Going Beyond Coverage-Guided Fuzzing with Structured Fuzzing
summary
Argues that adding format awareness to coverage-guided fuzzers yields more bugs and control: uses AFL and libFuzzer plus a custom libprotobuf mutator workflow to generate structured inputs, run coverage reports, and expand the corpus for uncovered features. Concrete wins: about 10 vulnerabilities in Skia not hit by unstructured fuzzers, roughly 50 Chrome bugs found with structured fuzzing, an AppCache fuzzer that produced a sandbox-escaping exploit and an iOS kernel bug used in an iOS 12.2 jailbreak. Techniques: custom mutators, protobuf schemas, and converting black‑box mutators.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:25What is fuzzing
- 5:13Why Structured Fuzzing
- 7:50Why Does Structured Fuzzing Help
- 11:17Example of Structured Fuzzing
- 13:29Fuzzing with Structured Fuzzing
- 14:41Why Use Structured Fuzzing
- 15:02Practical Advice
- 15:28Custom Mutators
- 16:11Protobuf Mutator
- 18:33Custom Mutator
related talks
01h 15mMake your programs more reliable with Fuzzing
52mStructure aware fuzzing
39mMaking Fuzzing Part of Your Software Development Lifecycle
25mHow fuzzing helps to find bugs
53mFuzzing 101
31m“Fuzz or lose..."
53mThree Colours of Fuzzing: Reflections and Open Challenges
24mWhy you should be using automated fuzzing to test for security issues in your code