Back to Search
Start Over
WEIZZ: Automatic grey-box fuzzing for structured binary formats
- Source :
- ISSTA
- Publication Year :
- 2020
- Publisher :
- Association for Computing Machinery, Inc, 2020.
-
Abstract
- Fuzzing technologies have evolved at a fast pace in recent years, revealing bugs in programs with ever increasing depth and speed. Applications working with complex formats are however more difficult to take on, as inputs need to meet certain format-specific characteristics to get through the initial parsing stage and reach deeper behaviors of the program. Unlike prior proposals based on manually written format specifications, in this paper we present a technique to automatically generate and mutate inputs for unknown chunk-based binary formats. We propose a technique to identify dependencies between input bytes and comparison instructions, and later use them to assign tags that characterize the processing logic of the program. Tags become the building block for structure-aware mutations involving chunks and fields of the input. We show that our techniques performs comparably to structure-aware fuzzing proposals that require human assistance. Our prototype implementation WEIZZ revealed 16 unknown bugs in widely used programs.
- Subjects :
- FOS: Computer and information sciences
Computer Science - Cryptography and Security
Parsing
Programming language
Computer science
binary testing
Byte
Binary number
Fuzz testing
structural mutations
Grey box
computer.software_genre
chunk-based formats
Fuzzing
Cryptography and Security (cs.CR)
computer
Block (data storage)
Pace
Subjects
Details
- Language :
- English
- Database :
- OpenAIRE
- Journal :
- ISSTA
- Accession number :
- edsair.doi.dedup.....ded9dcc7c4e5b4a1990b0f326a0aad34