Effective fuzz testing via model-guided program synthesis - Zhang, Cen (Nanyang Technological University, 2023)
Fuzzing has been widely recognized as the most effective method for finding vulnerabilities. Many security researchers have proposed methods for improving fuzzers in order to detect more types of vulnerabilities, achieve higher coverage, or find more bugs in a given amount of time. However, there has been relatively little research on the gap between the diverse requirements of testing different types of targets and the general assumptions made by existing fuzzers. This gap is caused by mismatches between the interfaces provided by the targets and the interfaces assumed by the fuzzers. For example, it is difficult to test firmware targets because of the lack of execution environments, and fuzzing libraries requires the use of fuzz drivers, which are pieces of code that properly use library APIs. Effectively fuzzing these types of targets requires both engineering efforts and new methods. In this thesis, we present four works that address this gap in the context of three types of targets: binaries, kernel modules inside firmware, and libraries.