关键词: 系统服务, 漏洞挖掘, Binder, 模糊测试, 遗传算法, 概率排序

Abstract: In order to solve the problem of low efficiency in mining service vulnerabilities in Android system by conventional fuzzy testing, this paper proposes and implements a framework for mining service vulnerabilities in Android system based on genetic algorithm, named ASFuzzer. The framework uses Binder driver to interact with system services to send test cases to the target. According to the feedback of the test results, the genetic algorithm is guided to continuously change the test parameters, and an efficient genetic selection operator model based on probability sorting and combination is proposed to improve the sample coverage and fuzzy test efficiency. Through the testing of the framework on mobile phones of different system versions, multiple system service vulnerabilities are discovered. Compared with the traditional fuzzy testing method, the experimental results show that the scheme has more advantages in the efficiency of vulnerability mining.

Key words: system service, vulnerability mining, Binder, fuzzy testing, genetic algorithm, probability ranking