High-efficiency dynamic software vulnerability exploiting method

Abstract

The invention discloses a high-efficiency dynamic software vulnerability exploiting method which comprises the following steps: 1. processing normal input data by target software, and collecting the bytes spread into system function parameters and library function parameters in the normal input data; 2. modifying the bytes spread into a system function and a library function in the normal input data, and generating malformed data; and 3. inputting the generated malformed data to the target software, and if the target software is abnormal in processing the malformed data, generating a vulnerability report. In the method of the invention, the malformed data generated by the bytes are modified with pertinency by automatically recognizing the bytes spread into the system function and the library function in the normal input data, thereby the possibility of triggering security vulnerabilities by the malformed data is markedly improved, and the efficiency of fuzzy testing is fully improved.

Description

technical field [0001] The invention belongs to the fields of software engineering and information security, and in particular relates to an efficient dynamic software loophole mining method. Background technique [0002] The rapid development and wide application of information technology such as computers, network communications, and software has promoted the modern society to move towards an information society, and a large number of loopholes and hidden dangers in it have also made the current information security situation increasingly severe. A core issue in information security It is the software security loopholes that exist in the computer system. Malicious attackers can use these security loopholes to elevate their privileges, access unauthorized resources, and even destroy sensitive data. Software security loopholes have become one of the root causes of many system security problems, so how to find security loopholes in software is very important. [0003] Fuzzin...

AI Technical Summary

Problems solved by technology

But such fuzzing tools rely heavily on manually defining the generation rules for malformed data

For complex data formats, manual definition of generation rules faces a huge workload, which is usually impossible; even for simple data formats, manual definition of rules is easy to introduce errors, resulting in generated malformed data that cannot trigger security vulnerabilities

Images