FieldsFuzz: Implement efficient fuzzing based on grammar-aware mutation strategy

Yinghao Su

doi:10.1016/j.jss.2025.112557

Return

FieldsFuzz: Implement efficient fuzzing based on grammar-aware mutation strategy

2025-07-14

PRE

DOI：10.1016/j.jss.2025.112557

Original

Original request for help

Save

Abstract

En 中文

A comprehensive understanding of the input format utilized by the testing program is essential for the generation of valid inputs and the enhancement of testing efficacy in fuzz testing. Nevertheless, current format-aware fuzz testing tools predominantly focus on recognizing various functional segments of binary input files, usually overlooking the structural intricacies and dependencies inherent within these files. Furthermore, existing format-aware methodologies that based on comparison and taint analysis exhibit limitations in accurately identifying file fields and types. To mitigate these challenges, this article introduces a novel format-aware fuzz testing tool, termed FieldsFuzz. Initially, FieldsFuzz performs byte-level taint analysis on significant seed inputs during program execution to derive a set of input byte instructions, thereby identifying input file structures and dependencies, and constructing a file format tree. During the mutation phase, FieldsFuzz traverses the file format tree to ascertain field dependencies, executes fields and dependencies based mutations to enhance the efficiency of effective seed generation, and introduces random modifications to the file structure to uncover previously unknown vulnerabilities. An evaluation of FieldsFuzz was conducted using twelve distinct format input programs, revealing that it surpasses leading fuzzing tools (including AFL, AFL++, WEIZZ, ProFuzzer, and NestFuzz) in terms of format recognition accuracy, code coverage, and the detection of security vulnerabilities.