Improving Fuzzing Using Input Data Offsets Comparison Information

Abstract

There is a wide range of fuzzing techniques for security assurance. Communication protocols and programs accepting complex structured data, including compilers, can be efficiently tested with a corresponding fuzzing approach. The main advantage of the fuzzing is actual data, which demonstrates the defects of the target software. The performance of fuzzing primarily depends on the quality of generated data. Existing fuzzing tools provide a fixed set of data generation algorithms, which doesn’t consider the specifics of the target program. There are several scenarios when the performance of the fuzzing may suffer. The target may execute different parts of the code based on a comparison of the offsets of the input data with some constant value. For such cases, random mutations will invalidate input data and lead to lower code coverage.

In this paper, we present a new approach for effective input data generation. We use static analysis to extract information regarding the input data offsets’ comparisons with constant values. Then we use this information during input data generation. Experimental evaluation of the developed method on several projects proves the efficiency of the developed method. Our approach allowed up to 91% increase in the number of executed paths for the same execution count.