Driller: Augmenting Fuzzing Through Selective Symbolic Execution

By Nick Stephens, John Grosen, Christopher Salls, Andrew Dutcher, Ruoyu Wang, Jacopo Corbetta, Yan Shoshitaishvili, Christopher Krügel, Giovanni Vigna. Network and Distributed System Security Symposium, 2016

1,048 citations recorded by the source corpus.

—Memory corruption vulnerabilities are an ever- present risk in software, which attackers can exploit to obtain unauthorized access to conﬁdential information. As products with access to sensitive data are becoming more prevalent, the number of potentially exploitable systems is also increasing, resulting in a greater need for automated software vetting tools. DARPA recently funded a competition, with millions of dollars in prize money, to further research focusing on automated vulnerability ﬁnding and patching, showing the importance of research in this area. Current techniques for ﬁnding potential bugs include static, dynamic, and concolic analysis systems, which each having their own advantages and disadvantages. A common limitation of systems designed to create inputs which trigger vulnerabilities is that they only ﬁnd shallow bugs and struggle to exercise deeper paths in executables. We present Driller, a hybrid vulnerability excavation tool which leverages fuzzing and selective concolic execution in a complementary manner, to ﬁnd deeper bugs. Inexpensive fuzzing is used to exercise compartments of an application, while concolic execution is used to generate inputs which satisfy the complex checks separating the compartments. By combining the strengths of the two techniques, we mitigate their weaknesses, avoiding the path explosion inherent in concolic analysis and the incompleteness of fuzzing. Driller uses selective concolic execution to explore only the paths deemed interesting by the fuzzer and to generate inputs for conditions that the fuzzer cannot satisfy. We evaluate Driller on 126 applications released in the qualifying event of the DARPA Cyber Grand Challenge and show its efﬁcacy by identifying the same number of vulnerabilities, in the same time, as the top-scoring team of the qualifying event.

Subfields: Computer Science Applications, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/f049751103f13d1ce6080418813e2a26820713e1

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Science Applications

In Software

In Signal Processing

Citations in the corpus

NAUTILUS: Fishing for Deep Bugs with Grammars (2019, background): “More advanced techniques are either taint-based [24], [27], [29], [43], [50], symbolic [26], or concolic [31], [32], [46] (a portmanteau of concrete and symbolic).”
Skyfire: Data-Driven Seed Generation for Fuzzing (2017, background): “Driller [39] combines fuzzing and concolic execution in a complementary way to find deep bugs.”
Hawkeye: Towards a Desired Directed Grey-box Fuzzer (2018, background): “However, as discussed in [6], DGF is generally more effective on real-world programs as DSE techniques suffer from the infamous path-explosion problem [40].”
VUzzer: Application-aware Evolutionary Fuzzing (2017, methodology): “This is evident from the results presented in the Driller paper [47]: out of 41 binaries from DARPA CGC, Driller’s concolic engine could generate new meaningful”
kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels (2017, background): “However, with the development of American Fuzzy Lop (AFL), smarter fuzzers have gained significant traction in the industry [1] as well as in research [8, 14, 35, 37].”
Steelix: program-state based binary fuzzing (2017, methodology): “For example, Driller [44] uses concolic execution to solve those comparison constraints.”
SOK: (State of) The Art of War: Offensive Techniques in Binary Analysis (2016, methodology): “While we give a summary of our symbolic-assisted fuzzing implementation here, the full approach, called Driller, is detailed in a separate paper [54].”
Learning to Fuzz from Symbolic Execution with Application to Smart Contracts (2019, methodology): “Mutation-based fuzzers [15, 39, 45, 48, 59, 63, 68] mutate initial seeds to craft new inputs that may expose vulnerabilities.”
REDQUEEN: Fuzzing with Input-to-State Correspondence (2019, methodology): “One common approach to handle state explosion is to use concolic execution [21]– [23], [26], [33], [38], [40].”
Evaluating Fuzz Testing (2018, background): “However, sometimes the CGC benchmark was subset: Driller [50], VUzzer [44], and Steelix [33] were evaluated on 126, 63, and 17 out of the 296 programs,”
Fuzzing: A Survey for Roadmap (2022, background): “Whitebox fuzzing usually utilizes concolic execution (i.e., dynamic symbolic execution) to analyze target programs [71, 81, 150, 177, 204].”
Directed Greybox Fuzzing (2017, background): “Driller [38] is an example of an (undirected) fuzzer that integrates the AFL greybox fuzzer and the Klee whitebox fuzzer.”
Angora: Efficient Fuzzing by Principled Search (2018, background): “Some tools tried to mitigate this obstacle by combining it with fuzzing [15, 16, 7, 28].”
Coverage-Based Greybox Fuzzing as Markov Chain (2016, background): “RECENTLY, there has been a controversial debate about the efficiency of symbolic execution-based whitebox fuzzers versus more lightweight greybox fuzzers [2], [3].”