Steelix: program-state based binary fuzzing

By Yuekang Li, Bihuan Chen, Mahinthan Chandramohan, Shang-Wei Lin, Yang Liu, Alwen Tiu. ESEC/SIGSOFT FSE, 2017

298 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/d9b98ccc75ec1a464e84121916fb39838dc61862

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Software

In Signal Processing

Citations in the corpus

Superion: Grammar-Aware Greybox Fuzzing (2018, unknown): “A fuzzer can be classiﬁed as generation-based (e.g., [32, 62, 64, 69]) or mutation-based (e.g., [9, 43, 55, 59]), depending on whether test inputs are generated by the knowledge of the input format or grammar or by modifying well-formed test inputs.”
The Art, Science, and Engineering of Fuzzing: A Survey (2018, background): “Ad-ditionally, Steelix [138] checks which input offsets inﬂuence comparison instructions.”
Evaluating Fuzz Testing (2018, methodology): “Steelix [33] and Angora [10] instrument the program so that finer grained information about progress towards satisfying a condition is exposed through observation .”
T-Fuzz: Fuzzing by Program Transformation (2018, methodology): “Programs in this dataset contain a wide range of sanity checks on the input that are representative of real world programs, and thus are used widely as benchmark in related work [12], [13], [14].”
Angora: Efficient Fuzzing by Principled Search (2018, background): “• Steelix: a fuzzer outperforming VUzzer on LAVAM [19].”
REDQUEEN: Fuzzing with Input-to-State Correspondence (2019, methodology): “STEELIX was able to find one crash that AFL could not find.”
FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage (2017, background): “While playing with AFL and its extensions, we observed—as others have in the past [1, 9, 30, 39] — one important limitation of AFL: AFL often fails to explore programs very deeply, i.”
Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks (2019, methodology): “Besides the classic approaches such as static analysis [1, 2], dynamic analysis [3–8] and symbolic execution, a number of advances have been made in applying machine learning as a complementary approach.”
Hawkeye: Towards a Desired Directed Grey-box Fuzzer (2018, background): “[12, 25, 32, 34, 40] aim to help the CGFs to break through path constraints.”
QSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing (2018, background): “Steelix [37] recovers correct magic values by collecting comparison progress information during program execution.”
Fuzzing: A Survey for Roadmap (2022, background): “Most fuzzers select bytes heuristically based on execution information [7, 37, 38, 67, 101, 103, 157, 160, 187] or randomly [22, 23, 118, 203, 206].”