Efficient fuzzing and software updating via dynamic binary rewriting
File(s)
Author(s)
Andronidis, Anastasios
Type
Thesis
Abstract
The mounting reliance on software in an array of applications, from smartphones to spacecrafts, demands a development and deployment process that ensures reliability, security, and efficiency. However, the multifaceted nature of software development, the escalating emphasis on security, and the prevalence of software bugs have led to grave consequences. This thesis explores how we can improve testing and deployment, two key but often overlooked stages in the software development life cycle (SDLC).
This thesis introduces a set of three methodologies–—SaBRe, SnapFuzz, and Mvedsua—–that each address distinct challenges. Our work aims to enhance the SDLC, requiring minimal specialised knowledge and reducing the laborious nature of the process. As a result, developers will be better equipped to create dependable, efficient, and secure software applications that can meet the rigorous demands of contemporary technology.
First, SaBRe is a load-time dynamic binary rewriting platform that optimizes the process of binary rewriting by performing modifications after the program is loaded into memory but before execution, leading to safe and efficient rewriting with minimal overhead below 3%. SaBRe is the platform primitive leveraged by the rest methodologies to implement efficient and robust fuzzing and software updating.
Second, SnapFuzz is a fuzzing system that addresses the difficulties in testing stateful network applications by transforming slow asynchronous network communication into a more efficient synchronous form, leveraging snapshot-taking mechanisms and accelerating file operations. Compared to traditional methods, SnapFuzz simplifies the fuzzing harness, has an impressive performance speedup (8.4x-62.8x) and discovered additional 12 crashes in real applications.
Third, Mvedsua integrates Dynamic Software Updating (DSU) with Multi-Version Execution (MVE) to ensure constant availability and seamless user experience during software updates. This innovative approach significantly reduces the update-time delay by hiding the update process, quickly detects and rectifies errors introduced during the update process, and imposes minimal steady-state overhead.
This thesis introduces a set of three methodologies–—SaBRe, SnapFuzz, and Mvedsua—–that each address distinct challenges. Our work aims to enhance the SDLC, requiring minimal specialised knowledge and reducing the laborious nature of the process. As a result, developers will be better equipped to create dependable, efficient, and secure software applications that can meet the rigorous demands of contemporary technology.
First, SaBRe is a load-time dynamic binary rewriting platform that optimizes the process of binary rewriting by performing modifications after the program is loaded into memory but before execution, leading to safe and efficient rewriting with minimal overhead below 3%. SaBRe is the platform primitive leveraged by the rest methodologies to implement efficient and robust fuzzing and software updating.
Second, SnapFuzz is a fuzzing system that addresses the difficulties in testing stateful network applications by transforming slow asynchronous network communication into a more efficient synchronous form, leveraging snapshot-taking mechanisms and accelerating file operations. Compared to traditional methods, SnapFuzz simplifies the fuzzing harness, has an impressive performance speedup (8.4x-62.8x) and discovered additional 12 crashes in real applications.
Third, Mvedsua integrates Dynamic Software Updating (DSU) with Multi-Version Execution (MVE) to ensure constant availability and seamless user experience during software updates. This innovative approach significantly reduces the update-time delay by hiding the update process, quickly detects and rectifies errors introduced during the update process, and imposes minimal steady-state overhead.
Version
Open Access
Date Issued
2023-07
Date Awarded
2024-09
Copyright Statement
Creative Commons Attribution NonCommercial Licence
License URL
Advisor
Cadar, Cristian
Publisher Department
Computing
Publisher Institution
Imperial College London
Qualification Level
Doctoral
Qualification Name
Doctor of Philosophy (PhD)