• Journal of KIISE:Software and Applications
• /
• v.37 no.10
• /
• pp.768-772
• /
• 2010

Concolic testing generates test data by combining concrete program execution and symbolic execution to achieve high test coverage. CREST is a representative open-source test tool implementing concolic testing. Currently, however, CREST aims at exploring all possible execution paths. In case of testing a specific branch or block, thus, it can be ineffective. This paper suggests a goal-oriented concolic testing that generates test data to execute a given branch or block.

• KIPS Transactions on Software and Data Engineering
• /
• v.9 no.8
• /
• pp.229-234
• /
• 2020

This paper presents the design and the implementation of CRESTIVE-DX, a concolic testing tool that distribute the concolic testing process over the embedded target system and the host system for efficient test generation of a target embedded program. CRESTIVE-DX conducts the execution of a target program on the target embedded system to consider possible machine-dependent behaviors of a target program execution, and conducts machine-independent parts, such as search-strategy heuristics, constraint solving, on host systems with high-speed computation unit, and coordinates their concurrent executions. CRESTIVE-DX is implemented by extending an existing concolic testing tool for C programs CREST. We conducted experiments with a test bed that consists of an embedded target system in the Arm Cortex A54 architecture and host systems in the x86-64 architecture. The results of experiments with Unix utility programs Grep, Busybox Awk, and Busybox Ed show that test input generation of CRESTIVE-DX is 1.59 to 2.64 times faster than that of CREST.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.14 no.9
• /
• pp.3885-3906
• /
• 2020

Hybrid fuzzing which combines fuzzing and concolic execution, has proved its ability to achieve higher code coverage and therefore find more bugs. However, current hybrid fuzzers usually suffer from inefficiency and poor scalability when applied to complex, real-world program testing. We observed that the performance bottleneck is the inefficient cooperation between the fuzzer and concolic executor and the slow symbolic emulation. In this paper, we propose a novel solution named EPfuzzer to improve hybrid fuzzing. EPfuzzer implements two key ideas: 1) only the hardest-to-reach branch will be prioritized for concolic execution to avoid generating uninteresting inputs; and 2) only input bytes relevant to the target branch to be flipped will be symbolized to reduce the overhead of the symbolic emulation. With these optimizations, EPfuzzer can be efficiently targeted to the hardest-to-reach branch. We evaluated EPfuzzer with three sets of programs: five real-world applications and two popular benchmarks (LAVA-M and the Google Fuzzer Test Suite). The evaluation results showed that EPfuzzer was much more efficient and scalable than the state-of-the-art concolic execution engine (QSYM). EPfuzzer was able to find more bugs and achieve better code coverage. In addition, we discovered seven previously unknown security bugs in five real-world programs and reported them to the vendors.

• The KIPS Transactions:PartD
• /
• v.17D no.4
• /
• pp.297-310
• /
• 2010

Recently, a new testing technique called concolic testing receives lots of attention. Concolic testing generates test data by combining concrete program execution and symbolic execution to achieve high test coverage. CREST is a representative open-source test tool implementing concolic testing. Currently, however, CREST only deals with integer type as input. This paper presents a new rule for automated test data generation in presence of inputs of pointer type. The rules effectively handles multi-level stack-directed pointers that are mainly used in C programs. In addition, we describe a tool named vCREST implementing the proposed rules together with the results of applying the tool to some C programs.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.7 no.3
• /
• pp.576-599
• /
• 2013

Protocol reverse engineering is useful for many security applications, including intelligent fuzzing, intrusion detection and fingerprint generation. Since manual reverse engineering is a time-consuming and tedious process, a number of automatic techniques have been proposed. However, the accuracy of these techniques is limited due to the complexity of binary instructions, and the derived formats have missed constraints that are critical for security applications. In this paper, we propose a new approach for protocol format extraction. Our approach reasons about only the evaluation behavior of a program on the input message from concolic execution, and enables field identification and constraint inference with high accuracy. Moreover, it performs binary analysis with low complexity by reducing modern instruction sets to BIL, a small, well-specified and architecture-independent language. We have implemented our approach into a system called Icefex and evaluated it over real-world implementations of DNS, eDonkey, FTP, HTTP and McAfee ePO protocols. Experimental results show that our approach is more accurate and effective at extracting protocol formats than other approaches.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2016.10a
• /
• pp.423-425
• /
• 2016

콘콜릭 테스팅(Concolic testing)은 프로그램 실행을 실제 구체적인 입력 값(Concrete Values)을 입력하며, 동시에 심볼릭 실행 (Syrnbolic execution)을 진행하는 테스팅 기법이다. 콘콜릭 테스팅은 모든 실행 가능 경로를 탐색하여, 테스트 케이스를 자동 생생한다. 그래서 높은 분기 커버리지를 나타내지만, 안전성을 목표로 하는 MC/DC 커버리지는 만족하지 못한다. 본 논문에서는 분기 커버리지와 MC/DC 커버리지를 만족하는 테스트 케이스를 자동생성하는 CREST 도구 개선을 제안한다.

• KIISE Transactions on Computing Practices
• /
• v.21 no.3
• /
• pp.257-262
• /
• 2015

As software grows more complex, it contains more bugs that are not recognized by developers. Attackers can then use exploitable bugs to penetrate systems or spread malicious code. As a representative method, attackers manipulated documents or multimedia files in order to make the software engage in unanticipated behavior. Recently, this method has gained frequent use in A.P.T. In this paper, an automatic analysis method to find software security bugs was proposed. This approach aimed at finding security bugs in the software which can arise from input data such as documents or multimedia. Through dynamic taint analysis, how input data propagation to vulnerable code occurred was tracked, and relevant instructions in relation to input data were found. Next, the relevant instructions were translated to a formula and vulnerable input data were found via the formula using an SMT solver. Using this approach, 6 vulnerable codes were found, and data were input to crash applications such as HWP and Gomplayer.

• KIPS Transactions on Software and Data Engineering
• /
• v.6 no.8
• /
• pp.385-390
• /
• 2017

Because of the ever-increasing software complexity, model-based development techniques are becoming an essential technique in software development. However, even if model-based techniques are used, the test case generation for complex software is still a challenge to solve. In this paper, we propose a method to generate automatic test cases based on UML model using custom parser and SMT solver. By proposed technique, a test case can be generated even though the model is described in a platform independent language such as action language, or in a platform dependent language. In addition, a concolic execution technique is applied to efficiently generate test cases in the model. In this paper, we present a case study on the power window switch model of Hyundai Santa Fe through the proposed test case generation technique.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.18 no.11
• /
• pp.94-103
• /
• 2017

As automatic hacking tools and techniques have been improved, the number of new vulnerabilities has increased. The CVE registered from 2010 to 2015 numbered about 80,000, and it is expected that more vulnerabilities will be reported. In most cases, patching a vulnerability depends on the developers' capability, and most patching techniques are based on manual analysis, which requires nine months, on average. The techniques are composed of finding the vulnerability, conducting the analysis based on the source code, and writing new code for the patch. Zero-day is critical because the time gap between the first discovery and taking action is too long, as mentioned. To solve the problem, techniques for automatically detecting and analyzing software (SW) vulnerabilities have been proposed recently. Cyber Grand Challenge (CGC) held in 2016 was the first competition to create automatic defensive systems capable of reasoning over flaws in binary and formulating patches without experts' direct analysis. Darktrace and Cylance are similar projects for managing SW automatically with artificial intelligence and machine learning. Though many foreign commercial institutions and academies run their projects for automatic binary analysis, the domestic level of technology is much lower. This paper is to study developing automatic detection of SW vulnerabilities and defenses against them. We analyzed and compared relative works and tools as additional elements, and optimal techniques for automatic analysis are suggested.