SlideShare a Scribd company logo
LEARNING INPUT TOKENS FOR EFFECTIVE FUZZING
BJÖRN MATHIS, RAHUL GOPINATH, ANDREAS ZELLER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TESTFUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TEST
7245
FUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TEST
7245
FUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TEST
7245
FUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TESTFUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TEST
C4tscs
FUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TEST
C4tscs
FUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TEST
C4tscs
FUZZER
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
C4tscs
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
C4tscs
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
X + 0
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
X + 0
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
X + 0
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
X + 0
COMPLEX INPUT STRUCTURES NEED SYNTACTIC FUZZING
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
&
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
&
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
&
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X @
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X @
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X @
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X +
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X +
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X + 0
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X + 0
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
TOKENIZATION - COMPLEX PARSERS
5
TOKENIZATION - COMPLEX PARSERS
5
X + 0
TOKENIZATION - COMPLEX PARSERS
5
X + 0
TOKENIZER
TOKENIZATION - COMPLEX PARSERS
5
X + 0
TOKENIZER
T_ALPHA T_PLUS T_DIGIT
TOKENIZATION - COMPLEX PARSERS
5
X + 0
TOKENIZER
T_ALPHA T_PLUS T_DIGIT
PARSER
6
TOKENIZATION - COMPLEX PARSERS
X + 0
TOKENIZER
T_ALPHA T_PLUS T_DIGIT
PARSER
6
TOKENIZATION - COMPLEX PARSERS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
X + 0
TOKENIZER
T_ALPHA T_PLUS T_DIGIT
PARSER
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
T_MINUS
T_PLUS
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
T_MINUS
T_PLUS
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
T_MINUS
T_PLUS
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
T_MINUS
T_PLUS
T_DIGIT
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
&
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
&
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
&
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X 3
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X 3
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X 3
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X +
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X +
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X + 0
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X + 0
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - BOOSTING FUZZERS
9
LFUZZER - BOOSTING FUZZERS
9
0 .. 9

A .. Z

a .. z

+

-
TOKENS
LFUZZER - BOOSTING FUZZERS
9
0 .. 9

A .. Z

a .. z

+

-
TOKENS
0 + 5

a + 6
SAMPLE INPUTS
LFUZZER - BOOSTING FUZZERS
9
0 .. 9

A .. Z

a .. z

+

-
TOKENS
0 + 5

a + 6
SAMPLE INPUTS
AFL

MIMID*

LIBFUZZER

…

YOURFAVORITEFUZZER
FUZZER
* In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
LFUZZER - BOOSTING FUZZERS
9
0 .. 9

A .. Z

a .. z

+

-
TOKENS
0 + 5

a + 6
SAMPLE INPUTS
AFL

MIMID*

LIBFUZZER

…

YOURFAVORITEFUZZER
FUZZER
A - K

8 - I + P - q

R + y - 6 + u

…
INPUTS
* In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
LFUZZER - BOOSTING FUZZERS
9
0 .. 9

A .. Z

a .. z

+

-
TOKENS
0 + 5

a + 6
SAMPLE INPUTS
AFL

MIMID*

LIBFUZZER

…

YOURFAVORITEFUZZER
FUZZER
A - K

8 - I + P - q

R + y - 6 + u

…
INPUTS
PROGRAM UNDER TEST
* In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
LFUZZER - BOOSTING FUZZERS
9
0 .. 9

A .. Z

a .. z

+

-
TOKENS
0 + 5

a + 6
SAMPLE INPUTS
AFL

MIMID*

LIBFUZZER

…

YOURFAVORITEFUZZER
FUZZER
A - K

8 - I + P - q

R + y - 6 + u

…
INPUTS
PROGRAM UNDER TEST
* In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
EVALUATION - TOKENS AND COVERAGE
10
EVALUATION - TOKENS AND COVERAGE
10
Fsv
ini
Fjson
lisS
tinyF
mjs
6uEjeFt
0
20
40
60
80
TokensExtraFted
6tring ExtraFtion
lFuzzer
NUMBER OF VALID TOKENS
EXTRACTED
EVALUATION - TOKENS AND COVERAGE
10
Fsv
ini
Fjson
lisS
tinyF
mjs
6uEjeFt
0
20
40
60
80
TokensExtraFted
6tring ExtraFtion
lFuzzer
NUMBER OF VALID TOKENS
EXTRACTED
Fsv
ini
Fjson
lisS
tinyF
mjs
SuEjeFt
0
25
50
75
100
125
150
175
200
7okensExtraFted
String ExtraFtion
lFuzzer
NUMBER OF INVALID TOKENS
EXTRACTED
EVALUATION - TOKENS AND COVERAGE
10
Fsv
ini
Fjson
lisS
tinyF
mjs
6uEjeFt
0
20
40
60
80
TokensExtraFted
6tring ExtraFtion
lFuzzer
NUMBER OF VALID TOKENS
EXTRACTED
Fsv
ini
Fjson
lisS
tinyF
mjs
SuEjeFt
0
25
50
75
100
125
150
175
200
7okensExtraFted
String ExtraFtion
lFuzzer
NUMBER OF INVALID TOKENS
EXTRACTED
0 4 8 12 16 20 24
TLme (h)
0
5
10
15
20
25
30
35
CoverDge(%)
mjs
A)L
A)L_DLFt
p)uzzer
p)uzzer + A)L
l)uzzer + A)L
COVERAGE OVER TIME FOR MJS
11
11
11
11
11
11
GITHUB.COM/UDS-SE/LFUZZER

More Related Content

What's hot

c-programming-using-pointers
c-programming-using-pointersc-programming-using-pointers
c-programming-using-pointers
Sushil Mishra
 
The solution manual of c by robin
The solution manual of c by robinThe solution manual of c by robin
The solution manual of c by robin
Abdullah Al Naser
 
Ansi c
Ansi cAnsi c
DataStructures notes
DataStructures notesDataStructures notes
DataStructures notes
Lakshmi Sarvani Videla
 
Infix to-postfix examples
Infix to-postfix examplesInfix to-postfix examples
Infix to-postfix examples
mua99
 
Datastructures asignment
Datastructures asignmentDatastructures asignment
Datastructures asignment
sreekanth3dce
 
Introduction to c part -1
Introduction to c   part -1Introduction to c   part -1
Cpds lab
Cpds labCpds lab
C programms
C programmsC programms
C programms
Mukund Gandrakota
 
Data Structures Using C Practical File
Data Structures Using C Practical File Data Structures Using C Practical File
Data Structures Using C Practical File
Rahul Chugh
 
C PROGRAMS
C PROGRAMSC PROGRAMS
ADA FILE
ADA FILEADA FILE
ADA FILE
Gaurav Singh
 
C Programming
C ProgrammingC Programming
C Programming
Sumant Diwakar
 
Simple c program
Simple c programSimple c program
Simple c program
Ravi Singh
 
C basics
C basicsC basics
C basics
MSc CST
 
SPL 8 | Loop Statements in C
SPL 8 | Loop Statements in CSPL 8 | Loop Statements in C
SPL 8 | Loop Statements in C
Mohammad Imam Hossain
 
Program flowchart
Program flowchartProgram flowchart
Program flowchart
Sowri Rajan
 
Stack prgs
Stack prgsStack prgs
Stack prgs
Ssankett Negi
 
Chapter 5 Balagurusamy Programming ANSI in c
Chapter 5 Balagurusamy Programming ANSI  in cChapter 5 Balagurusamy Programming ANSI  in c
Chapter 5 Balagurusamy Programming ANSI in c
BUBT
 
C++ Programming - 1st Study
C++ Programming - 1st StudyC++ Programming - 1st Study
C++ Programming - 1st Study
Chris Ohk
 

What's hot (20)

c-programming-using-pointers
c-programming-using-pointersc-programming-using-pointers
c-programming-using-pointers
 
The solution manual of c by robin
The solution manual of c by robinThe solution manual of c by robin
The solution manual of c by robin
 
Ansi c
Ansi cAnsi c
Ansi c
 
DataStructures notes
DataStructures notesDataStructures notes
DataStructures notes
 
Infix to-postfix examples
Infix to-postfix examplesInfix to-postfix examples
Infix to-postfix examples
 
Datastructures asignment
Datastructures asignmentDatastructures asignment
Datastructures asignment
 
Introduction to c part -1
Introduction to c   part -1Introduction to c   part -1
Introduction to c part -1
 
Cpds lab
Cpds labCpds lab
Cpds lab
 
C programms
C programmsC programms
C programms
 
Data Structures Using C Practical File
Data Structures Using C Practical File Data Structures Using C Practical File
Data Structures Using C Practical File
 
C PROGRAMS
C PROGRAMSC PROGRAMS
C PROGRAMS
 
ADA FILE
ADA FILEADA FILE
ADA FILE
 
C Programming
C ProgrammingC Programming
C Programming
 
Simple c program
Simple c programSimple c program
Simple c program
 
C basics
C basicsC basics
C basics
 
SPL 8 | Loop Statements in C
SPL 8 | Loop Statements in CSPL 8 | Loop Statements in C
SPL 8 | Loop Statements in C
 
Program flowchart
Program flowchartProgram flowchart
Program flowchart
 
Stack prgs
Stack prgsStack prgs
Stack prgs
 
Chapter 5 Balagurusamy Programming ANSI in c
Chapter 5 Balagurusamy Programming ANSI  in cChapter 5 Balagurusamy Programming ANSI  in c
Chapter 5 Balagurusamy Programming ANSI in c
 
C++ Programming - 1st Study
C++ Programming - 1st StudyC++ Programming - 1st Study
C++ Programming - 1st Study
 

Similar to lFuzzer - Learning Input Tokens for Effective Fuzzing

data structure and algorithm.pdf
data structure and algorithm.pdfdata structure and algorithm.pdf
data structure and algorithm.pdf
Asrinath1
 
Applications of stack
Applications of stackApplications of stack
Applications of stack
A. S. M. Shafi
 
Assignment on Numerical Method C Code
Assignment on Numerical Method C CodeAssignment on Numerical Method C Code
Assignment on Numerical Method C Code
Syed Ahmed Zaki
 
VTU Data Structures Lab Manual
VTU Data Structures Lab ManualVTU Data Structures Lab Manual
VTU Data Structures Lab Manual
Nithin Kumar,VVCE, Mysuru
 
Please need help on C++ language.Infix to Postfix) Write a program.pdf
Please need help on C++ language.Infix to Postfix) Write a program.pdfPlease need help on C++ language.Infix to Postfix) Write a program.pdf
Please need help on C++ language.Infix to Postfix) Write a program.pdf
pristiegee
 
Write a program to check a given number is prime or not
Write a program to check a given number is prime or notWrite a program to check a given number is prime or not
Write a program to check a given number is prime or not
aluavi
 
Ada file
Ada fileAda file
Ada file
Kumar Gaurav
 
Naive application of Machine Learning to Software Development
Naive application of Machine Learning to Software DevelopmentNaive application of Machine Learning to Software Development
Naive application of Machine Learning to Software Development
Andriy Khavryuchenko
 
openFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollider
openFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollideropenFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollider
openFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollider
Atsushi Tadokoro
 
Functional programming in Python
Functional programming in PythonFunctional programming in Python
Functional programming in Python
Colin Su
 
Stack and queue
Stack and queueStack and queue
Stack and queue
Shakila Mahjabin
 
pointers 1
pointers 1pointers 1
pointers 1
gaurav koriya
 
C Code and the Art of Obfuscation
C Code and the Art of ObfuscationC Code and the Art of Obfuscation
C Code and the Art of Obfuscation
guest9006ab
 
Solutionsfor co2 C Programs for data structures
Solutionsfor co2 C Programs for data structuresSolutionsfor co2 C Programs for data structures
Solutionsfor co2 C Programs for data structures
Lakshmi Sarvani Videla
 
Swift School #1
Swift School #1Swift School #1
Swift School #1
Sergey Pronin
 
Stack,queue and linked list data structure.pptx
Stack,queue and linked list data structure.pptxStack,queue and linked list data structure.pptx
Stack,queue and linked list data structure.pptx
yukti266975
 
design and analysis of algorithm Lab files
design and analysis of algorithm Lab filesdesign and analysis of algorithm Lab files
design and analysis of algorithm Lab files
Nitesh Dubey
 
Pratt Parser in Python
Pratt Parser in PythonPratt Parser in Python
Pratt Parser in Python
Percolate
 
Data structure and algorithm.(dsa)
Data structure and algorithm.(dsa)Data structure and algorithm.(dsa)
Data structure and algorithm.(dsa)
mailmerk
 
Bti1022 lab sheet 8
Bti1022 lab sheet 8Bti1022 lab sheet 8
Bti1022 lab sheet 8
alish sha
 

Similar to lFuzzer - Learning Input Tokens for Effective Fuzzing (20)

data structure and algorithm.pdf
data structure and algorithm.pdfdata structure and algorithm.pdf
data structure and algorithm.pdf
 
Applications of stack
Applications of stackApplications of stack
Applications of stack
 
Assignment on Numerical Method C Code
Assignment on Numerical Method C CodeAssignment on Numerical Method C Code
Assignment on Numerical Method C Code
 
VTU Data Structures Lab Manual
VTU Data Structures Lab ManualVTU Data Structures Lab Manual
VTU Data Structures Lab Manual
 
Please need help on C++ language.Infix to Postfix) Write a program.pdf
Please need help on C++ language.Infix to Postfix) Write a program.pdfPlease need help on C++ language.Infix to Postfix) Write a program.pdf
Please need help on C++ language.Infix to Postfix) Write a program.pdf
 
Write a program to check a given number is prime or not
Write a program to check a given number is prime or notWrite a program to check a given number is prime or not
Write a program to check a given number is prime or not
 
Ada file
Ada fileAda file
Ada file
 
Naive application of Machine Learning to Software Development
Naive application of Machine Learning to Software DevelopmentNaive application of Machine Learning to Software Development
Naive application of Machine Learning to Software Development
 
openFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollider
openFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollideropenFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollider
openFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollider
 
Functional programming in Python
Functional programming in PythonFunctional programming in Python
Functional programming in Python
 
Stack and queue
Stack and queueStack and queue
Stack and queue
 
pointers 1
pointers 1pointers 1
pointers 1
 
C Code and the Art of Obfuscation
C Code and the Art of ObfuscationC Code and the Art of Obfuscation
C Code and the Art of Obfuscation
 
Solutionsfor co2 C Programs for data structures
Solutionsfor co2 C Programs for data structuresSolutionsfor co2 C Programs for data structures
Solutionsfor co2 C Programs for data structures
 
Swift School #1
Swift School #1Swift School #1
Swift School #1
 
Stack,queue and linked list data structure.pptx
Stack,queue and linked list data structure.pptxStack,queue and linked list data structure.pptx
Stack,queue and linked list data structure.pptx
 
design and analysis of algorithm Lab files
design and analysis of algorithm Lab filesdesign and analysis of algorithm Lab files
design and analysis of algorithm Lab files
 
Pratt Parser in Python
Pratt Parser in PythonPratt Parser in Python
Pratt Parser in Python
 
Data structure and algorithm.(dsa)
Data structure and algorithm.(dsa)Data structure and algorithm.(dsa)
Data structure and algorithm.(dsa)
 
Bti1022 lab sheet 8
Bti1022 lab sheet 8Bti1022 lab sheet 8
Bti1022 lab sheet 8
 

Recently uploaded

Gametogenesis: Male gametes Formation Process / Spermatogenesis .pdf
Gametogenesis: Male gametes Formation Process / Spermatogenesis .pdfGametogenesis: Male gametes Formation Process / Spermatogenesis .pdf
Gametogenesis: Male gametes Formation Process / Spermatogenesis .pdf
SELF-EXPLANATORY
 
A Strong He II λ1640 Emitter with an Extremely Blue UV Spectral Slope at z=8....
A Strong He II λ1640 Emitter with an Extremely Blue UV Spectral Slope at z=8....A Strong He II λ1640 Emitter with an Extremely Blue UV Spectral Slope at z=8....
A Strong He II λ1640 Emitter with an Extremely Blue UV Spectral Slope at z=8....
Sérgio Sacani
 
Collaborative Team Recommendation for Skilled Users: Objectives, Techniques, ...
Collaborative Team Recommendation for Skilled Users: Objectives, Techniques, ...Collaborative Team Recommendation for Skilled Users: Objectives, Techniques, ...
Collaborative Team Recommendation for Skilled Users: Objectives, Techniques, ...
Hossein Fani
 
Modelling, Simulation, and Computer-aided Design in Computational, Evolutiona...
Modelling, Simulation, and Computer-aided Design in Computational, Evolutiona...Modelling, Simulation, and Computer-aided Design in Computational, Evolutiona...
Modelling, Simulation, and Computer-aided Design in Computational, Evolutiona...
University of Maribor
 
Dalghren, Thorne and Stebbins System of Classification of Angiosperms
Dalghren, Thorne and Stebbins System of Classification of AngiospermsDalghren, Thorne and Stebbins System of Classification of Angiosperms
Dalghren, Thorne and Stebbins System of Classification of Angiosperms
Gurjant Singh
 
SCIENCEgfvhvhvkjkbbjjbbjvhvhvhvjkvjvjvjj.pptx
SCIENCEgfvhvhvkjkbbjjbbjvhvhvhvjkvjvjvjj.pptxSCIENCEgfvhvhvkjkbbjjbbjvhvhvhvjkvjvjvjj.pptx
SCIENCEgfvhvhvkjkbbjjbbjvhvhvhvjkvjvjvjj.pptx
WALTONMARBRUCAL
 
[1] Data Mining - Concepts and Techniques (3rd Ed).pdf
[1] Data Mining - Concepts and Techniques (3rd Ed).pdf[1] Data Mining - Concepts and Techniques (3rd Ed).pdf
[1] Data Mining - Concepts and Techniques (3rd Ed).pdf
PANDURANGLAWATE1
 
ANTIGENS_.pptx ( Ranjitha SL) PRESENTATION SLIDE
ANTIGENS_.pptx ( Ranjitha SL) PRESENTATION SLIDEANTIGENS_.pptx ( Ranjitha SL) PRESENTATION SLIDE
ANTIGENS_.pptx ( Ranjitha SL) PRESENTATION SLIDE
RanjithaSL
 
Deploying DAPHNE Computational Intelligence on EuroHPC Vega for Benchmarking ...
Deploying DAPHNE Computational Intelligence on EuroHPC Vega for Benchmarking ...Deploying DAPHNE Computational Intelligence on EuroHPC Vega for Benchmarking ...
Deploying DAPHNE Computational Intelligence on EuroHPC Vega for Benchmarking ...
University of Maribor
 
largeintestinepathologiesconditions-240627071428-3c936a47 (2).pptx
largeintestinepathologiesconditions-240627071428-3c936a47 (2).pptxlargeintestinepathologiesconditions-240627071428-3c936a47 (2).pptx
largeintestinepathologiesconditions-240627071428-3c936a47 (2).pptx
muralinath2
 
Possible Anthropogenic Contributions to the LAMP-observed Surficial Icy Regol...
Possible Anthropogenic Contributions to the LAMP-observed Surficial Icy Regol...Possible Anthropogenic Contributions to the LAMP-observed Surficial Icy Regol...
Possible Anthropogenic Contributions to the LAMP-observed Surficial Icy Regol...
Sérgio Sacani
 
How Does TaskTrain Integrate Workflow and Project Management Efficiently.pdf
How Does TaskTrain Integrate Workflow and Project Management Efficiently.pdfHow Does TaskTrain Integrate Workflow and Project Management Efficiently.pdf
How Does TaskTrain Integrate Workflow and Project Management Efficiently.pdf
Task Train
 
Forces grade 9 slideshow used for grade 9
Forces grade 9 slideshow used for grade 9Forces grade 9 slideshow used for grade 9
Forces grade 9 slideshow used for grade 9
manavhelamuki
 
Lunar Mobility Drivers and Needs - Artemis
Lunar Mobility Drivers and Needs - ArtemisLunar Mobility Drivers and Needs - Artemis
Lunar Mobility Drivers and Needs - Artemis
Sérgio Sacani
 
Summer program introduction in Yunnan university
Summer program introduction in Yunnan universitySummer program introduction in Yunnan university
Summer program introduction in Yunnan university
Hayato Shimabukuro
 
Active and Passive Surveillance of pharmacovigillance
Active and Passive Surveillance of pharmacovigillanceActive and Passive Surveillance of pharmacovigillance
Active and Passive Surveillance of pharmacovigillance
SejalAgrawal43
 
Komodo Dragon I PPT
Komodo Dragon I PPT Komodo Dragon I PPT
Komodo Dragon I PPT
alokitapramanik0
 
Gasification and Pyrolyssis of plastic Waste under a Circular Economy perpective
Gasification and Pyrolyssis of plastic Waste under a Circular Economy perpectiveGasification and Pyrolyssis of plastic Waste under a Circular Economy perpective
Gasification and Pyrolyssis of plastic Waste under a Circular Economy perpective
Recupera
 
Probing the northern Kaapvaal craton root with mantle-derived xenocrysts from...
Probing the northern Kaapvaal craton root with mantle-derived xenocrysts from...Probing the northern Kaapvaal craton root with mantle-derived xenocrysts from...
Probing the northern Kaapvaal craton root with mantle-derived xenocrysts from...
James AH Campbell
 
The Dynamical Origins of the Dark Comets and a Proposed Evolutionary Track
The Dynamical Origins of the Dark Comets and a Proposed Evolutionary TrackThe Dynamical Origins of the Dark Comets and a Proposed Evolutionary Track
The Dynamical Origins of the Dark Comets and a Proposed Evolutionary Track
Sérgio Sacani
 

Recently uploaded (20)

Gametogenesis: Male gametes Formation Process / Spermatogenesis .pdf
Gametogenesis: Male gametes Formation Process / Spermatogenesis .pdfGametogenesis: Male gametes Formation Process / Spermatogenesis .pdf
Gametogenesis: Male gametes Formation Process / Spermatogenesis .pdf
 
A Strong He II λ1640 Emitter with an Extremely Blue UV Spectral Slope at z=8....
A Strong He II λ1640 Emitter with an Extremely Blue UV Spectral Slope at z=8....A Strong He II λ1640 Emitter with an Extremely Blue UV Spectral Slope at z=8....
A Strong He II λ1640 Emitter with an Extremely Blue UV Spectral Slope at z=8....
 
Collaborative Team Recommendation for Skilled Users: Objectives, Techniques, ...
Collaborative Team Recommendation for Skilled Users: Objectives, Techniques, ...Collaborative Team Recommendation for Skilled Users: Objectives, Techniques, ...
Collaborative Team Recommendation for Skilled Users: Objectives, Techniques, ...
 
Modelling, Simulation, and Computer-aided Design in Computational, Evolutiona...
Modelling, Simulation, and Computer-aided Design in Computational, Evolutiona...Modelling, Simulation, and Computer-aided Design in Computational, Evolutiona...
Modelling, Simulation, and Computer-aided Design in Computational, Evolutiona...
 
Dalghren, Thorne and Stebbins System of Classification of Angiosperms
Dalghren, Thorne and Stebbins System of Classification of AngiospermsDalghren, Thorne and Stebbins System of Classification of Angiosperms
Dalghren, Thorne and Stebbins System of Classification of Angiosperms
 
SCIENCEgfvhvhvkjkbbjjbbjvhvhvhvjkvjvjvjj.pptx
SCIENCEgfvhvhvkjkbbjjbbjvhvhvhvjkvjvjvjj.pptxSCIENCEgfvhvhvkjkbbjjbbjvhvhvhvjkvjvjvjj.pptx
SCIENCEgfvhvhvkjkbbjjbbjvhvhvhvjkvjvjvjj.pptx
 
[1] Data Mining - Concepts and Techniques (3rd Ed).pdf
[1] Data Mining - Concepts and Techniques (3rd Ed).pdf[1] Data Mining - Concepts and Techniques (3rd Ed).pdf
[1] Data Mining - Concepts and Techniques (3rd Ed).pdf
 
ANTIGENS_.pptx ( Ranjitha SL) PRESENTATION SLIDE
ANTIGENS_.pptx ( Ranjitha SL) PRESENTATION SLIDEANTIGENS_.pptx ( Ranjitha SL) PRESENTATION SLIDE
ANTIGENS_.pptx ( Ranjitha SL) PRESENTATION SLIDE
 
Deploying DAPHNE Computational Intelligence on EuroHPC Vega for Benchmarking ...
Deploying DAPHNE Computational Intelligence on EuroHPC Vega for Benchmarking ...Deploying DAPHNE Computational Intelligence on EuroHPC Vega for Benchmarking ...
Deploying DAPHNE Computational Intelligence on EuroHPC Vega for Benchmarking ...
 
largeintestinepathologiesconditions-240627071428-3c936a47 (2).pptx
largeintestinepathologiesconditions-240627071428-3c936a47 (2).pptxlargeintestinepathologiesconditions-240627071428-3c936a47 (2).pptx
largeintestinepathologiesconditions-240627071428-3c936a47 (2).pptx
 
Possible Anthropogenic Contributions to the LAMP-observed Surficial Icy Regol...
Possible Anthropogenic Contributions to the LAMP-observed Surficial Icy Regol...Possible Anthropogenic Contributions to the LAMP-observed Surficial Icy Regol...
Possible Anthropogenic Contributions to the LAMP-observed Surficial Icy Regol...
 
How Does TaskTrain Integrate Workflow and Project Management Efficiently.pdf
How Does TaskTrain Integrate Workflow and Project Management Efficiently.pdfHow Does TaskTrain Integrate Workflow and Project Management Efficiently.pdf
How Does TaskTrain Integrate Workflow and Project Management Efficiently.pdf
 
Forces grade 9 slideshow used for grade 9
Forces grade 9 slideshow used for grade 9Forces grade 9 slideshow used for grade 9
Forces grade 9 slideshow used for grade 9
 
Lunar Mobility Drivers and Needs - Artemis
Lunar Mobility Drivers and Needs - ArtemisLunar Mobility Drivers and Needs - Artemis
Lunar Mobility Drivers and Needs - Artemis
 
Summer program introduction in Yunnan university
Summer program introduction in Yunnan universitySummer program introduction in Yunnan university
Summer program introduction in Yunnan university
 
Active and Passive Surveillance of pharmacovigillance
Active and Passive Surveillance of pharmacovigillanceActive and Passive Surveillance of pharmacovigillance
Active and Passive Surveillance of pharmacovigillance
 
Komodo Dragon I PPT
Komodo Dragon I PPT Komodo Dragon I PPT
Komodo Dragon I PPT
 
Gasification and Pyrolyssis of plastic Waste under a Circular Economy perpective
Gasification and Pyrolyssis of plastic Waste under a Circular Economy perpectiveGasification and Pyrolyssis of plastic Waste under a Circular Economy perpective
Gasification and Pyrolyssis of plastic Waste under a Circular Economy perpective
 
Probing the northern Kaapvaal craton root with mantle-derived xenocrysts from...
Probing the northern Kaapvaal craton root with mantle-derived xenocrysts from...Probing the northern Kaapvaal craton root with mantle-derived xenocrysts from...
Probing the northern Kaapvaal craton root with mantle-derived xenocrysts from...
 
The Dynamical Origins of the Dark Comets and a Proposed Evolutionary Track
The Dynamical Origins of the Dark Comets and a Proposed Evolutionary TrackThe Dynamical Origins of the Dark Comets and a Proposed Evolutionary Track
The Dynamical Origins of the Dark Comets and a Proposed Evolutionary Track
 

lFuzzer - Learning Input Tokens for Effective Fuzzing

  • 1. LEARNING INPUT TOKENS FOR EFFECTIVE FUZZING BJÖRN MATHIS, RAHUL GOPINATH, ANDREAS ZELLER
  • 2. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TESTFUZZER
  • 3. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TEST 7245 FUZZER
  • 4. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TEST 7245 FUZZER
  • 5. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TEST 7245 FUZZER
  • 6. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TESTFUZZER
  • 7. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TEST C4tscs FUZZER
  • 8. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TEST C4tscs FUZZER
  • 9. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TEST C4tscs FUZZER
  • 10. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER
  • 11. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER
  • 12. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER
  • 13. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER C4tscs
  • 14. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER C4tscs
  • 15. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER
  • 16. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER X + 0
  • 17. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER X + 0
  • 18. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER X + 0
  • 19. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER X + 0 COMPLEX INPUT STRUCTURES NEED SYNTACTIC FUZZING
  • 20. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 21. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER & def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 22. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER & def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 23. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER & def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 24. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 25. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 26. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 27. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X @ def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 28. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X @ def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 29. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X @ def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 30. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X + def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 31. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X + def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 32. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X + 0 def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 33. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X + 0 def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 35. TOKENIZATION - COMPLEX PARSERS 5 X + 0
  • 36. TOKENIZATION - COMPLEX PARSERS 5 X + 0 TOKENIZER
  • 37. TOKENIZATION - COMPLEX PARSERS 5 X + 0 TOKENIZER T_ALPHA T_PLUS T_DIGIT
  • 38. TOKENIZATION - COMPLEX PARSERS 5 X + 0 TOKENIZER T_ALPHA T_PLUS T_DIGIT PARSER
  • 39. 6 TOKENIZATION - COMPLEX PARSERS X + 0 TOKENIZER T_ALPHA T_PLUS T_DIGIT PARSER
  • 40. 6 TOKENIZATION - COMPLEX PARSERS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax X + 0 TOKENIZER T_ALPHA T_PLUS T_DIGIT PARSER
  • 41. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 42. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 43. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 44. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 45. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 46. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 47. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 48. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 49. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 50. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA T_MINUS T_PLUS X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 51. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA T_MINUS T_PLUS X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 52. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA T_MINUS T_PLUS X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 53. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA T_MINUS T_PLUS T_DIGIT X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 54. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 55. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER & def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 56. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER & def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 57. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER & def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 58. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 59. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 60. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 61. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 62. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 63. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X 3 Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 64. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X 3 Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 65. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X 3 Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 66. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X + Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 67. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X + Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 68. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X + 0 Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 69. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X + 0 Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 70. LFUZZER - BOOSTING FUZZERS 9
  • 71. LFUZZER - BOOSTING FUZZERS 9 0 .. 9 A .. Z a .. z + - TOKENS
  • 72. LFUZZER - BOOSTING FUZZERS 9 0 .. 9 A .. Z a .. z + - TOKENS 0 + 5
 a + 6 SAMPLE INPUTS
  • 73. LFUZZER - BOOSTING FUZZERS 9 0 .. 9 A .. Z a .. z + - TOKENS 0 + 5
 a + 6 SAMPLE INPUTS AFL
 MIMID*
 LIBFUZZER … YOURFAVORITEFUZZER FUZZER * In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
  • 74. LFUZZER - BOOSTING FUZZERS 9 0 .. 9 A .. Z a .. z + - TOKENS 0 + 5
 a + 6 SAMPLE INPUTS AFL
 MIMID*
 LIBFUZZER … YOURFAVORITEFUZZER FUZZER A - K 8 - I + P - q R + y - 6 + u … INPUTS * In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
  • 75. LFUZZER - BOOSTING FUZZERS 9 0 .. 9 A .. Z a .. z + - TOKENS 0 + 5
 a + 6 SAMPLE INPUTS AFL
 MIMID*
 LIBFUZZER … YOURFAVORITEFUZZER FUZZER A - K 8 - I + P - q R + y - 6 + u … INPUTS PROGRAM UNDER TEST * In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
  • 76. LFUZZER - BOOSTING FUZZERS 9 0 .. 9 A .. Z a .. z + - TOKENS 0 + 5
 a + 6 SAMPLE INPUTS AFL
 MIMID*
 LIBFUZZER … YOURFAVORITEFUZZER FUZZER A - K 8 - I + P - q R + y - 6 + u … INPUTS PROGRAM UNDER TEST * In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
  • 77. EVALUATION - TOKENS AND COVERAGE 10
  • 78. EVALUATION - TOKENS AND COVERAGE 10 Fsv ini Fjson lisS tinyF mjs 6uEjeFt 0 20 40 60 80 TokensExtraFted 6tring ExtraFtion lFuzzer NUMBER OF VALID TOKENS EXTRACTED
  • 79. EVALUATION - TOKENS AND COVERAGE 10 Fsv ini Fjson lisS tinyF mjs 6uEjeFt 0 20 40 60 80 TokensExtraFted 6tring ExtraFtion lFuzzer NUMBER OF VALID TOKENS EXTRACTED Fsv ini Fjson lisS tinyF mjs SuEjeFt 0 25 50 75 100 125 150 175 200 7okensExtraFted String ExtraFtion lFuzzer NUMBER OF INVALID TOKENS EXTRACTED
  • 80. EVALUATION - TOKENS AND COVERAGE 10 Fsv ini Fjson lisS tinyF mjs 6uEjeFt 0 20 40 60 80 TokensExtraFted 6tring ExtraFtion lFuzzer NUMBER OF VALID TOKENS EXTRACTED Fsv ini Fjson lisS tinyF mjs SuEjeFt 0 25 50 75 100 125 150 175 200 7okensExtraFted String ExtraFtion lFuzzer NUMBER OF INVALID TOKENS EXTRACTED 0 4 8 12 16 20 24 TLme (h) 0 5 10 15 20 25 30 35 CoverDge(%) mjs A)L A)L_DLFt p)uzzer p)uzzer + A)L l)uzzer + A)L COVERAGE OVER TIME FOR MJS
  • 81. 11
  • 82. 11
  • 83. 11
  • 84. 11
  • 85. 11