Conceptos Básicos
FuSeBMC v4 is a state-of-the-art hybrid fuzzer that combines bounded model checking and evolutionary fuzzing to achieve high code coverage and detect security vulnerabilities in C programs.
Resumen
FuSeBMC v4 is a hybrid fuzzer that combines bounded model checking (BMC) and evolutionary fuzzing to improve code coverage and bug detection in C programs. The tool works in two main stages:
Seed Generation:
- FuSeBMC first analyzes the input C program and injects goal labels to guide the BMC and fuzzing engines.
- It then applies the fuzzer and BMC engine for a short time to generate "smart seeds" - inputs that can help the fuzzer bypass complex input validation checks.
Test Generation:
- In the main coverage analysis phase, FuSeBMC runs the fuzzer and BMC engine with longer timeouts, using the smart seeds generated earlier.
- A Tracer subsystem coordinates the engines, records covered goals, and selects high-impact test-cases to add to the seed store.
- The fuzzer is modified to generate inputs only within the ranges identified by static analysis, and to limit the size of generated test-cases.
- The BMC engine is used to check the reachability of specific goal labels and produce counterexamples as additional seeds.
The key innovations in FuSeBMC v4 include:
- Using lightweight static analysis to recognize input validation and optimize the fuzzing process.
- Prioritizing deeper goals during seed generation and test generation to improve coverage.
- Setting loop unwinding bounds to mitigate path explosion during BMC.
FuSeBMC v4 was evaluated in the 2022 Test-Comp competition, where it outperformed all other state-of-the-art tools, winning first place in both the main categories - Cover-Error and Cover-Branches.
Estadísticas
FuSeBMC v4 achieved first place in 9 out of 16 subcategories in the Cover-Branches category of Test-Comp 2022.
FuSeBMC v4 achieved first or joint first place in 8 out of 14 subcategories in the Cover-Error category of Test-Comp 2022.
Citas
"FuSeBMC works by first analyzing and incrementally injecting goal labels into the given C program to guide BMC and Evolutionary Fuzzing engines."
"During seed generation and normal running, the Tracer subsystem aids coordination between the engines. This subsystem conducts additional coverage analysis and updates a shared memory with information on goals covered so far."
"The BMC engine can provide the seed that allows the fuzzing engine to bypass complex mathematical guards (e.g., input validation)."