Improving fuzzing performance by applying interval mutations (Movsisyan Hovhannes, ISPRASOPEN-2019)

Короткая ссылка: 20191206AF-

Speaker: Оганес Мовсисян

English translation of http://0x1.tv/20191206AF
This talk presents a novel approach of generation effective inputs for fuzz testing. Most applications check input format before performing basic calculations. That kind of applications usually parse service information of input file to decide whether input is supported or not. Input formats which are not supported are discarded and the application finishes its execution immediately. For example, the service information of ELF (Extensible Linking Format) file should start with following data "0x7f 'E' 'L' 'F'". If a file does not contain this information in header then it will not be considered as ELF. Effective fuzzing of an application which has input validation stage is a relevant and important problem. Random changes of input files usually malform service data and the target application finishes its work without main code execution. This makes fuzzing process inefficient.
To solve this problem, we have designed and implemented two special plugins for ISP-Fuzzer. The first plugin connects fragments of input data and corresponding executed basic blocks of the target program. Based on that information we can determine potential fragments (critical fragments) of input data which should not be mutated for new test case generation. The second plugin is designed for interval mutations. It mutates input file escaping critical fragments detected by the first plugin. Experimental results prove the effectiveness of proposed method.