FUZZFACTORY: Domain-Specific Fuzzing with Waypoints
FUZZFACTORY: Domain-Specific Fuzzing with Waypoints
复制标题
DOI：
10.1145/3360600
复制
发表时间：
2019-10-01
影响因子：
1.8
通讯作者：
Vijayakumar, Hayawardh
中科院分区：
文献类型：
--
作者：
Padhye, Rohan;Lemieux, Caroline;Vijayakumar, Hayawardh
覆盖范围引导的绒毛测试已成为一种高度有效的方法，可以找到安全漏洞，例如在解析二进制数据的程序中的缓冲区溢出。最近，研究人员为不同的特定领域测试目标（例如查找性能瓶颈，生成有效的输入，处理魔术字节比较等）介绍了覆盖范围引导的模糊算法的各种专业。并产生模糊工具的独特变体。我们观察到，这些域特异性解决方案中有许多遵循常见的解决方案模式。在本文中，我们提出了FuzzFactory，这是开发特定域的模糊应用程序的框架，而无需更改突变和搜索启发式方法。 FuzzFactory允许用户在测试执行过程中指定动态域特异性反馈的收集，以及如何汇总此类反馈。 FuzzFactory使用此信息来选择性地保存中间输入（称为Waypoints）来增强覆盖范围引导的模糊。这样的路点始终朝着特定领域的多维目标取得进展。我们使用FuzzFactory实例化了六个域特异性的模糊应用程序：先前工作的三个重新实现和三种新颖的解决方案，并评估它们对Google Fuzzer Test Suite基准测试的有效性。我们还展示了如何组成多个域以比其部分的总和更好。例如，我们结合了有关严格平等比较和动态内存分配的特定领域的反馈，以使LZ4炸弹和PNG炸弹自动生成。
Coverage-guided fuzz testing has gained prominence as a highly effective method of finding security vulnerabilities such as buffer overflows in programs that parse binary data. Recently, researchers have introduced various specializations to the coverage-guided fuzzing algorithm for different domain-specific testing goals, such as finding performance bottlenecks, generating valid inputs, handling magic-byte comparisons, etc. Each such solution can require non-trivial implementation effort and produces a distinct variant of a fuzzing tool. We observe that many of these domain-specific solutions follow a common solution pattern. In this paper, we present FuzzFactory, a framework for developing domain-specific fuzzing applications without requiring changes to mutation and search heuristics. FuzzFactory allows users to specify the collection of dynamic domain-specific feedback during test execution, as well as how such feedback should be aggregated. FuzzFactory uses this information to selectively save intermediate inputs, called waypoints, to augment coverage-guided fuzzing. Such waypoints always make progress towards domain-specific multi-dimensional objectives. We instantiate six domain-specific fuzzing applications using FuzzFactory: three re-implementations of prior work and three novel solutions, and evaluate their effectiveness on benchmarks from Google's fuzzer test suite. We also show how multiple domains can be composed to perform better than the sum of their parts. For example, we combine domain-specific feedback about strict equality comparisons and dynamic memory allocations, to enable the automatic generation of LZ4 bombs and PNG bombs.