FOT: A Versatile, Configurable, Extensible Fuzzing Framework Hongxu Chen, Yuekang Li, Bihuan Chen, Yinxing Xue, Yang Liu

Contents Background & Motivation Design & Implementation Extension & Evaluation Conclusion

What is fuzzing? The basic idea is to feed the program under test (PUT) with a large amount of (randomly) generated inputs and observe whether the PUT exercise some abnormal behaviors or not. Abnormal behaviors: Crash Timeout ...

What is greybox fuzzing? Blackbox Fuzzing: know nothing about the program internals just feed the PUT with random inputs Whitebox Fuzzing: often refers to symbolic execution relies on heavy-weight techniques Blackbox fuzzing lacks effectiveness. Whitebox fuzzing lacks scalability.

What is greybox fuzzing? Use light-weight program instrumentation to extract program execution information Extract ONLY the needed information coverage target location … Best of two worlds effective scalable

Why another greybox fuzzer? Existing greybox fuzzers: American Fuzzy Lop (AFL) AFLFast AFLGo … Honggfuzz libfuzzer We want a framework: Versatile Configurable Extensible FOT

Contents Background & Motivation Design & Implementation Extension & Evaluation Conclusion

Overall Design Preprocessors Fuzzer Toolchain instrumented program source code Toolchain results program binary

Preprocessors Static Analyzer Binary Rewriter Compiler Configurable: can extract different information Extensible: can add new static analyzers as long as the generated data follows the specified format Binary Rewriter Compiler

Fuzzer Overall Manager Seed Scorer Mutation Manager Executor Configurable: can select from several built-in strategies Extensible: can implement with the provided interface Mutation Manager Executor Feedback Collector

Toolchain For a versatile framework. crash triaging coverage analysis ...

Implementation Core fuzzing logic: ~15000 lines of Rust Library & Tools Preprocessors: ~2600 lines of C/C++ Toolchain: ~2400 lines of Python

Contents Background & Motivation Design & Implementation Extension & Evaluation Conclusion

Extension: Hawkeye Hawkeye is a directed greybox fuzzer implemented based on FOT. Directed fuzzing means to reach the predefined target locations as fast as possible. patch testing crash reproduction ... Published in CCS’18.

Extension: Hawkeye Prioritize the inputs that execute paths closer to the targets. distance prioritize scheduling mutation More details here: https://dl.acm.org/citation.cfm?id=3243849

Extension: Hawkeye Static Analyzer extract the predefined target locations information and the information about the distance to the targets. Compiler Embed the information through instrumentation

Extension: Hawkeye Seed Scorer To give the inputs “closer” to the targets higher scores. Mutation Manager To mutate adaptively according to the distance. Feedback Collector To collect extra feedbacks from the instrumentations.

Other extensions examples Steelix: AFLFast: Connect with other tools (radamsa, KLEE):

Trophies (Bugs found with FOT) Evaluation Feature comparison Trophies (Bugs found with FOT)

Contents Background & Motivation Design & Implementation Extension & Evaluation Conclusion

Conclusion FOT Supports most features versatile configurable extensible Supports most features Finds bugs in real-world programs Contact: Hongxu: hchen017@e.ntu.edu.sg​ Yuekang: yli044@e.ntu.edu.sg

Thank you !