Fuzzing technology based on suspicious basic block orientation

Abstract

With the increasing complexity of software and the diversification of vulnerability forms, manual vulnerability mining can no longer meet the needs of software vulnerability mining, and automated vulnerability mining methods are becoming increasingly important. Fuzzing is one of the popular automated vulnerability mining techniques, which is widely used in software vulnerability mining due to its ease of deployment and efficiency. However, fuzzing has strong randomness, which leads to the generation of a large number of redundant and invalid inputs during the fuzzing process, wasting program execution time, resulting in low code coverage, and only a small number of inputs can truly trigger program exceptions. Therefore, the research on oriented fuzzing methods is becoming increasingly important. This article proposes a fuzzing method based on suspicious basic blocks, which uses LLVM in the static analysis stage to analyze the target program and identify the code that may have vulnerabilities. In fuzzing, tracking the execution of these codes, recording edge coverage information, prioritizing the selection of seeds that can trigger potential vulnerability areas for testing, and verifying the effectiveness of the proposed method through experiments.