Windows Kernel Fuzzing via Static Type Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current kernel fuzzing techniques face challenges in effectively detecting errors in Windows operating systems due to limited documentation of system call types, making it difficult to apply fuzzing methods to undocumented system calls, whereas Linux-based systems have more accessible type information.
Innovation Solution
A method and system for automatically inferring type information of Windows system calls through static analysis of library files, using a type reasoner to convert binary code into intermediate language, detect functions, generate function call graphs, and synthesize parameter information to perform type-based fuzzing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual analysis is performed to obtain type information for each system call, then fuzzing accuracy improves, but the time and effort required increases significantly
Solution Approach 1:
The patent performs static analysis on library files in advance to extract and store type information for system calls before fuzzing begins. This preliminary action creates a reusable knowledge base that eliminates the need for manual analysis during the fuzzing process, resolving the contradiction between accuracy and time consumption
Solution Approach 2:
The patent creates a copy of type information from library files through automated static analysis, rather than manually creating or analyzing each system call definition. This copying approach preserves accuracy while dramatically reducing the time and effort required compared to manual analysis
2Reliability
If fuzzing is performed without type information, then the fuzzing process is simpler to implement, but the effectiveness of error detection decreases
Solution Approach 1:
The patent introduces a type reasoner as an intermediary component that automatically infers type information from library files. This intermediary handles the complexity of type analysis separately from the fuzzing engine, allowing the fuzzing system to achieve high reliability without directly managing the complexity of type information extraction
Solution Approach 2:
The patent enables the fuzzing system to automatically obtain type information through static analysis of library files, making the system self-sufficient. Rather than requiring external manual provision of type information or increasing overall system complexity, the fuzzing system serves itself by extracting necessary type data from available resources
3Adaptability or versatility
If static analysis is performed on binary library files to infer type information, then type information can be obtained for undocumented system calls, but the analysis complexity increases
Solution Approach 1:
The patent copies type information patterns from documented system calls and library file structures to infer types for undocumented system calls. By reusing type information from known patterns and applying it to unknown cases, the system achieves broad coverage without proportionally increasing analysis complexity
Solution Approach 2:
The patent changes the state of library files from binary format to intermediate representation through static analysis, enabling type information extraction. This parameter change in file format representation allows the system to handle both documented and undocumented system calls uniformly, increasing adaptability while managing complexity through automated transformation
Data Source
AI summary
Disclosed is a window kernel fuzzing technique utilizing type information obtained through binary static analysis. The method of fuzzing a kernel of a computer operating system performed by a fuzzing system may include the steps of: automatically inferring type information of a system call using a library file provided by the computer operating system; and performing system call fuzzing on the basis of the type information of the system call obtained through the inference.