Abstract:Many assisting exploration strategies have been proposed to assist grey-box fuzzers in exploring program states guarded by tight and complex branch conditions such as equality constraints. Although they have shown promising results in their original papers, their evaluations seldom follow equivalent protocols, e.g., they are rarely evaluated on identical benchmarks. Moreover, there is a lack of sufficient investigations on the specifics of the program states explored by these strategies which can obfuscate the future application and development of such strategies. Consequently, there is a pressing need for a comprehensive study of assisting exploration strategies on their effectiveness, versatility, and limitations to enlighten their future development. To this end, we perform the first comprehensive study about the assisting exploration strategies for grey-box fuzzers. Specifically, we first collect nine recent fuzzers representing the mainstream assisting exploration strategies as our studied subjects and 21 real-world projects to form our benchmark suite. After evaluating the subjects on the benchmark suite, we then surprisingly find that the dictionary strategy is the most promising since it not only achieves similar or even slightly better performance over the other studied assisting exploration strategies in terms of exploring program states but also is more practical to be enhanced. Accordingly, we propose CDFUZZ, which generates a customized dictionary for each seed upon the baseline fuzzer AFL to improve over the original dictionary strategy. The evaluation results demonstrate that CDFUZZ increases the edge coverage by 16.1% on average for all benchmark projects over the best performer in our study (i.e., AFL++ with the dictionary strategy). CDFUZZ also successfully exposed 37 previously unknown bugs, with nine confirmed and seven fixed by the corresponding developers.

An Improvement of AFL Based on the Function Call Depth

Fuzzing Based on Function Importance by Interprocedural Control Flow Graph

AFL++: A Vulnerability Discovery and Reproduction Framework

FairFuzz: a targeted mutation strategy for increasing greybox fuzz testing coverage

Path Sensitive Fuzzing for Native Applications

Improving Grey-Box Fuzzing by Modeling Program Behavior

SAFL: increasing and accelerating testing coverage with symbolic execution and guided fuzzing.

Facilitating Parallel Fuzzing with mutually-exclusive Task Distribution

Target Program Select Test Input Trim Test Input Mutate Test Input Execute Program Update Queue Instrument Program Grammar

PAFL: Extend Fuzzing Optimizations of Single Mode to Industrial Parallel Mode

DeltaFuzz: Historical Version Information Guided Fuzz Testing

Fuzzing with Quantitative and Adaptive Hot-Bytes Identification

Energy distribution matters in greybox fuzzing

$μ$AFL: Non-intrusive Feedback-driven Fuzzing for Microcontroller Firmware

Tumbling Down the Rabbit Hole: How do Assisting Exploration Strategies Facilitate Grey-box Fuzzing?

Industrial Oriented Evaluation of Fuzzing Techniques

Coverage-based Greybox Fuzzing as Markov Chain

FuzzCoder: Byte-level Fuzzing Test via Large Language Model

Improving AFL++ CmpLog: Tackling the bottlenecks

Better Pay Attention Whilst Fuzzing.

ISC4DGF: Enhancing Directed Grey-box Fuzzing with LLM-Driven Initial Seed Corpus Generation