Binary Level Concolic Execution on Windows with Rich Instrumentation Based Taint Analysis

Windows programs are widely used. The effective testing of Windows applications can prevent financial losses. Currently, there are only a few tools that can test programs without source code on Windows. The state-of-art WinAFL tool suffers from the poor testing efficiency. Most of the other tools rely on analysing the source code on Linux. Concolic execution based on binary code is an efficient method to discover defects in program without source code. In this paper, we present WinTaintCE, which mainly uses Rich Instrument-based taint analysis technique for instruction refinement. The data in the input file of fuzzing tasks will be marked as the tainted source. All instructions that are flowing through tainted data will be extracted for symbolic execution. However, this step will overlook many instructions for calculating non tainted data. Thus, we innovatively propose Rich Instrument technology, which saves the values on all registers and memory addresses involved in an instruction to a trace file. During concolic execution based on that trace file, those saved values will be set directly for non tainted data in an instruction. Experimental results show that WinTaintCE can explore about 24%–130% more paths compared to WinAFL. Also, 96%–99% reduction in the number of instructions need to be analysed compared to existing binary analysis tools on Windows also proves the effectiveness of the methodology of this paper.