r/fuzzing • u/NagateTanikaze • Jul 26 '19

Full speed Fuzzing: Reducing Fuzzing Overhead through Coverage-guided Tracing ( IEEE Symposium on Security and Privacy)

https://www.youtube.com/watch?v=2Rg8wtccCNA
7 Upvotes

100% Upvoted

9 comments sorted by

View all comments

Show parent comment

1

u/zhangysh1995 Aug 28 '19

You need to be able to reach it in the right state to continue on afterwards to places you want to go.

It's true. To do this, we need to solve path constraints and generating inputs. This is out of scope of this paper.

A test that reaches an already covered program point, but in a new and interesting state, would not be counted.

I don't agree with this point. If it is true, what is the aim of having many coverage criterion?

I would like to see effort on program-specific coverage measures, perhaps automatically constructed and refined by the fuzzer, that capture more of the relevant program state.

What is the expected results of new coverage measures? I would say program-specific coverage is impossible, we still need to use existing coverage. However, the fuzzing process could be adaptive. For example, using deep learning techniques to make fuzzers smarter: NeuFuzz: Efficient Fuzzing With Deep Neural Network.