ASE 2024
Sun 27 October - Fri 1 November 2024 Sacramento, California, United States
Tue 29 Oct 2024 16:42 - 16:54 at Camellia - Fuzzing 1 Chair(s): Parnian Kamran

Fuzz driver generation (FDG) is a fundamental technique for fuzzing library software. Existing FDG approaches have been highly successful with open-source libraries. However, in practice, due to the complex nature of OEM Android frameworks (e.g., customized compilation toolchains, extensive codebases, diverse C/C++ language features), it is not straightforward to integrate existing fuzz driver generation tools with OEM Android libraries. To address this challenge, we first systematically summarize the obstacles to applying existing tools (e.g., FuzzGen) to libraries of an OEM Android\footnote{Name is not provided yet, for anonymous concern}, including compatibility, usability, and effectiveness issues. Following this, we developed a new fuzz driver generation tool, namely \tool{}, specifically designed to tackle these obstacles one by one. In our evaluation, we demonstrate the advantages of \tool{} in real-world OEM Android frameworks. \tool{} is compatible with OEM Android and can generate fuzz drivers for all its libraries which are not supported by existing works. The additional analysis of the OEM Android code also enhances its usability within the system. Overall, \tool{} has helped automatically generate 21,457 fuzz drivers. Additionally, through fuzz driver ranking and selection solution, \tool figured out cut off 95% fuzz drivers which are less useful. \tool{} supports sophisticated C/C++ features in code analysis, ensuring effectiveness. Compared to hand-written fuzz drivers, \tool{} could generate and select fuzz drivers providing a 107.92% coverage improvement. Furthermore, they discovered 6 bugs, showcasing the capability of \tool{} to find real-world issues.

Tue 29 Oct

Displayed time zone: Pacific Time (US & Canada) change

16:30 - 17:30
Fuzzing 1Research Papers / Journal-first Papers / Industry Showcase / Tool Demonstrations at Camellia
Chair(s): Parnian Kamran University of California, Davis
16:30
12m
Talk
Magneto: A Step-Wise Approach to Exploit Vulnerabilities in Dependent Libraries via LLM-Empowered Directed Fuzzing
Research Papers
Zhuotong Zhou Fudan University, China, Yongzhuo Yang Fudan University, Susheng Wu Fudan University, Yiheng Huang Fudan University, Bihuan Chen Fudan University, Xin Peng Fudan University
16:42
12m
Talk
Applying Fuzz Driver Generation to Native C/C++ Libraries of OEM Android Framework: Obstacles and Solutions
Industry Showcase
Shiyan Peng Fudan University, Yuan Zhang Fudan University, Jiarun Dai Fudan University, Yue Gu Fudan University, Zhuoxiang Shen Fudan University, Jingcheng Liu Fudan University, Lin Wang Fudan University, Yong Chen OPPO, Yu Qin OPPO, Lei Ai OPPO, Xianfeng Lu OPPO, Min Yang Fudan University
16:54
12m
Talk
Olympia: Fuzzer Benchmarking for Solidity
Tool Demonstrations
Jana Chadt TU Wien, Austria, Christoph Hochrainer TU Wien, Valentin Wüstholz ConsenSys, Maria Christakis TU Wien
17:06
15m
Talk
BUGOSS: A Benchmark of Real-world Regression Bugs for Empirical Investigation of Regression Fuzzing Techniques
Journal-first Papers
Jeewoong Kim Chungbuk National University, Shin Hong Chungbuk National University
DOI Authorizer link Pre-print
17:21
15m
Talk
Learning Failure-Inducing Models for Testing Software-Defined Networks
Journal-first Papers
Raphaël Ollando University of Luxembourg, Seung Yeob Shin University of Luxembourg, Lionel Briand University of Ottawa, Canada; Lero centre, University of Limerick, Ireland