Hawkeye

Chen, Hongxu; Xue, Yinxing; Li, Yuekang; Chen, Bihuan; Xie, Xiaofei; Wu, Xiuheng; Liu, Yang

doi:10.1145/3243734.3243849

Cited by 187 publications

(51 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We evaluated DGF-CFGConstructor with 8 real-world programs; the relevant information is shown in Table 3. These benchmarks are selected according to the evaluations in the related works [28,29,35,36].…”

Section: Evaluation Setupmentioning

confidence: 99%

“…The limitation of this technique is that it is difficult to resolve indirect jump targets by pure static analysis. To handle indirect jumps, Chen et al [29] proposed to apply the inclusion-based pointer analysis against the function pointers. The point-to set is calculated by focusing on four rules: address-of, copy, assign, and dereference.…”

Section: Cfg Constructionmentioning

confidence: 99%

“…At present, DGF is also mainly applied in vulnerability detection. Existing works [28][29][30][31][32][33][34] usually take the changed statements or dangerous locations as target locations. Their purposes are to generate test cases that can trigger vulnerabilities.…”

Section: Gray-box Fuzzingmentioning

confidence: 99%

“…Its main idea is to focus on interesting parts of code, rather than to spend a lot of time on undirected exploration of the whole program like coverage-based fuzzing. Previous studies [28][29][30][31][32][33][34] have shown that DGF has good practicability in the vulnerability detection. When testing large-scale programs, it can generate test cases to exercise the given targets more effectively than the coverage-based fuzzing.…”

mentioning

confidence: 99%

See 3 more Smart Citations

Constructing More Complete Control Flow Graphs Utilizing Directed Gray-Box Fuzzing

Zhu

Huang

et al. 2021

Applied Sciences

View full text Add to dashboard Cite

Control Flow Graphs (CFGs) provide fundamental data for many program analyses, such as malware analysis, vulnerability detection, code similarity analysis, etc. Existing techniques for constructing control flow graphs include static, dynamic, and hybrid analysis, which each having their own advantages and disadvantages. However, due to the difficulty of resolving indirect jump relations, the existing techniques are limited in completeness. In this paper, we propose a practical technique that applies static analysis and dynamic analysis to construct more complete control flow graphs. The main innovation of our approach is to adopt directed gray-box fuzzing (DGF) instead of coverage-based gray-box fuzzing (CGF) used in the existing approach to generate test cases that can exercise indirect jumps. We first employ a static analysis to construct the static CFGs without indirect jump relations. Then, we utilize directed gray-box fuzzing to generate test cases and resolve indirect jump relations by monitoring the execution traces of these test cases. Finally, we combine the static CFGs with indirect jump relations to construct more complete CFGs. In addition, we also propose an iterative feedback mechanism to further improve the completeness of CFGs. We have implemented our technique in a prototype and evaluated it through comparing with the existing approaches on eight benchmarks. The results show that our prototype can resolve more indirect jump relations and construct more complete CFGs than existing approaches.

show abstract

Section: Evaluation Setupmentioning

confidence: 99%

Section: Cfg Constructionmentioning

confidence: 99%

Section: Gray-box Fuzzingmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

Constructing More Complete Control Flow Graphs Utilizing Directed Gray-Box Fuzzing

Zhu

Huang

et al. 2021

Applied Sciences

View full text Add to dashboard Cite

show abstract

“…VUzzer 41 extract the control flow and data flow information of the program based on the dynamic and static analysis to guide the generation of test cases corresponding to the execution deeper path. Hawkeye 42 evaluates seeds based on static information and execution traces to improve the seed selection process to cause program crashes faster. Profuzz 43 automatically analyzes input fields that are critical for vulnerability discovery and intelligently adjusts mutation strategies to increase the probability of discovering vulnerabilities.…”

Section: Related Workmentioning

confidence: 99%

Fw‐fuzz: A code coverage‐guided fuzzing framework for network protocols on firmware

Gao¹,

Dong²,

Chang

et al. 2020

Concurrency and Computation

View full text Add to dashboard Cite

Summary Fuzzing is an effective approach to detect software vulnerabilities utilizing changeable generated inputs. However, fuzzing the network protocol on the firmware of IoT devices is limited by inefficiency of test case generation, cross‐architecture instrumentation, and fault detection. In this article, we propose the Fw‐fuzz, a coverage‐guided and crossplatform framework for fuzzing network services running in the context of firmware on embedded architectures, which can generate more valuable test cases by introspecting program runtime information and using a genetic algorithm model. Specifically, we propose novel dynamic instrumentation in Fw‐fuzz to collect the running state of the firmware program. Then Fw‐fuzz adopts a genetic algorithm model to guide the generation of inputs with high code coverage. We fully implement the prototype system of Fw‐fuzz and conduct evaluations on network service programs of various architectures in MIPS, ARM, and PPC. By comparing with the protocol fuzzers Boofuzz and Peach in metrics of edge coverage, our prototype system achieves an average growth of 33.7% and 38.4%, respectively. We further verify six known vulnerabilities and discover 5 0‐day vulnerabilities with the Fw‐fuzz, which prove the validity and utility of our framework. The overhead of our system expressed as an additional 5% of memory growth.

show abstract

The progress, challenges, and perspectives of directed greybox fuzzing

Wang,

Zhou,

Yue

et al. 2023

Software Testing Verif & Rel

View full text Add to dashboard Cite

SummaryGreybox fuzzing is a scalable and practical approach for software testing. Most greybox fuzzing tools are coverage‐guided as reaching high code coverage is more likely to find bugs. However, since most covered codes may not contain bugs, blindly extending code coverage is less efficient, especially for corner cases. Unlike coverage‐guided greybox fuzzing which increases code coverage in an undirected manner, directed greybox fuzzing (DGF) spends most of its time allocation on reaching specific targets (e.g. the bug‐prone zone) without wasting resources stressing unrelated parts. Thus, DGF is particularly suitable for scenarios such as patch testing, bug reproduction, and special bug detection. For now, DGF has become an active research area. However, DGF has general limitations and challenges that are worth further studying. Based on the investigation of 42 state‐of‐the‐art fuzzers that are closely related to DGF, we conducted the first in‐depth study to summarize the empirical evidence on the research progress of DGF. This paper studies DGF from a broader view, which takes into account not only the location‐directed type that targets specific code parts but also the behavior‐directed type that aims to expose abnormal program behaviors. By analyzing the benefits and limitations of DGF research, we try to identify gaps in current research, meanwhile, reveal new research opportunities and suggest areas for further investigation.

show abstract

Hawkeye

Cited by 187 publications

References 16 publications

Constructing More Complete Control Flow Graphs Utilizing Directed Gray-Box Fuzzing

Constructing More Complete Control Flow Graphs Utilizing Directed Gray-Box Fuzzing

Fw‐fuzz: A code coverage‐guided fuzzing framework for network protocols on firmware

The progress, challenges, and perspectives of directed greybox fuzzing

Contact Info

Product

Resources

About