Coverage based fuzzing is a widespread vulnerability detection technique, and it has exposed many bugs in many real-world programs. However, its attention is to eliminate the testing on the repeated paths, yet it still employs random mutation to generate inputs, which is blind to penetrate complex comparisons in the program. As a result, the testing coverage is limited. Despite some solution proposals are presented, this problem is still partially solved. This paper argues that random mutation is mainly limited by two challenges, the sizable search spaceand the lack of a useful feedback to direct the search. Then we present an augmented fuzzing technique by addressing these two challenges. First of all, we point out a black relationship between input contents and comparison operands, which is dubbed connection. Second, we present a novel method to collect the comparison operands during execution, which is leveraged to infer the connections. Based on the connections, the fuzzer can learn about which input byte affects on which comparison instruction to establish a smaller search space. Third, the connection provides a useful feedback to direct the search. We resort to a modern meta-heuristic algorithm to satisfy this searching requirement. We developed a prototype and evaluated its performance on several benchmarks and four real-world programs. The experimental results demonstrate that works better than some other state-of-the-art fuzzers on bug detection, and can achieve a higher testing coverage. Moreover, we take a detailed statistic about the execution overhead in Pusher, and the results indicate that the execution overhead introduced by our approach is within an acceptable scope.
. [J]. Frontiers of Computer Science, 2022, 16(4): 164206.
Bin ZHANG, Jiaxi YE, Ruilin LI, Chao FENG, Yunfei SU, Chaojing TANG. Pusher: an augmented fuzzer based on the connection between input and comparison operand. Front. Comput. Sci., 2022, 16(4): 164206.
B P Miller , L Fredriksen , B So . An empirical study of the reliability of UNIX utilities. Communications of the ACM, 1990, 33( 12): 32– 44
2
H Liang , X Pei , X Jia , W Shen , J Zhang . Fuzzing: state of the art. IEEE Transactions on Reliability, 2018, 67( 3): 1199– 1218
3
K Serebryany. Continuous fuzzing with libfuzzer and addresssanitizer. In: Proceedings of IEEE Cybersecurity Development. 2016, 157– 157
4
S Gan, C Zhang, X Qin, X Tu, K Li, Z Pei, Z Chen. CollAFL: path sensitive fuzzing. In: Proceedings of IEEE Symposium on Security and Privacy. 2018, 679−696
5
L Demoura, N Bjørner. Z3: An efficient SMT solver. In: Proceedings of Tools and Algorithms for the Construction and Analysis of Systems. 2008, 337– 340
6
N Stephens, J Grosen, C Salls, A Dutcher, R Wang, J Corbetta, Y Shoshitaishvili, C Kruegel, G Vigna. Driller: augmenting fuzzing through selective symbolic execution. In: Proceedings of Network and Distributed System Security Symposium. 2016
7
L Zhao, Y Duan, H Yin, J Xuan. Send hardest problems my way: probabilistic path prioritization for hybrid fuzzing. In: Proceedings 2019 Network and Distributed System Security Symposium. 2019
8
B S Pak. Hybrid fuzz testing: discovering software bugs via fuzzing and symbolic execution. PhD thesis, Carnegie Mellon University Pittsburgh, PA, 2012
9
R Baldoni , E Coppa , D C Doelia , C Demetrescu , I Finocchi . A survey of symbolic execution techniques. Journal of ACM Computer Survey, 2018, 51( 3): 1– 39
10
H Peng, Y Shoshitaishvili, M Payer. T-Fuzz: fuzzing by program transformation. In: Proceedings of IEEE Symposium on Security and Privacy. 2018, 697– 710
11
Newsome J, Song D X. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In: Proceedings of the Network and Distributed System Security Symposium. 2005
12
S Rawat, V Jain, A Kumar, L Cojocar, C Giuffrida, H Bos. VUzzer: application-aware evolutionary fuzzing. In: Proceedings of Network and Distributed System Security Symposium. 2017
13
Dowser: A guided fuzzer to find buffer overflow vulnerabilities. In: Proceedings of the USENIX Security Symposium
14
P Chen, H Chen. Angora: efficient fuzzing by principled search. In: Proceedings of IEEE Symposium on Security and Privacy. 2018, 711– 725
15
Y Li, B Chen, M Chandramohan, S W Lin, Y Liu, A Tiu. Steelix: program-state based binary fuzzing. In: Proceedings of the Joint Meeting on Foundations of Software Engineering. 2017, 627– 637
16
J Ye , B Zhang , R Li , C Feng , C Tang . Program state sensitive parallel fuzzing for real world software. IEEE Access, 2019, 7 : 42557– 42564
17
M Böhme, V T Pham, A Roychoudhury. Coveragebased greybox fuzzing As Markov chain. In: Proceedings of ACM SIGSAC Conference on Computer and Communications Security. 2016, 1032−1043
18
C Lemieux, K Sen. FairFuzz: a targeted mutation strategy for increasing greybox fuzz testing coverage. In: Proceedings of ACM/IEEE International Conference on Automated Software Engineering. 2018, 475– 485
19
M Dave, R Agrawal. Search based techniques and mutation analysis in automatic test case generation: a survey. In: Proceedings of IEEE International Advance Computing Conference. 2015, 795– 799
20
M Harman, Y Jia, Y Zhang. Achievements, open problems and challenges for search based software testing. In: Proceedings of IEEE International Conference on Software Testing, Verification and Validation. 2015, 1– 12
21
G Fraser, A Arcuri. EvoSuite: automatic test suite generation for object-oriented software. In: Proceedings of ACM SIGSOFT Symposium and the 13th European Conference on Foundations of Software Engineering. 2011, 416– 419
22
J E Rowe. Genetic algorithm theory. In: Proceedings of Conference Companion on Genetic and Evolutionary Computation. 2007, 3585
23
Dolan-Gavitt B, Hulin P, Kirda E, Leek T, Mambretti A, Robertson W, Ulrich F, Whelan R. LAVA: large-scale automated vulnerability addition. In: Proceedings of IEEE Symposium on Security and Privacy. 2016, 110–121
24
C Lattner, V Adve. LLVM: a compilation framework for lifelong program analysis & transformation. In: Proceedings of IEEE International Symposium on Code Generation and Optimization. 2004, 75– 86
25
J Liang, Y Jiang, Y Chen, M Wang, C Zhou, J Sun. PAFL: extend fuzzing optimizations of single mode to industrial parallel mode. In: Proceedings of ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 2018, 809– 814
26
K Serebryany, D Bruening, A Potapenko, D Vyukov. AddressSanitizer: a fast address sanity checker. In: Proceedings of USENIX Annual Technical Conference. 2012, 309– 318
27
M Security. fuzzdata: fuzzing resources for feeding various fuzzers with input. Mozilla Security, December 2017
28
C Aschermann, S Schumilo, T Blazytko, R Gawlik, T Holz. REDQUEEN: fuzzing with input-to-state correspondence. In: Proceedings of Annual Network and Distributed System Security Symposium. 2019
29
K Böttinger, C Eckert. Deepfuzz: triggering vulnerabilities deeply hidden in binaries. In: Proceedings of International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment. 2016, 25– 34
30
M Wang, J Liang, Y Chen, Y Jiang, X Jiao, H Liu, X Zhao, J Sun. Safl: increasing and accelerating testing coverage with symbolic execution and guided fuzzing. In: Proceedings of International Conference on Software Engineering: Companion Proceeedings. 2018
31
M Cho, S Kim, T Kwon. Intriguer: field-level constraint solving for hybrid fuzzing. In: Proceedings of ACM SIGSAC Conference on Computer and Communications Security. 2019, 515– 530
32
W Gong, G Zhang, X Zhou. Learn to accelerate identifying new test cases in fuzzing. In: Proceeding of Security, Privacy, and Anonymity in Computation, Communication, and Storage. 2017, 298– 307
33
Y Wang , Z Wu , Q Wei , Q Wang . Neufuzz: efficient fuzzing with deep neural network. IEEE Access, 2019, 7 : 36340– 36352
34
D She, K Pei, D Epstein, J Yang, B Ray, S Jana. NEUZZ: efficient fuzzing with neural program smoothing. In: Proceedings of IEEE Symposium on Security and Privacy. 2019, 803– 817
35
T Wang, T Wei, G Gu, W Zou. Taintscope: a checksumaware directed fuzzing tool for automatic software vulnerability detection. In: Proceedings of IEEE Symposium on Security and Privacy. 2010, 497– 512
36
X Liu , Q Wei , Q Wang , Z Zhao , Z Yin . Cafa: a checksum-aware fuzzing assistant tool for coverage improvement. Journal of Security and Communication Networks, 2018, 2018 : 1– 13