GUIFuzz++: Unleashing Grey-box Fuzzing on Desktop Graphical User Interfacing Applications
This program is tentative and subject to change.
Desktop applications represent one of today’s largest software ecosystems, accounting for over 96% of workplace computing and supporting essential operations across critical sectors such as healthcare, commerce, industry, and government. Though modern software is increasingly being vetted through fuzzing—an automated testing technique for large-scale bug discovery—a major component of desktop applications remains universally under-vetted: the Graphical User Interface (GUI). Existing desktop-based fuzzers like AFL++ and libFuzzer are limited to non-GUI interfaces (e.g., file- or buffer-based inputs), rendering them wholly incompatible with GUIs. Conversely, mobile app GUI fuzzers like Android’s Monkey and iOS’s XCMonkey rely on platform-specific SDKs and event-handling, rendering them fundamentally unportable to the broader, more complex landscape of desktop software. For these reasons, desktop GUI code remains largely under-tested, burdening users with numerous GUI-induced errors that should, in principle, be just as discoverable as any other well-fuzzed class of software bugs.
This paper introduces GUIFuzz++: the first general-purpose fuzzer for desktop GUI software. Unlike desktop fuzzers that randomly mutate file- or buffer-based inputs, GUIFuzz++ exclusively targets GUI interactions—clicks, scrolls, key presses, window navigation, and more—to uncover complex event sequences triggering GUI-induced program errors. Central to our approach is a novel GUI Interaction Interpreter: a middle-layer translating fuzzer-generated random inputs into distinct GUI operations, enabling successful non-GUI fuzzers like AFL++ to be easily ported to testing GUIs. Beyond supporting today’s most popular GUI development frameworks like QT, GTK, and Xorg, we introduce a suite of enhancements capitalizing on ubiquitous Software Accessibility Technologies, significantly boosting GUI fuzzing precision as well as GUI bug-finding effectiveness.
We integrate GUIFuzz++ as a prototype atop state-of-the-art GUI-agnostic fuzzer AFL++, and perform a large-scale ablation study of its fundamental components and enhancements. In an evaluation across 12 popular, real-world GUI applications, GUIFuzz++ uncovers 23 previously-unknown GUI-induced bugs— with 14 thus far confirmed or fixed by developers.
This program is tentative and subject to change.
Wed 19 NovDisplayed time zone: Seoul change
14:00 - 15:30 | |||
14:00 10mTalk | Adaptive and accessible user interfaces for seniors through model-driven engineering Journal-First Track Shavindra Wickramathilaka Monash University, John Grundy Monash University, Kashumi Madampe Monash University, Australia, Omar Haggag Monash University, Australia Link to publication DOI | ||
14:10 10mTalk | AppBDS: LLM-Powered Description Synthesis for Sensitive Behaviors in Mobile Apps Research Papers | ||
14:20 10mTalk | Large Language Models for Automated Web-Form-Test Generation: An Empirical Study Journal-First Track Tao Li Macau University of Science and Technology, Chenhui Cui Macau University of Science and Technology, Rubing Huang Macau University of Science and Technology (M.U.S.T.), Dave Towey University of Nottingham Ningbo China, Lei Ma The University of Tokyo & University of Alberta | ||
14:30 10mTalk | Beyond Static GUI Agent: Evolving LLM-based GUI Testing via Dynamic Memory Research Papers Mengzhuo Chen Institute of Software, Chinese Academy of Sciences, Zhe Liu Institute of Software, Chinese Academy of Sciences, Chunyang Chen TU Munich, Junjie Wang Institute of Software at Chinese Academy of Sciences, Yangguang Xue University of Chinese Academy of Sciences, Boyu Wu Institute of Software at Chinese Academy of Sciences, Yuekai Huang Institute of Software, Chinese Academy of Sciences, Libin Wu Institute of Software Chinese Academy of Sciences, Qing Wang Institute of Software at Chinese Academy of Sciences | ||
14:40 10mTalk | Who's to Blame? Rethinking the Brittleness of Automated Web GUI Testing from a Pragmatic Perspective Research Papers Haonan Zhang University of Waterloo, Kundi Yao University of Waterloo, Zishuo Ding The Hong Kong University of Science and Technology (Guangzhou), Lizhi Liao Memorial University of Newfoundland, Weiyi Shang University of Waterloo | ||
14:50 10mTalk | LLM-Cure: LLM-based Competitor User Review Analysis for Feature Enhancement Journal-First Track Maram Assi Université du Québec à Montréal, Safwat Hassan University of Toronto, Ying Zou Queen's University, Kingston, Ontario | ||
15:00 10mTalk | MIMIC: Integrating Diverse Personality Traits for Better Game Testing Using Large Language Model Research Papers Pre-print | ||
15:10 10mTalk | Debun: Detecting Bundled JavaScript Libraries on Web using Property-Order Graphs Research Papers Seojin Kim North Carolina State University, Sungmin Park Korea University, Jihyeok Park Korea University | ||
15:20 10mTalk | GUIFuzz++: Unleashing Grey-box Fuzzing on Desktop Graphical User Interfacing Applications Research Papers Pre-print | ||