77_二进制安全高级技术：模糊测试(Fuzzing)深度解析与实战指南——从随机测试到智能漏洞挖掘的系统化方法

模糊测试基本流程：
+------------------+     +------------------+     +------------------+
|                  |     |                  |     |                  |
|  生成测试用例    +---->+  执行目标程序    +---->+  监控与分析结果  |
|                  |     |                  |     |                  |
+------------------+     +------------------+     +------------------+
         ^                         |                       |
         |                         v                       v
+------------------+     +------------------+     +------------------+
|                  |     |                  |     |                  |
|  结果反馈与优化  +<----+   覆盖率收集     +<----+    漏洞确认      |
|                  |     |                  |     |                  |
+------------------+     +------------------+     +------------------+

# AFL基本使用方法
afl-fuzz -i input_dir -o output_dir ./target_program @@

<!-- Peach Fuzzer配置示例 -->
<DataModel name="HTTPRequest">
  <String value="GET /"/>
  <String name="Path" value="index.html"/>
  <String value=" HTTP/1.1\r\n"/>
  <String value="Host: example.com\r\n"/>
  <String value="\r\n"/>
</DataModel>

# 使用Python的Hypothesis库进行基于生成的模糊测试
from hypothesis import given, strategies as st

@given(st.text(min_size=1, max_size=100))
def test_function_with_hypothesis(s):
    # 测试函数
    result = process_input(s)
    # 断言结果
    assert result is not None

# 使用Python生成畸形PDF文件示例
def generate_corrupt_pdf():
    # 正常PDF文件头
    pdf_header = b'%PDF-1.5\n%\xe2\xe3\xcf\xd3\n'
    
    # 生成畸形内容
    corrupt_content = b''
    # 1. 无效的对象引用
    corrupt_content += b'xref\n0 10\n0000000000 65535 f \n'
    for i in range(1, 10):
        corrupt_content += f"{i:010d} 00000 n \n".encode()
    
    # 2. 不匹配的对象
    corrupt_content += b'trailer\n<< /Size 10 /Root 10 R >>\n'
    
    # 3. 无效的交叉引用表
    corrupt_content += b'startxref\n9999999999\n%%EOF\n'
    
    return pdf_header + corrupt_content

# Boofuzz基本使用示例
from boofuzz import *

def main():
    # 创建会话
    session = Session(target=Target(connection=TCPSocketConnection("127.0.0.1", 21)))
    
    # 定义协议模型
    s_initialize("user")
    s_static("USER ")
    s_string("anonymous")
    s_static("\r\n")
    
    # 添加到会话
    session.connect(s_get("user"))
    
    # 开始模糊测试
    session.fuzz()

if __name__ == "__main__":
    main()

覆盖率引导模糊测试流程：
1. 初始化种子语料库
2. 从语料库中选择测试用例
3. 对选定的测试用例进行变异
4. 执行变异后的测试用例
5. 收集代码覆盖率信息
6. 如果覆盖率提高，将测试用例添加到语料库
7. 重复步骤2-6，直到达到停止条件

# 使用AFL的编译器包装器进行插桩
export CC=afl-gcc
export CXX=afl-g++
./configure
make

# 执行模糊测试
afl-fuzz -i input_dir -o output_dir ./target_program @@

# 使用LibFuzzer编译目标
export CC=clang
export CXX=clang++
clang -fsanitize=fuzzer target_function.c -o target_fuzzer

// 目标模糊测试函数
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
    // 处理输入数据
    process_input(Data, Size);
    return 0;  // 非零值表示错误
}

# 执行模糊测试
./target_fuzzer -seed_corpus=input_dir -artifact_prefix=output/

# AFL自定义插桩示例
afl-gcc-fast -mllvm -custom-instrumentation -fno-omit-frame-pointer target.c -o target

# AFL并行模糊测试示例
# 主实例
afl-fuzz -i input_dir -o output_dir -M master ./target @@

# 从实例
afl-fuzz -i- -o output_dir -S slave1 ./target @@
afl-fuzz -i- -o output_dir -S slave2 ./target @@

# LibFuzzer资源限制示例
./target_fuzzer -max_len=1024 -timeout=1000 -rss_limit_mb=2048

混合模糊测试工作流程：
1. 模糊测试组件执行常规测试，收集覆盖率信息
2. 识别难以覆盖的代码区域（如复杂条件分支）
3. 符号执行组件分析这些区域，生成满足约束的输入
4. 将生成的输入反馈给模糊测试组件
5. 模糊测试组件使用这些输入继续探索

# QSYM与AFL结合使用
afl-fuzz -i input_dir -o output_dir -M afl-master ./target @@

# 启动QSYM实例
python3 qsym/bin/run_qsym_afl.py -a afl-master -o output_dir -- ./target @@

# Driller基本使用示例
from driller import Driller

d = Driller("./target", "initial_input.bin")
for test_case in d.drill():
    # 处理生成的测试用例
    with open(f"output_{counter}.bin", "wb") as f:
        f.write(test_case)
    counter += 1

# NEUZZ使用示例
python train_models.py --input_dir seeds --output_dir models --target ./target
python fuzz.py --model_dir models --target ./target --output_dir results

# TensorFuzz基本使用示例
import tensorfuzz

# 定义测试目标
model = load_your_model()

# 配置模糊测试
config = tensorfuzz.Config(
    model=model,
    input_shape=(1, 224, 224, 3),
    output_classes=1000
)

# 执行模糊测试
results = tensorfuzz.fuzz(config)

# DGF使用示例
cd llvm-project/compiler-rt/lib/fuzzer
g++ -fsanitize=fuzzer -fsanitize-coverage=trace-pc-guard,pc-table,bb,trace-cmp target.cpp -o target
./target -target_location=0x123456 -dict=dict.txt

# DFF基本架构示例
from dff import MasterNode, WorkerNode

# 启动主节点
master = MasterNode(port=8080)
master.start()

# 工作节点连接
worker = WorkerNode(master_ip="192.168.1.10", master_port=8080)
worker.set_target("./target")
worker.start()

# 分析目标程序结构
file image_library.so
objdump -T image_library.so | grep -i jpeg

# 编译插桩版本的目标程序
export CC=afl-gcc
export CXX=afl-g++
./configure --enable-debug
make

# 准备种子语料库
mkdir -p seeds/jpeg
cp /path/to/sample/jpeg/*.jpg seeds/jpeg/

# 编写简单的测试包装器
cat > fuzz_jpeg.c << 'EOF'
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "image_library.h"

int main(int argc, char *argv[]) {
    if (argc < 2) {
        fprintf(stderr, "Usage: %s <input_file>\n", argv[0]);
        return 1;
    }
    
    // 读取输入文件
    FILE *f = fopen(argv[1], "rb");
    if (!f) {
        perror("fopen");
        return 1;
    }
    
    fseek(f, 0, SEEK_END);
    long size = ftell(f);
    fseek(f, 0, SEEK_SET);
    
    unsigned char *buffer = (unsigned char *)malloc(size);
    if (!buffer) {
        perror("malloc");
        fclose(f);
        return 1;
    }
    
    fread(buffer, 1, size, f);
    fclose(f);
    
    // 调用目标函数
    Image *img = image_load_jpeg(buffer, size);
    if (img) {
        image_free(img);
    }
    
    free(buffer);
    return 0;
}
EOF

gcc -o fuzz_jpeg fuzz_jpeg.c -L. -limage_library

# 使用AFL执行模糊测试
afl-fuzz -i seeds/jpeg -o results/jpeg -m none -t 2000 ./fuzz_jpeg @@

# 监控模糊测试进度
watch -n 60 "afl-whatsup results/jpeg/"

# 查看发现的崩溃
ls -la results/jpeg/crashes/

# 重现崩溃
./fuzz_jpeg results/jpeg/crashes/id:000000,sig:11,src:000000,op:havoc,rep:4

# 使用调试器分析崩溃
gdb --args ./fuzz_jpeg results/jpeg/crashes/id:000000,sig:11,src:000000,op:havoc,rep:4

# 在GDB中检查崩溃原因
(gdb) run
(gdb) bt  # 查看堆栈跟踪
(gdb) info registers  # 检查寄存器状态
(gdb) x/s $rdi  # 检查相关内存内容

# 分析目标服务
netstat -tulpn | grep server_name
strings server_binary | grep -i protocol

# fuzz_server.py
from boofuzz import *

def main():
    # 创建会话
    session = Session(
        target=Target(
            connection=TCPSocketConnection("127.0.0.1", 8080)
        ),
        sleep_time=1
    )
    
    # 定义协议模型
    s_initialize("request")
    
    with s_block("header"):
        s_static("COMMAND ")
        s_string("default_command")
        s_delim(" ")
        s_string("param1")
        s_delim(" ")
        s_string("param2")
        s_static("\r\n")
    
    with s_block("body"):
        s_size("body_content", output_format="ascii")
        s_static("\r\n")
        s_string("default_content", name="body_content")
        s_static("\r\n")
    
    # 添加到会话
    session.connect(s_get("request"))
    
    # 开始模糊测试
    session.fuzz()

if __name__ == "__main__":
    main()

# 启动目标服务
./server_binary -port 8080 -debug

# 运行模糊测试脚本
python fuzz_server.py

# 监控服务状态
watch -n 10 "ps aux | grep server_binary"

# 检查服务日志
cat server.log

# 分析崩溃信息
gdb --args ./server_binary -port 8080

# 在GDB中运行直到崩溃
(gdb) run
(gdb) bt  # 查看堆栈
(gdb) frame 0  # 检查当前栈帧
(gdb) info locals  # 检查局部变量

# 验证漏洞的简单脚本
import socket

def test_vulnerability():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect(("127.0.0.1", 8080))
    
    # 构造触发漏洞的payload
    payload = "COMMAND " + "A" * 1000 + "\r\n"
    payload += "1000\r\n"
    payload += "A" * 1000 + "\r\n"
    
    s.send(payload.encode())
    try:
        response = s.recv(1024)
        print("Response:", response)
    except:
        print("Service crashed!")
    
    s.close()

test_vulnerability()

# 分析内核驱动模块
modinfo vulnerable_driver.ko
lsmod | grep vulnerable_driver

# 准备Linux内核源码
git clone --depth=1 https://github.com/torvalds/linux.git
cd linux

# 配置内核
make defconfig
make kvm_guest.config
echo "CONFIG_KCOV=y" >> .config
echo "CONFIG_DEBUG_INFO=y" >> .config
echo "CONFIG_KASAN=y" >> .config
echo "CONFIG_KASAN_INLINE=y" >> .config
make olddefconfig

# 编译内核
make -j$(nproc)

# 编译QEMU镜像
sudo apt-get install debootstrap qemu-system-x86
./tools/testing/selftests/kvm/lib/guest_configure.sh

# 安装syzkaller
go get -u github.com/google/syzkaller/program

# syzkaller/dashboard/configs/sys/vulnerable.txt
syscall vulnerable_ioctl(fd ptr[in, fd], cmd int32, arg const ptr[in, array, 1024])

# 启动syzkaller
./bin/syz-manager --config=my.cfg

# my.cfg配置文件
{
  "target": "linux/amd64",
  "http": "127.0.0.1:56741",
  "workdir": "/path/to/workdir",
  "kernel_obj": "/path/to/linux",
  "image": "/path/to/image/stretch.img",
  "sshkey": "/path/to/image/stretch.id_rsa",
  "syzkaller": "/path/to/syzkaller",
  "procs": 8,
  "type": "qemu",
  "vm": {
    "count": 4,
    "cpu": 2,
    "mem": 2048
  }
}

# 检查syzkaller发现的崩溃
cat /path/to/workdir/crashes/crash-*

# 使用crash工具分析内核崩溃转储
crash /path/to/vmlinux /path/to/memory.dump

# 在crash中分析
crash> bt  # 查看堆栈
crash> sys  # 查看系统信息
crash> files  # 查看打开的文件

# 安装智能合约分析工具
npm install -g solhint slither-analyzer

# 分析智能合约
solhint contract.sol
slither contract.sol

# 安装Echidna
wget https://github.com/crytic/echidna/releases/download/v2.0.0/echidna-test-2.0.0-Ubuntu-18.04.tar.gz
tar -xvf echidna-test-2.0.0-Ubuntu-18.04.tar.gz

// TestContract.sol
pragma solidity ^0.8.0;

import "./TargetContract.sol";

contract TestTarget {
    TargetContract public target;
    
    constructor() {
        target = new TargetContract();
    }
    
    // 测试函数 - 应该永远不会返回true
    function echidna_test_overflow() public view returns (bool) {
        // 如果触发了整数溢出，这个测试应该失败
        // 返回false表示测试通过
        return false;
    }
    
    // 暴露目标合约的所有公共函数给模糊测试器
    function call_function1(uint256 a, uint256 b) public returns (uint256) {
        return target.function1(a, b);
    }
    
    function call_function2(address addr) public returns (bool) {
        return target.function2(addr);
    }
}

# 编译测试合约
solc --bin --abi TestContract.sol -o build/

# 使用Echidna执行模糊测试
./echidna-test TestContract.sol --contract TestTarget

# 查看测试结果
cat echidna_output.txt

# 使用Mythril进行深度分析
myth analyze TestContract.sol --mode deep

# 修复示例
function function1(uint256 a, uint256 b) public pure returns (uint256) {
    // 使用SafeMath或Solidity 0.8+的内置溢出检查
    return a + b;  // 在0.8+中会自动检查溢出
}

# GitLab CI配置示例
fuzzing:
  stage: test
  script:
    - ./build_fuzzer.sh
    - timeout 3600 ./run_fuzzer.sh
    - ./analyze_results.sh
  artifacts:
    paths:
      - fuzzing-results/
    expire_in: 1 week