Taint-based directed whitebox fuzzing

TLDR

Unlike standard fuzzing, which randomly mutates inputs without regard to syntax, BuzzFuzz uses dynamic taint tracing to locate seed‑input regions that influence key program attack points. We present a new automated white‑box fuzzing technique and tool, BuzzFuzz, that implements this technique. BuzzFuzz automatically generates new fuzzed test inputs by fuzzing the taint‑identified seed regions, preserving syntactic structure so the inputs reach deep semantic code. BuzzFuzz automatically found errors in Swfdec and MuPDF, demonstrating that the directed taint‑based fuzzing can expose deep errors in large programs, especially those with complex structured inputs.

Abstract

We present a new automated white box fuzzing technique and a tool, BuzzFuzz, that implements this technique. Unlike standard fuzzing techniques, which randomly change parts of the input file with little or no information about the underlying syntactic structure of the file, BuzzFuzz uses dynamic taint tracing to automatically locate regions of original seed input files that influence values used at key program attack points (points where the program may contain an error). BuzzFuzz then automatically generates new fuzzed test input files by fuzzing these identified regions of the original seed input files. Because these new test files typically preserve the underlying syntactic structure of the original seed input files, they tend to make it past the initial input parsing components to exercise code deep within the semantic core of the computation. We have used BuzzFuzz to automatically find errors in two open-source applications: Swfdec (an Adobe Flash player) and MuPDF (a PDF viewer). Our results indicate that our new directed fuzzing technique can effectively expose errors located deep within large programs. Because the directed fuzzing technique uses taint to automatically discover and exploit information about the input file format, it is especially appropriate for testing programs that have complex, highly structured input file formats.