AIMFuzz: Automated Function-Level In-Memory Fuzzing on Binaries

Abstract

In-memory fuzzing, designed to perform direct mutation on memory contents, has gained attention as a technique that enables intensive, efficient testing. To facilitate this fuzzing technique, identifications of mutable buffers, which will be subject to mutation, and fuzzing target functions should be preceded. So far, these identifications have been relied on manual efforts with source code available. Unfortunately, such manual identifications are challenging on binary-only programs due mainly to loss of source-level information during compilation. To address this difficulty, this paper proposes AIMFuzz that supports in-memory fuzzing on binary programs at function level. AIMFuzz largely consists of two stages: the analysis stage that identifies mutable buffers and prioritizes fuzzing target functions based on dynamic taint tracking, and the fuzzing stage that tests the designated target functions by injecting mutated inputs through the identified mutable buffers. Noteworthily, these two stages are carried out automatically, eliminating daunting manual efforts for the binary. Our evaluation results demonstrate that AIMFuzz successfully detects bugs on real applications. AIMFuzz shows great effectiveness in testing selected target functions efficiently and thoroughly, and also comparable performance to the state-of-the-art implementation of in-memory fuzzing with better usability thanks to its automated analysis and testing.