Our approach tackles limitations exhibited by existing hybrid fuzzing frameworks, by negating roadblock checks (RC) in the program. In this research, we design DeepDiver, a novel transformational hybrid fuzzing tool that explores deeply hidden software vulnerabilities.

Despite those methods having demonstrated high performance across different benchmarks such as DARPA CGC programs, they still present deficiencies in their ability to analyze deeper code branches and in bypassing the roadblocks checks (magic bytes, checksums) in real-world programs. To eliminate these limitations in mutational fuzzers, patching-based fuzzers and hybrid fuzzers have been proposed as groundbreaking advancements which combine two software testing approaches. However, it is restrained by coverage and thus, there are chances of finding bugs entrenched in the deep execution paths of the program. 359–368.Fuzz testing is a simple automated software testing approach that discovers software vulnerabilities at a high level of performance by using randomly generated seeds.

In: IEEE/IFIP International Conference on Dependable Systems and Networks DSN 2009, pp. Xie, T., Tillmann, N., De Halleux, J., Schulte, W.: Fitness-guided path exploration in dynamic symbolic execution. Takanen, A., Demott, J.D., Miller, C.: Fuzzing for Software Security Testing and Quality Assurance. In: Proceedings of the Network and Distributed System Security Symposium (NDSS) (2016) Stephens, N., Grosen, J., Salls, C., Dutcher, A., Wang, R., Corbetta, J., Shoshitaishvili, Y., Kruegel, C., Vigna, G.: Driller: augmenting fuzzing through selective symbolic execution.

In: European Software Engineering Conference, pp. Sen, K., Marinov, D., Agha, G.: CUTE: a concolic unit testing engine for C. In: Symposium sur la sécurité des technologies de l’information et des communications, SSTIC, France, Rennes, 3–5 June 2015, pp. Saudel, F., Salwan, J.: Triton: a dynamic symbolic execution framework. In: 29th International Conference on Software Engineering, 2007, ICSE 2007, pp. Majumdar, R., Sen, K.: Hybrid concolic testing. Godefroid, P., Levin, M.Y., Molnar, D.A.: Automated whitebox fuzz testing. Godefroid, P., Levin, M.Y., Molnar, D.: SAGE: whitebox fuzzing for security testing. Godefroid, P., Klarlund, N., Sen, K.: DART: directed automated random testing. In: Proceedings of the 2012 International Symposium on Software Testing and Analysis, pp.

Geldenhuys, J., Dwyer, M.B., Visser, W.: Probabilistic symbolic execution. ACM 57(2), 74–84 (2014)Ĭadar, C., Sen, K.: Symbolic execution for software testing: three decades later. Avgerinos, T., Cha, S.K., Rebert, A., Schwartz, E.J., Woo, M., Brumley, D.: Automatic exploit generation.

Deeply hidden