Branch Coverage Guided Symbolic Execution for Hybrid Fuzzing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hybrid fuzz testing faces inefficiencies due to the lack of effective integration between greybox fuzzers and symbolic execution engines, leading to redundant branch testing and increased computational resources, particularly exacerbated by the path explosion problem in software with many branches.
Innovation Solution
Implementing branch coverage guided symbolic execution by sharing a bitmap between greybox fuzzers and symbolic execution engines to record and utilize branch coverage information, allowing the symbolic execution engine to focus on discovering new branches and avoid redundant testing, thereby improving integration and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If symbolic execution is used to test binary programs, then path coverage is achieved, but execution time increases significantly and path explosion occurs
Solution Approach 1:
The patent segments the execution trace into basic blocks and identifies branches between them. By focusing on branches rather than complete paths, the system divides the complex execution space into manageable units, reducing the overall complexity and avoiding path explosion while maintaining coverage effectiveness.
Solution Approach 2:
The patent introduces a bitmap data structure as an intermediary to track branch coverage. This bitmap acts as a mediator between the symbolic execution engine and the coverage measurement, allowing efficient recording and comparison of executed branches without requiring full path analysis, thus reducing time complexity.
2Productivity
If fuzz testing is used to test binary programs, then execution speed is fast, but branch coverage is incomplete
Solution Approach 1:
The patent implements feedback by using the bitmap to record discovered branches and feeding this information back to the symbolic execution engine. This feedback mechanism allows the system to identify unexplored branches and focus symbolic execution efforts on those areas, improving branch coverage while maintaining the speed advantage of fuzz testing.
Solution Approach 2:
The patent performs preliminary branch discovery using fast fuzz testing before initiating comprehensive symbolic execution. By pre-identifying which branches have been covered through random inputs, the system can prioritize symbolic execution on unexplored branches, combining the speed of fuzz testing with the thoroughness of symbolic analysis.
3Device complexity
If greybox fuzzer and symbolic execution engine work independently, then each can function simply, but redundant branch testing occurs and integration is insufficient
Solution Approach 1:
The patent merges the greybox fuzzer and symbolic execution engine by sharing a common bitmap data structure for branch coverage tracking. This merging allows both systems to cooperate efficiently, with the fuzzer providing initial branch discovery and the symbolic engine filling in gaps, thereby eliminating redundant testing and optimizing computational resource usage.
Data Source
AI summary
According to some examples, computer-implemented methods for branch coverage guided symbolic execution for hybrid fuzzing are described. An example computer-implemented method may include receiving a seed input of a binary program under analysis (BPUA) that is discovered during testing by a greybox fuzzer. The method may also include concretely executing the seed input in the BPUA, and collecting a trace resulting from the concrete execution of the seed input. The method may further include determining whether the concrete execution of the seed input discovers a new branch. The method may include, responsive to a determination that the concrete execution of the seed input discovers a new branch, updating a bitmap to indicate that the new branch is discovered, wherein the bitmap is utilized by the greybox fuzzer to maintain a record of discovered branches in BPUA, and providing the seed input to the greybox fuzzer.