Fuzz-Testing Input Identification via Function Hooking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional fuzz-testing methods face challenges in achieving high code coverage and identifying software bugs, particularly when instrumentation requires hooking basic blocks, which can be hindered by alignment requirements and the use of emulators is slower than native execution.
Innovation Solution
A method that instruments a computer program by hooking functions at arbitrary locations within basic blocks, analyzing arguments to determine if they are within predetermined limits or match patterns, and using metadata to detect anomalous behavior, allowing for efficient identification of bug-triggering inputs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If fuzz-testing is performed by running the program on a native processor, then execution speed is improved, but accessibility and compatibility are worsened due to limited access and language constraints
Solution Approach 1:
The patent uses QEMU as an intermediary emulator between the fuzz-testing framework and the target program. QEMU provides a virtualized execution environment that allows fuzz-testing on emulated processors, maintaining accessibility and compatibility while enabling program execution without requiring native processor access. The emulator acts as a mediator that translates and executes instructions, making the system adaptable to different architectures and languages.
2Adaptability or versatility
If fuzz-testing is performed using an emulator like QEMU, then environment accessibility is improved, but execution speed is worsened
Solution Approach 1:
The patent applies partial instrumentation by selectively hooking only specific functions that are critical for bug detection rather than instrumenting the entire program. This partial action approach reduces the overhead of emulation and instrumentation, improving execution speed while maintaining the ability to detect bugs in critical paths. The system performs excessive analysis on specific arguments of hooked functions to compensate for the reduced coverage.
Solution Approach 2:
The patent changes the parameters being analyzed by focusing on specific function arguments rather than comprehensive program state. By analyzing arguments of hooked functions for anomalies (such as unexpected values, patterns, or ranges), the system achieves efficient bug detection with reduced emulation overhead, improving execution speed while maintaining effectiveness.
3Reliability
If instrumentation is performed by hooking basic blocks, then code coverage is improved, but alignment requirements and implementation complexity are worsened
Solution Approach 1:
The patent extracts the instrumentation complexity by moving the hooking implementation to the emulator layer (QEMU) rather than modifying the target program directly. The emulator handles the complexity of basic block identification and hook insertion, while the fuzz-testing framework simply specifies which functions to hook. This extraction reduces the complexity burden from the testing system while maintaining high code coverage through comprehensive function instrumentation.
Data Source
AI summary
Systems and methods are provided for efficiently identifying software bugs in computer programs and the inputs to trigger the bugs using fuzz-testing.