Decoupling Dynamic Test Generation from Specific Operating System Details Based on Whole System Virtual Machine

Dynamic test generation approach is becoming increasingly popular to find security vulnerabilities in software. However, such existing approaches and tools are not retargetable and can only find vulnerabilities over a specific OS because the execution trace is totally OS-independently recorded in these tools. This paper presents a new dynamic test generation technique and a tool, ReTBLDTG, short for ReTargetable Dynamic Test Generation, that implements this technique. Unlike other such techniques that can only operate over a specific OS, ReTBLDTG can process the programs over any OSes. ReTBLDTG is based on the whole system virtual machine that provides OS-independent and fast concrete execution of the target program. And which thread the executing instruction belongs to is OS-independently identified by analyzing the registers' value and hardware events over the virtual machine. Thus, the execution trace is recorded, without knowing the internal structure of the guest OS. We have implemented our ReTBLDTG and used it to automatically find the six known bugs in the six benchmarks over Linux and Windows. Our results indicate that our ReTBLDTG can operate on any OSes; and ReTBLDTG can effectively find bugs located deep within large applications over any OSes.