# ObFuzzer: Object-Oriented Hybrid Fuzzer for Binaries
## 1 Introduction  
Software vulnerabilities have become more and more critical to our daily lives. To solve this problem, fuzzing has become the most popular technology for vulnerability discovery. The traditional fuzzing technology randomly generates the test cases and detects the target program status. It can nearly be used in all programs. However, with pure randomly generated test cases, it is hard to test all code of the target program. Many test cases lead the target program to the same path (exception handling, etc.) and other paths are hard to test. Due to this drawback of purely random fuzzing, grey box fuzzing has been proposed [1]. When the target program is being executed, the fuzzer can obtain information from it. With this information, the fuzzer can generate more effective test cases and increase the vulnerability-discovery performance. Coverage-guided has been the mainstream approach to grey box fuzzing. Its basic assumption is that unexecuted code is more likely to have defects. Coverage-guided can help the fuzzer increase the coverage of basic blocks or edges. It assists the vulnerability-discovery tool in testing untested positions in the target program. This technique has found a large number of vulnerabilities in recent years. However, software security and vulnerability discovery capability are improving each other. Many software developers perform coverage-based fuzzing on their software before it is released. This leads to making it increasingly difficult for the coverage-based fuzzer to find vulnerabilities in programs. The traditional coverage-guided fuzzing technology only uses the edge-based coverage measure method. Therefore, it only effectively discovers the vulnerabilities generatedin the same base block or adjacent basic blocks. This paper summarized three types of vulnerabilities that are difficult to find by coverage-based vulnerability-discovery tools. 1. Overflow: Vulnerability is related to the loop: Since the loop has a low impact on coverage, such vulnerabilities are difficult to discover;
2. Null Pointer Dereference: Vulnerability is related to a series of discontinuous basic block execution orders: Since no edge can reflect the execution order of the disconnected basic blocks, such vulnerabilities are difficult to discover;
3. Type Conversion: Vulnerability is related to the current state of the object: Since the state of the object cannot be reflected by coverage, such vulnerabilities are difficult to discover. It is difficult to find an edge that is needed in traditional coverage-guided fuzzing to guide effective discovery of these vulnerabilities. Therefore, a completely new technique is needed to improve the effectiveness of grey box vulnerability discovery. This paper proposes a new vulnerability-discovery technology called **object-oriented vulnerability discovery** to address these challenges. The object-oriented vulnerability-discovery technology allocates its resource in accordance with the object operation information obtained during the static analysis phase. This paper applies this standard in designing ObFuzzer: a binary hybrid fuzzer that combines static analysis, symbolic execution and fuzzing. ObFuzzer can discover the vulnerabilities which traditional coverage-guided fuzzers find it difficult to discover. First, ObFuzzer's static analysis phase obtains the nodes (basic blocks) related to object operations in the program by static analysis and scores the corresponding nodes. It will score these nodes with three types of scoring: PCP (Potential Crash Point), PCPP (Potential Crash Point' Predecessor) and PEP (Potential Error Point) scores. The scoring approach will be explained later. Second, ObFuzzer's symbolic execution phase generates test cases that can be executed to the position containing complex object operations by symbolic execution. This allows bypassing a large number of positions that are not related to object operations and testing the program in a more targeted way.