Inferring Input Grammars from Dynamic Control Flow
This addresses the issue of unavailable or outdated input models for programs, which is crucial for vulnerability analysis, reverse engineering, fuzzing, and software testing, though it is incremental as it builds on existing grammar inference methods.
The paper tackles the problem of automatically inferring readable context-free grammars for program input languages from dynamic control flow, using a small set of sample inputs without program-specific heuristics. The Mimid prototype produced accurate and readable grammars for subjects like expr, URLparse, and microJSON.
A program is characterized by its input model, and a formal input model can be of use in diverse areas including vulnerability analysis, reverse engineering, fuzzing and software testing, clone detection and refactoring. Unfortunately, input models for typical programs are often unavailable or out of date. While there exist algorithms that can mine the syntactical structure of program inputs, they either produce unwieldy and incomprehensible grammars, or require heuristics that target specific parsing patterns. In this paper, we present a general algorithm that takes a program and a small set of sample inputs and automatically infers a readable context-free grammar capturing the input language of the program. We infer the syntactic input structure only by observing access of input characters at different locations of the input parser. This works on all program stack based recursive descent input parsers, including PEG and parser combinators, and can do entirely without program specific heuristics. Our Mimid prototype produced accurate and readable grammars for a variety of evaluation subjects, including expr, URLparse, and microJSON.