A crash analysis method and system for binary programs

Abstract

The present invention discloses a crash analysis method and system for binary programs, including steps: S1, information collection and processing, in this step, the instrumentation module performs code instrumentation on multiple key positions and basic blocks, and then runs the program , record information; the taint module takes the program input as taint, tracks the spread of taint during program execution, and at the same time, performs symbolic operation on each executed instruction, and finally performs reverse slice from the crash point according to the symbolic content , record information; S2, analyze based on the data processed in step S1, and obtain the program execution trajectory diagram, stain propagation trajectory diagram and crash causes, etc.; the present invention can analyze the program without source code, and collect the program running Crash information, crash backtracking, locating the crash point, determining the cause of the crash, etc., greatly reduces the cost of manual analysis, and can assist vulnerability analysts to quickly determine the mechanism of the program crash.

Description

technical field [0001] The present invention relates to the field of computer information security, and more specifically, to a crash analysis method and system for binary programs. Background technique [0002] With the exponential growth of the number of programs, the security of programs has attracted more and more attention. A program crash often means that the code of the program itself is unreasonable, or there are some potential loopholes in the program itself. Fuzz testing technology has developed rapidly in recent years. The principle of fuzz testing is a method to find software vulnerabilities by providing unexpected input to the target system and monitoring abnormal results. It can effectively cause a large number of program crashes. However, , a large number of crashes also requires a lot of manpower to evaluate the effectiveness of the crashes. How to analyze these crashes more automatically, evaluate the cause of the crash, and judge whether it is a vulnerabi...

AI Technical Summary

Problems solved by technology

This method of first recording the program execution track, and then performing virtual replay of the program according to the program execution track file is an offline analysis method, but the disadvantage is that it takes too long; the other is to use tools such as pin and dynamoRIO for instrumentation. Analyzing while the program is running belongs to an online analysis method. Because online analysis records and analyzes the tested program, there are problems such as large memory consumption and long time consumption.

Images