MoonShine: Optimizing OS Fuzzer Seed Selection with Trace Distillation

on YouTube ↗24m

" summary

Takes 2.8 million system calls from 3,220 real programs and uses trace distillation to compress them to just over 14,000 calls while preserving 86% of original coverage. Implements a lightweight static analysis to track explicit and implicit dependencies between syscalls, integrates distilled seeds into Syzkaller, and uses strace plus kcov to collect traces and coverage. Distilled seeds raise Syzkaller coverage ~13% on average and uncover 14 kernel vulnerabilities not found before.

AI-written summary · about

" chapters (11)

1. 0:00Intro
2. 1:09OS Fuzzing - Overview
3. 2:24Synthetic Program Generation
4. 6:25Trace Distillation vs. User-Level Seed Selection
5. 8:18Distillation Challenges
6. 11:48Tracking Implicit Dependencies
7. 14:50Implementation
8. 15:39Evaluation - Setup
9. 17:31Effectiveness of Distillation
10. 19:52Conclusion
11. 21:54Coverage Improvement

" related talks

• 20mKSG: Augmenting Kernel Fuzzing with System Call Specification GenerationYu Jiang, Yuheng Shen, Yiru Xu, Hao Sun, Jianzhong Liu · USENIX ATC '22
• 32mListen to your EngineRobby Cochran · BSidesSF 2018
• 18mOptimizing Input Minimization in Kernel FuzzingShan Huang, Shaohua Li, Ting Su, Hao Sun, Hui Guo, Geguang Pu · USENIX ATC '25
• 42mCPU Fuzzing: Automatic Discovery of...Daniel Weber, Michael Schwarz · RuhrSec 2023
• 38mHow I started chasing speculative type confusion bugs in the kernel and ended up wi...Jakob Koschel · Linux Plumbers Conference 2022
• 01h 15mMake your programs more reliable with FuzzingMarshall Clow · ACCU Autumn 2019 Belfast
• 35mEnter SandboxMichael Schwarz, Claudio Canella, Mario Werner · Black Hat Asia 2021
• 17mAutomated Policy Synthesis for System Call SandboxingIşıl Dillig, Xinyu Wang, Isil Dillig, Hovav Shacham, Shankara Pailoor · OOPSLA 2020