Source Code Fuzzing via Barrier Bypass Instrumentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Fuzzing methods for software testing are slow and computationally intensive, often failing to access all software paths and detect vulnerabilities due to complex entry conditions and limited input comprehensiveness, leaving many errors undetected.
Innovation Solution
An instrumentation tool that performs static and dynamic analysis to identify and bypass barriers in software source code, generating input data to access inaccessible code sections and enhance the fuzzer's capabilities through source-level instrumentation, trace points, and external event simulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional fuzzing methods are used to test software, then vulnerabilities can be detected through random input modifications, but the process becomes slow and computationally intensive
Solution Approach 1:
The instrumentation tool performs preliminary static analysis on the software source code before fuzzing begins, identifying barriers and generating targeted input data in advance. This preliminary action enables the fuzzer to skip random exploration and directly test critical code paths, significantly improving testing speed while maintaining vulnerability detection capability
Solution Approach 2:
An instrumentation tool is introduced as an intermediary between the fuzzer and the software under test. This intermediary performs static analysis, identifies barriers, and generates intelligent input data, mediating between random fuzzing and the target software to achieve both speed and reliability
2Reliability
If random input modifications are used in fuzzing, then some vulnerabilities can be discovered, but many code sections remain inaccessible due to complex entry conditions
Solution Approach 1:
The instrumentation tool acts as an intermediary that performs static analysis to identify barriers with complex entry conditions. It then generates specialized input data designed to satisfy these complex conditions, enabling the fuzzer to access previously unreachable code sections and improve overall detection coverage
Solution Approach 2:
The instrumentation tool analyzes barrier conditions and transforms the fuzzing approach by changing input parameters systematically. Instead of random modifications, it generates inputs with specific parameter values designed to satisfy complex entry conditions, enabling access to restricted code paths
3Reliability
If the fuzzer generates more input samples to improve coverage, then more code paths may be accessed, but the computational requirements increase significantly
Solution Approach 1:
The instrumentation tool performs preliminary static analysis to identify all barriers and generate a targeted set of input samples that are most likely to achieve comprehensive path coverage. This preliminary generation of intelligent test inputs eliminates the need for exhaustive random sampling, achieving high coverage with reduced computational energy consumption
Solution Approach 2:
The instrumentation tool analyzes the software's own structure and barrier conditions to self-generate appropriate test inputs. By using the software's own code structure information to create targeted test cases, it achieves efficient path coverage without requiring extensive computational resources for random input generation
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed techniques relate to exposing potential vulnerabilities in software programs. Techniques include referencing a software vulnerability assessment program, and modifying source code of a tested software program with native language commands. Techniques also include testing the modified software program, analyzing tracked executed code sections of output data to identify one or more current barriers in the tested software program, generating new input data for the tested software program configured to cross one or more current barriers, and merging the new generated input data with a dataset that is being tested by the software vulnerability assessment program.