A generative fuzzing method for PDF readers

Abstract

The application relates to the technical field of network security and software testing, and discloses a generative fuzzy testing method for a PDF reader, which has the technical effects of reducing the cost of syntax modeling, improving the coverage of the model, and effectively suppressing the hallucination of a large language model by designing a polymorphic object syntax reduction template and automatically constructing a POG reduction library by combining a retrieval enhancement generation technology; wherein the POG template encodes the complex semantics of the PDF specification into a machine-interpretable structured skeleton by introducing inheritance, polymorphism and dynamic generation instruction fields; the RAG technology combines the specification text, the table and the prior knowledge of the large model to automatically extract accurate object definitions from the ISO standard document; and finally, the POG reduction library with high coverage and high fidelity is constructed by combining the breadth-first iterative extraction and manual checking, thereby fundamentally solving the problems of high cost of traditional manual modeling, poor structural consistency of the deep learning method and hallucination caused by direct generation of the large language model.

Description

Technical Field

[0001] This invention relates to the fields of network security and software testing technology, specifically a generative fuzzing method for PDF readers. Background Technology

[0002] Currently, cyberspace security has become the fifth strategic domain, and cybersecurity vulnerabilities, as one of its fundamental threats, have attracted widespread attention. In actual attack chains, PDF documents, due to their cross-platform nature and wide range of commercial applications, have become the mainstream carrier for delivering malicious payloads. However, PDFs are not simply static displays of text and images, but complex containers that support scripts, 3D models, and multimedia objects. Their risks mainly stem from memory safety and logical flaws in the parsing, object construction, and rendering processes of terminal readers. Fuzzing, as one of the most effective automated vulnerability discovery techniques, still faces severe technical bottlenecks in the two core aspects of sample generation and execution monitoring when targeting highly structured closed-source software like PDF readers.

[0003] In the sample generation stage, existing technologies struggle to generate test cases that both conform to grammatical norms and delve into core logic. Early technologies relied on manually written grammar templates, which, while ensuring a high sample pass rate, became extremely costly, incomplete, and difficult to maintain due to the hundreds of complex object definitions and nesting rules in the ISO 32000 standard. Deep learning-based methods attempted to automatically learn formats from corpora, but limitations in model size and training data made it difficult to capture the high-dimensional nested grammatical logic and cross-object consistency constraints in PDF formats. While recently emerging large language models possess powerful text generation capabilities, they suffer from a serious "illusion" problem when handling rigorous binary format standards, often generating dictionary keys and values ​​not present in the standard, incorrect reference relationships, or data with type mismatches. This results in loosely formatted samples with semantic gaps, making them difficult for parsers to effectively accept. Existing technologies generally lack mechanisms for rigorously constraining and validating generated content, leading to insufficient sample validity and difficulty in penetrating the shallow parsing layer to reach core attack surfaces such as rendering and script engines. In the execution monitoring stage, existing general-purpose fuzzing tools are ill-suited to the closed-source, multi-process architecture of modern commercial PDF readers. To improve stability, mainstream software such as WPS and Adobe Reader generally adopt a design that separates the main process from the rendering subprocess. When the rendering subprocess crashes or deadlocks, the main process often covers up the abnormality by silently restarting. Traditional tools such as WinAFL are mainly designed for single-process or function-level instrumentation, making it difficult to effectively detect the abnormal state of the subprocess. This results in a large number of high-value rendering layer vulnerabilities being missed, which seriously affects the continuity and reliability of testing.

[0004] Therefore, there is an urgent need in this field for an automated fuzzing solution that can automatically construct high-precision, machine-parseable PDF syntax descriptions to constrain the sample generation process, while also enabling reliable anomaly monitoring and management in a closed-source, multi-process Windows environment. Summary of the Invention

[0005] Technical problems to be solved To address the shortcomings of existing technologies, this invention provides a generative fuzzing method for PDF readers. It has the advantages of automatically constructing PDF syntax constraints containing complex inheritance and polymorphic semantics to constrain sample generation, and realizing master-slave process collaborative anomaly monitoring in a closed-source multi-process environment of Windows. It solves the problems in existing technologies, such as sample generation relying on manual modeling and lacking effective constraints leading to insufficient coverage of deep logic, large language model generation being prone to illusions leading to low sample validity, and blind spots in multi-process monitoring leading to the easy omission of rendering layer vulnerabilities.

[0006] (II) Technical Solution To achieve the above objectives, the present invention provides the following technical solution: a generative fuzz testing method for PDF readers, comprising the following steps: Step 1: Design a polymorphic object syntax template: Build a standardized JSON syntax template to describe the complex object structure, inheritance relationships, and polymorphic characteristics of PDF files; Step 2: Construct a polymorphic object syntax library: Automatically extract PDF object definitions based on retrieval enhancement generation technology, and discover all relevant objects through breadth-first search iteration, combined with manual verification to construct a polymorphic object syntax library; Step 3, Sample Generation Engine: Load the generated polymorphic object syntax library, integrate the external input generation mutation strategy configuration, and prepare for dynamic instantiation of test samples; Step 4: Construct the PDF object tree: Construct the PDF object tree based on a non-recursive generation algorithm using a work queue. The task queue-driven approach instantiates objects in a breadth-first manner, starting from the root object. Step 5: Inject semantic-level mutations: Based on the configuration of the policy controller, semantic malformations are dynamically injected in the process of serializing objects according to probability, generating test samples that both conform to the syntax and contain attack vectors. Step 6: Start target multi-process monitoring: Establish a monitoring system that includes an execution driver, a target process monitor, a crash capture module, and an environment reset module. The execution driver calls the target PDF reader to open the test sample. The target process monitor monitors the running status of the main process and all its rendering child processes in real time through the Windows debugging application programming interface and process chain polling technology. Step 7, Anomaly Detection and Crash Capture: Anomalies are detected by debugging events and timeouts. When a crash occurs, the system automatically records the scene information and generates an anomaly report. Step 8: Signature Deduplication and Environment Reset: Generate a unique signature for the captured crash and perform deduplication. When a new vulnerability is detected, save the sample and stack information, then forcibly terminate the entire process tree and clean up residual resources, and enter the next round of testing.

[0007] Preferably, the polymorphic object syntax specification template design in step one is as follows: S1.1 Based on the standard JSON pattern, design the core structure of the POG template. The structure includes object-level meta information, object-oriented feature fields, attribute definition fields, and a list of required fields. S1.2 In the attribute definition, the generation logic of the field is encapsulated by the dynamic generation instruction, and the mutation probability is configured through the fuzz test probability field, thereby explicitly encoding the complex context dependencies and generation constraints in the PDF specification into a machine-interpretable structured specification skeleton.

[0008] Preferably, the polymorphic object syntax library construction process in step two is as follows: S2.1 First, preprocess the ISO standard document, clean up header and footer noise, divide the text paragraphs into text blocks, convert the tables to Markdown format, use the embedding model to generate vectors and store them in the knowledge base to form a dual index of paragraphs and tables; S2.2 Starting with the PDF root object Catalog, initialize the task queue. For each object to be extracted in the queue, use the HyDE retrieval strategy to generate hypothetical documents and send them to the quantization. Retrieve the most relevant paragraph and table information from the knowledge base and integrate the prior summary of the large language model itself to form three-source input. S2.3. Then input the three source contexts into the large language model to generate a JSON format specification fragment that conforms to the POG template; S2.4 Finally, perform a quick manual verification of the generated specification to correct errors or omissions; parse the verified specification to find the sub-objects referenced and add the new sub-objects to the end of the task queue. S2.5. Repeat the extraction, verification, and queuing process from S2.1 to S2.4 until the queue is empty, ultimately forming a POG specification library that contains complete inheritance and polymorphic relationships and covers all PDF objects.

[0009] Preferably, in step three, the sample generation engine reads all object definitions from the polymorphic object syntax library. The policy controller, as the configuration management component of the sample generation engine, loads the user-configured generation and mutation policies from the external input module and injects the policy parameters into the generation engine to provide control basis for subsequent sample construction.

[0010] Preferably, in step four, a PDF object tree is constructed: S3.1 The sample generation engine initializes a task queue and enqueues the root object Catalog as the initial task; S3.2. Process the objects in the queue in a loop, dequeue the current object, generate a basic value that conforms to the syntax for each field according to the field definition and constraints in its POG specification, and record the reference relationship between objects; S3.3 During the processing, when it is found that the current object references a child object, a new ID is assigned to each child object and a subtask is generated and enqueued. S3.4 Repeat steps S3.1-S3.3 until the queue is empty. At this point, the basic skeleton of all objects is complete.

[0011] Preferably, in step five, semantic-level mutations are injected: during the process of serializing the PDF object tree constructed in step four into a binary PDF file, the mutation controller integrated inside the sample generation engine determines whether to trigger a semantic-level mutation operator on the current field based on the configuration parameters issued by the policy controller and a preset probability; when triggered, the mutation controller performs targeted modification on the value or structure of the current field according to the operator type, and writes it into the object stream immediately after the mutation is completed, and finally outputs a complete PDF test sample.

[0012] Preferably, the configuration of the policy controller includes the mutation operator type and its trigger probability, numerical constraint parameters, recursion depth limit, and mutation budget; The semantic-level mutation operators include: integer extreme value replacement, floating-point boundary value, name format exception, string bracket mismatch, Boolean case mutation, dangling reference construction, array structure adjustment, required key deletion, and stream length inconsistency.

[0013] Preferably, in step six, target multi-process monitoring is initiated: S5.1 Establish a monitoring system that includes an execution driver, a target process monitor, a crash capture module, and an environment reset module. The execution driver is responsible for calling the target PDF reader to open the test sample and start the main process. The target process monitor is responsible for capturing process creation and exception events through the Windows debugging API and maintaining the relationship between the main and child processes. The crash capture module is responsible for recording the scene information when an exception occurs. The environment reset module is responsible for cleanup of resources after the test ends, providing a guarantee for continuous testing. S5.2 Execute the driver to start the target reader's main process and immediately enable the child process tracing mechanism. Capture the newly created rendering child process by creating a process debugging event and establish the relationship between the main and child processes. S5.3 The target process monitor continuously collects the running status of the process tree. For child processes that can be captured through debug events, it directly monitors their abnormal events; for child processes that cannot be captured through debug events, it uses a polling mechanism to detect their exit status, thereby achieving comprehensive monitoring of the multi-process architecture.

[0014] Preferably, in step seven, the anomaly detection and crash capture are as follows: the target process monitor captures process exit debugging events, abnormal debugging events, and thread creation debugging events through the Windows debugging API. When a serious anomaly is captured, it is immediately determined to be a crash, triggering the crash capture module to record the instruction address, exception code, register state, and storage path of the trigger sample at the time of the crash, forming an anomaly report. At the same time, if no crash event is detected within a preset time window, it is determined to be a timeout, and the timeout processing branch is entered.

[0015] Preferably, in step eight, signature deduplication and environment reset are performed as follows: S7.1 Establish a crash deduplication unit that includes a crash signature generator and a history database; S7.2 After the crash capture module generates an exception report, the crash signature generator automatically generates a crash signature based on the crash type and call stack characteristics, and compares it with the signature in the history database. S7.3. Based on the comparison results: if the signature does not exist in the history database, it is determined to be a new vulnerability, and the PDF sample that triggered the crash and the corresponding exception report are archived to the output module; if the signature already exists, it is determined to be a known vulnerability, and there is no need to save it again. S7.4 Regardless of the judgment result, the environment reset module is called to forcibly terminate the main process and all child processes of the target program, delete temporary files, release handles and file locks. After the environment reset process, return to step three to continue generating new samples, forming a continuously iterative fuzzy testing closed loop.

[0016] Compared with existing technologies, this invention provides a generative fuzz testing method for PDF readers, which has the following advantages: 1. This invention designs a polymorphic object syntax specification (POG) template and integrates retrieval-enhanced generation (RAG) technology to automatically construct a POG specification library. This achieves significant technical effects such as reducing the cost of grammatical modeling, improving specification coverage, and effectively suppressing the illusion of large language models. Specifically, the POG template encodes the complex semantics of PDF specifications into a machine-interpretable structured skeleton by introducing fields such as inheritance, polymorphism, and dynamic generation instructions. The RAG technology integrates specification text, tables, and prior knowledge of large models to automatically extract precise object definitions from ISO standard documents. Combined with breadth-first iterative extraction and manual verification, a high-coverage and high-fidelity POG specification library is finally constructed, fundamentally solving the problems of high cost of traditional manual modeling, poor structural consistency of deep learning methods, and the tendency of large language models to generate illusions when directly generated.

[0017] 2. This invention achieves a significant improvement in the coverage of deep attack surfaces of PDF readers while ensuring sample parsability through a non-recursive generation algorithm based on a work queue and a semantic-level mutation injection mechanism. The non-recursive queue-based generation algorithm effectively avoids stack overflow risks during the instantiation of deeply nested objects, improving the stability of the generation process. Meanwhile, the mutation controller injects semantic-level mutation operators (such as dangling reference construction, required key deletion, and boundary value replacement) probabilistically during the streaming write process based on policy configuration. This allows test samples to penetrate deep into the core logic paths of the rendering engine and script execution environment after passing shallow syntax validation, greatly improving the probability of reaching and the efficiency of discovering deep vulnerabilities.

[0018] 3. This invention constructs a full-link monitoring system for Windows closed-source multi-process architecture and integrates crash signature deduplication and environment reset mechanisms. This achieves the technical effects of eliminating monitoring blind spots, ensuring test continuity, and improving automation. Specifically, the target process monitor combines debug event capture with process polling to achieve comprehensive monitoring of the main process and all rendering child processes, effectively detecting silent crashes, abnormal exits, and suspensions of child processes, thereby avoiding the vulnerability underreporting caused by traditional single-process monitoring tools. The combination of the crash signature generator and the history database avoids the repeated recording of the same vulnerability. The environment reset module forcibly cleans up the process tree and residual files after each round of testing, thereby eliminating the interference of traditional zombie processes on subsequent tests. Finally, a stable, efficient, and continuously iterative automated fuzzing closed loop is constructed. Attached Figure Description

[0019] Figure 1 This is a diagram illustrating the architecture of the generative fuzzy testing method of this invention. Figure 2 This is a flowchart illustrating the execution of the method of the present invention; Figure 3 This is a basic structural diagram of the PDF file of this invention; Figure 4 This invention provides a structured information extraction process based on RAG. Figure 5 This is a flowchart of the breadth-first iterative discovery process for the full reduction of this invention; Figure 6 This is a detailed flowchart of the generative fuzzy testing method of the present invention; Figure 7 This is a detailed flowchart of the non-recursive generation and mutation process of this invention; Figure 8 This is a flowchart of the target program execution, multi-process monitoring, result discrimination, and environment reset of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Please see Figures 1-8 A generative fuzzing method for PDF readers includes the following steps: Step 1: Design a Polymorphic Object Syntax (POG) Template: Construct a standardized JSON syntax template to accurately describe the complex object structure, inheritance relationships, and polymorphic characteristics of PDF files, providing a unified framework for subsequent automated extraction and generation. The design process of the Polymorphic Object Syntax (POG) template is as follows: S1.1 Based on the standard JSON schema, design the core structure of the POG template. The structure includes object-level meta-information (title, description, type), object-oriented feature fields (extends indicates inheritance, x-subtypes declares polymorphic subtypes), property definition fields (properties), and a list of required fields (required). S1.2 In the attribute definition, a dynamic generation instruction (generator_hint) is introduced to encapsulate the generation logic of the field (such as enumeration value, reference type, polymorphic selection), and the mutation probability is configured through the fuzz-probability field, thereby explicitly encoding the complex context dependencies and generation constraints in the PDF specification into a machine-interpretable structured specification skeleton. The advantages are: by designing polymorphic object syntax rules (POG) templates, the cost of syntax modeling can be greatly reduced and the rule coverage can be improved, laying the foundation for subsequent automated extraction and generation.

[0022] Step 2: Constructing a Polymorphic Object Syntax (POG) Library: Based on retrieval-enhanced generation technology, PDF object definitions are automatically extracted from the ISO 32000-1:2008 standard document. Breadth-first search iteratively discovers all relevant objects, and combined with manual verification, a complete POG specification library is constructed. The specific process is as follows: S1.1 First, preprocess the ISO standard document, clean up header and footer noise, divide the text paragraphs into text blocks, convert the tables to Markdown format, use the embedding model to generate vectors and store them in the knowledge base to form a dual index of paragraphs and tables. S1.2 Starting with the PDF root object Catalog, initialize the task queue. For each object to be extracted in the queue, use the HyDE retrieval strategy to generate hypothetical documents and quantize them. Retrieve the most relevant paragraphs and table information from the knowledge base and integrate the prior summary of the large language model itself to form three-source inputs. S1.3 Then input the three source contexts into the large language model (such as DeepSeek-v3) to generate a JSON format specification fragment that conforms to the POG template; S1.4 Finally, perform a quick manual verification of the generated specification to correct errors or omissions; parse the verified specification to find any referenced sub-objects (such as Catalog referencing Pages), and add the new sub-objects to the end of the task queue; S1.5 Repeat the extraction, verification, and queuing process from S1.1 to S1.4 until the queue is empty, ultimately forming a POG specification library that contains complete inheritance and polymorphic relationships and covers all PDF objects; The advantages are: by using RAG technology to automatically extract POG reductions and build a reduction library, the risk of illusion in large language models is reduced, and the validity of sample structure is ensured; at the same time, the cost of manual modeling is greatly reduced and the coverage of reductions is improved.

[0023] Step 3, Sample Generation Engine: Load the generated Polymorphic Object Syntax (POG) library, integrate the externally input generation and mutation strategy configuration, and prepare for the dynamic instantiation of test samples. Specifically, the sample generation engine reads all object definitions from the Polymorphic Object Syntax (POG) library, the policy controller loads the externally configured generation and mutation strategies (including numerical constraints such as maximum array length, recursion depth, and mutation probabilities such as boundary value injection probability, required key deletion probability, etc.), and injects the policy parameters into the generation engine to provide control basis for subsequent sample construction. The advantage is that the above steps enable the configurability and controllability of the generation process, making it easier to adjust the testing focus in a targeted manner.

[0024] Step 4: Construct the PDF object tree: A non-recursive generation algorithm based on a work queue is used to construct the PDF object tree. This algorithm employs a task queue-driven approach, instantiating objects in a breadth-first manner starting from the root object to avoid stack overflow caused by deep recursion. The PDF object tree construction process is as follows: S3.1 Initialize a task queue for the generation engine in step three, and enqueue the root object Catalog as the initial task; S3.2. Process the objects in the queue in a loop, dequeue the current object, generate a basic value (such as default value, enumeration value or random legal value) for each field according to the field definition and constraints in its POG specification, and record the reference relationship between objects; S3.3 During processing, when it is found that the current object references a child object (such as Catalog referencing Pages), a new ID is assigned to each child object and a subtask is generated and enqueued. S3.4 Repeat steps S3.1-S3.3 until the queue is empty. At this point, the basic skeleton of all objects has been built. The advantages are: the non-recursive queue generation mechanism effectively avoids stack overflow caused by deep recursion, and improves the stability and controllability of the generation process.

[0025] Step 5: Inject Semantic-Level Mutations: Based on the policy controller configuration, semantic malformations are dynamically injected probabilistically during object serialization to generate test samples that conform to grammatical rules and contain attack vectors. The specific content of semantic-level mutation injection includes: during the serialization of the PDF object tree built in Step 4 into a binary PDF file, the mutation controller integrated within the sample generation engine determines whether to trigger a semantic-level mutation operator on the current field based on the configuration parameters issued by the policy controller and a preset probability. When triggered, the mutation controller performs targeted modifications to the value or structure of the current field based on the operator type (e.g., replacing integers with boundary extreme values, deleting required keys from the dictionary, constructing dangling references to undefined objects, etc.). After mutation is completed, the data is immediately written to the object stream, ultimately outputting a complete PDF test sample. Specifically, the configuration of the policy controller in step five includes the mutation operator types and their trigger probabilities, numerical constraint parameters (such as integer extreme value range, floating-point boundary value, maximum array length), recursion depth limit, and mutation budget (the maximum number of mutations allowed per round of testing); semantic-level mutation operators include: integer extreme value replacement (INT_EXTREME), floating-point boundary value (FLOAT_EXTREME), name format exception (NAME_BAD_ESCAPE), string bracket mismatch (STRING_LONG_UNBALANCED), boolean case mutation (BOOL_WEIRD_CASE), dangling reference construction (REF_DANGLING_OR_REUSE), array structure adjustment (ARRAY_TWEAK), required key deletion (DROP_REQUIRED_KEY), and stream length inconsistency (LENGTH_OFF_BY_ONE). These operators collectively cover the key data type and structural constraints in PDF syntax; The advantages are: by injecting semantic-level mutations, deep malformations are injected while maintaining the parsability of the sample, thereby improving the coverage of core attack surfaces such as the rendering engine and the probability of vulnerability access.

[0026] Step Six: Start Target Multi-Process Monitoring: Establish a monitoring system including an execution driver, a target process monitor, a crash capture module, and an environment reset module. The execution driver calls the target PDF reader to open the test sample. The target process monitor monitors the running status of the main process and all its rendering child processes in real time through the Windows debugging application programming interface and process chain polling technology. The target multi-process monitoring startup process is as follows: S5.1 Establish a monitoring system that includes an execution driver, a target process monitor, a crash capture module, and an environment reset module. The execution driver is responsible for calling the target PDF reader to open the test sample and start the main process. The target process monitor is responsible for capturing process creation and exception events through the Windows debugging API and maintaining the relationship between the main and child processes. The crash capture module is responsible for recording the scene information when an exception occurs. The environment reset module is responsible for cleanup of resources after the test ends, providing a guarantee for continuous testing. S5.2 Execute the driver to start the target reader's main process and immediately enable the child process tracing mechanism. Capture the newly created rendering child process by creating a process debugging event and establish the relationship between the main and child processes. S5.3 The target process monitor continuously collects the running status of the process tree. For child processes that can be captured through debug events, it directly monitors their abnormal events; for child processes that cannot be captured through debug events, it uses a polling mechanism to detect their exit status (e.g., a non-zero return code indicates abnormal exit), thereby achieving comprehensive monitoring of the multi-process architecture. The advantages are: by establishing a full-link monitoring system that links the main and child processes, and combining debugging event capture and polling complementary mechanisms, it is possible to effectively detect silent crashes, abnormal exits and suspensions of rendering child processes in the multi-process architecture of Windows closed-source PDF readers, thereby significantly reducing the number of missed reports.

[0027] Step 7, Anomaly Detection and Crash Capture: Anomalies are detected through debug events and timeouts. When a crash occurs, the scene information is recorded and an anomaly report is generated. The anomaly detection and crash capture process is as follows: The target process monitor captures process exit debug events, abnormal debug events, and thread creation debug events through the Windows Debugging API. When a serious anomaly (such as access violation, stack overflow, illegal instruction, heap corruption, etc.) is captured, it is immediately determined to be a crash, triggering the crash capture module to record the instruction address, exception code, register state, and storage path of the trigger sample at the time of the crash, forming an anomaly report. At the same time, if no crash event is detected within a preset time window, it is determined to be a runtime timeout, and the timeout handling branch is entered. The advantages are: by capturing debugging events, determining timeouts, and recording crash scenarios, it can accurately capture various anomalies in a multi-process environment, providing a complete chain of evidence for vulnerability reproduction and analysis.

[0028] Step 8: Signature Deduplication and Environment Reset: A unique signature is generated for each captured crash, and deduplication is performed. If a new vulnerability is detected, the sample and stack information are saved. Then, the entire process tree is forcibly terminated, and residual resources are cleaned up before entering the next test cycle. The specific reset process is as follows: S7.1 Establish a crash deduplication unit that includes a crash signature generator and a history database; wherein the crash signature generator is responsible for mapping the crash type and call stack characteristics in the exception report to a unique hash value, and the history database is used to store historical crash signatures for comparison. S7.2 After the crash capture module generates an exception report, the crash signature generator automatically generates a crash signature based on the crash type and call stack characteristics, and compares it with the signature in the history database. S7.3. Based on the comparison results: if the signature does not exist in the history database, it is determined to be a new vulnerability, and the PDF sample that triggered the crash and the corresponding exception report are archived to the output module; if the signature already exists, it is determined to be a known vulnerability, and there is no need to save it again. S7.4 Regardless of the judgment result, the environment reset module is called to forcibly terminate the main process and all child processes of the target program, delete temporary files, release handles and file locks, and ensure that the test environment is clean for the next round. After the environment reset process, return to step three to continue generating new samples, forming a continuously iterative fuzzy testing closed loop. The advantages are: by comparing the crash signature deduplication mechanism with the historical record database, the same vulnerability is not recorded repeatedly, ensuring the continuity of testing; the forced environment reset eliminates the interference of zombie processes on subsequent tests, improving the stability and automation of the testing system.

[0029] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A generative fuzz testing method for PDF readers, characterized in that, Includes the following steps: Step 1: Design a polymorphic object syntax template: Build a standardized JSON syntax template to describe the complex object structure, inheritance relationships, and polymorphic characteristics of PDF files; Step 2: Construct a polymorphic object syntax library: Automatically extract PDF object definitions based on retrieval enhancement generation technology, and discover all relevant objects through breadth-first search iteration, combined with manual verification to construct a polymorphic object syntax library; Step 3, Sample Generation Engine: Load the generated polymorphic object syntax library, integrate the external input generation mutation strategy configuration, and prepare for dynamic instantiation of test samples; Step 4: Construct the PDF object tree: Construct the PDF object tree based on a non-recursive generation algorithm using a work queue. The task queue-driven approach instantiates objects in a breadth-first manner, starting from the root object. Step 5: Inject semantic-level mutations: Based on the configuration of the policy controller, semantic malformations are dynamically injected in the process of serializing objects according to probability, generating test samples that both conform to the syntax and contain attack vectors. Step 6: Start target multi-process monitoring: Establish a monitoring system that includes an execution driver, a target process monitor, a crash capture module, and an environment reset module. The execution driver calls the target PDF reader to open the test sample. The target process monitor monitors the running status of the main process and all its rendering child processes in real time through the Windows debugging application programming interface and process chain polling technology. Step 7, Anomaly Detection and Crash Capture: Anomalies are detected by debugging events and timeouts. When a crash occurs, the system automatically records the scene information and generates an anomaly report. Step 8: Signature Deduplication and Environment Reset: Generate a unique signature for the captured crash and perform deduplication. When a new vulnerability is detected, save the sample and stack information, then forcibly terminate the entire process tree and clean up residual resources, and enter the next round of testing.

2. The generative fuzz testing method for PDF readers according to claim 1, characterized in that, The design of the polymorphic object syntax convention template in step one: S1.1 Based on the standard JSON pattern, design the core structure of the POG template. The structure includes object-level meta information, object-oriented feature fields, attribute definition fields, and a list of required fields. S1.2 In the attribute definition, the generation logic of the field is encapsulated by the dynamic generation instruction, and the mutation probability is configured through the fuzz test probability field, thereby explicitly encoding the complex context dependencies and generation constraints in the PDF specification into a machine-interpretable structured specification skeleton.

3. The generative fuzz testing method for PDF readers according to claim 1, characterized in that, The process of constructing the polymorphic object syntax library in step two: S2.1 First, preprocess the ISO standard document, clean up header and footer noise, divide the text paragraphs into text blocks, convert the tables to Markdown format, use the embedding model to generate vectors and store them in the knowledge base to form a dual index of paragraphs and tables; S2.2 Starting with the PDF root object Catalog, initialize the task queue. For each object to be extracted in the queue, use the HyDE retrieval strategy to generate hypothetical documents and send them to the quantization. Retrieve the most relevant paragraph and table information from the knowledge base and integrate the prior summary of the large language model itself to form three-source input. S2.

3. Then input the three source contexts into the large language model to generate a JSON format specification fragment that conforms to the POG template; S2.4 Finally, perform a quick manual verification of the generated specification to correct errors or omissions; parse the verified specification to find the sub-objects referenced and add the new sub-objects to the end of the task queue. S2.

5. Repeat the extraction, verification, and queuing process from S2.1 to S2.4 until the queue is empty, ultimately forming a POG specification library that contains complete inheritance and polymorphic relationships and covers all PDF objects.

4. The generative fuzz testing method for PDF readers according to claim 1, characterized in that, In step three, the sample generation engine reads all object definitions from the polymorphic object syntax library. The policy controller, as the configuration management component of the sample generation engine, loads the user-configured generation and mutation policies from the external input module and injects the policy parameters into the generation engine to provide control basis for subsequent sample construction.

5. The generative fuzz testing method for PDF readers according to claim 1, characterized in that, In step four, the PDF object tree is constructed: S3.1 The sample generation engine initializes a task queue and enqueues the root object Catalog as the initial task; S3.

2. Process the objects in the queue in a loop, dequeue the current object, generate a basic value that conforms to the syntax for each field according to the field definition and constraints in its POG specification, and record the reference relationship between objects; S3.3 During the processing, when it is found that the current object references a child object, a new ID is assigned to each child object and a subtask is generated and enqueued. S3.4 Repeat steps S3.1-S3.3 until the queue is empty. At this point, the basic skeleton of all objects is complete.

6. The generative fuzz testing method for PDF readers according to claim 1, characterized in that, In step five, semantic-level mutations are injected: during the process of serializing the PDF object tree constructed in step four into a binary PDF file, the mutation controller integrated inside the sample generation engine determines whether to trigger a semantic-level mutation operator on the current field based on the configuration parameters issued by the policy controller and a preset probability. When triggered, the mutation controller performs targeted modification on the value or structure of the current field according to the operator type. After the mutation is completed, it is immediately written into the object stream, and finally a complete PDF test sample is output.

7. The generative fuzz testing method for PDF readers according to claim 6, characterized in that, The configuration of the policy controller includes the mutation operator type and its trigger probability, numerical constraint parameters, recursion depth limit, and mutation budget; The semantic-level mutation operators include: integer extreme value replacement, floating-point boundary value, name format exception, string bracket mismatch, Boolean case mutation, dangling reference construction, array structure adjustment, required key deletion, and stream length inconsistency.

8. The generative fuzz testing method for PDF readers according to claim 1, characterized in that, In step six, target multi-process monitoring is initiated: S5.1 Establish a monitoring system that includes an execution driver, a target process monitor, a crash capture module, and an environment reset module. The execution driver is responsible for calling the target PDF reader to open the test sample and start the main process. The target process monitor is responsible for capturing process creation and exception events through the Windows debugging API and maintaining the relationship between the main and child processes. The crash capture module is responsible for recording the scene information when an exception occurs. The environment reset module is responsible for cleanup of resources after the test ends, providing a guarantee for continuous testing. S5.2 Execute the driver to start the target reader's main process and immediately enable the child process tracing mechanism. Capture the newly created rendering child process by creating a process debugging event and establish the relationship between the main and child processes. S5.3 The target process monitor continuously collects the running status of the process tree. For child processes that can be captured through debug events, it directly monitors their abnormal events. For child processes that cannot be captured through debug events, a polling mechanism is used to detect their exit status, thereby achieving comprehensive monitoring of the multi-process architecture.

9. The generative fuzz testing method for PDF readers according to claim 1, characterized in that, In step seven, anomaly detection and crash capture: the target process monitor captures process exit debugging events, abnormal debugging events, and thread creation debugging events through the Windows debugging API. When a serious anomaly is captured, it is immediately determined to be a crash, triggering the crash capture module to record the instruction address, exception code, register state, and storage path of the trigger sample at the time of the crash, forming an anomaly report. At the same time, if no crash event is detected within a preset time window, it is determined to be a timeout, and the timeout processing branch is entered.

10. The generative fuzz testing method for PDF readers according to claim 1, characterized in that, In step eight, signature deduplication and environment reset are performed as follows: S7.1 Establish a crash deduplication unit that includes a crash signature generator and a history database; S7.2 After the crash capture module generates an exception report, the crash signature generator automatically generates a crash signature based on the crash type and call stack characteristics, and compares it with the signature in the history database. S7.

3. Based on the comparison results: if the signature does not exist in the history database, it is determined to be a new vulnerability, and the PDF sample that triggered the crash and the corresponding exception report are archived to the output module. If the signature already exists, it is considered a known vulnerability and there is no need to save it again. S7.4 Regardless of the judgment result, the environment reset module is called to forcibly terminate the main process and all child processes of the target program, delete temporary files, release handles and file locks. After the environment reset process, return to step three to continue generating new samples, forming a continuously iterative fuzzy testing closed loop.

Images