Skip to main content
SpringerLink
Log in

KLUZZER: Whitebox Fuzzing on Top of LLVM

  • Conference paper
  • First Online:
Book cover Automated Technology for Verification and Analysis (ATVA 2019)

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 11781))

Abstract

Whitebox fuzzing (a.k.a. concolic testing) has been shown to be an effective bug finding technique on its own as well as in combination with coverage-guided greybox fuzzing. However, there is currently a lack of whitebox fuzzers operating above the binary code level. We present KLUZZER, a whitebox fuzzer targeting LLVM bitcode, and thus can be easily combined with the widely deployed LLVM’s coverage-guided greybox fuzzer LibFuzzer. Experimental evaluation on a set of benchmarks shows encouraging results.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://github.com/travitch/whole-program-llvm.

  2. 2.

    https://github.com/google/fuzzer-test-suite.

References

  1. Angr - a powerful and user-friendly binary analysis platform. https://github.com/angr/angr

  2. LibFuzzer - a library for coverage-guided fuzz testing. https://llvm.org/docs/LibFuzzer.html

  3. Cadar, C., Dunbar, D., Engler, D.R.: KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs. In: USENIX OSDI, pp. 209–224 (2008)

    Google Scholar 

  4. Cha, S.K., Avgerinos, T., Rebert, A., Brumley, D.: Unleashing mayhem on binary code. In: IEEE Symposium on Security and Privacy, pp. 380–394 (2012)

    Google Scholar 

  5. Chen, P., Chen, H.: Angora: efficient fuzzing by principled search. In: IEEE Symposium on Security and Privacy, pp. 711–725 (2018)

    Google Scholar 

  6. Chipounov, V., Kuznetsov, V., Candea, G.: S2E: a platform for in-vivo multi-path analysis of software systems. In: ASPLOS, pp. 265–278 (2011)

    Google Scholar 

  7. de Moura, L., Bjørner, N.: Z3: an efficient SMT solver. In: Ramakrishnan, C.R., Rehof, J. (eds.) TACAS 2008. LNCS, vol. 4963, pp. 337–340. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-78800-3_24

    Chapter  Google Scholar 

  8. Fietkau, J., Shastry, B.: KleeFL - seeding fuzzers with symbolic execution. In: USENIX Security (Poster presentation) (2017)

    Google Scholar 

  9. Ganesh, V., Dill, D.L.: A decision procedure for bit-vectors and arrays. In: Damm, W., Hermanns, H. (eds.) CAV 2007. LNCS, vol. 4590, pp. 519–531. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-73368-3_52

    Chapter  Google Scholar 

  10. Godefroid, P., Levin, M.Y., Molnar, D.A.: Automated whitebox fuzz testing. In: NDSS (2008)

    Google Scholar 

  11. Marinescu, P.D., Cadar, C.: Make test-zesti: a symbolic execution solution for improving regression testing. In: ICSE, pp. 716–726 (2012)

    Google Scholar 

  12. Martignoni, L., McCamant, S., Poosankam, P., Song, D., Maniatis, P.: Path-exploration lifting: hi-fi tests for lo-fi emulators. In: ASPLOS, pp. 337–348 (2012)

    Article  Google Scholar 

  13. Ruhstaller, M., Chang, O.: A new chapter for OSS-Fuzz. https://security.googleblog.com/2018/11/a-new-chapter-for-oss-fuzz.html

  14. Stephens, N., et al.: Driller: augmenting fuzzing through selective symbolic execution. In: NDSS (2016)

    Google Scholar 

  15. Wang, M., et al.: SAFL: increasing and accelerating testing coverage with symbolic execution and guided fuzzing. In: ICSE, pp. 61–64 (2018)

    Google Scholar 

  16. Yun, I., Lee, S., Xu, M., Jang, Y., Kim, T.: QSYM : a practical concolic execution engine tailored for hybrid fuzzing. In: USENIX Security, pp. 745–761 (2018)

    Google Scholar 

  17. Zalewski, M.: American fuzzy lop (AFL) white paper. http://lcamtuf.coredump.cx/afl/technical_details.txt

  18. Zhao, L., Duan, Y., Yin, H., Xuan, J.: Send hardest problems my way: probabilistic path prioritization for hybrid fuzzing. In: NDSS (2019)

    Google Scholar 

Download references

Acknowledgment

This work was supported by the Central Research Development Fund of the University of Bremen.

Author information

Authors and Affiliations

  1. Group of Computer Architecture, University of Bremen, 28359, Bremen, Germany

    Hoang M. Le

Authors
  1. Hoang M. Le
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Hoang M. Le .

Editor information

Editors and Affiliations

  1. Institute of Information Science, Academia Sinica, Taipei, Taiwan

    Yu-Fang Chen

  2. DENSO AUTOMOTIVE Deutschland GmbH, Eching, Germany

    Chih-Hong Cheng

  3. Institute of Computer Science, TU München, Munich, Germany

    Javier Esparza

Rights and permissions

Reprints and permissions

Copyright information

© 2019 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Le, H.M. (2019). KLUZZER: Whitebox Fuzzing on Top of LLVM. In: Chen, YF., Cheng, CH., Esparza, J. (eds) Automated Technology for Verification and Analysis. ATVA 2019. Lecture Notes in Computer Science(), vol 11781. Springer, Cham. https://doi.org/10.1007/978-3-030-31784-3_14

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-31784-3_14

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-31783-6

  • Online ISBN: 978-3-030-31784-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation