Not All Branches Are Equal: An Improved QSYM Schema for Binary Vulnerability Mining

Recently, with the observation that fuzzing and concolic execution can complement each other, fuzzing and concolic execution combined method has been widely used for mining vulnerabilities in real world software, while not paying enough attention to the complementary strategy. That is current methods, such as Driller, QYSM, etc., normally use the on-demand strategy to switch between fuzzing and concolic execution engine, which drives down the efficiency of vulnerability mining process. This paper proposed a novel un-touched branch guided strategy to make full use of both fuzzing and concolic execution capability. By combining static analysis and runtime information, we can construct a dynamic set of un-touched and tainted branches, and the corres-pondence test case which can reach the brother branches, and then we can select the best input test case to drive concolic execution, and generate new test cases to cover the un-touched branches. We implement a prototype system FPSFuzz and evaluate our system with LAVA-M dataset and compared it with QSYM. The results show that FPSFuzz found more vulnerabilities quickly and improved the contribution of conclic execution for hybrid fuzzing, which significantly improves the efficiency.