# ObFuzzer: Object-Oriented Hybrid Fuzzer for Binaries
## 4 Design
### Symbolic Execution: Guiding Fuzzing to Object Operation Related Positions
#### 4.4.1 High-Performance Test Case Generation  
High-performance test case generation focuses on performance. It tries to explore the specific basic blocks that are hidden deep in the program. Since global variables are often used, high-performance test case generation can only use a single core, which greatly affects execution speed. Our high-performance test case generation is divided into three parts: accessibility of path, path planning and generate test cases. **(1) Accessibility of Path**  
Our ultimate goal is to obtain test cases for a basic block that has a higher PCPP score. However, all of our previous information was obtained from static analysis. ObFuzzer needs to convert this static data into dynamic symbolic execution states in order to generate the corresponding test cases using the satisfiability solver. Therefore, ObFuzzer needs to direct the symbolic execution engine to the basic block that has a higher PCPP score. ObFuzzer can easily find a path to the target basic block from the control flow graph. However, this path is often unreachable in dynamic execution. This makes it difficult for ObFuzzer to generate the test case for the target basic block. We illustrate this problem with Figure 6.  
Figure 5: Scoring the potential error point. As shown in Figure 5(a), when ObFuzzer obtains a path from the control flow graph that requires a program to execute the branch that the false condition of the basic block \"B\" points to, this path is unreachable. Because \"i\" needs to be greater than 10 to execute the basic block \"B\", there is no case where \"i\" is not greater than 5. This situation makes it difficult to generate a path from the control flow graph that can reach the target basic block from the entry point. One of the most straightforward ideas to solve this problem is deleting such unreachable edges from the control flow graph whenever they are encountered. The accuracy of the control flow graph is improved by deleting such unreachable edges, which improves the accuracy of the path generated by the control flow graph. However, in reality, things are often not that simple. As shown in Figure 5(b), when ObFuzzer executes into a loop, there are few exits when the loop is executed only once. If ObFuzzer follows the above approach and finds that the false condition of node \"B\" cannot be satisfied when the program first executes the loop body, ObFuzzer deletes this edge from the control flow graph. This deletes an edge from the control flow graph that could have been executed, which seriously affects the accuracy of the control flow graph. This makes the control flow graph unable to assist ObFuzzer in generating a path to the target basic block. A new idea can solve this problem by dividing the unreachable edges into in-loop unreachable edges and out-loop unreachable edges. Out-loop unreachable edges will be deleted and in-loop unreachable edges will continue to be executed. However, in reality, we often encounter more complex situations. As shown in Figure 5(c), when the unreachable edges of Figure 5(a) are located in the loop of Figure 5(b), our previous proposed approach fails again. It is difficult to determine whether the false edge of node \"D\" should be deleted. In object-oriented programs, this  
Figure 6: Accessibility of Path. repeated code execution is not only a simple loop but also a recursion or other forms of code reuse. This makes path-accessibility analysis more difficult. In practice, ObFuzzer can only do its best to determine whether an edge is reachable or not. That is, ObFuzzer analyzes the unreachable edges in the repeated code. When certain conditions that ObFuzzer sets are reached, ObFuzzer deletes the unreachable edges from the control flow graph and considers them completely unreachable. To better solve the reachability issue, ObFuzzer proposes a new data structure, the ExeTree. With the ExeTree, ObFuzzer can transform the control flow graph of static analysis into a tree structure of dynamic execution.