# ObFuzzer: Object-Oriented Hybrid Fuzzer for Binaries
## 4 Design
### Static Analysis: Identifying and Scoring Information Related to Object Operations in the Program
#### 4.3.2 Scoring the Identified Information  
Since the ultimate purpose of the static analysis module is to assist the subsequent dynamic analysis tools, it guides the program to the position that is more worthy of testing and tries to test more complex object operations. Therefore, after ObFuzzer identified objects to the potential crash points and the basic blocks related to the potential crash point's object, ObFuzzer needs to score the potential crash points and the basic blocks related to the potential crash point's object. **(1) Scoring the potential crash point**  
From a programming perspective, if an object is operated by more basic blocks, it is more difficult for the programmer to guarantee its security. Moreover, it is more likely to trigger an object-oriented vulnerability. ObFuzzer needs to conduct more testing on such objects. We can see from Algorithm 1 that when ObFuzzer scores a potential crash point, ObFuzzer tracks the predecessor node related to the potential crash point on the data dependency graph. It will obtain a higher score when a potential crash point has more predecessor nodes (this can be many layers). Because more predecessor nodes represent that they can be more complex operations, security is more difficult to guarantee. ```
Input: The previously identified potential crash point \(PotentialCrashPoint\) Result: The score of potential crash point \(PCPScore\)
1 Worklist \(\leftarrow\{PotentialCrashPoint\}\);
2\(PCPScore\gets 0\);
3 forCurrentInfoonDDG in Worklist do
4 Predecessors \(\leftarrow\) GetPredecessorDDG(CurrentInfoonDDG);
5\(PCPScore\gets PCPScore+\) CountPredecessors(Predecessors);
6 Worklist \(\leftarrow\) Worklist \(\cup\) Predecessors;
7
8 end for
```  
**Algorithm 1**Scoring the potential crash point. As shown in Figure 3, the number of predecessor nodes of node \"A\" is 3 and the number of predecessor nodes of node \"B\" is 1 (data dependency graph). The security of node \"A\" is more difficult to guarantee than that of node \"B\". This paper thinks the program is more likely to crash at node \"A\" than at node \"B\". Therefore, node \"A\" should have a higher potential crash point score than node \"B\". We call this score PCP (potential crash point) score. (2) Scoring the potential crash point's predecessor  
The premise of causing a program to crash at a potential crash point is that an error occurred in the execution of the program before the potential crash point (in most cases, especially object-oriented vulnerabilities). If the previous program is executed normally, the program will not crash even at the potential crash point. Therefore, the analysis of the predecessor nodes of the potential crash point is significant. We can see from Algorithm 2 that when ObFuzzer scores a potential crash point's predecessor, ObFuzzer tracks the predecessor nodes of potential crash points on the control flow graph and calculates the PCPP scores for these predecessor nodes. ObFuzzer accumulates the PCPP scores from the successor nodes to the predecessor nodes with the PCP scores uniquely. The unique PCP scores are achieved with the Hash method. Only for a PCP Hash that does not exist in the Hashlist can the score be accumulated. If a basic block can reach more potential crash points and these potential crash points have a higher PCP score, this paper thinks there is a higher probability of composing a valid order of object operations to try to trigger a crash of a potential crash point. Therefore, in calculating the potential crash point's predecessor scores, ObFuzzer starts with the potential crash point and iterates over the predecessor node of the potential crash point. Then it accumulates the successor node's PCP score of the current node. As shown in Figure 4a, node \"a\" has only one successor node with a PCP score of 3, node \"b\" has a successor node with a PCP score of 3 and a successor node with a PCP score of 2 and node \"aa\" has a successor node with a PCP score of 3 and a successor node with a PCP score of 1 (control flow graph).