DriverGen: Automatic Driver Generation for Windows GUI program

Fuzz testing is the most effective method in software vulnerability detection. However, for programs on Windows platform, user graphical interface(GUI) obstructs fuzz testing process. In the existing solutions, manual writing fuzz driver widely used, but unable to large-scale applications due to the high requirement of reverse engineering ability. In order to solve this problem, we design the DriverGen, an automatic driver generation for Windows GUI program. DriverGen uses dynamic binary instrumentation to collect trace information of GUI programs, then rebuild function relation and, including function dependency extraction, LCA recognition and static control flow recovery to combine fuzz driver. We test DriverGen on 9 real GUI-programs in 4 different categories, such as Iqiyi Pictures and Format Factory. Compared with the manual driver, DriverGen improved the coverage of basic block and crashes. Our results show that DriverGen could identify 7 zero-day vulnerabilities, which 1 get CNVD and 1 get CVE number.