Fuzzy test-oriented program snapshot recovery method and device

Abstract

The invention provides a fuzzy test-oriented program snapshot recovery method and device, and belongs to the technical field of fuzzy test. The method comprises the steps that a memory pool is constructed, and a continuous physical memory area is allocated to the memory pool in advance; starting a virtual machine of a to-be-tested target program, and determining snapshot female parent data of the virtual machine under the condition that the to-be-tested target program runs to a target preset position; determining snapshot copy data based on the snapshot female parent data and storing the snapshot copy data in a memory pool; wherein the snapshot copy data is represented as key memory page data in the snapshot female parent data; the test sample is input into a to-be-tested target program, fuzzy testing is carried out on the virtual machine, dirty page information in the testing process is collected, and the dirty page information comprises a modified memory page; and recovering the modified memory page in the dirty page information based on the snapshot copy data.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of fuzz testing, and more particularly, to a program snapshot recovery method and device for fuzz testing. BACKGROUND

[0002] As an efficient software security detection method, fuzz testing triggers abnormal behaviors and potential vulnerabilities of a program by automatically generating and executing a large number of unexpected inputs. Compared with static analysis techniques relying on source code analysis, symbolic execution methods with large computational overhead, and unit testing requiring manual construction of test cases, fuzz testing has the ability to semi-automatically test binary programs or black-box systems, reducing labor costs while maintaining high vulnerability discovery efficiency, and has been widely applied to high-security scenarios such as operating system kernels, virtualization platforms, and network protocol stacks.

[0003] However, as the complexity of the target program increases, its initialization process often involves complex environment configuration and state loading, which is time-consuming. If the target program is started from the initial state every time the test case is executed, a large amount of time will be consumed in repeated initialization, which will seriously affect the overall execution efficiency of the fuzz testing.

[0004] To alleviate this problem, researchers have proposed snapshot-based fuzz testing techniques. This method creates a system snapshot when the target program executes to a stable state (such as completing initialization), and resumes execution from this snapshot in subsequent test iterations, thereby avoiding the overhead of repeated startup. Although this strategy effectively shortens the single test period, its performance is still limited by the design limitations of existing snapshot mechanisms.

[0005] Current mainstream snapshot techniques are mostly based on general virtualization platforms and designed for system-level backup and recovery scenarios, without optimization for the high-frequency and low-latency recovery requirements of fuzz testing. Specifically, existing solutions usually save the complete memory image and device context of the virtual machine in full, resulting in a large amount of snapshot data. During the recovery process, a large amount of memory data needs to be reloaded, introducing significant latency. At the same time, frequent full read-write operations exacerbate the I / O bottleneck, making it difficult to meet the requirements of millisecond-level fast recovery. In addition, although some improved solutions attempt to reduce redundant data storage, they still lack effective mechanisms in terms of memory organization structure, recovery path optimization, and dirty page management, failing to fully release the hardware performance potential. SUMMARY

[0006] Therefore, the present disclosure provides a program snapshot recovery method and device for fuzz testing, which can at least partially solve the above technical problems.

[0007] One aspect of the present disclosure provides a program snapshot recovery method for fuzz testing, comprising: constructing a memory pool, the memory pool being pre-allocated a block of continuous physical memory area; starting a virtual machine of a target program to be tested, determining snapshot parent data of the virtual machine in a case where the target program to be tested runs to a target preset position; determining snapshot copy data based on the snapshot parent data and storing the snapshot copy data into the memory pool; wherein the snapshot copy data represents key memory page data in the snapshot parent data; inputting a test case into the target program to be tested, performing fuzz testing on the virtual machine, collecting dirty page information in the testing process, the dirty page information including modified memory pages; and restoring the modified memory pages in the dirty page information based on the snapshot copy data.

[0008] According to an embodiment of the present disclosure, the dirty page information further includes physical addresses of the modified memory pages; and the restoring the modified memory pages in the dirty page information based on the snapshot copy data comprises: performing continuity physical address analysis on the dirty page information, merging the continuous dirty pages to generate corresponding merged pages in a case where a continuity number of the continuous dirty pages is greater than a preset threshold; and performing parallel restoration on the dirty pages and the merged pages whose continuity numbers of the continuous dirty pages are less than the preset threshold based on the snapshot copy data.

[0009] According to an embodiment of the present disclosure, the memory pool is a two-dimensional array structure; and the performing parallel restoration on the dirty pages and the merged pages whose continuity numbers of the continuous dirty pages are less than the preset threshold based on the snapshot copy data comprises: taking high-bit fields in the physical addresses of the dirty pages whose continuity numbers of the continuous dirty pages are less than the preset threshold as row indexes and middle fields as column indexes; taking high-bit fields in the physical addresses of the merged pages as row indexes and middle fields as column indexes; respectively determining corresponding byte offsets according to the row indexes and the column indexes corresponding to the dirty pages and the merged pages whose continuity numbers of the continuous dirty pages are less than the preset threshold; determining corresponding memory pages in the snapshot copy data of the dirty pages and the merged pages whose continuity numbers of the continuous dirty pages are less than the preset threshold according to base addresses of the two-dimensional array structure of the memory pool and the corresponding byte offsets; and performing parallel restoration on the dirty pages and the merged pages based on the corresponding memory pages in the snapshot copy data.

[0010] According to an embodiment of the present disclosure, the starting the virtual machine of the target program to be tested and determining the snapshot parent data of the virtual machine in a case where the target program to be tested runs to a target preset position comprises: starting the virtual machine of the target program to be tested, pausing the virtual machine and collecting state data of the virtual machine in a case where the target program to be tested runs to the target preset position; and constructing the snapshot parent data according to the state data of the virtual machine.

[0011] According to an embodiment of the present disclosure, the state data includes memory image data and register state data of the virtual machine.

[0012] According to an embodiment of the present disclosure, before the modified memory pages in the dirty page information are recovered based on the snapshot copy data, the modified memory pages in the dirty page information are classified by priority; and the modified memory pages are recovered in sequence based on the priority classification.

[0013] According to an embodiment of the present disclosure, before the modified memory pages in the dirty page information are recovered based on the snapshot copy data, the method further comprises: performing memory page boundary detection on the continuity dirty pages whose continuity quantity is greater than a preset threshold, so that the boundary of the merged page after fusion is the same as the single page boundary in the continuity dirty pages.

[0014] According to an embodiment of the present disclosure, the method further comprises: in the case that the continuity quantity of the continuity dirty pages is greater than the preset threshold and the types of the continuity dirty pages are the same, performing merging processing on the continuity dirty pages to generate corresponding merged pages.

[0015] According to an embodiment of the present disclosure, the method further comprises: after the dirty page information is recovered, performing bit cleaning and forward incremental data updating on the dirty page information.

[0016] Another aspect of the present disclosure provides a program snapshot recovery device for fuzz testing, comprising: a construction module configured to construct a memory pool, the memory pool being a pre-allocated contiguous physical memory region; a running module configured to start a virtual machine of a target program to be tested, and determine snapshot parent data of the virtual machine in the case that the target program to be tested runs to a target preset position; a generation module configured to determine snapshot copy data based on the snapshot parent data and store the snapshot copy data in the memory pool; wherein the snapshot copy data represents key memory page data in the snapshot parent data; a collection module configured to input a test case into the target program to be tested, perform fuzz testing on the virtual machine, and collect dirty page information in the test process, the dirty page information comprising modified memory pages; and a recovery module configured to recover the modified memory pages in the dirty page information based on the snapshot copy data.

[0017] The program snapshot recovery method for fuzz testing according to an embodiment of the present disclosure has at least the following beneficial effects:

[0018] By pre-constructing a contiguous physical memory region as a memory pool and extracting key memory page data in the snapshot parent data as snapshot copy data stored in the memory pool, special memory management for high-frequency snapshot recovery operations is achieved. The memory pool uses a static pre-allocation mechanism, avoiding the memory fragmentation problem caused by runtime dynamic allocation, effectively alleviating the memory fragmentation phenomenon caused by high-speed execution of test cases and repeated state recovery in the high-frequency fuzz testing process, and effectively improving the locality of data access and cache hit rate. BRIEF DESCRIPTION OF DRAWINGS

[0019] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description when taken in conjunction with the accompanying drawings, in which:

[0020] Figure 1 A flowchart of a program snapshot recovery method for fuzz testing according to an embodiment of the present disclosure is schematically shown.

[0021] Figure 2 A relationship diagram between the number of operations per second and the minimum trigger threshold according to an embodiment of the present disclosure is schematically shown.

[0022] Figure 3 A relationship diagram between the number of operations per second and different methods according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0023] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood, however, that the description which follows is merely illustrative and is not intended to limit the scope of the present disclosure. In the following detailed description of embodiments of the present disclosure, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. However, it will be apparent to one skilled in the art that one or more embodiments of the present disclosure can be practiced without these specific details. In other instances, well-known structures and functions have not been described in detail in order to avoid obscuring aspects of the present disclosure.

[0024] The terms used herein are merely used to describe specific embodiments and are not intended to limit the present disclosure. The terms "include" and "have" and the like used herein indicate the presence of the features, steps, operations and / or components, but do not exclude the presence or addition of one or more other features, steps, operations or components.

[0025] All terms used herein, including technical and scientific terms, have the same meanings as those generally understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the present description, and should not be interpreted in an idealized or overly formal manner.

[0026] In the case of using expressions similar to "at least one of A, B, and C, etc.", it is generally interpreted to include at least one of the items enumerated after the term, such as "a system having at least one of A, B, and C" should be interpreted to include a system having at least one of A, a system having at least one of B, a system having at least one of C, a system having at least one of A and B, a system having at least one of A and C, a system having at least one of B and C, and / or a system having at least one of A, B, and C, etc.

[0027] Figure 1 A flowchart of a program snapshot recovery method for fuzz testing according to an embodiment of the present disclosure is schematically shown.

[0028] As Figure 1 shown, the program snapshot recovery method for fuzz testing of this embodiment includes operation S110 to operation S150.

[0029] In operation S110, a memory pool is constructed, which is a block of continuous physical memory region pre-allocated.

[0030] In operation S120, a virtual machine of a target program to be tested is started, and in the case where the target program to be tested runs to a target preset position, snapshot parent data of the virtual machine is determined.

[0031] In operation S130, snapshot copy data is determined based on the snapshot parent data and stored in the memory pool; wherein the snapshot copy data represents key memory page data in the snapshot parent data.

[0032] In operation S140, a test case is input into the target program to be tested, the virtual machine is subjected to fuzz testing, and dirty page information in the testing process is collected, the dirty page information including modified memory pages.

[0033] In operation S150, the modified memory pages in the dirty page information are recovered based on the snapshot copy data.

[0034] In an embodiment of the present disclosure, a block of continuous physical memory region is pre-allocated in the host memory as a dedicated memory pool. The memory pool is allocated in the system initialization stage by using a static pre-allocation manner, avoiding the memory fragmentation problem caused by dynamic application at runtime. At the same time, since its physical address is continuous, it has good cache locality and TLB hit rate, and is suitable for high-frequency and low-latency data access scenarios, providing high-performance memory basis for subsequent storage and rapid recovery of snapshot copies.

[0035] The target program to be tested is deployed in a virtual machine running on a Quick Emulator (QEMU for short) virtualization platform, and the virtual machine is equipped with a specially designed Linux kernel to support more fine-grained state monitoring and performance optimization. After starting the virtual machine, the target program to be tested is run until it reaches a preset stable execution position—usually a key state point before the program completes initialization and enters the main logic loop. At this time, the virtual machine is paused, and the complete system state is collected through the snapshot interface of QEMU / KVM, including the guest physical memory image, CPU register context and device state information, to form snapshot parent data.

[0036] Among them, the specially made Linux kernel has enhanced tracking ability of dirty pages, optimizes the KVM (Kernel-based Virtual Machine) dirty page log collection process, improves the real-time performance and accuracy of dirty page information acquisition, and reduces the monitoring overhead. Secondly, the support extension of the hardware-assisted execution tracking technology is integrated, which can realize instruction-level execution path capture with low performance loss, and provide high-precision coverage feedback for fuzz testing. In addition, the bitmap maintenance mechanism for recording the execution coverage state is migrated from the traditional user-mode proxy transfer mode to kernel space direct management, reducing the data copy and context switch overhead between user mode and kernel mode, and significantly improving the state synchronization efficiency.

[0037] After obtaining the snapshot parent data, memory pages that play a key role in program execution state are extracted therefrom to constitute snapshot copy data. These key memory pages usually include page table pages, kernel stacks, code segments, data segments, interrupt descriptor tables, global descriptor tables, and other core structures that directly affect program behavior. The data of these key pages is copied to the aforementioned constructed memory pool to realize the structured organization and centralized management of snapshot data. In this way, the high I / O overhead of loading the complete snapshot from the disk each time is avoided, and the continuity and predictable layout of the memory pool are utilized to lay the foundation for subsequent high-speed recovery.

[0038] After the virtual machine is restored to run, the generated test cases are input into the target program to be tested, and the fuzz testing process is started. During the test execution, the hardware-assisted virtualization mechanism provided by KVM (Kernel-based Virtual Machine, referred to as KVM) is used to monitor the modification behavior of the guest memory in real time. KVM automatically records the physical memory page addresses that are written by maintaining a dirty page log mechanism to form a dirty page information table.

[0039] After the current test case execution is completed, according to the entries in the dirty page information table, in combination with the snapshot copy data in the memory pool, all modified key memory pages are located and restored. This recovery process only performs incremental write-back on the actual changed pages, avoiding full memory reloading, and significantly shortening the state reset time.

[0040] According to the embodiments of the present disclosure, the method effectively solves the problems of memory fragmentation, I / O bottleneck, and recovery delay caused by high-frequency recovery, and significantly improves the iteration speed and overall throughput of fuzz testing.

[0041] On the basis of the above-mentioned embodiments, the dirty page information further comprises a physical address of the modified memory page; and the modified memory page in the dirty page information is recovered based on the snapshot copy data, comprising: performing continuity physical address analysis on the dirty page information, and in a case where a continuity quantity of the continuity dirty page is greater than a preset threshold, performing merging processing on the continuity dirty page to generate a corresponding merged page; and performing parallel recovery on the dirty page and the merged page whose continuity quantity of the continuity dirty page is less than the preset threshold based on the snapshot copy data.

[0042] In the embodiments of the present disclosure, the dirty page information not only contains the modified memory page identifier, but also records the specific physical address of each modified memory page. This detailed record provides a solid foundation for subsequent efficient recovery. After each test case execution ends, the system first performs continuity physical address analysis on the dirty page information to identify whether there is a continuous dirty page area. Specifically, the system checks whether these dirty pages form a continuous block in the physical address space. When the number of continuity dirty pages exceeds a preset threshold (for example, the number of continuous dirty pages is greater than 16), the system merges these continuous dirty pages into a “merged page”. The merging processing improves the recovery efficiency and reduces the interaction overhead between CPU and memory by reducing the number and complexity of recovery operations. For a small amount of scattered dirty pages that do not reach the merging threshold and the merged pages after merging processing, the system uses a parallel recovery mechanism to improve the overall recovery speed.

[0043] According to the embodiments of the present disclosure, by analyzing the physical address distribution in the dirty page information, the system can identify the continuous dirty page block arranged in the memory space. When the number of continuous dirty pages exceeds the preset threshold, it is merged into a “merged page”, thereby integrating multiple independent single-page recovery operations into a batch recovery operation, significantly reducing the number of memory write calls in the recovery process and the context switching overhead caused thereby.

[0044] In the traditional method, each dirty page is recovered one by one, and when facing a large number of dirty pages generated by a complex program, frequent fine-grained memory access will seriously restrict the recovery efficiency. In contrast, the present scheme realizes the centralized write-back of large blocks of continuous memory through the merging processing of continuous dirty pages, effectively improves the memory bandwidth utilization, and fully plays the performance advantages of modern processors in the continuous data access mode, greatly shortens the state reset time.

[0045] Further, for each merged page, only one memory copy (memcpy) is required to complete the overall data write-back, significantly reducing the number of system calls, function overhead and context switching costs, and effectively avoiding the performance bottleneck caused by a large number of fine-grained memory accesses in the traditional page-by-page recovery mode. On this basis, to further improve the overall recovery efficiency, the system uses a parallel recovery method based on the Advanced Vector Extensions (AVX) instruction set to efficiently and concurrently process all the memory pages to be recovered, including the merged pages and the discrete dirty pages that do not meet the merging conditions

[0046] On the basis of the above embodiment, the memory pool is a two-dimensional array structure; the dirty pages with a continuity number less than a preset threshold and the merged pages of the continuous dirty pages are recovered in parallel based on snapshot copy data, including: taking the high bit field in the physical address of the dirty pages with a continuity number less than a preset threshold of the continuous dirty pages as a row index, and taking the middle bit field as a column index; taking the high bit field in the physical address of the merged pages as a row index, and taking the middle bit field as a column index; respectively determining the corresponding byte offset according to the row index and the column index corresponding to the dirty pages with a continuity number less than a preset threshold of the continuous dirty pages and the merged pages; determining the corresponding memory pages of the dirty pages with a continuity number less than a preset threshold of the continuous dirty pages and the merged pages in the snapshot copy data respectively according to the base address of the two-dimensional array structure of the memory pool and the corresponding byte offset; and recovering the dirty pages with a continuity number less than a preset threshold of the continuous dirty pages and the merged pages in parallel based on the corresponding memory pages in the snapshot copy data.

[0047] In an embodiment of the present disclosure, the memory pool is organized in a two-dimensional array structure, where each row and each column corresponds to a group of key memory pages in the virtual machine physical address space. After the collection of dirty page information and the analysis of continuous physical addresses are completed, the system uniformly recovers the discrete dirty pages with a continuity number less than a preset threshold and the "merged pages" generated by merging in parallel. To efficiently locate the corresponding snapshot copy of these dirty pages in the memory pool, the present scheme utilizes the spatial coding characteristics of the virtual machine physical address: taking the high bit field in the physical address of the dirty page or the merged page as a row index, and taking the middle bit field as a column index, thereby realizing direct mapping of the two-dimensional structure of the memory pool. According to this indexing rule, the system can quickly calculate the linear offset of each page to be recovered in the memory pool, and combined with the base address of the two-dimensional array of the memory pool, the starting address of the corresponding snapshot copy can be directly located. This addressing method does not require hash table lookup or complex data structure traversal, and only through bit shifting, masking and arithmetic operations, the address decoding can be completed in constant time, realizing the ultimate positioning performance.

[0048] On the basis of the above embodiment, the virtual machine of the to-be-tested target program is started, and in the case that the to-be-tested target program runs to a target preset position, snapshot parent data of the virtual machine is determined, comprising: starting the virtual machine of the to-be-tested target program, and in the case that the to-be-tested target program runs to a target preset position, pausing the virtual machine and collecting state data of the virtual machine; and constructing snapshot parent data according to the state data of the virtual machine.

[0049] Further, the state data comprises memory image data and register state data of the virtual machine.

[0050] In the embodiments of the present disclosure, after starting the virtual machine carrying the to-be-tested target program, the system controls its running until the program executes to a preset critical stable position, usually the stage of completing initialization and preparing to enter the main logic processing. At this moment, the system actively pauses the virtual machine, and collects its complete runtime state data, and then constructs snapshot parent data based on the data, as a benchmark template for high-frequency state recovery in subsequent fuzz testing.

[0051] The collected state data comprises two core components: one is memory image data of the virtual machine, that is, a complete copy of the physical memory of the guest machine, covering code segments, data segments, stacks, page tables and various kernel key structures, ensuring the integrity of the program context; the other is register state data, including general-purpose registers, control registers, instruction pointers, flag registers, segment descriptor tables and related registers of the CPU, used for accurately restoring the execution site of the processor. The snapshot parent constructed based on the above data completely retains all necessary state information of the program at this execution point, ensuring that subsequent recovery can continue execution from the completely consistent initial conditions, realizing a highly reproducible test environment. This mechanism effectively avoids the time-consuming system startup, dependency loading and environment initialization process repeated for each test case execution, significantly shortens the single test period, and improves the overall test throughput.

[0052] On the basis of the above embodiment, before the modified memory page in the dirty page information is recovered based on the snapshot copy data, comprising: classifying the modified memory page in the dirty page information by priority; and recovering the modified memory page in sequence based on the priority classification.

[0053] In the embodiments of the present disclosure, before the modified memory pages in the dirty page information are recovered based on the snapshot copy data, a dirty page priority classification mechanism is further introduced, that is, according to the criticality and dependency of each memory page in the system running, the modified memory pages are divided into different priority categories, for example, page table pages, kernel stack pages and regular data pages and the like. Among them, the page table page is used for address mapping and is the premise of memory access; the kernel stack page depends on the correct page table to be correctly parsed; and the recovery of the regular data page is based on the former two. Therefore, the recovery order must strictly follow the principle of "high priority first".

[0054] On this basis, the system sequentially performs the recovery operation in the order from high to low priority, ensuring that the key structure is completed before its dependent is rebuilt. This mechanism effectively avoids problems such as address translation failure, stack pointer disorder or data semantic error caused by the recovery of low-priority pages before high-priority pages, and significantly improves the consistency and executability of the virtual machine state after recovery.

[0055] According to the embodiments of the present disclosure, before the modified memory pages in the dirty page information are recovered based on the snapshot copy data, further comprising: performing memory page boundary detection on the continuous dirty pages with a continuity number greater than a preset threshold, so that the boundary of the merged page after fusion is the same as the single page boundary in the continuous dirty pages.

[0056] In the embodiments of the present disclosure, in order to prevent data reading or writing errors across page boundaries during merging and parallel recovery, strict memory page boundary detection is performed on each memory region to be merged before dirty page merging processing, to ensure that any merging operation does not cross the boundary of two independent memory pages. Specifically, by judging whether the access start address and length cross the alignment boundary, if there is a cross-page situation, merging is prohibited or the region is split into multiple independent pages for separate processing, to avoid data pollution of adjacent pages due to out-of-bound access.

[0057] According to the embodiments of the present disclosure, further comprising: in the case that the continuity number of the continuous dirty pages is greater than the preset threshold and the types of the continuous dirty pages are the same, the continuous dirty pages are merged to generate corresponding merged pages.

[0058] In the embodiments of the present disclosure, in the recovery execution phase, a type isolation constraint is further applied: memory pages of different types (such as page table and stack pages) are not allowed to be merged or recovered in parallel even if the physical addresses are continuous. The system marks the attribute category of each page, and performs type consistency checking when scheduling to eliminate the potential risks caused by mixed recovery of different types of pages.

[0059] According to the embodiments of the present disclosure, further comprising: after the dirty page information is recovered, performing bit cleaning and forward incremental data updating on the dirty page information.

[0060] In an embodiment of the present disclosure, after each round of snapshot recovery is completed, the present disclosure adopts atomic-level operations to clean the dirty page table and update the forward incremental log data, ensuring the atomicity of each snapshot recovery and state resetting process, effectively avoiding mutual pollution problems caused by state residues or log disorder between multiple rounds of test iterations.

[0061] Specifically, the atomic-level cleaning operation can instantly clear the memory page markers modified by the current test case in the dirty page table, restoring the dirty page table to a "blank" state and preparing for the next round of testing; at the same time, the atomic-level forward incremental log data update will solidify or reset the memory changes recorded during this test process, ensuring the accuracy and independence of the incremental log. Through this atomicity guarantee, the system can maintain a clear state boundary in the high-frequency snapshot recovery scenario, preventing state information from the previous test from leaking into the subsequent test, thereby ensuring the accuracy and reproducibility of the fuzz testing results.

[0062] Figure 2 A schematic diagram of the relationship between the number of executions per second and the minimum triggering threshold according to an embodiment of the present disclosure is shown schematically.

[0063] In some possible embodiments, to verify the effectiveness of the technical solutions of the present disclosure, high-speed fuzz testing is performed on a commonly used binary library libxml, and the performance under different dirty page fusion minimum thresholds is systematically evaluated to determine the optimal configuration parameters, and a comparative analysis is performed with the benchmark method.

[0064] The specific test scheme is as follows: the nyx mode of the open-source fuzz testing framework AFL++ is selected as the test platform, the open-source binary program libxml is selected as the target to be tested, and the xml data set in the mozilla-fuzzdata project is selected as the initial seed set. The minimum threshold for triggering dirty page fusion is set to 8, 16, 24, 32, 40, 48, 56, and 64 consecutive dirty pages, respectively, and the number of executions per second (exec / sec) during the fuzz testing process is monitored as a performance indicator. The test performance under each threshold configuration is data collected and the average value is calculated. The experimental results show that when the dirty page fusion threshold is set to 16, the system performance is optimal, and the specific test data is shown in Figure 2 The verification results confirm the effectiveness of the technical solutions of the present disclosure in balancing recovery efficiency and system overhead, providing an important reference for parameter configuration in actual application scenarios.

[0065] Figure 3 A schematic diagram of the relationship between the number of executions per second and different methods according to an embodiment of the present disclosure is shown schematically.

[0066] As Figure 3As shown, using the optimal dirty page fusion trigger threshold 16, the number of runs per second of the method of the embodiment of the present disclosure is 8589.67 exec / sec, which is an increase of 326.27 exec / sec compared with the benchmark FDL mode and an increase of 293.67 exec / sec compared with the benchmark Dirty Ring mode, using the same framework and data set.

[0067] In some possible embodiments, to verify the effectiveness of the snapshot dirty page fast priority classification technology and the memory-safe snapshot data arrangement mechanism, the embodiment performs high-speed fuzz testing on a commonly used binary library libxml, and compares and analyzes the system stability difference between the case of using the above memory-safe technology and the case of not using the safe technology.

[0068] The specific verification scheme is as follows: on the basis of the optimal dirty page fusion threshold 16 determined in the above embodiment, the system running stability under the configuration of enabling the safe technology and the configuration of disabling the safe technology is tested respectively. The initial seed set without variation is used as the test input, and theoretically these seeds will not trigger program crashes or abnormal behaviors. By counting the proportion of the number of initial seeds that cause system abnormalities in the total number of seeds, the system stability is measured as an index. To ensure the reliability of the results, 5 independent tests are performed for each configuration, and the average crash rate is calculated. The test results are shown in Table 1.

[0069] Table 1

[0070]

[0071] As shown in Table 1, by comparing the difference in the number of system crashes with and without the safe technology, it is verified that the safe mechanism of the present disclosure has a significant effect on ensuring the memory consistency and system stability during the snapshot recovery process.

[0072] Another aspect of the present disclosure provides a device for program snapshot recovery for fuzz testing, comprising:

[0073] The construction module is configured to construct a memory pool, and the memory pool is a pre-allocated continuous physical memory area.

[0074] The running module is configured to start a virtual machine of a target program to be tested, and determine the snapshot parent data of the virtual machine when the target program to be tested runs to a target preset position.

[0075] The generating module is configured to determine snapshot copy data based on the snapshot parent data and store the snapshot copy data into the memory pool, wherein the snapshot copy data represents key memory page data in the snapshot parent data.

[0076] The collecting module is configured to input a test sample into a target program to be tested, perform a fuzz test on a virtual machine, and collect dirty page information in a test process, wherein the dirty page information includes modified memory pages.

[0077] The restoring module is configured to restore the modified memory pages in the dirty page information based on the snapshot copy data. The principle of the device is the same as that of the method described above, and thus will not be described here.

[0078] Further, the restoring module is further configured to perform continuity physical address analysis on the dirty page information, merge the continuity dirty pages to generate corresponding merged pages when the continuity number of the continuity dirty pages is greater than a preset threshold, and perform parallel restoration on the dirty pages and the merged pages whose continuity number is less than the preset threshold based on the snapshot copy data. The restoring module is further configured to perform parallel restoration on the dirty pages and the merged pages whose continuity number is less than the preset threshold based on the snapshot copy data, including: taking a high bit field in a physical address of the dirty pages whose continuity number is less than the preset threshold as a row index and taking a middle bit field as a column index; taking a high bit field in a physical address of the merged pages as a row index and taking a middle bit field as a column index; determining corresponding byte offsets according to the row indexes and the column indexes of the dirty pages and the merged pages, respectively; determining corresponding memory pages of the dirty pages and the merged pages in the snapshot copy data according to a base address of a two-dimensional array structure of the memory pool and the corresponding byte offsets; and performing parallel restoration on the dirty pages and the merged pages based on the corresponding memory pages in the snapshot copy data.

[0079] The running module is further configured to start a virtual machine of the target program to be tested, pause the virtual machine and collect state data of the virtual machine when the target program to be tested runs to a target preset position, and construct the snapshot parent data according to the state data of the virtual machine.

[0080] Further, the device further includes:

[0081] The first processing module is configured to perform priority classification on the modified memory pages in the dirty page information, and perform restoration on the modified memory pages in sequence based on the priority classification.

[0082] The second processing module is configured to perform memory page boundary detection on the continuity dirty pages whose continuity number is greater than the preset threshold, so that a boundary of the fused merged page is the same as a single page boundary in the continuity dirty pages.

[0083] The third processing module is configured to, in a case where the continuity quantity of the continuity dirty page is greater than the preset threshold and the types of the continuity dirty pages are the same, perform merging processing on the continuity dirty pages to generate corresponding merged pages.

[0084] The fourth processing module is configured to, after the dirty page information is recovered, perform bit cleaning and forward incremental data updating on the dirty page information.

[0085] The above describes the embodiments of the present disclosure. However, these embodiments are only for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although each embodiment is described above separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art can make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A program snapshot recovery method for fuzz testing, characterized by, The method comprises the following steps: constructing a memory pool, the memory pool being pre-allocated a continuous physical memory region; starting a virtual machine of a to-be-tested target program, and determining snapshot parent data of the virtual machine in a case where the to-be-tested target program runs to a target preset position; determining snapshot copy data based on the snapshot parent data and storing the snapshot copy data into the memory pool; wherein the snapshot copy data represents key memory page data in the snapshot parent data; inputting a test sample into the to-be-tested target program, performing a fuzz test on the virtual machine, and collecting dirty page information in a test process, the dirty page information including modified memory pages; restoring the modified memory pages in the dirty page information based on the snapshot copy data.

2. The method of claim 1, wherein, The dirty page information further includes physical addresses of the modified memory pages. The restoring the modified memory pages in the dirty page information based on the snapshot copy data comprises the following steps: performing continuity physical address analysis on the dirty page information, merging the continuous dirty pages to generate corresponding merged pages in a case where a continuity number of the continuous dirty pages is greater than a preset threshold; performing parallel restoration on the dirty pages whose continuity number is less than the preset threshold and the merged pages based on the snapshot copy data.

3. The method of claim 2, wherein, The memory pool is a two-dimensional array structure. The performing parallel restoration on the dirty pages whose continuity number is less than the preset threshold and the merged pages based on the snapshot copy data comprises the following steps: taking a high bit field in a physical address of the dirty pages whose continuity number is less than the preset threshold as a row index and taking a middle bit field as a column index; taking a high bit field in a physical address of the merged pages as a row index and taking a middle bit field as a column index; determining corresponding byte offsets according to the row index and the column index corresponding to the dirty pages whose continuity number is less than the preset threshold and the merged pages respectively; determining corresponding memory pages of the dirty pages whose continuity number is less than the preset threshold and the merged pages in the snapshot copy data according to a base address of the two-dimensional array structure of the memory pool and the corresponding byte offsets; performing parallel restoration on the dirty pages whose continuity number is less than the preset threshold and the merged pages based on the corresponding memory pages in the snapshot copy data.

4. The method of claim 1, wherein, The starting a virtual machine of a to-be-tested target program and determining snapshot parent data of the virtual machine in a case where the to-be-tested target program runs to a target preset position comprises the following steps: starting a virtual machine of a to-be-tested target program, pausing the virtual machine and collecting state data of the virtual machine in a case where the to-be-tested target program runs to a target preset position; constructing snapshot parent data according to the state data of the virtual machine.

5. The method of claim 4, wherein, The state data includes memory image data and register state data of the virtual machine.

6. The method of claim 2, wherein, Before the restoring the modified memory pages in the dirty page information based on the snapshot copy data, the method further comprises the following steps: performing priority classification on the modified memory pages in the dirty page information; recover the modified memory pages in the dirty page information in the order based on the priority classification.

7. The method of claim 6, wherein, Before the recovering of the modified memory pages in the dirty page information based on the snapshot copy data, the method further comprises: performing memory page boundary detection on the continuity dirty pages with a continuity number greater than a preset threshold, so that the boundary of the merged page after fusion is the same as the single page boundary in the continuity dirty pages.

8. The method of claim 6, wherein, The method further comprises: in the case that the continuity number of the continuity dirty pages is greater than the preset threshold and the types of the continuity dirty pages are the same, performing merging processing on the continuity dirty pages to generate corresponding merged pages.

9. The method of claim 1, wherein, The method further comprises: after the recovering of the dirty page information, performing bit cleaning and forward incremental data updating on the dirty page information.

10. An apparatus for program snapshot recovery oriented to fuzz testing, characterized in that, The method comprises: a construction module configured to construct a memory pool, the memory pool being a pre-allocated contiguous physical memory region; a running module configured to start a virtual machine of a target program to be tested, and determine snapshot parent data of the virtual machine in the case that the target program to be tested runs to a target preset position; a generation module configured to determine snapshot copy data based on the snapshot parent data and store the snapshot copy data into the memory pool; wherein the snapshot copy data represents key memory page data in the snapshot parent data; a collection module configured to input a test sample into the target program to be tested, perform fuzz testing on the virtual machine, and collect dirty page information in a testing process, the dirty page information including modified memory pages; and a recovery module configured to recover the modified memory pages in the dirty page information based on the snapshot copy data.

Images