PTrix

Abstract

Despite its effectiveness in uncovering software defects, American Fuzzy Lop (AFL), one of the best grey-box fuzzers, is inefficient when fuzz-testing source-unavailable programs. AFL's binary-only fuzzing mode, QEMU-AFL, is typically 2-5× slower than its sourceavailable fuzzing mode. The slowdown is largely caused by the heavy dynamic instrumentation.Recent fuzzing techniques use Intel Processor Tracing (PT), a light-weight tracing feature supported by recent Intel CPUs, to remove the need of dynamic instrumentation. However, we found that these PT-based fuzzing techniques are even slower than QEMU-AFL when fuzzing real-world programs, making them less effective than QEMU-AFL. This poor performance is caused by the slow extraction of code coverage information from highly compressed PT traces.In this work, we present the design and implementation of PTrix, which fully unleashes the benefits of PT for fuzzing via three novel techniques. First, PTrix introduces a scheme to highly parallel the processing of PT trace and target program execution. Second, it directly takes decoded PT trace as feedback for fuzzing, avoiding the expensive reconstruction of code coverage information. Third, PTrix maintains the new feedback with stronger feedback than edge-based code coverage, which helps reach new code space and defects that AFL may not.We evaluated PTrix by comparing its performance with the stateof-the-art fuzzers. Our results show that, given the same amount of time, PTrix achieves a significantly higher fuzzing speed and reaches into code regions missed by the other fuzzers. In addition, PTrix identifies 35 new vulnerabilities in a set of previously wellfuzzed binaries, showing its ability to complement existing fuzzers. CCS CONCEPTS• Security and privacy → Software security engineering.

The progress, challenges, and perspectives of directed greybox fuzzing

“…Using the packet trace captured by Intel PT along with the corresponding binary of the PUT, the execution path of the PUT could be fully reconstructed. There have been attempts of fuzzing with PT [10,[112][113][114], but it has never been used to DGF yet. For the problem of target identification and labeling at the binary code level, a machine-learning-based approach [30,31] and a heuristic binary diffing approach [100] can be leveraged to automatically identify the vulnerable code.…”

“…However, emulator‐based tools are usually less efficient. For example, the execution speed of vanilla AFL is 2‐5 times faster than its QEMU mode [112]. Second, difficulty in collecting target information .…”

JPortal: precise and efficient control-flow tracing for JVM programs with Intel processor trace

“…Hardware tracing has already enabled a variety of client tasks, including testing/fuzzing [5,28,47,63], debugging [30,33,34,44], security enforcement [32,39,55], performance tuning [50,51], etc. Multiple fuzzing systems, such as Honggfuzz, kAFL, PTFuzz, and PTrix, collect code coverage information via PT so as to efficiently guide the fuzzing process.…”

“…Modern CPUs are equipped with tracing modules such as Intel processor trace (PT) [19] and ARM embedded trace macrocell (ETM) [18], providing ultra efficiency for control-flow profiling of end-to-end program executions. With these hardware traces, it is possible to reconstruct a program's complete execution flow, enabling a wide spectrum of client applications in testing [5,28,47,[61][62][63], debugging [27,30,64,65], performance analysis [50,51], etc. For example, with a program's control flow, various execution statistics, such as function and statement coverage, path profiles, call tree profiles, etc.…”

Holistic methods for protecting and testing embedded devices

“…In this scenario, SHIFT can borrow design ideas from previous works (e.g., Chen et al, 2019, andLi et al, 2022) to acquire coverage information from blobs using tracing components provided by the Cortex-M architecture (e.g., the ARM-embedded trace macrocell (ETM) or the embedded trace buffer (ETB), ARM Ltd., 2020b). These 4.6.…”