An Intel-PT and Syzkaller-based gray-box fuzzing method and system

Abstract

The application provides a kind of grey box fuzzing test method and system based on Intel-PT and Syzkaller, method includes: first fuzzing test engine starts test cycle, constantly test and synchronize test progress to manager;Manager sends the new use case found by second fuzzing test engine to first fuzzing test engine in response to the poll request of first fuzzing test engine, the effective queue of first fuzzing test engine is updated, start to generate new use case and test;First fuzzing test engine sends new use case to executor, executor prepares to execute test;Executor identifies kernel address range before executing test, collects static storage area of new use case, applies to start PT tracking function by super call;Intercept control register setting request, obtain the value of control register, and assign the value of control register to the parameter of super call, the value of control register is the page table base address of tracking system;Process super call to set the kernel address range of tracking, set page table base address, start PT tracking;Executor starts to parse and execute input use case, real-time call registered parsing function to complete parsing, fill in static storage area;After the execution of multiple rounds of system call of executor, updated coverage information is synchronized to first fuzzing test engine.The grey box fuzzing test method and system based on Intel-PT and Syzkaller provided by the application can be used for closed source version linux system binary grey box fuzzing test, to form effective feedback information closed loop.

Description

TECHNICAL FIELD

[0001] The embodiment of the application relates to the technical field of network information security, in particular to a gray-box fuzzing test method and system based on Intel-PT and Syzkaller. BACKGROUND

[0002] Multiple test processes share the same resources, such as memory, files, network ports, etc., which will cause resource competition and conflict. The garbage collection mechanism of Java will bring problems such as memory leakage and inconsistent memory state when multiple processes share memory, and the shared memory space will cause the memory problem of one process to affect other processes.

[0003] As an important means to help find system defects and vulnerabilities, fuzzing is widely used in system security evaluation due to its low false positive characteristics.

[0004] Therefore, it is necessary to provide a gray-box fuzzing test method and system based on Intel-PT and Syzkaller to solve the above problems. SUMMARY

[0005] The application provides a gray-box fuzzing test method and system based on Intel-PT and Syzkaller, which can be used for closed-source version linux system binary gray-box fuzzing test, and forms an effective feedback information closed loop.

[0006] The embodiment of the application provides a gray-box fuzzing test method based on Intel-PT and Syzkaller, which comprises the following steps:

[0007] The first fuzzing test engine starts a test cycle, continuously tests and synchronizes the test progress to the manager;

[0008] The manager sends a new use case found by the second fuzzing test engine to the first fuzzing test engine in response to the poll request of the first fuzzing test engine, the effective queue of the first fuzzing test engine is updated, and the first fuzzing test engine starts to generate a new use case and test;

[0009] The first fuzzing test engine sends the new use case to the executor, and the executor prepares to execute the test;

[0010] The executor identifies the kernel address range before executing the test, collects the static storage area of the new use case, and applies for starting the PT tracking function through a super call;

[0011] The request for setting the control register is intercepted, the value of the control register is obtained, and the value of the control register is assigned to the parameter of the super call, and the value of the control register is the page table base address of the tracking system;

[0012] The processor sets a tracking range of a kernel address of the super call, sets the page table base address, and starts PT tracking;

[0013] The executor starts to parse and execute the input use case, calls a registration parsing function in real time to complete the parsing, and fills the static storage area.

[0014] After the execution of multiple rounds of system calls by the executor, the updated coverage information is synchronized to the first fuzz testing engine.

[0015] Preferably, the method further comprises: the executor performing format conversion on the data in the static storage area and submitting the data to shared memory for communication with the first fuzz testing engine.

[0016] Preferably, the information submitted to the shared memory for communication with the first fuzz testing engine further comprises a system call number, flag information of the system call, and a return value of the system call.

[0017] Preferably, the real-time call registration parsing function to complete the parsing comprises creating and obtaining a decoding function pointer through libxdc_init, registering a callback function through libxdc_register_bb_callback, and completing real-time decoding of PT tracking information of each basic block instruction.

[0018] Preferably, the coverage information is in a format of starting with a machine bit-width integer and followed by a PC sequence, and is converted into a coverage information storage format of the shared memory.

[0019] Preferably, the coverage information storage format of the shared memory is in a format of edge followed by point, the edge count is an edge hash value sequence, and the PC point count is a PC value sequence, and the conversion is performed through the following formula:

[0020] H_sig | = (pc & 0xFFF) ^ (hash(prev_pc & 0xFFF) & 0xFFF);

[0021] The conversion of the edge hash value sequence is performed by calculating the hash of each edge, ignoring repeated edges, writing the edges to the shared memory, and accumulating the count, and finally updating the edge count at the beginning, and the conversion of the PC value sequence is performed by directly copying the PC value and updating the initial count value.

[0022] Preferably, the manager is arranged outside a virtual machine, and the executor is arranged inside the virtual machine.

[0023] Preferably, the control register is a CR3 register.

[0024] Preferably, a SYZ_OP_INPUT structure is created and a cover_addr pointer is initialized to the shared memory.

[0025] The embodiment of the application further provides a grey-box fuzz testing system based on Intel-PT and Syzkaller, which comprises:

[0026] A test loop starting module starts a test loop through a first fuzz testing engine, continuously tests and synchronizes test progress to a manager;

[0027] An effective queue updating module sends a new use case found by a second fuzz testing engine to the first fuzz testing engine in response to a poll request of the first fuzz testing engine through the manager, so that the effective queue of the first fuzz testing engine is updated to start generating a new use case and testing;

[0028] A new use case sending module sends the new use case to an executor through the first fuzz testing engine, so that the executor is prepared to execute the test;

[0029] A PT tracking function starting module identifies a kernel address range through the executor before executing the test, collects a static storage area of the new use case, and starts a PT tracking function through a super call application;

[0030] A control register value obtaining module obtains a value of a control register through interception of a control register setting request, and assigns the value of the control register to a parameter of the super call, wherein the value of the control register is a page table base address of a tracking system;

[0031] A kernel address range setting module sets a tracked kernel address range through processing of the super call, sets the page table base address, and starts PT tracking;

[0032] An input use case parsing and executing module starts parsing and executing an input use case through the executor, and calls a registered parsing function in real time to complete the parsing and fill in the static storage area;

[0033] An updated coverage information synchronizing module synchronizes updated coverage information to the first fuzz testing engine through execution of multiple rounds of system calls of the executor.

[0034] Compared with the prior art, the technical scheme of the embodiment of the application has the following beneficial effects:

[0035] The method comprises: a first fuzzing test engine starts a test cycle, continuously tests and synchronizes test progress to a manager; the manager sends a new use case found by a second fuzzing test engine to the first fuzzing test engine in response to a poll request of the first fuzzing test engine, an effective queue of the first fuzzing test engine is updated, and the first fuzzing test engine starts to generate a new use case and test; the first fuzzing test engine sends the new use case to an executor, and the executor prepares to execute the test; the executor identifies a kernel address range before executing the test, collects a static storage area of the new use case, and applies for starting a PT tracking function through a super call; a control register setting request is intercepted, a value of the control register is obtained, and the value of the control register is assigned to a parameter of the super call, and the value of the control register is a page table base address of a tracking system; the super call processes the kernel address range of the tracking, sets the page table base address, and starts the PT tracking; the executor starts to analyze and execute the input use case, and registers an analysis function to complete the analysis in real time, and fills in the static storage area; after the executor executes multiple rounds of system calls, updated coverage information is synchronized to the first fuzzing test engine, and the first fuzzing test engine can be used for closed-source version linux system binary gray-box fuzzing test, and an effective feedback information closed loop is formed. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, not all embodiments. Those skilled in the art can obtain other drawings according to these drawings without any creative effort.

[0037] Figure 1 A flowchart of a gray-box fuzzing test method based on Intel-PT and Syzkaller is provided for an embodiment of the present application.

[0038] Figure 2 A structure diagram of a gray-box fuzzing test system based on Intel-PT and Syzkaller is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0039] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0040] The technical solutions of the present application will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and some embodiments can not be described again for the same or similar concepts or processes.

[0041] Based on the problems in the prior art, the embodiments of the present application provide an Intel-PT and Syzkaller-based gray-box fuzz testing method and system, which can be used for closed-source version linux system binary gray-box fuzz testing to form an effective feedback information closed loop.

[0042] Figure 1 The flowchart of the Intel-PT and Syzkaller-based gray-box fuzz testing method provided by an embodiment of the present application is shown in FIG. 1. Referring to FIG. 1, Figure 1 , an Intel-PT and Syzkaller-based gray-box fuzz testing method is provided, which comprises the following steps.

[0043] Step S101: A first fuzz testing engine starts a test cycle, continuously tests and synchronizes the test progress to a manager;

[0044] Step S102: The manager sends a new use case found by a second fuzz testing engine to the first fuzz testing engine in response to a poll request of the first fuzz testing engine, and an effective queue of the first fuzz testing engine is updated to start generating a new use case and testing;

[0045] Step S103: The first fuzz testing engine sends the new use case to an executor, and the executor prepares to execute the test;

[0046] Step S104: The executor identifies a kernel address range before executing the test, collects a static storage area of the new use case, and applies for starting a PT tracking function through a super call;

[0047] Step S105: A control register setting request is intercepted, a value of the control register is obtained, and the value of the control register is assigned to a parameter of the super call, and the value of the control register is a page table base address of a tracking system;

[0048] Step S106: processing the kernel address range of the super call setting tracking, setting the page table base address, and starting PT tracking;

[0049] Step S107: the executor starts to parse and execute the input use case, calls the registered parsing function to complete the parsing in real time, and fills in the static storage area;

[0050] Step S108: through the execution of multiple rounds of system calls of the executor, the updated coverage information is synchronized to the first fuzz testing engine.

[0051] In a specific implementation, the method further includes: the executor performing format conversion on the data in the static storage area and submitting the data to shared memory for communication with the first fuzz testing engine.

[0052] In a specific implementation, the information submitted to the shared memory for communication with the first fuzz testing engine further includes a system call number of execution, flag information of the system call, and a return value of the system call.

[0053] In a specific implementation, the real-time calling of the registered parsing function to complete the parsing includes creating and obtaining a decoding function pointer through libxdc_init, registering a callback function through libxdc_register_bb_callback, and completing real-time decoding of PT tracking information of each basic block instruction.

[0054] In a specific implementation, the coverage information is in a format of a machine bit width integer at the beginning and followed by a PC sequence, and the coverage information is converted into a coverage information storage format of shared memory.

[0055] In a specific implementation, the coverage information storage format of the shared memory is a format of an edge followed by a point, an edge count is an edge hash value sequence, and a PC point count is a PC value sequence, and the conversion is performed through the following formula:

[0056] H_sig | = (pc & 0xFFF) ^ (hash(prev_pc & 0xFFF) & 0xFFF);

[0057] The conversion of the edge hash value sequence is performed by calculating a hash of each edge, ignoring repeated edges, writing the edges to shared memory, and accumulating a count, and finally updating the edge count at the beginning, and the conversion of the PC value sequence is performed by directly copying the PC value and updating an initial count value.

[0058] In a specific implementation, the manager is arranged outside a virtual machine, and the executor is arranged inside the virtual machine.

[0059] Specifically, the manager generates a use case outside the virtual machine, which is then passed to an executor running inside the virtual machine. The executor parses the program fragment described in the use case, prepares relevant data parameters, executes a system call, and interfaces a data stream according to a variable transmission relationship.

[0060] In a specific implementation, the control register is a CR3 register.

[0061] Specifically, the executor initializes the CR3 register for setting tracking, a filtering range, and turns on the PT tracking function before execution, and turns off the PT tracking function after execution.

[0062] In a specific implementation, a SYZ_OP_INPUT structure is created, and a cover_addr pointer is initialized to the shared memory.

[0063] Figure 2 A structural schematic diagram of a gray-box fuzz testing system based on Intel-PT and Syzkaller provided for an embodiment of the present application is shown in FIG. 1. Figure 2 The embodiment of the present application also provides a gray-box fuzz testing system based on Intel-PT and Syzkaller, which comprises:

[0064] A test loop starting module 21 starts a test loop through a first fuzz testing engine, continuously tests, and synchronizes test progress to a manager;

[0065] An effective queue updating module 22 sends a new use case found by a second fuzz testing engine to the first fuzz testing engine in response to a poll request of the first fuzz testing engine through the manager, so that the effective queue of the first fuzz testing engine is updated, and the first fuzz testing engine starts to generate a new use case and test;

[0066] A new use case sending module 23 sends the new use case to an executor through the first fuzz testing engine, so that the executor is ready to perform a test;

[0067] A PT tracking function starting module 24 identifies a kernel address range through the executor before performing a test, collects a static storage area of the new use case, and starts a PT tracking function through a hypercall application;

[0068] A control register value obtaining module 25 obtains a value of a control register by intercepting a control register setting request, and assigns the value of the control register to a parameter of the hypercall, the value of the control register being a page table base address of a tracking system;

[0069] A kernel address range setting module 26 sets a kernel address range for tracking by processing the hypercall, sets the page table base address, and starts PT tracking.

[0070] The input case analysis and execution module 27 starts to analyze and execute the input case through the executor, calls the registered analysis function in real time to complete the analysis, and fills in the static storage area;

[0071] The updated coverage information synchronization module 28 synchronizes the updated coverage information to the first fuzz testing engine through the execution of multiple rounds of system calls of the executor.

[0072] In summary, the gray-box fuzz testing method and system based on Intel-PT and Syzkaller according to the embodiments of the present application, the method comprises: a first fuzz testing engine starts a test cycle, continuously tests and synchronizes the test progress to a manager; the manager sends a new case found by a second fuzz testing engine to the first fuzz testing engine in response to a poll request of the first fuzz testing engine, the effective queue of the first fuzz testing engine is updated, and a new case is generated and tested; the first fuzz testing engine sends the new case to an executor, and the executor prepares to execute the test; the executor identifies a kernel address range before executing the test, collects a static storage area of the new case, and applies for starting a PT tracking function through a super call; a control register setting request is intercepted, the value of the control register is obtained, and the value of the control register is assigned to the parameter of the super call, and the value of the control register is the page table base address of the tracking system; the super call sets the tracking kernel address range, sets the page table base address, and starts the PT tracking; the executor starts to analyze and execute the input case, calls the registered analysis function in real time to complete the analysis, and fills in the static storage area; the updated coverage information is synchronized to the first fuzz testing engine through the execution of multiple rounds of system calls of the executor, which can be used for gray-box fuzz testing of a closed-source version linux system binary, and an effective feedback information closed loop is formed.

[0073] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A gray-box fuzzy testing method based on Intel-PT and Syzkaller, characterized in that, The method includes: The first fuzz test engine starts a test loop, continuously tests, and synchronizes the test progress with the manager; The manager responds to the poll request of the first fuzzing engine and sends the new test cases discovered by the second fuzzing engine to the first fuzzing engine. The valid queue of the first fuzzing engine is updated, and it begins to generate new test cases and test them. The first fuzz test engine sends the new test case to the executor, which then prepares to execute the test. Before executing the test, the executor identifies the kernel address range, collects the static storage area of ​​the new test case, and requests to enable the PT tracing function through a hypercall. Intercept the control register setting request, obtain the value of the control register, and assign the value of the control register to the parameter of the super call. The value of the control register is the base address of the page table of the tracing system. The process involves setting the kernel address range to be traced for the hypercall, setting the page table base address, and enabling PT tracing. The executor begins parsing and executing the input test cases, calling the registered parsing function in real time to complete the parsing and filling the static storage area; After multiple rounds of system calls by the executor, the updated coverage information is synchronized to the first fuzz test engine.

2. The gray-box fuzzy testing method based on Intel-PT and Syzkaller according to claim 1, characterized in that, The method further includes: the executor converting the data in the static storage area into a format and submitting it to a shared memory for communicating with the first fuzz test engine.

3. The gray-box fuzzy testing method based on Intel-PT and Syzkaller according to claim 2, characterized in that, The information submitted to the shared memory used for communicating with the first fuzz test engine also includes the executed system call number, the system call flag information, and the system call return value.

4. The gray-box fuzzy testing method based on Intel-PT and Syzkaller according to claim 1, characterized in that, The real-time call to the registered parsing function to complete the parsing includes creating and obtaining a decoding function pointer through libxdc_init, registering a callback function through libxdc_register_bb_callback, and completing the real-time decoding of PT tracing information for each basic block instruction.

5. The gray-box fuzzy testing method based on Intel-PT and Syzkaller according to claim 1, characterized in that, The overlay information is in the format of starting with a machine bit-width integer followed by a PC sequence, and is converted into a shared memory overlay information storage format.

6. The gray-box fuzzy testing method based on Intel-PT and Syzkaller according to claim 5, characterized in that, The shared memory overlay information is stored in an edge-first, then node-later format. The edge count is a sequence of edge hash values, and the PC point count is a sequence of PC values. The conversion is performed using the following formula: H_sig |= (pc & 0xFFF) ^ (hash(prev_pc & 0xFFF) & 0xFFF); The transformation of the edge hash value sequence is achieved by calculating the hash of each edge, ignoring duplicate edges, writing the edges to shared memory, and accumulating the count. The final update is the count of the first edge. The transformation of the PC value sequence is achieved by directly copying the PC value and updating the initial count value.

7. The gray-box fuzzy testing method based on Intel-PT and Syzkaller according to claim 1, characterized in that, The manager is located outside the virtual machine, and the executor is located inside the virtual machine.

8. The gray-box fuzzy testing method based on Intel-PT and Syzkaller according to claim 1, characterized in that, The control register is the CR3 register.

9. The gray-box fuzzy testing method based on Intel-PT and Syzkaller according to claim 2, characterized in that, This is achieved by creating a SYZ_OP_INPUT structure and initializing the cover_addr pointer to the shared memory.

10. A gray-box fuzzy testing system based on Intel-PT and Syzkaller, characterized in that, The system includes: The test loop initiation module starts the test loop through the first fuzz test engine, continuously tests, and synchronizes the test progress with the manager. The effective queue update module responds to the poll request of the first fuzzing engine through the manager and sends the new test cases discovered by the second fuzzing engine to the first fuzzing engine. The effective queue of the first fuzzing engine is updated, and new test cases are generated and tested. A new test case sending module sends the new test cases to the executor through the first fuzz testing engine, and the executor prepares to execute the test; The PT tracing function enabling module identifies the kernel address range before executing the test through the executor, collects the static storage area of ​​the new test case, and requests to enable the PT tracing function through a hypercall. The control register value acquisition module intercepts control register setting requests, acquires the value of the control register, and assigns the value of the control register to the parameters of the super call. The value of the control register is the base address of the page table of the tracing system. The kernel address range setting module sets the kernel address range to be traced by processing the super call, sets the page table base address, and enables PT tracing; The input test case parsing and execution module starts parsing and executing the input test cases through the executor, and calls the registered parsing function in real time to complete the parsing and fill the static storage area; The updated coverage information synchronization module, through multiple rounds of system calls by the executor, synchronizes the updated coverage information to the first fuzz test engine.

Images