I have been fuzzing Adobe Reader lately.

One of the issues that I face is Code coverage. How do I determine that I have covered all the basic blocks in Adobe Reader and it's libraries.

Is there any script or tool to find basic blocks of all selected EXE and DLL statically. I mean, I want to get all the Basic Blocks in the corresponding EXE's and libraries.

Currently, I'm using PIN to do so. But, it does not show how many basic blocks I have covered.

My aim is to create a script that will scan the given directory and write all the basic blocks in a file so that I can create a graph and so.

Please share your expert views.

  • Can you link to the precise tools you are using? – baordog Jun 23 '14 at 18:28
  • Currently, I'm using PIN to do so. I use Minset to find the minimum set from the corpus. But I have no idea how much code coverage I have done, because there is no way to keep track of the same. – john4tech Jun 25 '14 at 8:39

Correct disassembly of an executable is known to be undecidable in the general case (this problem can obviously be related to the famous halting problem of a Turing machine).

So, extracting all the basic blocks of a binary program is a very difficult problem.

Yet, there are several techniques to try to approach a best effort coverage of the instructions. One of the most efficient technique is to use, both, concrete and symbolic exploration of the program. This is what is implemented in the Microsoft Research SAGE tool. See Patrice Godefroid's homepage.

Unfortunately, the SAGE tool is only for Microsoft Research internal use. But, in fact, Patrice Godefroid's first idea is at the origin of many other tools such as:

Anyway, there is still plenty of room to implement new tools with better handling of the binary program and with better support. So, feel free to start ! ;-)

Hope this helped.

  • Dear perror: you may forget FuzzWin that is presented recently at SSTIC 2014 (here is the link to the source code github.com/piscou/FuzzWin). I personally have implemented a very similar tool, but with simpler approach. I read the paper of Godefroid, but at this time I have not found any reliable IR for x86-64 instructions so I just omit it, and implement a application-layer reverse execution based on Pin. – Ta Thanh Dinh Jun 24 '14 at 0:11
  • You are absolutely right, I forgot FuzzWin which was presented at SSTIC'14. I will add it to the list. Concerning the IR, several tools propose their own, but unfortunately nobody seems to agree on one unique format (it seems that IR is something that you redo each time). Yet, all of them are extremely similar to each others, I do believe that translators between these formats are possible. – perror Jun 24 '14 at 6:26
  • Thank you perror. But I'm looking for a solution which can find the basic blocks of a binary program(without source) without dynamically running it. – john4tech Jun 25 '14 at 8:47
  • Then, the disassemblers of metasm, miasm, or the cfgrecovery tool from the Insight framework might do the job. All of them are using static techniques to disassemble the binary. I would also advise you to look at BAP (though it is not totally available). Finally, this list of tools and projects might be helpful as well. – perror Jun 25 '14 at 8:51
  • I found this I'm looking similar tools. One of the promising tool is Pyew. Thanks perror – john4tech Jun 25 '14 at 9:07

You can write an IDA script or create an IDA plugin to gather all basic blocks in a program. Sample plugin code to gather all basic blocks can be found in http://www.hexblog.com/ida_pro/files/coverit.zip -

// Find all basic blocks in the specified area
static bool gather_basic_blocks(ea_t ea1, ea_t ea2)
  show_wait_box("Finding basic blocks");
  ea_t start = BADADDR;
  bool ok = true;
  int cnt = 0;
  while ( true )
    if ( wasBreak() )
      ok = false;
    if ( ++cnt == 1000 )
      cnt = 0;
    if ( start == BADADDR )
      ea1 = nextthat(ea1, ea2, f_isCode, NULL);
      if ( ea1 >= ea2 )
      start = ea1;
    while ( ea1 < ea2 )
      if ( !ua_ana0(ea1) )
      ea1 = get_item_end(ea1);
      if ( is_basic_block_end(true) )
    if ( ea1 != start )
      bbs[start] = ea1 - start; // remember the bb start and size
    if ( !isCode(get_flags_novalue(ea1)) )
      start = BADADDR;
      start = ea1;
  return ok;
  • Yeah, we can use IDA Pro to do this. But I do not want to depend on IDA for this. That's why I'm trying to write a script that can find the basic blocks of the application without using IDA pro. Basically, my aim is to create a program that can find basic blocks without running it(If it's possible). – john4tech Jun 25 '14 at 8:44
  • To find basic blocks, you'll need a disassembler. IDA is a disassembler, and any alternative solution you find will still be based on a disassembler or a disassembler library. – Jason Geffner Jun 25 '14 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.