HDBFuzzer–Target-oriented Hybrid Directed Binary Fuzzer

Abstract

In this paper, we propose a target-oriented hybrid directed binary fuzzer (HDBFuzzer) to solve the vulnerability confirmation problem based on binary code similarity comparison. HDBFuzzer combines macro function level direction fuzzing and micro path-constraint directed solving. For some branches with simple or loose constraints, it still uses directed mutation of the directed fuzzing to penetrate while for some really hard-to-penetrate constraints, it resorts to guided concolic execution. At the same time, in order to improve the efficiency of constraint solving, we propose a constraint solving method based on “path abstraction”, which approximates the solution space by the linear expression and generates effective input utilizing the highly-effective sampling method towards the linear space. Then, under the guidance by the directed greybox fuzzing, HDBFuzzer can generate input that can quickly reach the vulnerable code region and finally crash the program under the test to confirm the vulnerability hidden in the binary program. We evaluate HDBFuzzer against AFLGo-B and QSYM on LAVA-M dataset and ten real-world programs, and the results show that HDBFuzzer is superior to AFLGo-B and QSYM on the bug discovery, bug reproduction and target reaching capabilities.