一句话：提出 Terminator，改写二进制使闭源 GUI 程序在覆盖率不再增长时自动终止，从而高效 fuzzing。
对专有文件处理程序做模糊测试时，通常要反复执行整个程序并根据正常/异常终止判断结果，但 GUI 程序（图像编辑器、媒体播放器、文档阅读器等）在解析完输入后往往不会自行退出，fuzzer 必须人为界定执行范围并强制终止。现有做法或需源码、或需专家逆向以构造测试 harness；直接作用于未修改二进制的方案则依赖固定超时、CPU 占用下降阈值等启发式，作者证明这些启发式实现简单但低效且不可靠。为此提出 Terminator：它自动改写被测程序二进制，以代码覆盖率为信号，当覆盖率在无用户交互的情况下不再增长时自动终止程序。该机制一方面保证输入处理结束后尽快退出，另一方面避免在输入处理过程中被过早终止。实验表明 Terminator 优于超时与 CPU 占用两类启发式，显著提升模糊测试效率。
When fuzzing a proprietary file-processing program, one typically executes the whole program repeatedly with sampled input files, and distinguishes between normal and abnormal termination. While this works well for many command-line utilities, it is more complicated for programs that usually do not terminate after input file processing. Many real-world applications are examples of such programs, in particular, those with a graphical user interface (GUI), such as image editors, media players and document viewers. In these cases, the fuzzer has to define the scope of the execution and forcefully terminate the program under test.In order to efficiently fuzz test file-processing programs with a GUI, a standard approach is to define a dedicated testing harness, which executes the file processing in isolation and strips irrelevant program parts. However, this either requires the source code of the program or an expert’s effort in reverse engineering. Alternative approaches work on the unmodified binary of the program, and use a heuristic to decide when the input processing is likely done. For example, one can terminate the program after a fixed timeout or once its CPU usage has dropped below a threshold. We show that these heuristics, while simple to implement, are inefficient and ineffective.We present Terminator, a fully-automated approach to facilitate efficient fuzzing of closed-source file-processing programs with a GUI. Terminator modifies the binary of the program under test so that it automatically terminates when code coverage stops increasing without user interaction. Consequently, Terminator (1) ensures that the program terminates soon after the input processing instead of waiting for user interaction, and, at the same time, (2) prevents premature termination during input processing. We show that Terminator outperforms the timeout and CPU usage heuristics and significantly increases fuzzing efficiency.
DOI 原文 ·
@inproceedings{paperbot9207,
title = {Terminator: Enabling Efficient Fuzzing of Closed-Source GUI Programs by Automatic Coverage-Guided Termination},
author = {Jonas Zabel and Philip Kolvenbach and Steven Arzt},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00136}
}