用大模型自动测试混淆器是否改变程序逻辑,发现11个隐藏漏洞。
OBsmith: LLM-Powered JavaScript Obfuscator Testing
- 用大模型生成代码模板,自动生成测试用例
- 发现11个传统模糊测试无法检测的语义错误
- 适合安全研究者和工具链开发者使用
JavaScript混淆器广泛用于保护知识产权和抵御逆向工程,但其正确性常被忽视,远低于性能与抗解混淆能力的关注。现有评估多聚焦于抗解混淆效果,却未回答混淆是否保持程序语义这一关键问题。错误的变换可能悄然改变功能,损害可靠性并削弱安全性,背离混淆初衷。为此,我们提出OBsmith,一个基于大语言模型(LLM)的系统化测试框架,用于测试JavaScript混淆器。OBsmith利用LLM生成涵盖多样语言结构、编程习惯和边界情况的程序草图,并实例化为可执行程序,在不同配置下进行混淆测试。此外,还通过从真实程序中自动提取草图,实现对特定项目特性的聚焦测试,支持开发者注入领域知识。OBsmith共发现11个此前未知的正确性缺陷;在同等程序预算下,五种主流JavaScript模糊测试工具(FuzzJIT、Jsfunfuzz、Superion、DIE、Fuzzilli)均未能发现这些问题,凸显其对混淆引入行为异常的互补检测能力。消融实验表明,除通用元变换关系(MRs)外,其余组件均至少贡献于一类错误;负结果提示需针对具体混淆器设计专属元变换关系。研究还引发关于混淆预设与性能代价平衡的讨论。我们视OBsmith为自动化测试与质量保障混淆器及其他语义保持工具链的重要一步。
原文摘要 · Abstract (English)
JavaScript obfuscators are widely deployed to protect intellectual property and resist reverse engineering, yet their correctness has been largely overlooked compared to performance and resilience. Existing evaluations typically measure resistance to deobfuscation, leaving the critical question of whether obfuscators preserve program semantics unanswered. Incorrect transformations can silently alter functionality, compromise reliability, and erode security-undermining the very purpose of obfuscation. To address this gap, we present OBsmith, a novel framework to systematically test JavaScript obfuscators using large language models (LLMs). OBsmith leverages LLMs to generate program sketches abstract templates capturing diverse language constructs, idioms, and corner cases-which are instantiated into executable programs and subjected to obfuscation under different configurations. Besides LLM-powered sketching, OBsmith also employs a second source: automatic extraction of sketches from real programs. This extraction path enables more focused testing of project specific features and lets developers inject domain knowledge into the resulting test cases. OBsmith uncovers 11 previously unknown correctness bugs. Under an equal program budget, five general purpose state-of-the-art JavaScript fuzzers (FuzzJIT, Jsfunfuzz, Superion, DIE, Fuzzilli) failed to detect these issues, highlighting OBsmith's complementary focus on obfuscation induced misbehavior. An ablation shows that all components except our generic MRs contribute to at least one bug class; the negative MR result suggests the need for obfuscator-specific metamorphic relations. Our results also seed discussion on how to balance obfuscation presets and performance cost. We envision OBsmith as an important step towards automated testing and quality assurance of obfuscators and other semantic-preserving toolchains.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。