FormatFuzzer: Effective Fuzzing of Binary File Formats

Abstract

Effective fuzzing of programs that process structured binary inputs, such as multimedia files, is a challenging task, since those programs expect a very specific input format. Existing fuzzers, however, are mostly formatagnostic, which makes them versatile, but also ineffective when a specific format is required.We present FormatFuzzer, a generator for format-specific fuzzers. FormatFuzzer takes as input a binary template (a format specification used by the 010 Editor) and compiles it into C++ code that acts as parser, mutator, and highly efficient generator of inputs conforming to the rules of the language.The resulting format-specific fuzzer can be used as a standalone producer or mutator in black-box settings, where no guidance from the program is available. In addition, by providing mutable decision seeds, it can be easily integrated with arbitrary format-agnostic fuzzers such as AFL to make them format-aware. In our evaluation on complex formats such as MP4 or ZIP, FormatFuzzer showed to be a highly effective producer of valid inputs that also detected previously unknown memory errors in ffmpeg and timidity.CCS Concepts: • Software and its engineering → Software testing and debugging; Translator writing systems and compiler generators; Parsers; Syntax.

Fast Format-Aware Fuzzing for Structured Input Applications

“…We note such test cases as format-well. Representative work in this category includes: peach [7], LangFuzz [6], AFLSmart [8], QuickFuzz [9], FormatFuzzer [10], FaFuzzer [11].…”

“…Based on the given data definition template written in XML, peach [7] is widely used to generate a large number of test cases meeting the file format, network protocol, or API and tests the robustness with targets including file parsers, network services, and web browsers. Fuzzers [8][9][10][11] are also similar to peach in that the user-supplied format template is required to parse and construct test cases following the format requirements. This type of method is fast and comprehensive, but labor-intensive and cannot identify unknown input format targets.…”