to the probabilistic reachability distribution of basic blocks to configure a directed mutation strategy for key indirect edge jump points and bottleneck region entries, and guides the execution flow to cross region boundaries by inserting specific byte patterns or adjusting the input structure.

[0025] The seed priority optimization strategy is configured as follows: new seeds that can cover new branches and basic blocks with a probabilistic reachability score exceeding a preset threshold are preferentially selected. If the newly generated seeds fail to cover the new branches, all seeds generated by the previous fuzz test are mutated again, and the seeds with the highest probabilistic reachability score are preferentially selected. In the seed power scheduling optimization strategy, power scheduling is optimized according to the following formula:

[0026] in, For optimized power scheduling allocated to seeds s energy, is the base energy that AFL assigns to the seed, is the average of the probabilistic reachability scores of all seeds; The reachability-guided mutation strategy includes: if the basic block m is a target reachable basic block, and the basic block m There is a subsequent basic block that is both reachable and not executed by the fuzz test. mIdentify as a critical basic block; during the seed mutation process, record the covered basic blocks and identify the critical basic blocks, then check whether the seed mutation changes the value of the variable in the critical basic block; if the mutated byte position causes the variable value of the critical basic block to change, mark the mutated byte position as a coarse-grained critical byte; perform an intersection operation on the coarse-grained critical byte position to extract the fine-grained critical byte position; dynamically adjust the selection probability of the fine-grained critical byte according to the number of seed mutations and the number of changes in the critical basic block variables in the seed.

[0027] Furthermore, the priority score of the seed is set according to the following formula based on the probabilistic reachability score: A computer system includes a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to execute the computer program to perform the above method.

[0028] A computer-readable storage medium storing a computer program, wherein the computer program implements the above method when executed by a processor.

[0029] Compared with the prior art, the advantages of the present invention are as follows: in the process of building CFG by scanning all code segments of the binary file under test, the present invention recovers the potentially missing indirect jump edges according to the memory distribution characteristics of the binary file, and then calculates the accuracy probability of each indirect edge based on the matching similarity score obtained for each indirect edge as the corresponding prior probability, combined with the execution times of the source and target basic blocks of the indirect edge during the fuzz test runtime, so as to realize the confidence evaluation of the accurate recovery of each indirect edge, and at the same time clusters the basic blocks of the control flow graph into different regions according to the degree to which their reachability is affected by the same group of indirect edges, so as to divide the control flow graph into different regions according to the target reachability characteristics. Basic blocks in the flow graph that are affected by the same set of indirect edges are clustered into the same region to construct a regional graph. In the process of constructing the regional graph, the depth within the region is calculated to quantify the difficulty of path exploration within the region, and the connectivity index between regions is calculated to measure the probability weight of cross-region jumps. The depth within the region and the connectivity index between regions are then combined to calculate the probabilistic reachability score of each path. Finally, the probabilistic reachability score of each path is used to perform fuzz testing optimization configuration, realizing dynamic reachability-guided fuzz testing optimization. The accurate confidence of indirect edge recovery is used to adaptively adjust the test strategy when the control flow graph changes dynamically, balancing the breadth of path exploration and the goal-oriented accuracy requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a schematic diagram of the implementation flow of the binary directed grey-box fuzz testing method based on regional probabilistic reachability in this embodiment.

[0031] Figure 2This is a schematic diagram of the implementation principle of binary directed gray-box fuzz testing based on regional probabilistic reachability in this embodiment. DETAILED DESCRIPTION

[0032] The present invention will be further described below in conjunction with the accompanying drawings and specific preferred embodiments, but the scope of protection of the present invention is not limited thereby.

[0033] Traditional testing methods inaccurately recover control flow graphs (CFGs) for commercial software binaries, hindering the effectiveness of reachability analysis in directed fuzz testing. Due to the lack of symbol and type information in commercial software binaries, static analysis methods struggle to accurately recover indirect edges formed by indirect jumps and calls. Current static analysis tools, such as Angr, BPA, and CALLEE, typically achieve indirect edge recovery accuracy below 70%. These erroneous indirect edges can impact the reachability of basic blocks. For example, missing indirect edges can disrupt actual reachable paths, while incorrectly added indirect edges can introduce spurious paths. In particular, a single missing indirect edge can lead to incorrect reachability for basic blocks across an entire region, severely impacting path guidance in directed fuzz testing.

[0034] Traditional directed fuzz testing tools typically design distance-based metrics based on complete and accurate control flow graphs and call graphs. However, due to the imperfections of binary-level control flow graphs, the calculation methods of these fitness metrics cannot accurately reflect the reachability of basic blocks. Therefore, such source code-level fitness metrics cannot meet the efficiency requirements of binary-level directed fuzz testing. Furthermore, binary-level fuzz testing relies on dynamic binary translation technology, resulting in extremely high overhead for runtime reachability updates. For example, on a control flow graph containing 5,000 nodes, a single update can take nearly 10 minutes. Traditional methods, such as path pruning and selective instrumentation, require precise reachability judgments, but due to the incompleteness of binary-level control flow graphs, these optimization strategies cannot be directly applied, ultimately resulting in wasted testing resources on exploring invalid paths.

[0035] Furthermore, existing binary-level directed fuzz testing tools, such as AFLGo and PDGF, typically assume that the statically recovered control flow graph is sufficiently accurate, thus lacking the ability to dynamically assess the confidence level of indirect edge recovery. Due to inherent errors in the indirect edge recovery process, these tools are unable to leverage runtime information (such as basic block execution frequency) to dynamically adjust the indirect edge recovery accuracy assessment during fuzz testing. This leads to uneven test energy distribution, for example, potentially erroneously directing testing to falsely reachable areas. This makes it difficult to adaptively adjust testing strategies as the control flow graph dynamically changes.

[0036] The present invention recovers potentially missing indirect jump edges according to the memory distribution characteristics of the binary file in the process of scanning all code segments of the tested binary file to build CFG, and then calculates the accuracy probability of each indirect edge based on the matching similarity score obtained for each indirect edge as the corresponding prior probability, combined with the execution times of the source and target basic blocks of the indirect edge during the fuzz test runtime, to achieve confidence evaluation of the accurate recovery of each indirect edge, and at the same time cluster the basic blocks of the control flow graph into different areas according to the degree to which their reachability is affected by the same set of indirect edges, so as to separate the basic blocks in the control flow graph that are affected by the same set of indirect edges. Clustered into the same region, a regional graph is constructed. During the regional graph construction process, the depth within the region is calculated to quantify the difficulty of path exploration within the region, and the inter-regional connectivity index is calculated to measure the probability weight of cross-region jumps. The intra-regional depth and inter-regional connectivity index are then combined to calculate the probabilistic reachability score of each path. Finally, the probabilistic reachability score of each path is used to optimize the fuzz testing configuration, realizing dynamic reachability-guided fuzz testing optimization. The accurate confidence of indirect edge recovery is used to adaptively adjust the test strategy when the control flow graph changes dynamically, balancing the breadth of path exploration and the goal-oriented accuracy requirements. like Figure 1 As shown, the steps of the binary directed gray-box fuzz testing method based on regional probabilistic reachability in this embodiment include: Step S1. Indirect edge recovery: Scan all code segments of the binary file under test and build a CFG. Create dangling nodes in the CFG for valid basic blocks. Recover potentially missing indirect edges for the dangling nodes based on the memory layout characteristics of the binary file.

[0037] This embodiment adopts static analysis technology and a heuristic indirect edge recovery method. Based on memory layout analysis, it utilizes the memory distribution characteristics of software binary files to recover potentially missing indirect jump edges. This solves the problem that traditional testing methods cannot accurately recover the control flow graph (CFG) of commercial software binary programs, which in turn affects the effectiveness of directed fuzz testing reachability analysis.

[0038] In this embodiment, the step of using a heuristic method to restore potentially missing indirect edges for dangling nodes based on the memory layout characteristics of the binary file includes: if the predecessor code segment of the current dangling node is added as a node in the CFG and is associated with a function, the disassembler infers the boundary of the current dangling node; if the address of the current dangling node falls within the boundary of the target function, an indirect edge is added from the entry block of the target function to the root node of the dangling area as an intra-function indirect edge; if the address of the current dangling node exceeds the function boundary, the current dangling node is regarded as the entry point of a new function, and an indirect edge is added between the current dangling node and the program entry as an inter-function indirect edge.

[0039] Specifically, first, all code segments are scanned to create dangling nodes in the CFG for valid basic blocks (e.g., non-exceptional code). Given that binaries typically have a contiguous memory layout, disassembly tools can heuristically infer the relationship between a dangling node and its preceding code segment. Then, if the dangling node's predecessor is added as a node in the CFG and associated with a function, its boundary can be inferred by a disassembler (such as IDA Pro). If the address of the dangling node falls within the function boundary, an indirect edge is added from the function's entry block to the root node of the dangling region; this indirect edge is called an intra-function indirect edge. Conversely, if the address of the dangling node exceeds the function boundary, it is treated as the entry point of a new function, and an indirect edge is added between the dangling node and the program entry point, which is called an inter-function indirect edge.

[0040] Step S2. Calculation of indirect edge recovery probability: Obtain a matching similarity score for each indirect edge and use it as the corresponding prior probability. When the fuzz test is running, calculate the accuracy probability of each indirect edge based on the number of executions of the source and target basic blocks of each indirect edge and the corresponding prior probability to characterize the probability of each indirect edge being correctly recovered.

[0041] In traditional testing methods, recovered indirect edges may contain errors, and their impact on DGF reachability analysis cannot be corrected before the indirect edges are hit. This embodiment calculates the accuracy probability of each indirect edge based on a Bayesian statistical model, combining runtime fuzz testing information with prior knowledge provided by static analysis to dynamically assess the confidence level (i.e., accuracy probability) in accurately recovering indirect edges. As a result, indirect edges with higher accuracy probabilities are more likely to be correctly recovered through static analysis, making paths containing these edges more likely to actually lead to the target, thereby enhancing overall reachability.

[0042] To ensure that Bayesian statistics accurately reflect the confidence of recovered indirect edges, this embodiment first uses the static method CALLEE to obtain a matching similarity score for each indirect edge and uses it as its prior probability. Then, the accuracy probability is calculated by combining the execution times of the source and target basic blocks of the indirect edge: (1) in, S and D Respectively represent the execution times of the source and target basic blocks of the current indirect edge, s and d Represents S and D Related specific statistical values, B Indicates that the current indirect edge is correctly restored. P ( B | S = s ,D = d ) represents the accuracy probability corresponding to the current indirect edge, which is used to represent the accuracy of S and D equal s and d The probability of event B occurring when PB represents the prior probability of the current indirect edge, which is determined by the similarity matching score in the static analysis. In the subsequent loop, It is updated with the accuracy probability in the previous cycle and applied in the next calculation.

[0043] Marginal probability The calculation expression is: (2) in, and Respectively in the event B The source basic block S The number of executions is s and the target basic block D The number of executions is d Since the Poisson distribution is suitable for modeling events within a fixed interval, especially for modeling low-frequency events, the above conditional probability can be calculated as follows: (3) (4) in, and Respectively expressed in B The average number of executions of S and D when correct, and Respectively expressed in B The average number of executions of S and D when incorrect.

[0044] Combining the above formulas (1) to (4), the accuracy probability of the indirect edge can be calculated based on the number of executions of the source and target basic blocks.

[0045] This embodiment constructs a Bayesian statistical model to calculate the accuracy probability of each indirect edge, dynamically assessing the probability of accurate recovery of indirect edges. The set of indirect edge candidates obtained during the static analysis phase is used as a priori probability. This is combined with dynamic execution information collected during the fuzz testing runtime (such as the hit frequency of the indirect edge's source and target basic blocks) to update the posterior probability, ultimately generating a confidence score for the accurate recovery of each indirect edge. This model implements probabilistic iteration using Bayes' theorem, dynamically reflecting the assessment results of accurate recovery of indirect edges. This probabilistic expression allows subsequent reachability analysis to accommodate the uncertainty of indirect edges. By integrating the Bayesian statistical model to integrate the prior knowledge from static analysis with runtime fuzz testing data, the confidence level of indirect edge recovery can be effectively assessed.

[0046] Step S3. Region division and region graph construction: The basic blocks of the control flow graph are clustered into different regions according to the degree to which their reachability is affected by the same set of indirect edges, and a region graph is constructed from the classified regions.

[0047] To evaluate the impact of indirect edges on DGF reachability analysis, this embodiment introduces the new concept of "regions" and constructs a region graph for probabilistic reachability analysis based on the region graph. A region consists of a set of basic blocks whose reachability is affected by the same indirect edges. This embodiment implements a region classification mechanism based on the impact of indirect edges, clustering basic blocks in the control flow graph affected by the same set of indirect edges into the same region, achieving region partitioning. This is then used to construct a region graph based on the region classification.

[0048] This embodiment divides the basic blocks of the control flow graph into three types according to the target reachability characteristics: a certain reachable area, a certain unreachable area, and a potential reachable area. The target reachable area is an area where all basic blocks have paths to the target location and the reachability is not affected by indirect edges. The target unreachable area is an area where no basic block has a path to the target location and the reachability is not affected by indirect edges. The potential target reachable area is an area where all basic blocks have paths to the target location but the reachability is affected by indirect edges.

[0049] Specifically, the following three types of regions are defined: Target reachable region: In this region, all basic blocks have paths to the target location, and their reachability is not affected by indirect edges; Target unreachable region: In this region, no basic block has a path to the target location, and its reachability is not affected by indirect edges; Potential target reachable region: In this region, all basic blocks have paths leading to the target location, but their reachability is affected by indirect edges.

[0050] Step S4. Probabilistic reachability analysis: Calculate the intra-region depth and inter-region connectivity index in the region graph based on the probability of each indirect edge being correctly restored to evaluate the reachability between regions, and calculate the probabilistic reachability score of each basic block in the region graph based on the intra-region depth and inter-region connectivity. The intra-region depth is used to measure the difficulty of reaching a specific basic block from the entry basic block in the same region, and the inter-region connectivity index is used to measure the difficulty of transitioning from a region to a target reachable region.

[0051] During the construction of the region graph, this embodiment quantifies the difficulty of path exploration within the region by calculating the depth within the region, combining the jump distance from the basic block to the region exit and the region's topological complexity. Simultaneously, an inter-region connectivity index is calculated to measure the probability weight of cross-region jumps. Based on the hierarchical structure of the region graph, the results of the intra-region depth and inter-region connectivity calculations are integrated to derive a calculation model for the probabilistic reachability score, which serves as the expected value of the probability that each basic block will reach the target location via the region path. During fuzz testing, this probabilistic reachability score is revised in real time as the region graph is dynamically updated (such as with the addition of indirect edges or execution trajectory feedback).

[0052] The depth within a region can be used to assess the complexity and path length of movement within the region, without being affected by external regions. For a subgraph with a root node and multiple exit nodes, the depth of a node is defined as the maximum number of edges from the root node to that node. This depth measurement helps assess the reachability of each basic block within the target reachable region, allowing for more accurate analysis of the connectivity between paths and nodes in the control flow graph, further facilitating path planning optimization and program behavior understanding.

[0053] Specifically, in the target reachable region, the root node is the entry basic block, the exit node is the target basic block, and the target basic block has the maximum depth in the region. Therefore, for any basic block in the target reachable region m If the depth of its region is large, it means that it is far away from the entry basic block but close to the exit node (i.e., the target basic block), which indicates that its reachability to the target basic block is higher. Basic blocks in the target reachable region m Depth within the region The calculation formula can be expressed as: (5) in, represents the depth of the target basic block, Represents a basic block m depth.

[0054] The exit node of the potential reachable region is the source basic block that connects the current potential reachable region with the target reachable region or other potential reachable regions through indirect edges. For a basic block m in the potential reachable region, a larger depth in the region indicates that m is closer to the exit basic block and is more likely to reach the target reachable region through indirect edges. Basic blocks in the potential reachable region m Depth within the region It can be calculated as follows: (6) in, represents the exit basic block in each region, Represents the set of all exit basic blocks that m can reach.

[0055] Inter-region connectivity can evaluate the difficulty of DGF crossing region boundaries, which is particularly important for evaluating the difficulty of basic blocks reaching target locations in different regions. If the path from a basic block to a target basic block contains an indirect edge that is not hit by DGF, then the basic block must first reach the exit node within its region and then reach the target through inter-region transfer. Since a lower probability of accuracy means that the static analysis method has a higher probability of incorrectly recovering indirect edges, the difficulty of inter-region transfer is related to the accuracy probability of the indirect edge. Therefore, there may be no path between the two regions, thereby hindering inter-region transfer. This embodiment evaluates the difficulty of reaching the target through inter-region conversion by calculating the inter-region connectivity index.

[0056] For the target unreachable region, since all basic blocks in the region are unreachable, its reachability is not analyzed.

[0057] Inter-region connectivity is positively correlated with the number of indirect edges between two regions, because more connected indirect edges mean that the DGF has a higher probability of reaching another region through multiple routes. ri and rj , if present n The indirect edges connected to each other correspond to the inter-region connectivity ci,j It can be calculated according to the following expression: (7) in, Indicates connection ri and rj No. k The accuracy probability of the indirect edge; represents the probability that all indirect edges are recovered incorrectly. Even if only one edge is recovered correctly, ri and rj Still considered connected.

[0058] Inter-region connectivity is negatively correlated with the length of the inter-region path. A longer inter-region path means that DGF may encounter more obstacles and restrictions. Therefore, this embodiment quantifies the inclusion of basic blocks based on connectivity by using inter-region paths. m Area rm The target reachable region containing the target basic block rt Specifically, it contains basic blocks m Area rm The target reachable region containing the target basic block rt The probabilistic reachability score between can be calculated according to the following calculation expression: (8) in Indicates from the area rm arrive rt The set of all possible inter-region paths, p express A path in the set. For each path from rm arrive rt There must be at least one indirect edge between any two adjacent regions to ensure connectivity. rm arrive rt The connectivity of a region is the product of the connectivity between adjacent regions on the path. At the same time, accessibility also depends on the number of paths between regions. rm arrive rt The connectivity of all paths is accumulated, following the principle of graph theory that more paths lead to higher connectivity. As the accuracy probability is updated, the connectivity between regions will be continuously adjusted.

[0059] To reach the target via a path containing an indirect edge that is not hit by the fuzz test, the basic block must first reach the exit node within its region and then undergo an inter-region transition to reach the target. The difficulty of these inter-region transitions is related to the accuracy probability of the indirect edge; a lower probability means a higher probability of error recovery. Therefore, there may be no path between regions, thus hindering inter-region transitions. This embodiment can provide the difficulty of path transfer across regions by calculating the inter-region connectivity index, which can effectively evaluate the difficulty of reaching the target through inter-region transitions.

[0060] In this embodiment, the depth within a region can be used to evaluate the difficulty of reaching a specific basic block from an entry basic block within the same region, while the inter-region connectivity measures the difficulty of transitioning from a region to a target reachable region. Using the depth within a region can help understand the complexity and path length of moving within a region without being affected by external regions. At the same time, the inter-region connectivity provides the degree of effort required to cross the region boundary, which is particularly important for evaluating the difficulty of a basic block reaching a target location in a different region. Therefore, by combining these two indicators, a more comprehensive understanding and optimization of reachability analysis in CFG can be achieved.

[0061] In this embodiment, the probabilistic reachability score of each basic block in the region graph is calculated based on the depth within the region and the connectivity between regions, and then the probabilistic reachability score of the seed is calculated. The specific steps include: For a basic block m in a target-unreachable region, its probabilistic reachability score is set to 0 because no basic block in the region can reach the target.

[0062] For basic blocks in the potentially reachable region m , the depth in the area Rdepth and inter-regional connectivity Rcnct The corresponding probability accessibility score is obtained by weighted calculation. To reach the target, m A basic block must first pass through the exit basic block of the region where it is located, and then enter the target reachable region along the cross-region path. Therefore, when calculating the reachability score of a basic block, satisfying the constraints of indirect edges and finding reachable paths between regions is more challenging than simply considering the depth within the region. Therefore, this embodiment sets the weight of regional connectivity higher than the weight of regional depth. The basic blocks in the potential reachable region are m The calculation expression of the probability accessibility score is: (9) in, score ( m ) is a basic block m The accessibility score of is the cross-region connectivity weight, defined as the total number of edges in the control flow graph (CFG) Eall and the number of cross-region edges Eir The higher the proportion of cross-region edges, the smaller the difference in granularity between cross-region jumps and basic block jumps, and the lower the weight. In extreme cases, if all edges in the CFG are indirect edges, the difficulty of cross-region jumps is equivalent to that of intra-region jumps.

[0063] For basic blocks in the reachable region m , the depth in the area Rdepth With basic blocks m The maximum value of regional connectivity maxRcnctThe corresponding probability accessibility score is obtained by weighted calculation, and the calculation expression is: (10) Then, based on the reachability score of the basic block, the probabilistic reachability score of each seed is calculated as: (11) in, ξ ( s ) indicates a seed s The set of all basic blocks covered in the execution path of , ∣ ξ ( s )∣ represents a set ξ ( s ) is the number of basic blocks in .

[0064] Step S5. Fuzzy test optimization: Optimize the fuzzy test configuration according to the probabilistic reachability score of each path in the area graph.

[0065] In this embodiment, based on the probabilistic reachability score of the seed obtained in step S4, the input priority, power scheduling, and mutation strategy are optimized to prioritize the coverage of basic blocks with high reachability. In this embodiment, a triple-guidance mechanism is used to optimize the configuration of fuzz testing based on the probabilistic reachability score of each path in the region graph. The triple-guidance mechanism includes: a seed priority optimization strategy, a seed power scheduling optimization strategy, and a reachability-guided mutation strategy. The seed priority optimization strategy sets the priority of the seed based on the probabilistic reachability score, and preferentially retains historical seeds pointing to regions with probabilistic reachability scores higher than a preset threshold. The seed power scheduling optimization strategy implements energy suppression on seeds covering regions with probabilistic reachability scores lower than a preset threshold based on a region heat feedback mechanism. In the mutation phase, the reachability-guided mutation strategy constructs a mutation weight matrix based on the probabilistic reachability distribution of the basic block to configure a directed mutation strategy for key indirect edge jump points and bottleneck region entries, and guides the execution flow to cross region boundaries by inserting specific byte patterns or adjusting the input structure.

[0066] Specifically, at the fuzz testing optimization level, the seed priority optimization strategy uses the normalized weighted value of the probabilistic reachability score as the priority criterion, giving priority to retaining historical seeds pointing to high-scoring regions. The seed power scheduling optimization strategy introduces a regional heat feedback mechanism to allocate energy to seeds covering high-scoring regions and suppress energy for seeds covering low-scoring regions. During the mutation phase, the reachability-guided mutation strategy constructs a mutation weight matrix based on the probabilistic reachability distribution of basic blocks. It designs targeted mutation strategies specifically for key indirect edge jump points (such as high-confidence correction edges) and bottleneck region entries, guiding the execution flow across region boundaries by inserting specific byte patterns or adjusting the input structure. This optimization system achieves dynamic policy adjustments through lightweight runtime information collection, further balancing the breadth of path exploration with goal-oriented accuracy requirements.

[0067] In a specific embodiment, the seed priority optimization strategy can be configured to prioritize new seeds that both cover new branches and cover highly reachable basic blocks. If the newly generated seeds fail to cover the new branches, all seeds generated by the previous fuzzing test are mutated again. During this process, seeds whose execution paths cover highly reachable basic blocks, that is, those with high probabilistic reachability scores, are prioritized.

[0068] In a specific application embodiment, the seed power scheduling optimization strategy can be configured as follows: based on the probabilistic reachability score of the seed and the energy allocation method of AFL, the energy power scheduling of the seed is optimized. For example, the power scheduling can be optimized according to the following formula: (12) in, For optimized power scheduling allocated to seeds s energy, is the base energy that AFL assigns to the seed, is the average of the probabilistic reachability scores of all seeds. Based on the optimized seed power scheduling, seeds with higher reachability scores will receive more energy, thereby increasing the chances of the fuzz tester overcoming path constraints and reaching the target. Seeds with lower reachability scores will receive less energy, preventing the fuzz tester from wasting computing resources on exploring unpromising paths.

[0069] In a specific application embodiment, the reachability-guided mutation strategy can be configured as follows: if a basic block m is a target reachable basic block, and m There exists a subsequent basic block that is both reachable and not executed by the fuzzer, then mIt will be identified as a critical basic block; during the seed mutation process, the covered basic blocks are recorded and the critical basic blocks are identified; then, it is checked whether the seed mutation changes the value of the variable in the critical basic block; if the mutation of certain byte positions causes the variable value of the critical basic block to change, the mutated byte position is marked as a coarse-grained critical byte. Then, an intersection operation is performed on these coarse-grained critical byte positions to refine and extract fine-grained critical byte positions. Finally, based on the comparison of the mutation effect with other bytes, the selection probability of the fine-grained critical byte is dynamically adjusted. For example, the selection probability of the fine-grained critical byte can be calculated as follows: (13) in, bytesfp Represents fine-grained key bytes, Npbb ( s ) means in the seed s The number of times the variables in the key basic blocks in Ns Indicates seed s The total number of mutations on .

[0070] To implement the above test method, Figure 2 As shown, this embodiment constructs the following system structure: Static Analysis Component: The core task of the static analysis component is to recover and correct the structural information of binary programs. It consists of three important modules: the indirect edge correction module, the control flow graph construction module, and the region classification module. First, the indirect edge correction module uses heuristic methods to recover missing indirect edges. It combines the prior knowledge of static analysis with runtime fuzz testing data in combination with a Bayesian statistical model to evaluate the confidence of indirect edge recovery (the probability that the indirect edge is correctly recovered). The control flow graph construction module is responsible for generating the initial control flow graph (CFG) and processing the connection relationship between direct edges and indirect edges. The region classification module is used to divide basic blocks into target reachable areas, unreachable areas, and potentially reachable areas based on the influence of indirect edges, and construct a region graph to support subsequent reachability analysis.

[0071] Directed Fuzz Testing Component: The directed fuzz testing component focuses on optimizing dynamic testing and includes three functional modules: an execution information collection module, a probabilistic reachability analysis module, and a fuzz testing optimization module. The execution information collection module uses dynamic binary instrumentation to record the execution frequency of basic blocks and edges. The probabilistic reachability analysis module uses dynamically updated region graph information to calculate the depth within a region and the connectivity between regions, thereby calculating the probabilistic reachability score. The fuzz testing optimization module optimizes the seed selection strategy, energy scheduling, and mutation direction based on the probabilistic reachability score, prioritizing the exploration of high-probability reachable paths and performing targeted testing acceleration on critical indirect edges or basic blocks with high scores.

[0072] In a specific application embodiment, the detailed implementation steps of binary directed gray-box fuzz testing based on the above system structure include: Step 1) The indirect edge correction module uses static analysis technology to restore indirect edges. The region classification module divides basic blocks into target reachable areas, unreachable areas, and potentially reachable areas based on the impact of indirect edges, constructs a region graph, and instrumentes the target program.

[0073] Step 2) Enable the directed fuzz testing component and select a seed from the seed queue for testing; Step 3) The execution information collection module uses dynamic binary instrumentation technology to record the execution frequency of basic blocks and edges, and feeds it back to the indirect edge correction module.

[0074] Step 4) The indirect edge correction module uses a Bayesian statistical model to integrate the prior knowledge of static analysis with the runtime fuzz testing data to calculate the probability that the indirect edge is correctly recovered, so as to dynamically evaluate the confidence level of accurate recovery of the indirect edge.

[0075] Step 5) The probabilistic reachability analysis module calculates the confidence level of the accurately recovered indirect edges based on the dynamically evaluated indirect edges, as well as the newly hit indirect edge information, the dynamically updated region graph information, and calculates the intra-region depth and inter-region connectivity indicators. Based on the intra-region depth and inter-region connectivity indicators, the directed fuzz testing component calculates the probability-based reachability scores of all paths.

[0076] Step 6) The fuzz testing optimization module optimizes seed selection, energy scheduling, and mutation direction based on the probabilistic reachability score. It prioritizes exploring highly probable reachable paths and performs targeted test acceleration on critical indirect edges or basic blocks with high scores. Go to Step 2) and continue testing based on the newly selected seed.

[0077] Step 7) Terminate the program execution by a user's pause operation or a preset running time.

[0078] This embodiment further provides a computer system, including a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to execute the computer program to perform the above method.

[0079] It is understandable that the above method of this embodiment can be executed by a single device, such as a computer or server, etc., and can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of a distributed scenario, one of the multiple devices can only execute one or more steps in the above method of this embodiment, and multiple devices interact to complete the above method. The processor can be implemented in the form of a general-purpose CPU, a microprocessor, an application-specific integrated circuit, or one or more integrated circuits, etc., for executing relevant programs to implement the above method of this embodiment. The memory can be implemented in the form of a read-only memory ROM, a random access memory RAM, a static storage device, and a dynamic storage device. The memory can store an operating system and other application programs. When the above method of this embodiment is implemented by software or firmware, the relevant program code is stored in the memory and called and executed by the processor.

[0080] This embodiment further provides a computer-readable storage medium storing a computer program, which implements the above method when executed by a processor.

[0081] Those skilled in the art will appreciate that the above-mentioned embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including the instruction device, which implements the function specified in the process. Figure 1 a process or multiple processes and / or boxes Figure 1These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0082] The above description is merely a preferred embodiment of the present invention and does not constitute any form of limitation to the present invention. Although the present invention has been disclosed above with reference to the preferred embodiment, it is not intended to limit the present invention. Therefore, any simple modifications, equivalent variations, and modifications to the above embodiment that do not depart from the technical solution of the present invention and are based on the technical essence of the present invention shall fall within the scope of protection of the technical solution of the present invention.

Claims

1. A binary directed grey-box fuzz testing method based on regional probabilistic reachability, characterized in that the steps include: Step S1. Indirect edge recovery: Scan all code segments of the binary file under test and build a CFG. Create dangling nodes in the CFG for valid basic blocks. Recover potentially missing indirect edges for the dangling nodes based on the memory layout characteristics of the binary file. Step S2. Calculate the probability of indirect edge recovery: Obtain a matching similarity score for each indirect edge and use it as the corresponding prior probability. During the fuzz test run, calculate the accuracy probability of each indirect edge based on the execution counts of the source and target basic blocks of each indirect edge and the corresponding prior probability, to represent the probability of each indirect edge being correctly recovered. Step S3. Region division and region graph construction: cluster the basic blocks of the control flow graph into different regions according to the degree to which their reachability is affected by the same set of indirect edges, and construct a region graph from the classified regions; Step S4. Probabilistic reachability analysis: Calculate the intra-region depth and inter-region connectivity in the region graph based on the probability of correctly recovering each indirect edge to evaluate the reachability between regions, and calculate the probabilistic reachability score for each path in the region graph based on the intra-region depth and inter-region connectivity. The intra-region depth is used to measure the difficulty of reaching a specific basic block from an entry basic block in the same region, and the inter-region connectivity is used to measure the difficulty of transitioning from a region to a target reachable region. Step S5. Fuzzy test optimization: Optimize the fuzzy test configuration according to the probabilistic reachability score of each path in the area graph.

2. The binary directed grey-box fuzz testing method based on regional probabilistic reachability according to claim 1 is characterized in that: In step S1, the potentially missing indirect edges for the dangling nodes are restored according to the memory layout characteristics of the binary file, including: if the predecessor code segment of the current dangling node is added as a node in the CFG and is associated with a function, the boundary of the current dangling node is inferred by the disassembler; if the address of the current dangling node falls within the boundary of the target function, an indirect edge is added from the entry block of the target function to the root node of the dangling area as an intra-function indirect edge; if the address of the current dangling node exceeds the function boundary, the current dangling node is regarded as the entry point of a new function, and an indirect edge is added between the current dangling node and the program entry as an inter-function indirect edge.

3. The binary directed grey-box fuzz testing method based on regional probabilistic reachability according to claim 1 is characterized in that: In step S2, the accuracy probability of each indirect edge is calculated by constructing a Bayesian statistical model, and the calculation expression is: in, S and D Respectively represent the execution times of the source and target basic blocks of the current indirect edge, s and d Represents S and D Related specific statistical values, B Indicates that the current indirect edge is correctly restored. P ( B | S = s , D = d ) represents the accuracy probability corresponding to the current indirect edge, which is used to indicate that the source basic block S and the target basic block D are equal s and d The probability of event B occurring when Represents the prior probability corresponding to the current indirect edge; Marginal probability The calculation expression is: in, and Respectively in the event B The source basic block S The number of executions is s and the target basic block D The number of executions is d The conditional probability of is calculated as follows: in, and Respectively expressed in B The average number of executions of S and D when correct, and Respectively expressed in B The average execution times of the source basic block S and the target basic block D when they are incorrect.

4. The binary directed grey-box fuzz testing method based on regional probabilistic reachability according to claim 1 is characterized in that: In step S3, the basic blocks of the control flow graph are classified into target reachable areas, potential target reachable areas and target unreachable areas, where the target reachable area is an area where all basic blocks have paths to the target location and the reachability is not affected by indirect edges, the target unreachable area is an area where no basic block has a path to the target location and the reachability is not affected by indirect edges, and the potential target reachable area is an area where all basic blocks have paths to the target location but the reachability is affected by indirect edges.

5. The binary directed grey-box fuzz testing method based on regional probabilistic reachability according to claim 1 is characterized in that: In the target reachable region, the root node is the entry basic block, the exit node is the target basic block, the target basic block has the maximum depth in the region, and the basic blocks in the target reachable region m Depth within the region The calculation formula is: in, represents the depth of the target basic block, Represents a basic block m Depth; The exit node of the potential reachable area is connected to the source basic block of the current potential reachable area and the target reachable area or other potential reachable areas through an indirect edge. m Depth within the region The calculation formula is: in, represents the exit basic block in each region, Represents the set of all exit basic blocks that m can reach.

6. The binary directed grey-box fuzz testing method based on regional probabilistic reachability according to any one of claims 1 to 5, characterized in that: For any two adjacent regions ri and rj , if present n The indirect edges connected to each other correspond to the connectivity between the regions ci,j The calculation expression is: in, Indicates connection ri and rj No. k The accuracy probability of the indirect edge; represents the probability of error recovery of all indirect edges; Contains basic blocks m Area rm The target reachable region containing the target basic block rt The calculation expression of the probabilistic reachability score between is: in, Indicates from the area rm arrive rt The set of all possible inter-region paths, p express A path in the collection.

7. The binary directed grey-box fuzz testing method based on regional probabilistic reachability according to any one of claims 1 to 5, characterized in that: Calculating the probabilistic reachability score of each path in the region graph according to the depth within the region and the connectivity between regions includes: For basic block m in the target unreachable region, the corresponding probability reachability score is set to 0; For basic blocks in the potentially reachable region m , the depth in the area Rdepth and inter-regional connectivity Rcnct The corresponding probability accessibility score is obtained by weighted calculation, and the weight of regional connectivity is configured to be higher than the weight of depth in the region. The basic blocks in the potential reachable region m The calculation expression of the probability accessibility score is: in, score ( m ) is a basic block m The probabilistic accessibility score of is the cross-region connectivity weight, defined as the total number of edges in the control flow graph CFG Eall and the number of cross-region edges Ei r The ratio of For basic blocks in the reachable region m , the depth in the area Rdepth With basic blocks m The maximum value of regional connectivity maxRcnct The corresponding probability accessibility score is obtained by weighted calculation, and the calculation expression is: According to the reachability score of the basic block, the reachability score calculation formula of each seed is obtained as follows: in, ξ ( s ) indicates a seed s The set of all basic blocks covered in the execution path of ξ ( s )∣ represents a set ξ ( s ) is the number of basic blocks in .

8. The binary directed grey-box fuzz testing method based on regional probabilistic reachability according to any one of claims 1 to 5, characterized in that: In step S5, a triple guidance mechanism is used to optimize the configuration of the fuzz test according to the probabilistic reachability score of each path in the region graph. The triple guidance mechanism includes: a seed priority optimization strategy, a seed power scheduling optimization strategy, and a reachability-guided mutation strategy, wherein the seed priority optimization strategy sets the priority of the seed according to the probabilistic reachability score, and preferentially retains historical seeds pointing to regions with probabilistic reachability scores higher than a preset threshold. The seed power scheduling optimization strategy implements energy suppression on seeds covering regions with probabilistic reachability scores lower than a preset threshold based on a region heat feedback mechanism. In the mutation phase, the reachability-guided mutation strategy constructs a mutation weight matrix according to the probabilistic reachability distribution of basic blocks to configure a directed mutation strategy for key indirect edge jump points and bottleneck region entries, and guides the execution flow to cross region boundaries by inserting specific byte patterns or adjusting the input structure.

9. The binary directed grey-box fuzz testing method based on regional probabilistic reachability according to claim 8, characterized in that: The seed priority optimization strategy is configured as follows: new seeds that can cover new branches and basic blocks with a probabilistic reachability score exceeding a preset threshold are preferentially selected. If the newly generated seeds fail to cover the new branches, all seeds generated by the previous fuzz test are mutated again, and the seeds with the highest probabilistic reachability score are preferentially selected. In the seed power scheduling optimization strategy, power scheduling is optimized according to the following formula: in, For optimized power scheduling allocated to seeds s energy, is the base energy that AFL assigns to the seed, is the average of the probabilistic reachability scores of all seeds; The reachability-guided mutation strategy includes: if the basic block m is a target reachable basic block, and the basic block m There is a subsequent basic block that is both reachable and not executed by the fuzz test. m Identify as a critical basic block; during the seed mutation process, record the covered basic blocks and identify the critical basic blocks, then check whether the seed mutation changes the value of the variable in the critical basic block; if the mutated byte position causes the variable value of the critical basic block to change, mark the mutated byte position as a coarse-grained critical byte; perform an intersection operation on the coarse-grained critical byte position to extract the fine-grained critical byte position; dynamically adjust the selection probability of the fine-grained critical byte according to the number of seed mutations and the number of changes in the critical basic block variables in the seed.

10. A computer system comprising a processor and a memory, wherein the memory is used to store a computer program, wherein: The processor is configured to execute the computer program to perform the method according to any one of claims 1 to 9.

Images