FSFuzzer: A High-Performance Greybox Fuzzer for Stateful Network Protocol
摘要
Bugs in network protocol programs exhibit statefulness, making it challenging for fuzzers to generate effective testcases without knowledge of the protocol. Additionally, features such as network transmission and communication synchronization can decrease the execution efficiency of fuzzing in these programs compared to local applications. Current network protocol fuzzing mainly focuses on state inference or execution speed optimization, but these two types of research are orthogonal to each other. However, we observe that enhancing the speed of execution may also increase the power of state inference, leading to improvements in both execution efficiency and testcase generation. In this paper, we introduce FSFuzzer, which leverages shared memory based message transmission and session state sharing based synchronization to alleviate the heavy post-execution analysis in StateAFL state inference. Our experimental results show that FSFuzzer accelerates the execution speed by 4.7x compared to StateAFL. Moreover, we find that the increase in execution speed also boosts StateAFL’s state inference ability, allowing FSFuzzer to infer richer state model information and better guide testcase generation, achieving a notable increase in code coverage and bug-finding capability compared to StateAFL on tested programs.