AutoGenD: fuzz driver generation for binary libraries without header files and symbol information

Ceming Wan; Qiuxi Zhong; Shuning Wei; Yong Tang

doi:10.1117/12.2657278

28 November 2022 AutoGenD: fuzz driver generation for binary libraries without header files and symbol information

Ceming Wan, Qiuxi Zhong, Shuning Wei, Yong Tang

Proceedings Volume 12503, International Conference on Network Communication and Information Security (ICNCIS 2022); 1250306 (2022) https://doi.org/10.1117/12.2657278
Event: International Conference on Network Communication and Information Security (ICNCIS 2022), 2022, Qingdao, China

Abstract

Fuzz testing technology is widely used in vulnerability mining. However, there is less research on fuzz testing specifically for libraries. Both public libraries and private libraries that come with commercial software may have security risks. In the past, testing a library required manual writing of drivers, which required testers to be familiar with the library and take a lot of time. Existing techniques mostly rely on static analysis of source code or focus on binary libraries which rely on header files, but no research in the case without header files and symbol information. In that case, there is faced with three major problems: 1) We do not have accurate information (such as the number and types of function parameters) about library functions. 2) The control and data dependencies among API functions are complex. 3) Effectively integrate the information to automatically generate a driver that can correctly perform fuzz testing. We propose AutoGenD to address the problem for libraries without source code, header files, and symbol information. First of all, we obtain the library function information based on the static analysis technology. Then, we obtain the data of the library function parameters through dynamic analysis technology. Finally, we take the template method to synthesize the driver. Through experiments, the driver generated by AutoGenD can effectively trigger existing vulnerabilities (11 bugs). The results indicate that it has the ability to automatically generate a fuzz driver.

Citation Download Citation

Ceming Wan, Qiuxi Zhong, Shuning Wei, and Yong Tang "AutoGenD: fuzz driver generation for binary libraries without header files and symbol information", Proc. SPIE 12503, International Conference on Network Communication and Information Security (ICNCIS 2022), 1250306 (28 November 2022); https://doi.org/10.1117/12.2657278

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available

Members: $17.00

Non-members: $21.00 ADD TO CART

PROCEEDINGS
10 PAGES

DOWNLOAD PAPER SAVE TO MY LIBRARY

GET CITATION

RIGHTS & PERMISSIONS

Get copyright permission Get copyright permission on Copyright Marketplace

KEYWORDS

Binary data

Detection and tracking algorithms

Data processing

Defense technologies

Information security

Internet

Mining

Show All Keywords

Keywords/Phrases

Search In:

Publication Years