SYSTEM AND METHOD FOR ANALYZING UNKNOWN FILE FORMAT TO PERFORM SOFTWARE SECURITY TEST

• US 20080115016A1
• Filed: 09/06/2007
• Published: 05/15/2008
• Est. Priority Date: 11/13/2006
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Hong, Soon Jwa, Kim, Hyoung Chun, CHOI, Young Han
• Application Number:
  US11/850,921
• Publication Number:
  US 20080115016A1
• Time in Patent Office: Days
• US Class Current: 714/701
• CPC Class Codes: G06F 11/3676 for coverage analysis

Abstract

A system and method for analyzing a file format to perform a software security test are provided. The system includes a file scanner for monitoring a program that loads an unknown file on a memory and parsing function parameters of the loaded file, and a file analyzer for receiving the parsing data from the file scanner and extracting a field location and a data type of the unknown file format.

Claims

1. A system for analyzing a file format to perform a software security test, comprising:

a file scanner for monitoring a program that loads an unknown file on a memory and parsing function parameters of the loaded file; and

a file analyzer for receiving the parsing data from the file scanner and extracting a field location and a data type of the unknown file format.

2. The system of claim 1, wherein the file scanner is a debugger that traces a function when an unknown file is loaded on a memory.

3. The system of claim 1, wherein the file analyzer compares the function parameter with the loaded file to extracts a field location and a data type of a file format.

4. A method for analyzing a file format to perform a software security test, comprising the steps of:

a) at a file scanner, monitoring operation of a corresponding program that loads an unknown file on a memory;

b) parsing function parameters of the loaded file;

c) extracting a field location and a data type of an unknown file format based on the parsing data received from a file analyzer; and

d) changing a value for a fault computation in consideration of the extracted field location and data type.

5. The method of claim 4, wherein in the step b), data is extracted after classified into a number type and a string type according to use in a stack and the extracted data is parsed according to a file format.

6. The method of claim 5, wherein a function parameter value corresponding to the number type and the string type is defined as one of an address pointing a predetermined data of a file, a number, and data generated by software.

7. The method of claim 6, wherein if the function parameter value is an address pointing a predetermined data of a file loaded on a memory, the function parameter value is used as one of a character string in which a corresponding address value is used in a function related to the character string and a data structure that is decomposed into a plurality of numbers and an address pointing a predetermined data in a later function call.

8. The method of claim 6, wherein if the function parameter value is the number, a position in a file and the number of bytes are detected and a fault related to the number is calculated when fault insertion is performed later.

9. The method of claim 6, wherein if the function parameter value is data generated by software, the function parameter value is used as an address pointing predetermined data.

10. The method of claim 5, wherein the step c) includes the steps of:

c-1) inspecting parameters when a function is called;

c-2) performing an analysis process based on predetermined cases corresponding to the number of parameters of the function; and

c-3) storing the analysis result.

11. The method of claim 10, wherein if the case is an address pointing a predetermined data of a file loaded on a memory, a location and a range of a data region stored in a memory and a pointer pointing the data region are stored for monitoring data later.

12. The method of claim 11, wherein the stored location and range of the data region stored in the memory and the pointer pointing the data region are used to extract a data type when a function is called later.

13. The method of claim 10, wherein if the case is a number, a field location of a file including a corresponding parameter value and a data type are stored.

14. The method of claim 10, wherein if the case is data generated by a program, the generated data value is ignored.

15. The method of claim 9, wherein the step c) includes the steps of:

c-1) inspecting parameters when a function is called;

c-2) performing an analysis process based on predetermined cases corresponding to the number of parameters of the function; and

c-3) storing the analysis result.

16. The method of claim 8, wherein the step c) includes the steps of:

c-1) inspecting parameters when a function is called;

c-2) performing an analysis process based on predetermined cases corresponding to the number of parameters of the function; and

c-3) storing the analysis result.

17. The method of claim 7, wherein the step c) includes the steps of:

c-1) inspecting parameters when a function is called;

c-2) performing an analysis process based on predetermined cases corresponding to the number of parameters of the function; and

c-3) storing the analysis result.

18. The method of claim 6, wherein the step c) includes the steps of:

c-1) inspecting parameters when a function is called;

c-2) performing an analysis process based on predetermined cases corresponding to the number of parameters of the function; and

c-3) storing the analysis result.