For Advanced Fuzzing

User-Mode Application Fuzzing

1. Strategy

1.1. Mutation Strategy

- Deterministic: bitflip, byteflip, arithmetic in/decrease, interesting value, special charactor

- Havoc: Same Deterministic, random byte, delete byte, insert byte, overwrite byte

- Custom: ?

- Radamsa [Github]

- AFLSmart: Smart Greybox Fuzzing [PDF, Github]

- Redqueen: Fuzzing with Input-to-State Correspondence, NDSS '19 [PDF, Slide, Video, Github]

1.2. Mutation Scheduling

- MOPT: Optimized Mutation Scheduling for Fuzzers, USENIX '19 [PDF, Slide, Video, Github]

- AFL++: EXPLORE, EXPLOIT, COE, FAST, LINEAR, QUAD, mmopt, rare, seek

1.3. Coverage

- DynamoRio[Github], Tinyinst[Github], QEMU[Github], IntelPT[Github]

- LLVM, GCC

2. Speed

2.1. 부하 제거를 통한 속도 향상

- peAFL, Make static instrumentation great again, High performance fuzzing for Windows system, BlueHatIL '19 [Slide, Video, Github]

- peafl64 [Github]

- Designing New Operating Primitives to Improve Fuzzing Performance, ACM CCS '17 [PDF, Video, Github]

2.2. 퍼저 성능 향상

- Nyx: Greybox Hypervisor Fuzzing using Fast Snapshots and Affine Types, USENIX '21 [PDF, Slide]

- Persistent mode on WinAFL [Github], Jackalope [Github]

- AFL++, USENIX '20 Woot [PDF, Github]

2.3. Distribute Fuzzing

- Network를 이용한 distribute fuzzing 수행, share seeds

- UltraFuzz: Towards Resource-saving in Distributed Fuzzing, TSE '22 [PDF, Git]

3. Seed Pool

3.1. 시드 풀이 많을 수록 유리함

- 시드 풀이 많을수로 다양한 커버리지를 테스트해볼 확률이 높음

- 같은 커버리지를 갖는 시드에 대해서는 퍼저가 처냄(Pre-Processing)

3.2. Quality of seed set

- regression test set과 일반 seed의 차이 존재: Targeted

3.3. Seed Selection

- Optimizing Seed Selection for Fuzzing, USENIX '14 [PDF, Video]

---

JavaScript Fuzzing

1. JsFunFuzz [Github]
2. Fuzzing with Code Fragments(LangFuzz), USENIX '12 [PDF, Slide, Video]
3. CodeAlchemist: Semantics-Aware Code Generation to Find Vulnerabilities in JavaScript Engines, NDSS '19 [PDF, Video, Github]
4. Fuzzilli [Github]
5. Superion: grammar-aware greybox fuzzing, ISEC '19 [PDF, Github]
6. Fuzzing JavaScript Engines with Aspect-preserving Mutation(DIE), S&P '20 [PDF, Slide, Video, Github]
7. JIT-Picking: Differential Fuzzing of JavaScript Engines, ACM CCS '22 [PDF, Github]

---

Kernel Fuzzing

1. syzkaller [Github]

2. kAFL [Github]

3. NtFuzz [Github]

 

계속...