Program State Abstraction for Feedback-Driven Fuzz Testing using Likely Invariants

TL;DR

This paper introduces a novel feedback mechanism for fuzz testing that combines code coverage with likely invariants to better approximate program state and improve fault detection.

Contribution

It proposes a new method that learns likely invariants to divide variable spaces, enhancing feedback for fuzzers beyond traditional coverage metrics.

Findings

Improved fault detection on some targets

Enhanced program state coverage approximation

Prototype implemented with LLVM and AFL++

Abstract

Fuzz testing proved its great effectiveness in finding software bugs in the latest years, however, there are still open challenges. Coverage-guided fuzzers suffer from the fact that covering a program point does not ensure the trigger of a fault. Other more sensitive techniques that in theory should cope with this problem, such as the coverage of the memory values, easily lead to path explosion. In this thesis, we propose a new feedback for Feedback-driven Fuzz testing that combines code coverage with the "shape" of the data. We learn likely invariants for each basic block in order to divide into regions the space described by the variables used in the block. The goal is to distinguish in the feedback when a block is executed with values that fall in different regions of the space. This better approximates the program state coverage and, on some targets, improves the ability of the fuzzer in finding faults. We developed a prototype using LLVM and AFL++ called InvsCov.