Fuzztura: An Android Runtime Fuzzer : Fuzzing for structural and type confusion vulnerabilities in Android Runtime

Sammanfattning

Modern fuzzing techniques are largely ineffective at identifying silentsemantic discrepancies and structural flaws in the Android Runtime (ART) that escape conventional crash detection heuristics. This thesis introduces a strategic dual tool framework, FUZZTURA and ARTFUZZION, to comprehensively evaluate ART’s security. ARTFUZZION adaptsa contract based semantic fuzzing methodology from the Java virtual machine (JVM) tool Confuzzion, to the Android runtime. ARTFUZZION successfully generated an input to trigger CVE-2017-3272 with anempty starting seed in a median of 7.1 hours using an optimized headless emulator configuration. FUZZTURA executes low level structuralfuzzing on Dalvik Executable (DEX) files to expose parser differentialsvia differential testing across multiple runtime versions. Navigating arugged binary fitness landscape, FUZZTURA employs a Multi-Armed Bandit algorithm with logarithmic reward dampening alongside simulated annealing to balance operator exploration and exploitation. Beyond detecting the known dexopt vulnerability, FUZZTURA successfully uncovered a verification blind spot that permits non-static constructors in an interface, as well as a circular inheritance resource exhaustion bug in Android 4.3. Both of these were known to the Android developers and have been patched. Together, these tools bridgethe gap between superficial binary testing and deep vulnerability discovery within the Android runtime.