TensileFuzz: Facilitating Seed Input Generation in Fuzzing via String Constraint Solving
Fri 22 Jul 2022 07:40 - 08:00 at ISSTA 1 - Session 2-13: Fuzzing and Friends B
Seed inputs are critical to the performance of mutation based fuzzers. Existing techniques make use of symbolic execution and gradient descent to generate seed inputs. However, these techniques are not particular suitable for input growth (i.e., making input longer and longer), a key step in seed input generation. Symbolic execution models very low level constraints and prefer fix-sized inputs whereas gradient descent only handles cases where path conditions are arithmetic functions of inputs. We observe that growing an input requires considering a number of relations: length, offset, and count, in which a field is the length of another field, the offset of another field, and the count of some pattern in another field, respective. Theory of string solver is particularly suitable for addressing these relations. We hence propose a novel technique called TensileFuzz, in which we identify input fields and denote them as string variables such that a seed input is the concatenation of these string variables. Additional padding string variables are inserted in between field variables. The aforementioned relations are reverse-engineered and lead to string constraints, solving which instantiates the padding variables and hence grows the input. Our technique also integrates linear regression and gradient descent to ensure the grown inputs satisfy path constraints that lead to path exploration. Our comparison with AFL, and a number of state-of-the-art fuzzers that have similar target applications, including Qsym, Angora, and SLF, shows that TensileFuzz substantially outperforms the others, by 39% - 98% in terms of path coverage.
Fri 22 JulDisplayed time zone: Seoul change
01:40 - 02:20 | |||
01:40 20mTalk | Efficient Greybox Fuzzing of Applications in Linux-based IoT Devices via Enhanced User-mode Emulation Technical Papers Yaowen Zheng Nanyang Technological University; Beijing Key Laboratory of IOT Information Security Technology, Institute of Information Engineering, CAS, China;, Yuekang Li Nanyang Technological University, Cen Zhang Nanyang Technological University, Hongsong Zhu Beijing Key Laboratory of IOT Information Security Technology, Institute of Information Engineering, CAS, China; School of Cyber Security, University of Chinese Academy of Sciences, China, Yang Liu Nanyang Technological University, Limin Sun Beijing Key Laboratory of IOT Information Security Technology, Institute of Information Engineering, CAS, China; School of Cyber Security, University of Chinese Academy of Sciences, China DOI | ||
02:00 20mTalk | TensileFuzz: Facilitating Seed Input Generation in Fuzzing via String Constraint Solving Technical Papers Xuwei Liu Purdue University, USA, Wei You Renmin University of China, Zhuo Zhang Purdue University, Xiangyu Zhang Purdue University DOI |
07:00 - 08:00 | |||
07:00 20mTalk | PrIntFuzz: Fuzzing Linux Drivers via Automated Virtual Device Simulation Technical Papers Zheyu Ma , Bodong Zhao Tsinghua University, Letu Ren Department of Computer Science and Technology, Tsinghua University, Zheming Li Tsinghua University, Siqi Ma the University of Queensland, Xiapu Luo Hong Kong Polytechnic University, Chao Zhang Tsinghua University DOI | ||
07:20 20mTalk | SLIME: Program-sensitive Energy Allocation for Fuzzing Technical Papers Chenyang Lyu Zhejiang University, Hong Liang Zhejiang University, Shouling Ji Zhejiang University, Xuhong Zhang Zhejiang University, Binbin Zhao Georgia Institute of Technology, Meng Han Binjiang Institute of Zhejiang University & Zhejiang University, Yun Li Huawei Technologies Co., Ltd., Zhe Wang State Key Laboratory of Computer Architecture, Institute of Computing Technology, Chinese Academy of Sciences, Wenhai Wang Zhejiang University, Raheem Beyah Georgia Institute of Technology DOI | ||
07:40 20mTalk | TensileFuzz: Facilitating Seed Input Generation in Fuzzing via String Constraint Solving Technical Papers Xuwei Liu Purdue University, USA, Wei You Renmin University of China, Zhuo Zhang Purdue University, Xiangyu Zhang Purdue University DOI |