CoLaFUZE: Coverage-Guided and Layout-Aware Fuzzing for Android Drivers
نویسندگان
چکیده
With the commercialization of 5G mobile phones, Android drivers are increasing rapidly to utilize a large quantity newly emerging feature-rich hardware. Most these developed by third-party vendors and lack proper vulnerabilities review, posing number new potential risks security privacy. However, complexity diversity make traditional analysis methods inefficient. For example, driver-specific argument formats syscall fuzzers difficult generate valid inputs, pointer-heavy code makes static results incomplete, pointer casting hides actual type. Triggering deep in remains challenging. We present CoLaFUZE, coverage-guided layout-aware fuzzing tool for automatically generating inputs exploring driver code. CoLaFUZE employs kernel module capture data copy operation redirect it engine, ensuring that correct size required is transferred driver. leverages dynamic symbolic execution recover interfaces generates interfaces. Furthermore, seed mutation coverage information achieve better quality expose bugs evaluate on 5 modern phones from top vendors, including Google, Xiaomi, Samsung, Sony, Huawei. The show can explore more compared with state-of-the-art fuzzer, successfully found 11 testing devices.
منابع مشابه
INSTRIM: Lightweight Instrumentation for Coverage-guided Fuzzing
Empowered by instrumentation, coverage-guided fuzzing monitors the program execution path taken by an input, and prioritizes inputs based on their contribution to code coverage. Although instrumenting every basic block ensures full visibility, it slows down the fuzzer and thus the speed of vulnerability discovery. This paper shows that thanks to common program structures (e.g., directed acyclic...
متن کاملVUzzer: Application-aware Evolutionary Fuzzing
Fuzzing is an effective software testing technique to find bugs. Given the size and complexity of real-world applications, modern fuzzers tend to be either scalable, but not effective in exploring bugs that lie deeper in the execution, or capable of penetrating deeper in the application, but not scalable. In this paper, we present an application-aware evolutionary fuzzing strategy that does not...
متن کاملSTAB Fuzzing: A Study of Android’s Binder IPC and Linux/Android Fuzzing
This paper focuses on describing the necessary background to begin working with Binder: Android’s Interprocess Communication (IPC) mechanism, and Linux/Android system call (“syscall”) fuzzing tools. The objective was to study Android and Binder along with system call fuzzing in order to learn more about Android, Binder IPC, and vulnerability detection and analysis. Our study was further concent...
متن کاملCode Coverage Measurement Framework for Android Devices
Software testing is a very important activity in the software development life cycle. Numerous general blackand white-box techniques exist to achieve different goals and there are a lot of practices for different kinds of software. The testing of embedded systems, however, raises some very special constraints and requirements in software testing. Special solutions exist in this field, but there...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
ژورنال
عنوان ژورنال: IEICE Transactions on Information and Systems
سال: 2021
ISSN: ['0916-8532', '1745-1361']
DOI: https://doi.org/10.1587/transinf.2021ngp0005