Efficient binary-level coverage analysis
Efficient binary-level coverage analysis
复制标题
DOI：
10.1145/3368089.3409694
复制
发表时间：
2020-04
期刊：
影响因子：
--
通讯作者：
M. Ammar Ben Khadra;D. Stoffel;W. Kunz
中科院分区：
文献类型：
--
作者：
M. Ammar Ben Khadra;D. Stoffel;W. Kunz
代码覆盖分析在软件测试过程中起着重要的作用。最近，覆盖反馈的显着效果引发了广泛的兴趣，反馈引导模糊。在这项工作中，我们介绍了bcov，一个工具，二进制级别的覆盖分析。我们的工具静态检测ELF格式的x86-64二进制文件，而无需编译器支持。我们实施了几种技术来提高效率，并扩展到大型现实世界的软件。首先，我们把Agrawal的探针修剪技术，二进制级别的仪器，并有效地利用其超级块，以减少开销。其次，我们引入切片微执行，一个强大的技术，跳转表分析，提高了CFG精度，使我们能够仪器跳转表条目。此外，x86-64中较小的指令对插入迂回构成了挑战。为了解决这一挑战，我们积极利用填充字节和系统主机绕道相邻的基本块。我们评估bcov的语料库的95个二进制文件编译从八个流行的和良好的测试包，如FFmpeg和LLVM。两种具有不同边缘级精度的插装策略用于修补该语料库中的所有函数-超过160万个函数。我们的精确策略的平均性能和内存开销分别为14%和22%。插装的二进制文件不会引入任何测试回归。报告的覆盖率非常准确，平均F分数为99.86%。最后，我们的跳转表分析与IDA Pro在gcc二进制文件上的分析相当，并且在clang二进制文件上优于IDA Pro。
Code coverage analysis plays an important role in the software testing process. More recently, the remarkable effectiveness of coverage feedback has triggered a broad interest in feedback-guided fuzzing. In this work, we introduce bcov, a tool for binary-level coverage analysis. Our tool statically instruments x86-64 binaries in the ELF format without compiler support. We implement several techniques to improve efficiency and scale to large real-world software. First, we bring Agrawal’s probe pruning technique to binary-level instrumentation and effectively leverage its superblocks to reduce overhead. Second, we introduce sliced microexecution, a robust technique for jump table analysis which improves CFG precision and enables us to instrument jump table entries. Additionally, smaller instructions in x86-64 pose a challenge for inserting detours. To address this challenge, we aggressively exploit padding bytes and systematically host detours in neighboring basic blocks. We evaluate bcov on a corpus of 95 binaries compiled from eight popular and well-tested packages like FFmpeg and LLVM. Two instrumentation policies, with different edge-level precision, are used to patch all functions in this corpus - over 1.6 million functions. Our precise policy has average performance and memory overheads of 14% and 22% respectively. Instrumented binaries do not introduce any test regressions. The reported coverage is highly accurate with an average F-score of 99.86%. Finally, our jump table analysis is comparable to that of IDA Pro on gcc binaries and outperforms it on clang binaries.