Accelerating Fuzzing through Prefix-Guided Execution
summary
Introduces prefix-guided execution that monitors a test's partial run (a sequence of basic block IDs) and applies early termination when the prefix is already seen, implemented as AFL++-PGE on top of AFL++. Evaluated on MAGMA (21 programs) with 48-hour fuzzing: throughput increases up to about 3×, finds bugs faster and more bugs overall, and the authors observe the prefix heuristic matches full-execution outcomes ≈99% of the time; it can still miss some bugs.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:23What is fuzzing
- 3:15Wasted execution time
- 5:43Prefix guided execution
- 7:29Example of prefix guided
- 8:54Balancing prefix length
- 9:16Evaluation setup
- 10:42Bug discovery improvements
- 11:43Positioning in fuzzing
- 13:28Future directions
- 14:12Conclusion
- 14:36Q&A
- 14:56Handling loops
- 15:59Control flow vs data flow
- 17:00Input filtering
related talks
20mAFL++ : Combining Incremental Steps of Fuzzing Research
45mFuzzing with AFL
53mFuzzing 101
52mStructure aware fuzzing
01h 15mMake your programs more reliable with Fuzzing
31m“Fuzz or lose..."
32mFuzzing Zephyr Apps - Struggles of Dynamic Analysis on Embedded Applications
24mFuzzing Guided by Bayesian Program Analysis