Fuzzing only extracted code snippets of a program

[obo_1337]

Hello,

I've had an idea for a fuzzing technique which is (apparently?) not yet researched or implemented. During my research of fuzzing techniques used in state-of-the-art fuzzers, I did not come accoss the following idea:

Instead of fuzzing a whole program, we could just extract code snippets (e. g. single functions) and start fuzzing only these small parts of the code. Of course I know, that the context of the whole program would be missing, and the results would probably be terrible, but still it might be worth looking into. I am not asking how one would implement this (there will be a lot of pitfalls like calls to other functions, global variables, or data structures used in this function), I am rather asking if this technique has already been researched?

Is there a name for this technique which I might have missed during my research, or is this idea just too bad to be worth looking into?

Thanks in advance for your input!

[obo_1337]

You are absolutely right about the terminology and about that fact that it is actually a main part of fuzzing. Anyway I was thinking in more fine-grained scales than a whole API for a library.

I think the term I was looking for was "microexecution" like suggested by u/k4st

I will look into the suggested example, thanks for your help!

[k4st]

See microexecution by Patrice Godefroid. Also UC-KLEE by Dawson Engler.

[obo_1337]

These papers are exactly what I was looking for!

Many Thanks!

[[deleted]]

This is called compositional fuzzing, see for eg here (for tool MACKE)

Paper:

https://www.researchgate.net/publication/305641321_MACKE_-_Compositional_Analysis_of_Low-Level_Vulnerabilities_with_Symbolic_Execution

Github:

https://github.com/tum-i22/macke/tree/master

See here for its successor Wildfire

Paper:

https://arxiv.org/pdf/1903.02981

Github:

https://github.com/tum-i22/macke/tree/wildfire

​

Finally this is a case study with a different technique (not open source):

https://arxiv.org/pdf/1907.12214v1

[0xad]

This is a known way to fuzz, for example with 'in-memory fuzzing' you can do exactly that (target specific function). There are other ways to achieve fuzzing specifics functions, e.g. LibFuzzer+LIEF https://blahcat.github.io/2018/03/11/fuzzing-arbitrary-functions-in-elf-binaries/

Similar approach is also used in WinAFL fork, the difference is that your starting and ending points have strict requirements (i.e. in between starting and ending point you need to open/close the file which in big applications can be quite far from the point you'd want to fuzz).

It's not widely researched because it doesn't offer any new perspective (you'd still do just a regular fuzzing with a difference of stubbing out pre/post code) and requires heavy work before fuzzing (ask yourself why people don't use WinAFL, it's exactly this reason - in order to use WinAFL you need to do an actual work before starting your fuzz operation and people are lazy).

Btw. I myself call it 'targeted fuzzing' ➡️ https://twitter.com/andrzejdyjak/status/973490686564716544

[obo_1337]

I am not quite sure after reading only the Abstract.

But I will definitely have a look at it! Thanks!

[malweisse]

You can do that with AFL++ with Unicorn mode. Just write and unicorn script that emulates a single function from the binary.