# ObFuzzer: Object-Oriented Hybrid Fuzzer for Binaries
## 4 Design
### Static Analysis: Identifying and Scoring Information Related to Object Operations in the Program
#### 4.3.2 Scoring the Identified Information
Fuzzing from node \"b\" can reach more potential crash points with a higher PCP score and is more likely to crash than fuzzing from node \"a\" and node \"aa\". Therefore, node \"b\" should have a higher potential crash point's predecessor score than node \"a\" and node \"aa\". We call this score the PCPP (potential crash point's predecessor) score. As shown in Figure 4b, PCPP scores will not be increased if the score from the PCP has been raised before. For example, if the PCPP score of node \"a\" already includes the PCP score of node \"C\" when calculating the PCPP score, then the predecessor node \"aa\" will not recalculate the PCP score of node \"C\". This ensures that PCPP scores do not accumulate indefinitely. In the loop, when the PCPP score of the predecessor is not less than the successor, further analysis is not required. Potential crash points have a large number of predecessor nodes. The score of the predecessor node is calculated by accumulating the scores of the successor nodes. Therefore, the score of the predecessor node must not be less than that of the successor node. [PERSON] prefers to use the successor when the PCPP scores of the predecessor and successor are the same. This paper thinks the successor is closer to the potential crash point and has a higher probability of reaching it. Eventually, the PCPP high score node count is not very large. Figure 3: Scoring the potential crash point. ```
Input: The previously identified potential crash point list PotentialCrashPointList Result: The scores of potential crash point's predecessor list \(CurrentPCPPScorelist\) 1 Worklist \(\leftarrow\{PotentialCrashPointList\}\); forCurrentBasicBlockonCFG in Worklist do  CurrentPCPCSerial \(\leftarrow\) GetPCPCSerial(CurrentBasicBlockonCFG); \(CurrentPCPCPScorelist\leftarrow\) GetPCPCPScorelist(CurrentBasicBlockonCFG);  CurrentPCPHashlist \(\leftarrow\) GetHashlist(CurrentBasicBlockonCFG); ifCountlist(CurrentPCPCSerial) > 0 then ifHash(CurrentBasicBlockonCFG) not in CurrentPCPHashlist then \(CurrentPCPPScorelist\leftarrow\) CurrentPCPCPCSerial \(\cup\) CurrentPCPCSerial;  CurrentPCPHashlist \(\leftarrow\) CurrentPCPHashlist \(\cup\)  Hash(CurrentBasicBlockonCFG);  SetHashlist(CurrentPCPHashlist);  end if  end for  Predecessors \(\leftarrow\) GetPredecessorCFG(CurrentBasicBlockonCFG); forOnePredecessor in Predecessors do  PredecessorPCPCPScorelist \(\leftarrow\) GetPCPCPScorelist(OnePredecessor);  PredecessorPCPHashlist \(\leftarrow\) GetHashlist(OnePredecessor); forCurrentPCPCPScore, CurrentPCPHash in CurrentPCPPScorelist, CurrentPCHashlist do ifCurrentPCPHash not in PredecessorPCPHashlist then  PredecessorPCPScorelist \(\leftarrow\) PredecessorPCPScorelist \(\cup\)  CurrentPCPPScore;  PredecessorPCPHashlist \(\leftarrow\) PredecessorPCPHashlist \(\cup\)  CurrentPCPHash;  SetHashlist(PredecessorPCPHashlist);  end if  end for  end for  Worklist \(\leftarrow\) Worklist \(\cup\) Predecessors;  end for
```  
**Algorithm 2**Scoring the potential crash point's predecessor. Figure 4: Scoring PCPP. (**a**) Scoring the potential crash point’s predecessor. (**b**) Scoring the potential crash point’s predecessor with reduplicate PCP. **(3) Scoring the potential error point**  
When ObFuzzer finds a potential crash point of the program and calculates a high score predecessor of the potential crash point, this does not mean that ObFuzzer already found the error and triggered the crash. ObFuzzer also needs to find a specified path from the high score predecessor to the potential crash point. This specified path is the way that can cause the crash. A more complex path with more object operations will more likely trigger object-oriented program errors. Such a path is more effective than the sample path, which has fewer object operations. In the traditional procedure-oriented vulnerability-discovery technique, paths through more basic blocks or edges between basic blocks are considered more complex. Our object-oriented vulnerability-discovery techniques consider paths with more object operations more complex.