摘要
伴随着各类应用软件在人们生活和工作中的应用越发广泛,对于软件自身安全的需求也越发强烈。软件漏洞是造成各类安全事件的重要原因之一。本研究运用代码覆盖引导的模糊测试技术,实现了基于Pin工具的Linux系统下二进制应用软件漏洞挖掘系统,将漏洞发现有效地融入了软件开发测试的全生命周期,从而降低漏洞带来的安全风险。针对现有模糊测试方法没有考虑带有虚拟机壳的程序这一问题,本研究通过准确地描述虚拟机壳内部的控制流,有效提高了这一类程序的代码覆盖效果。
With the popular application of software in production and life,the social demand for software security is more and more serious.Software vulnerability is an important factor that causes software security incidents.This research uses the fuzzy test technology of code coverage guidance to realize binary application software vulnerability mining system under the Linux system based on Pin tools,and effectively integrates the vulnerability discovery into the whole life cycle of software development and testing to reduce the security risk caused by vulnerabilities.In view of the fact that the existing fuzzy testing method does not consider the program with virtual shell,this study effectively improves the code coverage effect of this kind of program by accurately describing the control flow inside the virtual shell.
作者
曾强
ZENG Qiang(State Grid Bazhong Electric Power Supply Company,Bazhong 636000,China)
出处
《电力信息与通信技术》
2020年第9期37-42,共6页
Electric Power Information and Communication Technology
