Abstract: Systems written in C often contain potential memory vulnerabilities.Fuzz testing integrated with dynamic analysis tools can uncover memory vulnerabilities but introduce significant performance overhead.Meanwhile,current popular fuzz testing me-thods focus more on improving overall code coverage,while efficiently triggering memory vulnerabilities in already covered code is also an important capability.To this end,the dynamic analysis tool Movec is improved and combined with AFL,with the innovative work primarily using pointer metadata to guide fuzz testing for efficient memory vulnerability detection.The core steps include using a source-level hash table and secondary tree to manage pointer metadata to reduce page faults caused by combining fuzz testing with dynamic analysis.Then it removes coverage instrumentation of dynamic analysis code at the assembly level to reduce the impact of redundant instrumentation on coverage calculation.Subsequently it adds minimum pointer boundary distance and memory allocation peak indicators to guide fuzz testing in efficiently detecting buffer overflows and memory allocation failure vulnerabilities,and finally optimizes the seed queue filtering logic to streamline queue size and prioritize seeds related to memory vulnerabilities.Experiments on CVE programs show that the execution throughput of Movec combined with AFL is 54% of native,while Asan and Msan are only 10% and 4%,respectively.Compared with advanced fuzzers,it can uncover memory vulnerabilities in a shorter time,reducing the time consumption by an average of 48.4%.

Key words: Memory safety, Dynamic analysis, Fuzzing, Source-level instrumentation