A multi-process black-box coverage acquisition and error monitoring method and system

Abstract

This invention proposes a method and system for multi-process black-box coverage acquisition and error monitoring. By introducing daemon processes and exec system call interception techniques, it overcomes the shortcomings of existing technologies in multi-process environments, achieving coverage acquisition and error monitoring for all processes, thereby significantly improving the applicability and efficiency of black-box fuzzing in multi-process architectures.

Description

Technical Field

[0001] This invention belongs to the field of software testing technology, specifically relating to a method and system for obtaining multi-process black-box coverage and monitoring errors. Background Technology

[0002] With the development of database technology, multi-process architecture has become the mainstream design pattern for database management systems (DBMS). For example, PostgreSQL adopts a multi-process architecture, where the master process is responsible for scheduling and management, while worker child processes handle the actual business requests. This architecture performs well in improving system concurrency and stability, but it also presents new challenges to testing techniques.

[0003] Black-box fuzzing, as an automated testing method that does not rely on the internal structure of the target program, discovers vulnerabilities by inputting unexpected data into the system and monitoring abnormal reactions. However, traditional black-box fuzzing techniques have significant limitations in multi-process environments. For example, when using the QEMU simulator for coverage instrumentation, coverage can typically only be obtained for the main process, not the execution logic of worker child processes. Furthermore, traditional error monitoring methods can only detect crashes in the main process and cannot effectively identify anomalies in child processes.

[0004] In database systems, the main process is typically only responsible for scheduling, while the actual business logic is handled by worker child processes. Because the main process monitors for crashes in child processes and automatically restarts them, this further limits the effectiveness of black-box testing in multi-process environments.

[0005] Therefore, for database systems with multi-process architectures, existing black-box fuzzing techniques have significant shortcomings in terms of coverage acquisition and error monitoring. There is an urgent need for a technical solution that can comprehensively cover the execution logic of multi-process code and accurately monitor subprocess anomalies. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method and system for obtaining coverage and monitoring errors in multi-process black-box fuzzing. By introducing daemon processes and exec system call interception technology, the invention solves the deficiencies of the prior art in multi-process environments, realizes coverage acquisition and error monitoring for all processes, and thus significantly improves the applicability and efficiency of black-box fuzzing in multi-process architectures.

[0007] To achieve the above objectives, the present invention provides the following technical solution: According to a first aspect of the present invention, a method for obtaining multi-process black-box coverage and monitoring errors is proposed, comprising the following steps: After the device starts testing, the QEMU emulator is initialized and the main process is loaded; The main process creates multiple worker subprocesses, each of which is used to handle business requests; Start the daemon process and establish communication between the daemon process and all child processes. The daemon process is used to monitor and manage all child processes. During QEMU simulation execution, the exec system call is intercepted by modifying the process loader parameters; When any Worker child process executes a new binary program via the exec system call, the interception ensures that the newly executed child process continues to run in the QEMU emulation environment and continues to collect coverage data. When the Worker subprocesses process business requests, the daemon process monitors the error signals of all subprocesses in real time. If any child process crashes, the daemon process captures the crash signal and determines whether the crashed program is a monitoring target. If so, the daemon process sends a kill signal to all child processes to terminate all processes, and reports an error to the upper-level fuzzing framework to complete the error handling process.

[0008] In one possible embodiment, the step of intercepting the exec system call by modifying the process loader parameters specifically includes: In the QEMU simulator, the system call dispatch module is extended, and an exec system call hook function is registered in the system call processing flow. When an exec system call is detected during the simulation execution, the hook function is triggered to obtain the target program path and its execution parameters, and the original exec call is rewritten into a call form that executes the target program through the QEMU simulator.

[0009] In one possible embodiment, the daemon process establishes communication with all child processes in any one or more of the following ways: Pipe-based communication; Communication methods based on Unix domain sockets; Communication methods based on shared memory; Message queue-based communication method. In one possible embodiment, the daemon process monitors error signals of all child processes in real time, including capturing crash-related signals such as SIGSEGV, SIGABRT, SIGILL, and SIGFPE.

[0010] In one possible embodiment, the step of determining whether a crashed program is a monitoring target includes: Obtain the process identifier of the crashed child process and its corresponding program path information, and match the program path or process identifier with a pre-configured list of monitoring targets.

[0011] According to a second aspect of the present invention, a multi-process black-box coverage acquisition and error monitoring system is provided for implementing the above-described multi-process black-box coverage acquisition and error monitoring method, comprising: The QEMU simulator module is used to simulate the execution of the target program and load the main process during initialization; The main process module is used to create multiple worker child processes; Multiple Worker subprocess modules are used to execute business requests and can execute new binary programs via the exec system call; The system call interception module, located inside the QEMU emulator, is used to modify the process loader parameters to intercept the exec system call, ensuring that the new process still runs in the QEMU environment; The daemon process module communicates with the main process module, the worker child process module, and the system call interception module, respectively, to monitor the running status and error signals of all child processes, and to perform coordinated termination and error reporting when a child process crash is detected.

[0012] According to a third aspect of the invention, a computer-readable storage medium is provided on which a computer program is stored, which, when executed by a processor, implements the method described above.

[0013] According to a fourth aspect of the present invention, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described above.

[0014] Compared with the prior art, the technical solution provided by the present invention has the following beneficial effects: This invention achieves significant technological breakthroughs in coverage acquisition, error detection, and performance optimization through a multi-process monitoring architecture and a precise anomaly control mechanism.

[0015] Regarding the improvement of multi-process coverage acquisition capabilities, the technology of dynamic injection of daemon processes and interception of exec system calls breaks through the process derivation isolation limitations of traditional black-box testing. Under the multi-process architecture, the code coverage of worker child processes is significantly improved, the execution path of the core transaction processing module is fully captured, cross-process transaction state correlation analysis is realized, and the accuracy of the correspondence between fuzzy test cases and code paths is greatly improved.

[0016] In terms of performance efficiency and compatibility, lightweight interception technology and adaptive instrumentation strategies overcome the performance deficiencies of industry solutions. Regarding enhanced industry application value, this technology has proven its breakthrough value in multiple fields. In database fuzzing, it discovered multiple high-risk zero-day vulnerabilities in a short time, significantly shortening the average vulnerability discovery cycle. Multi-process monitoring can be achieved without source code, significantly reducing the cost of black-box testing and effectively improving system security. Attached Figure Description

[0017] The accompanying drawings are incorporated in and form part of this specification, and together with the description serve to explain the principles of the invention.

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of a multi-process black-box coverage acquisition and error monitoring method according to the present invention; Figure 2 This is a schematic diagram of a multi-process black-box coverage acquisition and error monitoring system according to the present invention. Detailed Implementation

[0020] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples consistent with some aspects of the invention as detailed in the appended claims.

[0021] To enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0022] Example 1 See Figure 1 A method for obtaining multi-process black-box coverage and monitoring errors includes the following steps: After the device starts testing, the QEMU simulator is initialized and the main process is loaded. For example, for a PostgreSQL database, the main process is responsible for scheduling each worker child process to execute SQL requests.

[0023] The main process then creates multiple worker processes, each of which is responsible for handling specific business requests. For example, a PostgreSQL database will create multiple worker processes to execute SQL statements or other transaction operations submitted by the main process.

[0024] Meanwhile, the daemon process starts and establishes communication with all child processes, responsible for monitoring and managing these child processes. For example, the daemon process starts when the QEMU emulator is initialized and creates a shared memory. The daemon process is responsible for monitoring this memory in real time, and the multiple worker child processes created subsequently write their internal process states to the shared memory. The daemon process can also register signal handlers to capture child process crash signals. SIGCHLD is triggered when a child process exits / crashes, while SIGSEGV and SIGABRT are triggered when a process crashes. In the signal handlers, the daemon process obtains the child process's PID and exit status to determine whether it is a monitoring target.

[0025] During QEMU simulation execution, the `exec` system call is intercepted by modifying the process loader parameters. When a worker child process executes a new binary program via the `exec` system call, it ensures that the child process is still running in the QEMU simulation environment, thereby achieving coverage of the child process.

[0026] While worker child processes handle business requests, the daemon process monitors error signals from all child processes in real time. If any child process crashes, the daemon process captures the crash signal and determines whether the crashing process is a monitoring target. If so, the daemon process sends a kill signal to all child processes, terminating all processes, and reports the error to the upper-level fuzzing framework, completing the error handling process.

[0027] Example 2 like Figure 2 As shown, a multi-process black-box coverage acquisition and error monitoring system is used to implement the above-mentioned multi-process black-box coverage acquisition and error monitoring method, including: The QEMU simulator module is used to simulate the execution of a target program and load the main process during initialization. For example, it is based on the open-source AFL-QEMU and modified to extend the system call dispatch module. The system call hook function is registered in the system call processing flow. When the exec system call is detected during the simulation execution, the hook function is triggered to obtain the target program path and its execution parameters, and the original exec call is rewritten into a call form that executes the target program through the QEMU simulator. The main process module is used to create multiple worker child processes; Multiple worker subprocess modules are used to execute business requests and can execute new binary programs via the exec system call. This module depends on the database under test, such as PostgreSQL or Oracle database, etc. The system call interception module, located inside the QEMU emulator, is used to modify the process loader parameters to intercept the exec system call, ensuring that the new process still runs in the QEMU environment; The daemon process module communicates with the main process module, the worker child process module, and the system call interception module, respectively, to monitor the running status and error signals of all child processes, and to perform coordinated termination and error reporting when a child process crash is detected.

[0028] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention.

[0029] It should be understood that the present invention is not limited to the content already described above, and various modifications and changes can be made without departing from its scope. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for multi-process black-box coverage acquisition and error monitoring, characterized in that, Includes the following steps: After the device starts testing, the QEMU simulator is initialized and the main process is loaded. The main process creates multiple worker child processes, each of which is used to handle business requests. A daemon process is started, and communication is established between the daemon process and all child processes. The daemon process is used to monitor and manage all child processes. During the QEMU simulation execution, the exec system call is intercepted by modifying the process loader parameters. When any Worker subprocess executes a new binary program via the exec system call, the interception ensures that the newly executed subprocess continues to run in the QEMU simulation environment and continuously collects coverage data. When the Worker subprocess processes business requests, the daemon process monitors error signals of all subprocesses in real time. If any subprocess crashes, the daemon process captures the crash signal and determines whether the crashed program is the monitoring target. If so, the daemon process sends a kill signal to all subprocesses, terminates all processes, and reports the error to the upper-layer fuzzing framework, completing the error handling process.

2. The method for obtaining multi-process black-box coverage and monitoring errors according to claim 1, characterized in that, The steps for intercepting the exec system call by modifying the process loader parameters specifically include: setting a system call hook function in the QEMU emulator; when the target process initiates an exec system call, the hook function obtains the path of the new binary program and forcibly rebinds the execution environment of the new process to the same QEMU emulator instance.

3. The method for obtaining multi-process black-box coverage and monitoring errors according to claim 1, characterized in that, The daemon process establishes communication with all child processes through inter-process communication channels or shared memory mechanisms.

4. The method for obtaining multi-process black-box coverage and monitoring errors according to claim 1, characterized in that, The daemon process monitors error signals of all child processes in real time, including capturing SIGSEGV, SIGABRT, SIGILL, and SIGFPE signals.

5. The method for obtaining multi-process black-box coverage and monitoring errors according to claim 1, characterized in that, Its features are, The step of determining whether a crashed program is a monitoring target includes: obtaining the PID of the crashed process and comparing it with the list of all worker child processes and their PIDs recorded in the daemon process.

6. A multi-process black-box coverage acquisition and error monitoring system, used to implement the multi-process black-box coverage acquisition and error monitoring method according to any one of claims 1-5, comprising: The QEMU simulator module is used to simulate the execution of the target program and load the main process during initialization; The main process module is used to create multiple worker child processes; Multiple Worker subprocess modules are used to execute business requests and can execute new binary programs via the exec system call; The system call interception module, located inside the QEMU emulator, is used to modify the process loader parameters to intercept the exec system call, ensuring that the new process still runs in the QEMU environment; The daemon process module communicates with the main process module, the worker child process module, and the system call interception module, respectively, to monitor the running status and error signals of all child processes, and to perform coordinated termination and error reporting when a child process crash is detected.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method described in any one of claims 1 to 5.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method according to any one of claims 1 to 5.

Images