# A Novel Network Protocol Syntax Extracting Method for Grammar-Based Fuzzing
## 4 Design and Implementation
### Main-Parsing Module
#### 4.2.3 Basic Path Set Extraction  
The main purpose of this step is to get all the packet types of the target protocol. The idea is that we get the basic path set of the dissector code, and then treat each basic path as a parsing path for a packet type, thereby obtaining all data packet types of the protocol. In order to achieve this goal, we propose a new basic block division method, which takes the normalized file as a basic processing unit and then divides the file into four types of basic blocks and assigns a unique type value to each of them. By maintaining a stack structure to indicate the current under-processing basic block, and executing different numbers of \"push\" and \"pop\" operations according to different block type values, all the packet types and the corresponding field information of each packet type can be obtained by scanning the normalized protocol dissector file only once. The four basic block types are defined as follows:  
* Ordinary basic block: A code block composed of consecutive statements that contain sequential execution. This block is also the place that actually saves field information. In particular, the \"do...while\", \"while\", and \"for\" loop structures are treated as ordinary basic blocks that only contain the \"data\" field. They are only traversed once during execution, and the iteration number of the loop is treated as the \"data\" field length, the loop-control-variable's change value in each iteration is regarded as the data type of the \"data\" field. * Branch basic block: A code block that contains a branch structure. These branch structures can be conditional structures, such as \"if/else if/else\" structures, or selection structures, such as \"switch\" structures. Typically, these structures are used to differentiate packet types and determine dependencies between fields. For example, for the switch structure, we extract its variable expressions as dependent fields and each constant expression as the value of the dependent field, and add this dependency relationship to the subsequently extracted fields, indicating that the subsequent fields are specific fields under the special values of the dependent fields. * Branch item basic block: The code block of each branch in the branch structure, including \"if\" basic block, \"else if\" basic block, \"else\" basic block, and \"default\" basic block. Each branch item basic block represents a packet type. Wherein, the \"if\" basic block is the default first basic block in the \"if/else if/else\"branch basic block. In particular, we consider \"function\" basic blocks as branch item basic blocks. * End basic block: The end basic block includes the return basic block which is added when encountering a \"return\" statement and the function end basic block which is added when there is a function end. These basic blocks identify the exit of the function and are used to guide the subsequent concatenating process. Figure 5 is a piece of Modbus TCP dissector code, we use it to illustrate the basic block partitioning process. Lines \"3-7\" of the code form an ordinary basic block, lines \"8-28\" form a branch basic block, lines \"8-25\" and lines \"26-28\" form two branch item basic blocks, each of line \"17\" and line \"29\" is a function return basic block, line \"30\" is a function end basic block. The normalized parsing code is sequentially traversed, each basic block encountered is allocated a separate list structure to store the basic block type and the field information extracted from that basic block, and the list is pushed onto the stack. Pop the list out of the stack at the end of its traversal. If there are nested basic blocks, such as switch basic block and case basic block, the child basic block (case basic block) is stored as an element in the list structure of the parent basic block (switch basic block), in this way a hierarchy between basic blocks is established.