Unleashing Mayhem on Binary Code

By Sang Kil Cha, Thanassis Avgerinos, Alexandre Rebert, David Brumley. IEEE Symposium on Security and Privacy, 2012

596 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/32c9b3a4990fdb26da19a4e0817936369a5e91bc

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Software

In Signal Processing

Citations in the corpus

REDQUEEN: Fuzzing with Input-to-State Correspondence (2019, methodology): “Several gray- or white-box fuzzing tools make use of symbolic execution to improve test coverage [12], [13].”
LAVA: Large-Scale Automated Vulnerability Addition (2016, background): “12 lava |= ((unsigned char *)(buf))[2]<<(2*8); lava |= ((unsigned char *)(buf))[3]<<(3*8);”
VUzzer: Application-aware Evolutionary Fuzzing (2017, background): “Mayhem [12], a system from CMU to automatically find exploitable bugs in binary code, uses several”
Driller: Augmenting Fuzzing Through Selective Symbolic Execution (2016, methodology): “We used an existing symbolic execution engine, based heavily on the ideas proposed by Mayhem [8], for the concolic execution test.”
Evaluating Fuzz Testing (2018, background): “We also considered a variety of seed files, including the empty file, paper benchmarks baseline trials variance crash coverage seed timeout MAYHEM[8] R(29) randomly selected files of the right type, and manually-generated (but well-formed) files.”
Cross-architecture bug search in binary executables (2015, background): “introduced an efficient symbolic execution engine to find previously-unseen bugs at the binary level with MAYHEM [6].”
Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware (2015, methodology): “Traditional vulnerability detection systems such as KLEE [8], AEG [29], and Mayhem [24], among others, are designed to identify memory corruption vulnerabilities in software.”
Angora: Efficient Fuzzing by Principled Search (2018, methodology): “Some fuzzers use symbolic execution to solve path constraints [5, 8], but symbolic execution is slow and cannot solve many types of constraints efficiently [6].”
The Art, Science, and Engineering of Fuzzing: A Survey (2018, background): “2, we intentionally omit dynamic symbolic executors such as [92], [198], [63], [49], [218], [54] because their authors did not explicitly describe their work as a fuzzer.”
discovRE: Efficient Cross-Architecture Identification of Bugs in Binary Code (2016, background): “There also exist orthogonal approaches that aim at finding previously unknown bugs such as AEG [14] or Mayhem [19].”
kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels (2017, methodology): “Tools like SAGE [23], DART [22], KLEE [15], SmartFuzz [33], or Mayhem [16] try to enumerate complex paths by using techniques such as symbolic execution and constraint solving.”
QSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing (2018, methodology): “Since QSYM can achieve performance without introducing forkingbased symbolic execution [21], QSYM can utilize the old but complete technique to support external environments.”
teEther: Gnawing at Ethereum to Automatically Exploit Smart Contracts (2018, background): “[11] both provide means to create a control flow hijacking exploit using buffer overflows or format string attacks from source code and compiled binaries, respectively.”
SOK: (State of) The Art of War: Offensive Techniques in Binary Analysis (2016, methodology): “By implementing algorithms similar to those described in AXGEN [51], AEG [4] and Mayhem [16], we were able to”