一句话:提出轻量技术,通过检测并利用输入中的关系字段,在变异时自动调整大小、保持输入结构,避免破坏性的 frameshift 变异。
覆盖率引导的模糊测试器是强大的自动化缺陷发现工具:它们变异程序输入、观察覆盖率,并保存命中未探索路径的输入以供后续变异。然而,由于缺乏对输入格式的知识——例如格式中数据字段与大小字段之间的关系——模糊测试器容易产生破坏性的 frameshift 变异。这类变异会改变输入中大小字段与实际数据长度之间的对应关系,从而生成被目标程序拒绝的畸形输入,白白浪费时间。为避免这种破坏性变异,本文提出一种新颖且轻量的技术,在变异过程中通过检测并使用「关系字段」(relation fields)来保持输入的结构。
Coverage-guided fuzzers are powerful automated bug-finding tools. They mutate program inputs, observe coverage, and save any input that hits an unexplored path for future mutation. Unfortunately, without knowledge of input formats—for example, the relationship between formats’ data fields and sizes—fuzzers are prone to generate destructive frameshift mutations. These time-wasting mutations yield malformed inputs that are rejected by the target program. To avoid such breaking mutations, this paper proposes a novel, lightweight technique that preserves the structure of inputs during mutation by detecting and using relation fields.