BitAFL: Provide More Accurate Coverage Information for Coverage-guided Fuzzing

Abstract

CGF (Coverage-guided fuzzing) has found a large number of software vulnerabilities with its low cost and adaptability. CGF mutates at the bit or byte level, so most of the mutated test cases cover the same paths. But no previous work had quantified the percentage of test cases that covered the duplicate paths. Therefore, we designed the experimental framework GSPR (get same path rate) based on AFL. We fuzzed seven applications using GSPR and found that approximately 70% of the test cases covered duplicate paths. Based on the above experimental results, we solve the hash collision issue in AFL. We analyzed the various situations that cause hash collision, and introduced the concepts of local collision and global collision. Because a large number of test cases cover duplicate paths, there are much repeated global collision. Based on these findings, we propose different solutions to hash collision according to the size of target program. We extended AFL to implement BitAFL and evaluated it on seven applications. In a comparison experiment with AFL, the results show that our method can completely eliminate hash collisions in small programs. In large programs, BitAFL is able to reduce collisions by more than 80%. In addition, on average, BitAFL found 8.87% more paths than AFL. In summary, our approach provides AFL with more accurate coverage information and can find more paths.