一句话：提出 MirageFuzz，利用 phantom 程序与双路模糊测试缓解程序依赖，提升种子探索能力。
覆盖率引导的模糊测试中，种子常因严格的程序依赖而只能探索有限程序状态，且需反复访问已覆盖状态，导致种子的探索能力未被充分利用。本文提出 MirageFuzz：先为原程序构造一个“phantom”程序，在保持条件语句原语义的前提下降低其程序依赖；随后对原程序与 phantom 程序进行双路模糊测试，并利用基于污点的变异机制，将 phantom 测试得到的条件取值更新回原种子对应条件语句，从而生成新种子。作者在18个项目构成的基准上，与7个开源模糊器比较，平均性能提升13.42%至77.96%，并发现29个未知缺陷，其中4个被确认、3个已修复。
For coverage-guided fuzzers, many of their adopted seeds are usually underused by exploring limited program states since essentially all their executions have to abide by rigorous program dependencies while only limited seeds are capable of accessing dependencies. Moreover, even when iteratively executing such limited seeds, the fuzzers have to repeatedly access the covered program states before uncovering new states. Such facts indicate that exploration power on program states of seeds has not been sufficiently leveraged by the existing coverage-guided fuzzing strategies. To tackle these issues, we propose a coverage-guided fuzzer, namely MirageFuzz, to mitigate the program dependencies when executing seeds for enhancing their exploration power on program states. Specifically, MirageFuzz first creates a “phantom” program of the target program by reducing its program dependencies corresponding to conditional statements while retaining their original semantics. Accordingly, MirageFuzz performs dual fuzzing, i.e., the source fuzzing to fuzz the original program and the phantom fuzzing to fuzz the phantom program simultaneously. Then, MirageFuzz applies the taint-based mutation mechanism to generate a new seed by updating the target conditional statement of a given seed from the source fuzzing with the corresponding condition value derived by the phantom fuzzing. To evaluate the effectiveness of MirageFuzz, we build a benchmark suite with 18 projects commonly adopted by recent fuzzing papers, and select seven open-source fuzzers as baselines for performance comparison with MirageFuzz. The experiment results suggest that MirageFuzz outperforms our baseline fuzzers from 13.42% to 77.96% averagely. Furthermore, MirageFuzz exposes 29 previously unknown bugs where 4 of them have been confirmed and 3 have been fixed by the corresponding developers.
@inproceedings{WuCLXQCCZ23,
title = {Enhancing Coverage-Guided Fuzzing via Phantom Program},
author = {Mingyuan Wu and Kunqiu Chen and Qi Luo and Jiahong Xiang and Ji Qi and Junjie Chen and Heming Cui and Yuqun Zhang},
booktitle = {FSE},
year = {2023},
doi = {10.1145/3611643.3616294}
}