# ObFuzzer: Object-Oriented Hybrid Fuzzer for Binaries
## 4 Design
### Overview  
In order to implement an object-oriented approach to vulnerability discovery, we further designed and implemented ObFuzzer. To achieve object-oriented vulnerability discovery, our vulnerability-discovery tool needs to transform our focus from the relationship between basic blocks in traditional procedure-oriented vulnerability discovery into the relationship between object operations in object-oriented vulnerability discovery. The difficulties of this transformation include the following three aspects. First, traditional procedure-oriented vulnerability discovery focuses on the relationships between the basic blocks, which can be obtained through simple program analysis or dynamic binary instrumentation. However, the relationships between object operations required in object-oriented vulnerability discovery are often much more difficult to obtain. Second, object-oriented vulnerability discovery begins with a normal object. Many basic blocks which have little relationship with the object have been executed. Therefore, our vulnerability-discovery tool needs to bypass a large number of meaningless basic block tests so that our fuzzer can focus on the basic blocks related to object operations. Third, object-oriented vulnerability discovery should focus on object-related operations. The traditional coverage-guided method is no longer suitable for object-oriented vulnerability discovery and this paper needs to propose a new guide method. It enables an object-oriented fuzzer to more effectively test complex object operations in programs. This paper proposes a new vulnerability-discovery tool, ObFuzzer (Object-oriented Fuzzer), to achieve object-oriented vulnerability discovery. It is called ObFuzzer and consists of three modules: static analysis, symbolic execution and fuzzing. The overall design of ObFuzzer is shown in Figure 2.  
ObFuzzer uses the static analysis module to analyze the target program and obtain the relationship between the object operations. Through the more detailed static analysis of the program, our understanding of the program goes beyond the traditional relationship between basic blocks to reach the relationship between objects. By effectively using the static analysis results, ObFuzzer can transform from procedure-oriented vulnerability discovery to object-oriented vulnerability discovery. The ObFuzzer's static analysis phase outputs PCP, PCPP and PEP scores. * The PCP scores are used to calculate the PCPP scores;
* The PCPP scores will be passed to subsequent symbolic execution modules and indicate the basic blocks that the symbolic execution module needs to execute;  
Figure 2: Overview of ObFuzzer. * The PEP and PCPP scores will be passed to subsequent fuzzing modules and assist the fuzzing module in implementing the guide based on the object operation complexity. ObFuzzer uses the symbolic execution module to bypass some complex unwanted basic blocks that have little correlation with object operations. Through the PCPP scores obtained by the static analysis module, the symbolic execution module has learned which basic blocks have more relationships with object operations. Then, ObFuzzer can more effectively bypass a large number of basic blocks ObFuzzer does not care about and quickly guide the program to the basic blocks with high PCPP scores by symbolic execution. Symbolic execution will generate test cases for the target basic blocks and pass them to the fuzzing module as a dictionary. This dictionary helps the fuzzing module bypass a lot of unconcerned basic blocks and focus on object operations. ObFuzzer uses the fuzzing module to randomly test the object operations of the program. Since the dictionary is generated during symbolic execution, ObFuzzer can quickly reach the basic blocks related to object operations without having to explore paths through a random method, which is slow. ObFuzzer tends to test the basic blocks with more complex object operations by calculating the PEP scores.