论文标题
程序状态抽象用于反馈驱动的模糊测试，使用可能不变的
Program State Abstraction for Feedback-Driven Fuzz Testing using Likely Invariants
论文作者
论文摘要
Fuzz测试证明了其在最近几年找到软件错误的出色效果，但是，仍然存在开放的挑战。覆盖范围引导的模糊剂遭受了这样一个事实，即覆盖程序点不能确保触发故障的触发因素。从理论上讲，其他更敏感的技术应该应对此问题，例如记忆值的覆盖范围，很容易导致路径爆炸。在本文中，我们为反馈驱动的绒毛测试提出了一种新的反馈，将代码覆盖范围与数据的“形状”结合在一起。我们了解每个基本块的不变性，以便将块中使用的变量描述的空间分为区域。目的是区分反馈时，当一个块执行块的值落在空间的不同区域中时。这样可以更好地近似程序状态覆盖范围，并且在某些目标上，可以提高模糊器查找故障的能力。我们使用LLVM和AFL ++开发了一个称为Invscov的原型。
Fuzz testing proved its great effectiveness in finding software bugs in the latest years, however, there are still open challenges. Coverage-guided fuzzers suffer from the fact that covering a program point does not ensure the trigger of a fault. Other more sensitive techniques that in theory should cope with this problem, such as the coverage of the memory values, easily lead to path explosion. In this thesis, we propose a new feedback for Feedback-driven Fuzz testing that combines code coverage with the "shape" of the data. We learn likely invariants for each basic block in order to divide into regions the space described by the variables used in the block. The goal is to distinguish in the feedback when a block is executed with values that fall in different regions of the space. This better approximates the program state coverage and, on some targets, improves the ability of the fuzzer in finding faults. We developed a prototype using LLVM and AFL++ called InvsCov.
