一句话：提出 E9AFL，基于静态二进制重写为程序二进制自动插入 AFL 插桩，实现可扩展的灰盒模糊测试。
灰盒模糊测试（如 AFL）依赖插桩收集路径覆盖信息来引导测试过程，而插桩通常由修改后的编译器工具链插入，因此程序必须重新编译才能兼容。当源代码不可得或构建系统复杂时，重新编译并非总是可行。本文提出 E9AFL，一个快速且可扩展的工具，能够自动向程序二进制插入 AFL 插桩。E9AFL 构建在 E9Patch 静态二进制重写工具之上，并针对二进制插桩带来的开销设计了一组优化策略。评估结果表明，E9AFL 优于现有二进制插桩工具，并达到与编译期插桩相当的性能。
Greybox fuzzing is an effective method for software testing. Greybox fuzzers, such as AFL, use instrumentation that collects path coverage information in order to guide the fuzzing process. The instrumentation is usually inserted by a modified compiler toolchain, meaning that the program must be recompiled in order to be compatible with greybox fuzzing. When source code is unavailable, or for projects with complex build systems, recompilation is not always feasible. In this paper, we present E9AFL, a fast and scalable tool that automatically inserts AFL instrumentation to program binaries. E9AFL is built on top of the E9Patch static binary rewriting tool. To combat the overhead caused by binary instrumentation, E9AFL develops a set of optimization strategies. Our evaluation results show that E9AFL outperforms existing binary instrumentation tools and achieves comparable performance with the compile time instrumentation.
DOI 原文 ·
@inproceedings{paperbot6488,
title = {Scalable Fuzzing of Program Binaries with E9AFL},
author = {Xiang Gao and Gregory J. Duck and Abhik Roychoudhury},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678913}
}