WINNIE : Fuzzing Windows Applications with Harness Synthesis and Fast Cloning
WINNIE : Fuzzing Windows Applications with Harness Synthesis and Fast Cloning
复制标题
DOI：
10.14722/ndss.2021.24334
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Jinho Jung;Stephen Tong;Hong Hu;Jungwon Lim;Yonghwi Jin;Taesoo Kim
中科院分区：
文献类型：
--
作者：
Jinho Jung;Stephen Tong;Hong Hu;Jungwon Lim;Yonghwi Jin;Taesoo Kim
—模糊测试是一种自动验证程序和发现错误的新兴技术。它已被广泛用于测试许多程序并发现了数千个安全漏洞。然而，现有的模糊测试工作主要集中在类 Unix 系统上，因为 Windows 给模糊测试带来了独特的挑战：闭源生态系统、图形界面的大量使用以及缺乏快速进程克隆机制。在本文中，我们提出了两种解决方案来解决 Windows 模糊测试面临的挑战。我们的系统 W INNIE 首先尝试为应用程序合成一个工具，这是一个基于示例执行直接调用目标函数的简单程序。然后，它使用 Windows 上 fork 的高效实现来测试该工具，而不是原来的复杂程序。使用这些技术，WINNIE 可以绕过不相关的 GUI 代码来测试应用程序深处的逻辑。我们使用 W INNIE 对 59 个闭源 Windows 二进制文件进行模糊测试，它成功地为所有这些文件生成了有效的模糊测试工具。在我们的评估中，WINNIE 可以支持比现有 Windows 模糊器多 2.2 倍的程序，识别出多 3.9 倍的程序状态，并实现 26.6 倍的执行速度。 W INNIE 总共在 32 个 Windows 二进制文件中发现了 61 个独特的错误。
—Fuzzing is an emerging technique to automatically validate programs and uncover bugs. It has been widely used to test many programs and has found thousands of security vulnerabilities. However, existing fuzzing efforts are mainly centered around Unix-like systems, as Windows imposes unique challenges for fuzzing: a closed-source ecosystem, the heavy use of graphical interfaces and the lack of fast process cloning machinery. In this paper, we propose two solutions to address the challenges Windows fuzzing faces. Our system, W INNIE , first tries to synthesize a harness for the application, a simple program that directly invokes target functions, based on sample executions. It then tests the harness, instead of the original complicated program, using an efficient implementation of fork on Windows. Using these techniques, W INNIE can bypass irrelevant GUI code to test logic deep within the application. We used W INNIE to fuzz 59 closed-source Windows binaries, and it successfully generated valid fuzzing harnesses for all of them. In our evaluation, W INNIE can support 2.2 × more programs than existing Windows fuzzers could, and identified 3.9 × more program states and achieved 26.6 × faster execution. In total, W INNIE found 61 unique bugs in 32 Windows binaries.