TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection

By Tielei Wang, Tao Wei, Guofei Gu, Wei Zou. IEEE Symposium on Security and Privacy, 2010

423 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/4795dd48f23f1404634e8cb160c1f8b7b6b75548

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Software

In Signal Processing

Citations in the corpus

VUzzer: Application-aware Evolutionary Fuzzing (2017, methodology): “TaintScope [49]—a checksum-aware fuzzer—uses taint analysis to infer checksumhandling code, which further helps fuzzing bypass checksum checks.”
The Art, Science, and Engineering of Fuzzing: A Survey (2018, methodology): “Some fuzzers [229], [55], [150], [189] lever-”
Angora: Efficient Fuzzing by Principled Search (2018, methodology): “Taintscope [31] used taint analysis to infer checksum-handling code and bypassed these checks by control flow alteration, because these checks are hard to satisfy by mutating the input.”
Hawkeye: Towards a Desired Directed Grey-box Fuzzer (2018, methodology): “Taint analysis is also widely used to facilitate directed white-box testing [12, 16, 24, 34, 44].”
NAUTILUS: Fishing for Deep Bugs with Grammars (2019, background): “More advanced techniques are either taint-based [24], [27], [29], [43], [50], symbolic [26], or concolic [31], [32], [46] (a portmanteau of concrete and symbolic).”
CollAFL: Path Sensitive Fuzzing (2018, methodology): “TaintScope [43] uses taint analysis to recognize checksum bytes and fix them during testing.”
T-Fuzz: Fuzzing by Program Transformation (2018, background): “Taintscope [15] focuses mutating the security-sensitive parts of the input identified by dynamic taint analysis.”
REDQUEEN: Fuzzing with Input-to-State Correspondence (2019, methodology): “Different approaches were proposed which typically make use of advanced program analysis techniques, such as taint tracking and symbolic execution [12], [13], [16], [22], [23], [26], [35], [38], [40].”
LAVA: Large-Scale Automated Vulnerability Addition (2016, background): “Automated bug discovery systems can work on source code [1], [8], [9], [24] or on binaries [3], [21]; we can easily test binary analysis tools by simply compiling the modified source.”
AVATAR: A Framework to Support Dynamic Security Analysis of Embedded Systems' Firmwares (2014, background): “, packed or obfuscated code) and to perform a wide range of more sophisticated examinations [24] - including taint propagation [33], [55], symbolic and concolic execution [10], [15], [22], unpacking [34], malware sandboxing [1], [5], and whitebox fuzzing [28], [29].”
Directed Greybox Fuzzing (2017, background): “…taint analysis [17, 25] to identify certain parts of the seed input which should be fuzzed with priority to increase the probability to generate a value that is required to observa a vulnerability at a target location (e.g., a zero value in the denominator of a division operator) [11, 31, 40].”
Fuzzing: A Survey for Roadmap (2022, methodology): “Fuzzers [37, 38, 67, 157, 160, 187] utilize 230:15 DTA to build relationships between input bytes and security-sensitive points (e.g., system/library calls or conditional jumps).”
FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage (2017, background): “BuzzFuzz [15] and TaintScope [40] pair taint analysis with the detection of potential attack points (i.e. array allocations) to find crashes more effectively.”
Superion: Grammar-Aware Greybox Fuzzing (2018, positive): “Dowser [30], TaintScope [65] and BORG [47] integrate taint analysis with symbolic execution to guide fuzzing.”
Steelix: program-state based binary fuzzing (2017, neutral): “TaintScope [48] performs checksum-aware fuzzing.”
Skyfire: Data-Driven Seed Generation for Fuzzing (2017, methodology): “BuzzFuzz [8] and TaintScope [9] use taint analysis to locate the interesting byte for guiding the mutation.”
ROPdefender: a detection tool to defend against return-oriented programming attacks (2011, methodology): “Moreover, it has been used in [61] for a checksum-aware fuzzing tool and in [17] as dynamic taint analysis system.”
Coverage-Based Greybox Fuzzing as Markov Chain (2016, methodology): “Taint-based fuzzing [16], [32] is a directed whitebox fuzzing technique.”