Abstract:Symbolic execution and fuzz testing are effective approaches for program analysis, thanks to their evolving path exploration approaches. The state-of-the-art symbolic execution and fuzzing techniques are able to generate valid program inputs to satisfy the conditional statements. However, they have very limited ability to explore the finite-state-machine models implemented by real-world programs. This is because such state machines contain program-state-dependent branches (state-dependent branches in this paper) which depend on earlier program execution instead of the current program inputs. This paper is the first attempt to thoroughly explore the state-dependent branches in real-world programs. We introduce program-state-aware symbolic execution, a novel technique that guides symbolic execution engines to efficiently explore the state-dependent branches. As we show in this paper, state-dependent branches are prevalent in many important programs because they implement state machines to fulfill their application logic. Symbolically executing arbitrary programs with state-dependent branches is difficult, since there is a lack of unified specifications for their state machine implementation. Faced with this challenging problem, this paper recognizes widely-existing data dependency between current program states and previous inputs in a class of important programs. Our insights into these programs help us take a successful first step on this task. We design and implement a tool Ferry, which efficiently guides symbolic execution engine by automatically recognizing program states and exploring state-dependent branches. By applying Ferry to 13 different real-world programs and the comprehensive dataset Google FuzzBench, Ferry achieves higher block and branch coverage than two state-of-the-art symbolic execution engines and manages to locate three 0-day vulnerabilities in jhead. Our further investigation shows that Ferry is able to cover more hard-to-reach code compared with existing symbolic executors and fuzzers. Further, we show that Ferry is able to reach more program-state-dependent vulnerabilities than existing symbolic executors and fuzzing approaches with 15 collected state-dependent vulnerabilities and a test suite of six prominent programs. Finally, we test Ferry on LAVA-M dataset to understand its strengths and limitations.

Westworld: Fuzzing-Assisted Remote Dynamic Symbolic Execution of Smart Apps on IoT Cloud Platforms

Atlas: Automating Cross-Language Fuzzing on Android Closed-Source Libraries

EXAMINER-PRO: Testing Arm Emulators Across Different Privileges

Physical Devices-Agnostic Hybrid Fuzzing of IoT Firmware

Constructing Cyber-Physical System Testing Suites Using Active Sensor Fuzzing

AflIot: Fuzzing on linux-based IoT device with binary-level instrumentation

IoTFuzz: Automated Discovery of Violations in Smart Homes With Real Environment

SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices

Labrador: Response Guided Directed Fuzzing for Black-box IoT Devices

Deep Learning-Based Hybrid Fuzz Testing

Ferry: State-Aware Symbolic Execution for Exploring State-Dependent Program Paths

Design and Implementation of a Dynamic Symbolic Execution Tool for Windows Executables.

Learning to Fuzz from Symbolic Execution with Application to Smart Contracts

Identifying Privilege Separation Vulnerabilities in IoT Firmware with Symbolic Execution

Parallel Fuzzing of IoT Messaging Protocols Through Collaborative Packet Generation

IoTInfer: Automated Blackbox Fuzz Testing of IoT Network Protocols Guided by Finite State Machine Inference

Cross-App Interference Threats in Smart Homes: Categorization, Detection and Handling

Detecting Buggy Contracts via Smart Testing

Semantic-guided fuzzing for virtual testing of autonomous driving systems

ChatHTTPFuzz: Large Language Model-Assisted IoT HTTP Fuzzing

IFIZZ: Deep-State and Efficient Fault-Scenario Generation to Test IoT Firmware