Windows Fuzzing Framework Based on Dynamic Tracing and Process Cloning

Existing security and fuzzing techniques for Windows operating systems have garnered substantial interest, but suffer from issues such as low efficiency, poor stability, challenges in circumventing the graphical user interface (GUI), and complicated interface framework construction. This paper introduces a method for creating a Windows platform Fork-Server based on process cloning technology, which improves fuzzer performance and stability. This method resolves the problems of low efficiency and unstable execution that are characteristic of existing fuzz testing methods. Moreover, This paper present a method for automating the construction of Fuzz Harness, which employs dynamic tracing technology to test the program’s core code and bypass GUI and related code logic. This technique decreases the development threshold and testing costs of fuzz testing while tackling the challenges of difficult GUI bypass and interface framework construction. This paper designed and implemented a fuzz testing framework named LQSWIN, which we evaluated against WinAFL in six categories and eight Windows applications. Experimental results demonstrate that LQSWIN performs significantly better than WinAFL, executing an average of 9.42 times faster with a maximum speed increase of 22.25 times. Additionally, LQSWIN detected an average of 3.30 times more basic blocks.