CONFETTI: Amplifying Concolic Guidance for Fuzzers
CONFETTI: Amplifying Concolic Guidance for Fuzzers
复制标题
DOI：
10.1145/3510003.3510628
复制
发表时间：
2022-05
期刊：
影响因子：
--
通讯作者：
J. Kukucka;Luís Pina;P. Ammann;Jonathan Bell
中科院分区：
文献类型：
--
作者：
J. Kukucka;Luís Pina;P. Ammann;Jonathan Bell
Fuzz Testing（Fuzzing）允许开发人员通过生成用于应用程序的输入来检测错误和漏洞，从而使应用程序的输入来进行操作。 uzed fuzzing有助于涵盖棘手的分支由复杂的条件（所谓的“魔术价值”），通常会将特定的字节值放置在某些输入的特定偏移量中，以覆盖分支机构，但是在实践中，这些动态分析不是完美的。简单但有效的技术暗示，Fuzzer不仅可以在目标位置插入这些有趣的字节，而且可以在任何输入中实现此想法，从而创建了五核，该五果都使用了与全球范围内的fosemers and the the-avabers the-Artbox the-Arts the-Arts of the-Arts of the-Arts，五彩纸屑覆盖更多分支机构并找到了15个以前未报告的错误，其中包括基线都无法通过对五彩纸屑的执行后进行验尸分析。
Fuzz testing (fuzzing) allows developers to detect bugs and vul-nerabilities in code by automatically generating defect-revealing inputs. Most fuzzers operate by generating inputs for applications and mutating the bytes of those inputs, guiding the fuzzing pro-cess with branch coverage feedback via instrumentation. Whitebox guidance (e.g., taint tracking or concolic execution) is sometimes in-tegrated with coverage-guided fuzzing to help cover tricky-to-reach branches that are guarded by complex conditions (so-called “magic values”). This integration typically takes the form of a targeted in-put mutation, e.g., placing particular byte values at a specific offset of some input in order to cover a branch. However, these dynamic analysis techniques are not perfect in practice, which can result in the loss of important relationships between input bytes and branch predicates, thus reducing the effective power of the technique. We introduce a new, surprisingly simple, but effective technique, global hinting, which allows the fuzzer to insert these interesting bytes not only at a targeted position, but in any position of any input. We implemented this idea in Java, creating Confetti, which uses both targeted and global hints for fuzzing. In an empirical com-parison with two baseline approaches, a state-of-the-art greybox Java fuzzer and a version of Confetti without global hinting, we found that Confetti covers more branches and finds 15 previously unreported bugs, including 9 that neither baseline could find. By conducting a post-mortem analysis of Confetti's execution, we determined that global hinting was at least as effective at revealing new coverage as traditional, targeted hinting.