Same Coverage, Less Bloat: Accelerating Binary-only Fuzzing with Coverage-preserving Coverage-guided Tracing
Same Coverage, Less Bloat: Accelerating Binary-only Fuzzing with Coverage-preserving Coverage-guided Tracing
复制标题
DOI：
10.1145/3460120.3484787
复制
发表时间：
2021-11
期刊：
影响因子：
--
通讯作者：
Stefan Nagy;A. Nguyen-Tuong;Jason Hiser;J. Davidson;Matthew Hicks
中科院分区：
文献类型：
--
作者：
Stefan Nagy;A. Nguyen-Tuong;Jason Hiser;J. Davidson;Matthew Hicks
覆盖率引导的模糊测试的积极性，高容量的测试已经帮助揭示了数以万计的软件安全缺陷。虽然执行数十亿个测试用例要求快速的代码覆盖跟踪，但仅二进制目标的性质导致跟踪性能降低。二进制模糊性能的最新进展是覆盖引导跟踪（CGT），它通过将覆盖跟踪的费用限制为仅在保证新覆盖时才进行，从而带来吞吐量的数量级增益。不幸的是，CGT只适合基本的块覆盖粒度-然而大多数模糊器需要更细粒度的覆盖度量：边缘覆盖和命中计数。正是这种限制，几乎所有的今天的国家的最先进的模糊实现CGT的性能优势。本文解决了适应CGT模糊的最普遍的覆盖指标的挑战。我们引入并实现了一套增强功能，扩展CGT的自省模糊的最常见的代码覆盖率指标，同时保持其数量级的速度比传统的始终覆盖跟踪。我们评估他们的权衡方面的模糊性能和有效性在12个不同的现实世界的二进制文件（8个开源和4个闭源）。平均而言，我们的覆盖率保持CGT达到了与目前仅块覆盖率CGT UnTracer几乎相同的速度;并且比领先的二进制和源代码级覆盖率跟踪器QEMU，Dyninst，RetroWrite和AFL-Clang高出2- 24倍，在更短的时间内发现更多的错误。
Coverage-guided fuzzing's aggressive, high-volume testing has helped reveal tens of thousands of software security flaws. While executing billions of test cases mandates fast code coverage tracing, the nature of binary-only targets leads to reduced tracing performance. A recent advancement in binary fuzzing performance is Coverage-guided Tracing (CGT), which brings orders-of-magnitude gains in throughput by restricting the expense of coverage tracing to only when new coverage is guaranteed. Unfortunately, CGT suits only a basic block coverage granularity---yet most fuzzers require finer-grain coverage metrics: edge coverage and hit counts. It is this limitation which prohibits nearly all of today's state-of-the-art fuzzers from attaining the performance benefits of CGT. This paper tackles the challenges of adapting CGT to fuzzing's most ubiquitous coverage metrics. We introduce and implement a suite of enhancements that expand CGT's introspection to fuzzing's most common code coverage metrics, while maintaining its orders-of-magnitude speedup over conventional always-on coverage tracing. We evaluate their trade-offs with respect to fuzzing performance and effectiveness across 12 diverse real-world binaries (8 open- and 4 closed-source). On average, our coverage-preserving CGT attains near-identical speed to the present block-coverage-only CGT, UnTracer; and outperforms leading binary- and source-level coverage tracers QEMU, Dyninst, RetroWrite, and AFL-Clang by 2--24x, finding more bugs in less time.