QuickFuzz: an automatic random fuzzer for common file formats

Grieco, Gustavo; Ceresa, Martín; Buiras, Pablo

doi:10.1145/2976002.2976017

Cited by 24 publications

(20 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Future Work. Tinbergen generates a function's DCIS through the use of techniques employed by mutational fuzzers [6,22,24,35,62]. Another key component employed by mutational fuzzers (but currently unused by Tinbergen) is the use of code coverage to guide fuzzing.…”

Section: Discussionmentioning

confidence: 99%

“…Fuzz testers, or fuzzers, come in many avors, but mutational coverage-guided greybox fuzzers -the most widely used class of fuzzers today -are the most relevant to Tinbergen. Mutational fuzzers [3,6,8,10,21,22,24,30,38,46,53,55,60,62] take an initial seed input, randomly permute the input, and provide the target application with the permuted input in an a empt to nd new paths in the application. is process is then repeated rapidly in an e ort to cover as many code paths as possible.…”

Section: Tinbergen Designmentioning

confidence: 99%

See 1 more Smart Citation

Software Ethology: An Accurate, Resilient, and Cross-Architecture Binary Analysis Framework

McKee,

Burow,

Payer

2019

Preprint

View full text Add to dashboard Cite

When reverse engineering a binary, the analyst must rst understand the semantics of the binary's functions through either manual or automatic analysis. Manual semantic analysis is time-consuming, because abstractions provided by high level languages, such as type information, variable scope, or comments are lost, and past analyses cannot apply to the current analysis task. Existing automated binary analysis tools currently su er from low accuracy in determining semantic function identi cation in the presence of diverse compilation environments.We introduce So ware Ethology, a binary analysis approach for determining the semantic similarity of functions. So ware Ethology abstracts semantic behavior as classi cation vectors of program state changes resulting from a function executing with a specied input state, and uses these vectors as a unique ngerprint for identi cation. All existing semantic identi ers determine function similarity via code measurements, and su er from high inaccuracy when classifying functions from compilation environments di erent from their ground truth source. Since So ware Ethology does not rely on code measurements, its accuracy is resilient to changes in compiler, compiler version, optimization level, or even di erent source implementing equivalent functionality.Tinbergen, our prototype So ware Ethology implementation, leverages a virtual execution environment and a fuzzer to generate the classi cation vectors. In evaluating Tinbergen's feasibility as a semantic function identi er by identifying functions in coreutils-8.30, we achieve a high .805 average accuracy. Compared to the state-of-the-art, Tinbergen is 1.5 orders of magnitude faster when training, 50% faster in answering queries, and, when identifying functions in binaries generated from di ering compilation environments, is 30%-61% more accurate.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Tinbergen Designmentioning

confidence: 99%

Software Ethology: An Accurate, Resilient, and Cross-Architecture Binary Analysis Framework

McKee,

Burow,

Payer

2019

Preprint

View full text Add to dashboard Cite

show abstract

“…4.4.1 Accessible Models or Tools. Many fuzzers generate valid input iles based on accessible input models [3,56,57,100,115,136,147,181] or existing tools [75,153]. Input generation based on bare speciications requires heavy engineering eforts.…”

Section: Input Modelmentioning

confidence: 99%

Fuzzing: A Survey for Roadmap

et al. 2022

View full text Add to dashboard Cite

Fuzz testing (fuzzing) has witnessed its prosperity in detecting security flaws recently. It generates a large number of test cases and monitors the executions for defects. Fuzzing has detected thousands of bugs and vulnerabilities in various applications. Although effective, there lacks systematic analysis of gaps faced by fuzzing. As a technique of defect detection, fuzzing is required to narrow down the gaps between the entire input space and the defect space. Without limitation on the generated inputs, the input space is infinite. However, defects are sparse in an application, which indicates that the defect space is much smaller than the entire input space. Besides, because fuzzing generates numerous test cases to repeatedly examine targets, it requires fuzzing to perform in an automatic manner. Due to the complexity of applications and defects, it is challenging to automatize the execution of diverse applications. In this paper, we systematically review and analyze the gaps as well as their solutions, considering both breadth and depth. This survey can be a roadmap for both beginners and advanced developers to better understand fuzzing.

show abstract

“…Such strategy to create inputs produces inputs that are syntactically valid by construction. We analyzed four grammar-based fuzzers-Grammarinator [36], jsfunfuzz [57], Lang-Fuzz [37], and Megadeth [33]. Unfortunately, none of those were effective outof-the-box.…”

Section: Fuzzersmentioning

confidence: 99%

Exposing Bugs in JavaScript Engines through Test Transplantation and Differential Testing

Lima

Silva

Miranda

et al. 2020

Preprint

View full text Add to dashboard Cite

Context. JavaScript is a popular programming language today with several implementations competing for market dominance. Although a specification document and a conformance test suite exist to guide engine development, bugs occur and have important practical consequences. Implementing correct engines is challenging because the spec is intentionally incomplete and evolves frequently. Objective. This paper investigates the use of test transplantation and differential testing for revealing functional bugs in JavaScript engines. The former technique runs the regression test suite of a given engine on another engine. The latter technique fuzzes existing inputs and then compares the output produced by different engines with a differential oracle. Method. We conducted experiments with engines from five major players-Apple, Facebook, Google, Microsoft, and Mozilla-to assess the effectiveness of test transplantation and differential testing. Results. Our results indicate that both techniques revealed several bugs, many of which confirmed by developers. We reported 35 bugs with test transplantation (23 of these bugs confirmed and 19 fixed) and reported 24 bugs with differential testing (17 of these confirmed and 10 fixed). Results indicate that most of these bugs affected two engines-Apple's JSC and Microsoft's ChakraCore (24 and 26 bugs, respectively). To summarize, our results show that test transplantation and differential testing are easy to apply and very effective in finding bugs in complex software, such as JavaScript engines.

show abstract

QuickFuzz: an automatic random fuzzer for common file formats

Cited by 24 publications

References 9 publications

Software Ethology: An Accurate, Resilient, and Cross-Architecture Binary Analysis Framework

Software Ethology: An Accurate, Resilient, and Cross-Architecture Binary Analysis Framework

Fuzzing: A Survey for Roadmap

Exposing Bugs in JavaScript Engines through Test Transplantation and Differential Testing

Contact Info

Product

Resources

About