SlideShare a Scribd company logo
LEARNING INPUT TOKENS FOR EFFECTIVE FUZZING
BJÖRN MATHIS, RAHUL GOPINATH, ANDREAS ZELLER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TESTFUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TEST
7245
FUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TEST
7245
FUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TEST
7245
FUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TESTFUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TEST
C4tscs
FUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TEST
C4tscs
FUZZER
FUZZING - THE ART OF AUTOMATIC BUG FINDING
2
PROGRAM UNDER TEST
C4tscs
FUZZER
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
C4tscs
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
C4tscs
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
X + 0
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
X + 0
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
X + 0
PROGRAM UNDER TEST
FUZZING - THE ART OF AUTOMATIC BUG FINDING
3
FUZZER
X + 0
COMPLEX INPUT STRUCTURES NEED SYNTACTIC FUZZING
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
&
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
&
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
&
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X @
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X @
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X @
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X +
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X +
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X + 0
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
PFUZZER - SURVIVING THE PARSING STAGE
4
PFUZZER
X + 0
def parse_exp(i):
c = input[i]
if isDigit(c):
parse_op(i + 1)
elif isAlpha(c):
parse_op(i + 1)
def parse_op(i):
c = input[i]
if c == '-':
parse_exp(i + 1)
elif c == '+':
parse_exp(i + 1)
else:
raise InvalidSyntax
TOKENIZATION - COMPLEX PARSERS
5
TOKENIZATION - COMPLEX PARSERS
5
X + 0
TOKENIZATION - COMPLEX PARSERS
5
X + 0
TOKENIZER
TOKENIZATION - COMPLEX PARSERS
5
X + 0
TOKENIZER
T_ALPHA T_PLUS T_DIGIT
TOKENIZATION - COMPLEX PARSERS
5
X + 0
TOKENIZER
T_ALPHA T_PLUS T_DIGIT
PARSER
6
TOKENIZATION - COMPLEX PARSERS
X + 0
TOKENIZER
T_ALPHA T_PLUS T_DIGIT
PARSER
6
TOKENIZATION - COMPLEX PARSERS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
X + 0
TOKENIZER
T_ALPHA T_PLUS T_DIGIT
PARSER
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
T_MINUS
T_PLUS
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
T_MINUS
T_PLUS
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
T_MINUS
T_PLUS
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
DYNAMIC TAINTING - LOOKING INTO A PROGRAM
7
T_DIGIT
T_ALPHA
T_MINUS
T_PLUS
T_DIGIT
X + 0
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
&
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
&
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
&
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X 3
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X 3
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X 3
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X +
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X +
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X + 0
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE
8
LFUZZER
X + 0
Tokenmapping
String Token
A .. Z, a .. z T_ALPHA
0 .. 9 T_DIGIT
- T_MINUS
+ T_PLUS
def parse_exp(i):
c = input[i]
token = tokenize(c)
if token == T_DIGIT:
parse_op(i + 1)
elif token == T_ALPHA:
parse_op(i + 1)
def parse_op(i):
c = input[i]
token = tokenize(c)
if token == T_MINUS:
parse_exp(i + 1)
elif token == T_PLUS:
parse_exp(i + 1)
else:
raise InvalidSyntax
def tokenize(c):
if isDigit(c):
return T_DIGIT
elif isAlpha(c):
return T_ALPHA
elif c == '-':
return T_MINUS
elif c == '+':
return T_PLUS
else:
raise InvalidToken
LFUZZER - BOOSTING FUZZERS
9
LFUZZER - BOOSTING FUZZERS
9
0 .. 9

A .. Z

a .. z

+

-
TOKENS
LFUZZER - BOOSTING FUZZERS
9
0 .. 9

A .. Z

a .. z

+

-
TOKENS
0 + 5

a + 6
SAMPLE INPUTS
LFUZZER - BOOSTING FUZZERS
9
0 .. 9

A .. Z

a .. z

+

-
TOKENS
0 + 5

a + 6
SAMPLE INPUTS
AFL

MIMID*

LIBFUZZER

…

YOURFAVORITEFUZZER
FUZZER
* In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
LFUZZER - BOOSTING FUZZERS
9
0 .. 9

A .. Z

a .. z

+

-
TOKENS
0 + 5

a + 6
SAMPLE INPUTS
AFL

MIMID*

LIBFUZZER

…

YOURFAVORITEFUZZER
FUZZER
A - K

8 - I + P - q

R + y - 6 + u

…
INPUTS
* In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
LFUZZER - BOOSTING FUZZERS
9
0 .. 9

A .. Z

a .. z

+

-
TOKENS
0 + 5

a + 6
SAMPLE INPUTS
AFL

MIMID*

LIBFUZZER

…

YOURFAVORITEFUZZER
FUZZER
A - K

8 - I + P - q

R + y - 6 + u

…
INPUTS
PROGRAM UNDER TEST
* In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
LFUZZER - BOOSTING FUZZERS
9
0 .. 9

A .. Z

a .. z

+

-
TOKENS
0 + 5

a + 6
SAMPLE INPUTS
AFL

MIMID*

LIBFUZZER

…

YOURFAVORITEFUZZER
FUZZER
A - K

8 - I + P - q

R + y - 6 + u

…
INPUTS
PROGRAM UNDER TEST
* In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
EVALUATION - TOKENS AND COVERAGE
10
EVALUATION - TOKENS AND COVERAGE
10
Fsv
ini
Fjson
lisS
tinyF
mjs
6uEjeFt
0
20
40
60
80
TokensExtraFted
6tring ExtraFtion
lFuzzer
NUMBER OF VALID TOKENS
EXTRACTED
EVALUATION - TOKENS AND COVERAGE
10
Fsv
ini
Fjson
lisS
tinyF
mjs
6uEjeFt
0
20
40
60
80
TokensExtraFted
6tring ExtraFtion
lFuzzer
NUMBER OF VALID TOKENS
EXTRACTED
Fsv
ini
Fjson
lisS
tinyF
mjs
SuEjeFt
0
25
50
75
100
125
150
175
200
7okensExtraFted
String ExtraFtion
lFuzzer
NUMBER OF INVALID TOKENS
EXTRACTED
EVALUATION - TOKENS AND COVERAGE
10
Fsv
ini
Fjson
lisS
tinyF
mjs
6uEjeFt
0
20
40
60
80
TokensExtraFted
6tring ExtraFtion
lFuzzer
NUMBER OF VALID TOKENS
EXTRACTED
Fsv
ini
Fjson
lisS
tinyF
mjs
SuEjeFt
0
25
50
75
100
125
150
175
200
7okensExtraFted
String ExtraFtion
lFuzzer
NUMBER OF INVALID TOKENS
EXTRACTED
0 4 8 12 16 20 24
TLme (h)
0
5
10
15
20
25
30
35
CoverDge(%)
mjs
A)L
A)L_DLFt
p)uzzer
p)uzzer + A)L
l)uzzer + A)L
COVERAGE OVER TIME FOR MJS
11
11
11
11
11
11
GITHUB.COM/UDS-SE/LFUZZER

More Related Content

What's hot

c-programming-using-pointers
c-programming-using-pointersc-programming-using-pointers
c-programming-using-pointers
Sushil Mishra
 
The solution manual of c by robin
The solution manual of c by robinThe solution manual of c by robin
The solution manual of c by robin
Abdullah Al Naser
 
Ansi c
Ansi cAnsi c
DataStructures notes
DataStructures notesDataStructures notes
DataStructures notes
Lakshmi Sarvani Videla
 
Infix to-postfix examples
Infix to-postfix examplesInfix to-postfix examples
Infix to-postfix examples
mua99
 
Datastructures asignment
Datastructures asignmentDatastructures asignment
Datastructures asignment
sreekanth3dce
 
Introduction to c part -1
Introduction to c   part -1Introduction to c   part -1
Cpds lab
Cpds labCpds lab
C programms
C programmsC programms
C programms
Mukund Gandrakota
 
Data Structures Using C Practical File
Data Structures Using C Practical File Data Structures Using C Practical File
Data Structures Using C Practical File
Rahul Chugh
 
C PROGRAMS
C PROGRAMSC PROGRAMS
ADA FILE
ADA FILEADA FILE
ADA FILE
Gaurav Singh
 
C Programming
C ProgrammingC Programming
C Programming
Sumant Diwakar
 
Simple c program
Simple c programSimple c program
Simple c program
Ravi Singh
 
C basics
C basicsC basics
C basics
MSc CST
 
SPL 8 | Loop Statements in C
SPL 8 | Loop Statements in CSPL 8 | Loop Statements in C
SPL 8 | Loop Statements in C
Mohammad Imam Hossain
 
Program flowchart
Program flowchartProgram flowchart
Program flowchart
Sowri Rajan
 
Stack prgs
Stack prgsStack prgs
Stack prgs
Ssankett Negi
 
Chapter 5 Balagurusamy Programming ANSI in c
Chapter 5 Balagurusamy Programming ANSI  in cChapter 5 Balagurusamy Programming ANSI  in c
Chapter 5 Balagurusamy Programming ANSI in c
BUBT
 
C++ Programming - 1st Study
C++ Programming - 1st StudyC++ Programming - 1st Study
C++ Programming - 1st Study
Chris Ohk
 

What's hot (20)

c-programming-using-pointers
c-programming-using-pointersc-programming-using-pointers
c-programming-using-pointers
 
The solution manual of c by robin
The solution manual of c by robinThe solution manual of c by robin
The solution manual of c by robin
 
Ansi c
Ansi cAnsi c
Ansi c
 
DataStructures notes
DataStructures notesDataStructures notes
DataStructures notes
 
Infix to-postfix examples
Infix to-postfix examplesInfix to-postfix examples
Infix to-postfix examples
 
Datastructures asignment
Datastructures asignmentDatastructures asignment
Datastructures asignment
 
Introduction to c part -1
Introduction to c   part -1Introduction to c   part -1
Introduction to c part -1
 
Cpds lab
Cpds labCpds lab
Cpds lab
 
C programms
C programmsC programms
C programms
 
Data Structures Using C Practical File
Data Structures Using C Practical File Data Structures Using C Practical File
Data Structures Using C Practical File
 
C PROGRAMS
C PROGRAMSC PROGRAMS
C PROGRAMS
 
ADA FILE
ADA FILEADA FILE
ADA FILE
 
C Programming
C ProgrammingC Programming
C Programming
 
Simple c program
Simple c programSimple c program
Simple c program
 
C basics
C basicsC basics
C basics
 
SPL 8 | Loop Statements in C
SPL 8 | Loop Statements in CSPL 8 | Loop Statements in C
SPL 8 | Loop Statements in C
 
Program flowchart
Program flowchartProgram flowchart
Program flowchart
 
Stack prgs
Stack prgsStack prgs
Stack prgs
 
Chapter 5 Balagurusamy Programming ANSI in c
Chapter 5 Balagurusamy Programming ANSI  in cChapter 5 Balagurusamy Programming ANSI  in c
Chapter 5 Balagurusamy Programming ANSI in c
 
C++ Programming - 1st Study
C++ Programming - 1st StudyC++ Programming - 1st Study
C++ Programming - 1st Study
 

Similar to lFuzzer - Learning Input Tokens for Effective Fuzzing

data structure and algorithm.pdf
data structure and algorithm.pdfdata structure and algorithm.pdf
data structure and algorithm.pdf
Asrinath1
 
Applications of stack
Applications of stackApplications of stack
Applications of stack
A. S. M. Shafi
 
Assignment on Numerical Method C Code
Assignment on Numerical Method C CodeAssignment on Numerical Method C Code
Assignment on Numerical Method C Code
Syed Ahmed Zaki
 
VTU Data Structures Lab Manual
VTU Data Structures Lab ManualVTU Data Structures Lab Manual
VTU Data Structures Lab Manual
Nithin Kumar,VVCE, Mysuru
 
Please need help on C++ language.Infix to Postfix) Write a program.pdf
Please need help on C++ language.Infix to Postfix) Write a program.pdfPlease need help on C++ language.Infix to Postfix) Write a program.pdf
Please need help on C++ language.Infix to Postfix) Write a program.pdf
pristiegee
 
Write a program to check a given number is prime or not
Write a program to check a given number is prime or notWrite a program to check a given number is prime or not
Write a program to check a given number is prime or not
aluavi
 
Ada file
Ada fileAda file
Ada file
Kumar Gaurav
 
Naive application of Machine Learning to Software Development
Naive application of Machine Learning to Software DevelopmentNaive application of Machine Learning to Software Development
Naive application of Machine Learning to Software Development
Andriy Khavryuchenko
 
openFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollider
openFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollideropenFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollider
openFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollider
Atsushi Tadokoro
 
Functional programming in Python
Functional programming in PythonFunctional programming in Python
Functional programming in Python
Colin Su
 
Stack and queue
Stack and queueStack and queue
Stack and queue
Shakila Mahjabin
 
pointers 1
pointers 1pointers 1
pointers 1
gaurav koriya
 
C Code and the Art of Obfuscation
C Code and the Art of ObfuscationC Code and the Art of Obfuscation
C Code and the Art of Obfuscation
guest9006ab
 
Solutionsfor co2 C Programs for data structures
Solutionsfor co2 C Programs for data structuresSolutionsfor co2 C Programs for data structures
Solutionsfor co2 C Programs for data structures
Lakshmi Sarvani Videla
 
Swift School #1
Swift School #1Swift School #1
Swift School #1
Sergey Pronin
 
design and analysis of algorithm Lab files
design and analysis of algorithm Lab filesdesign and analysis of algorithm Lab files
design and analysis of algorithm Lab files
Nitesh Dubey
 
Pratt Parser in Python
Pratt Parser in PythonPratt Parser in Python
Pratt Parser in Python
Percolate
 
Data structure and algorithm.(dsa)
Data structure and algorithm.(dsa)Data structure and algorithm.(dsa)
Data structure and algorithm.(dsa)
mailmerk
 
Bti1022 lab sheet 8
Bti1022 lab sheet 8Bti1022 lab sheet 8
Bti1022 lab sheet 8
alish sha
 
Bti1022 lab sheet 8
Bti1022 lab sheet 8Bti1022 lab sheet 8
Bti1022 lab sheet 8
alish sha
 

Similar to lFuzzer - Learning Input Tokens for Effective Fuzzing (20)

data structure and algorithm.pdf
data structure and algorithm.pdfdata structure and algorithm.pdf
data structure and algorithm.pdf
 
Applications of stack
Applications of stackApplications of stack
Applications of stack
 
Assignment on Numerical Method C Code
Assignment on Numerical Method C CodeAssignment on Numerical Method C Code
Assignment on Numerical Method C Code
 
VTU Data Structures Lab Manual
VTU Data Structures Lab ManualVTU Data Structures Lab Manual
VTU Data Structures Lab Manual
 
Please need help on C++ language.Infix to Postfix) Write a program.pdf
Please need help on C++ language.Infix to Postfix) Write a program.pdfPlease need help on C++ language.Infix to Postfix) Write a program.pdf
Please need help on C++ language.Infix to Postfix) Write a program.pdf
 
Write a program to check a given number is prime or not
Write a program to check a given number is prime or notWrite a program to check a given number is prime or not
Write a program to check a given number is prime or not
 
Ada file
Ada fileAda file
Ada file
 
Naive application of Machine Learning to Software Development
Naive application of Machine Learning to Software DevelopmentNaive application of Machine Learning to Software Development
Naive application of Machine Learning to Software Development
 
openFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollider
openFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollideropenFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollider
openFrameworks、サウンド機能・音響合成、ofxMaxim, ofxOsc, ofxPd, ofxSuperCollider
 
Functional programming in Python
Functional programming in PythonFunctional programming in Python
Functional programming in Python
 
Stack and queue
Stack and queueStack and queue
Stack and queue
 
pointers 1
pointers 1pointers 1
pointers 1
 
C Code and the Art of Obfuscation
C Code and the Art of ObfuscationC Code and the Art of Obfuscation
C Code and the Art of Obfuscation
 
Solutionsfor co2 C Programs for data structures
Solutionsfor co2 C Programs for data structuresSolutionsfor co2 C Programs for data structures
Solutionsfor co2 C Programs for data structures
 
Swift School #1
Swift School #1Swift School #1
Swift School #1
 
design and analysis of algorithm Lab files
design and analysis of algorithm Lab filesdesign and analysis of algorithm Lab files
design and analysis of algorithm Lab files
 
Pratt Parser in Python
Pratt Parser in PythonPratt Parser in Python
Pratt Parser in Python
 
Data structure and algorithm.(dsa)
Data structure and algorithm.(dsa)Data structure and algorithm.(dsa)
Data structure and algorithm.(dsa)
 
Bti1022 lab sheet 8
Bti1022 lab sheet 8Bti1022 lab sheet 8
Bti1022 lab sheet 8
 
Bti1022 lab sheet 8
Bti1022 lab sheet 8Bti1022 lab sheet 8
Bti1022 lab sheet 8
 

Recently uploaded

Gadgets for management of stored product pests_Dr.UPR.pdf
Gadgets for management of stored product pests_Dr.UPR.pdfGadgets for management of stored product pests_Dr.UPR.pdf
Gadgets for management of stored product pests_Dr.UPR.pdf
PirithiRaju
 
Sexuality - Issues, Attitude and Behaviour - Applied Social Psychology - Psyc...
Sexuality - Issues, Attitude and Behaviour - Applied Social Psychology - Psyc...Sexuality - Issues, Attitude and Behaviour - Applied Social Psychology - Psyc...
Sexuality - Issues, Attitude and Behaviour - Applied Social Psychology - Psyc...
PsychoTech Services
 
Introduction_Ch_01_Biotech Biotechnology course .pptx
Introduction_Ch_01_Biotech Biotechnology course .pptxIntroduction_Ch_01_Biotech Biotechnology course .pptx
Introduction_Ch_01_Biotech Biotechnology course .pptx
QusayMaghayerh
 
Pests of Storage_Identification_Dr.UPR.pdf
Pests of Storage_Identification_Dr.UPR.pdfPests of Storage_Identification_Dr.UPR.pdf
Pests of Storage_Identification_Dr.UPR.pdf
PirithiRaju
 
Alternate Wetting and Drying - Climate Smart Agriculture
Alternate Wetting and Drying - Climate Smart AgricultureAlternate Wetting and Drying - Climate Smart Agriculture
Alternate Wetting and Drying - Climate Smart Agriculture
International Food Policy Research Institute- South Asia Office
 
Methods of grain storage Structures in India.pdf
Methods of grain storage Structures in India.pdfMethods of grain storage Structures in India.pdf
Methods of grain storage Structures in India.pdf
PirithiRaju
 
Physiology of Nervous System presentation.pptx
Physiology of Nervous System presentation.pptxPhysiology of Nervous System presentation.pptx
Physiology of Nervous System presentation.pptx
fatima132662
 
Sustainable Land Management - Climate Smart Agriculture
Sustainable Land Management - Climate Smart AgricultureSustainable Land Management - Climate Smart Agriculture
Sustainable Land Management - Climate Smart Agriculture
International Food Policy Research Institute- South Asia Office
 
Quality assurance B.pharm 6th semester BP606T UNIT 5
Quality assurance B.pharm 6th semester BP606T UNIT 5Quality assurance B.pharm 6th semester BP606T UNIT 5
Quality assurance B.pharm 6th semester BP606T UNIT 5
vimalveerammal
 
Farming systems analysis: what have we learnt?.pptx
Farming systems analysis: what have we learnt?.pptxFarming systems analysis: what have we learnt?.pptx
Farming systems analysis: what have we learnt?.pptx
Frédéric Baudron
 
Flow chart.pdf LIFE SCIENCES CSIR UGC NET CONTENT
Flow chart.pdf  LIFE SCIENCES CSIR UGC NET CONTENTFlow chart.pdf  LIFE SCIENCES CSIR UGC NET CONTENT
Flow chart.pdf LIFE SCIENCES CSIR UGC NET CONTENT
savindersingh16
 
Reaching the age of Adolescence- Class 8
Reaching the age of Adolescence- Class 8Reaching the age of Adolescence- Class 8
Reaching the age of Adolescence- Class 8
abhinayakamasamudram
 
Clinical periodontology and implant dentistry 2003.pdf
Clinical periodontology and implant dentistry 2003.pdfClinical periodontology and implant dentistry 2003.pdf
Clinical periodontology and implant dentistry 2003.pdf
RAYMUNDONAVARROCORON
 
Compositions of iron-meteorite parent bodies constrainthe structure of the pr...
Compositions of iron-meteorite parent bodies constrainthe structure of the pr...Compositions of iron-meteorite parent bodies constrainthe structure of the pr...
Compositions of iron-meteorite parent bodies constrainthe structure of the pr...
Sérgio Sacani
 
Male reproduction physiology by Suyash Garg .pptx
Male reproduction physiology by Suyash Garg .pptxMale reproduction physiology by Suyash Garg .pptx
Male reproduction physiology by Suyash Garg .pptx
suyashempire
 
cathode ray oscilloscope and its applications
cathode ray oscilloscope and its applicationscathode ray oscilloscope and its applications
cathode ray oscilloscope and its applications
sandertein
 
Holsinger, Bruce W. - Music, body and desire in medieval culture [2001].pdf
Holsinger, Bruce W. - Music, body and desire in medieval culture [2001].pdfHolsinger, Bruce W. - Music, body and desire in medieval culture [2001].pdf
Holsinger, Bruce W. - Music, body and desire in medieval culture [2001].pdf
frank0071
 
Embracing Deep Variability For Reproducibility and Replicability
Embracing Deep Variability For Reproducibility and ReplicabilityEmbracing Deep Variability For Reproducibility and Replicability
Embracing Deep Variability For Reproducibility and Replicability
University of Rennes, INSA Rennes, Inria/IRISA, CNRS
 
Lattice Defects in ionic solid compound.pptx
Lattice Defects in ionic solid compound.pptxLattice Defects in ionic solid compound.pptx
Lattice Defects in ionic solid compound.pptx
DrRajeshDas
 
快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样
快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样
快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样
hozt8xgk
 

Recently uploaded (20)

Gadgets for management of stored product pests_Dr.UPR.pdf
Gadgets for management of stored product pests_Dr.UPR.pdfGadgets for management of stored product pests_Dr.UPR.pdf
Gadgets for management of stored product pests_Dr.UPR.pdf
 
Sexuality - Issues, Attitude and Behaviour - Applied Social Psychology - Psyc...
Sexuality - Issues, Attitude and Behaviour - Applied Social Psychology - Psyc...Sexuality - Issues, Attitude and Behaviour - Applied Social Psychology - Psyc...
Sexuality - Issues, Attitude and Behaviour - Applied Social Psychology - Psyc...
 
Introduction_Ch_01_Biotech Biotechnology course .pptx
Introduction_Ch_01_Biotech Biotechnology course .pptxIntroduction_Ch_01_Biotech Biotechnology course .pptx
Introduction_Ch_01_Biotech Biotechnology course .pptx
 
Pests of Storage_Identification_Dr.UPR.pdf
Pests of Storage_Identification_Dr.UPR.pdfPests of Storage_Identification_Dr.UPR.pdf
Pests of Storage_Identification_Dr.UPR.pdf
 
Alternate Wetting and Drying - Climate Smart Agriculture
Alternate Wetting and Drying - Climate Smart AgricultureAlternate Wetting and Drying - Climate Smart Agriculture
Alternate Wetting and Drying - Climate Smart Agriculture
 
Methods of grain storage Structures in India.pdf
Methods of grain storage Structures in India.pdfMethods of grain storage Structures in India.pdf
Methods of grain storage Structures in India.pdf
 
Physiology of Nervous System presentation.pptx
Physiology of Nervous System presentation.pptxPhysiology of Nervous System presentation.pptx
Physiology of Nervous System presentation.pptx
 
Sustainable Land Management - Climate Smart Agriculture
Sustainable Land Management - Climate Smart AgricultureSustainable Land Management - Climate Smart Agriculture
Sustainable Land Management - Climate Smart Agriculture
 
Quality assurance B.pharm 6th semester BP606T UNIT 5
Quality assurance B.pharm 6th semester BP606T UNIT 5Quality assurance B.pharm 6th semester BP606T UNIT 5
Quality assurance B.pharm 6th semester BP606T UNIT 5
 
Farming systems analysis: what have we learnt?.pptx
Farming systems analysis: what have we learnt?.pptxFarming systems analysis: what have we learnt?.pptx
Farming systems analysis: what have we learnt?.pptx
 
Flow chart.pdf LIFE SCIENCES CSIR UGC NET CONTENT
Flow chart.pdf  LIFE SCIENCES CSIR UGC NET CONTENTFlow chart.pdf  LIFE SCIENCES CSIR UGC NET CONTENT
Flow chart.pdf LIFE SCIENCES CSIR UGC NET CONTENT
 
Reaching the age of Adolescence- Class 8
Reaching the age of Adolescence- Class 8Reaching the age of Adolescence- Class 8
Reaching the age of Adolescence- Class 8
 
Clinical periodontology and implant dentistry 2003.pdf
Clinical periodontology and implant dentistry 2003.pdfClinical periodontology and implant dentistry 2003.pdf
Clinical periodontology and implant dentistry 2003.pdf
 
Compositions of iron-meteorite parent bodies constrainthe structure of the pr...
Compositions of iron-meteorite parent bodies constrainthe structure of the pr...Compositions of iron-meteorite parent bodies constrainthe structure of the pr...
Compositions of iron-meteorite parent bodies constrainthe structure of the pr...
 
Male reproduction physiology by Suyash Garg .pptx
Male reproduction physiology by Suyash Garg .pptxMale reproduction physiology by Suyash Garg .pptx
Male reproduction physiology by Suyash Garg .pptx
 
cathode ray oscilloscope and its applications
cathode ray oscilloscope and its applicationscathode ray oscilloscope and its applications
cathode ray oscilloscope and its applications
 
Holsinger, Bruce W. - Music, body and desire in medieval culture [2001].pdf
Holsinger, Bruce W. - Music, body and desire in medieval culture [2001].pdfHolsinger, Bruce W. - Music, body and desire in medieval culture [2001].pdf
Holsinger, Bruce W. - Music, body and desire in medieval culture [2001].pdf
 
Embracing Deep Variability For Reproducibility and Replicability
Embracing Deep Variability For Reproducibility and ReplicabilityEmbracing Deep Variability For Reproducibility and Replicability
Embracing Deep Variability For Reproducibility and Replicability
 
Lattice Defects in ionic solid compound.pptx
Lattice Defects in ionic solid compound.pptxLattice Defects in ionic solid compound.pptx
Lattice Defects in ionic solid compound.pptx
 
快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样
快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样
快速办理(UAM毕业证书)马德里自治大学毕业证学位证一模一样
 

lFuzzer - Learning Input Tokens for Effective Fuzzing

  • 1. LEARNING INPUT TOKENS FOR EFFECTIVE FUZZING BJÖRN MATHIS, RAHUL GOPINATH, ANDREAS ZELLER
  • 2. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TESTFUZZER
  • 3. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TEST 7245 FUZZER
  • 4. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TEST 7245 FUZZER
  • 5. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TEST 7245 FUZZER
  • 6. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TESTFUZZER
  • 7. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TEST C4tscs FUZZER
  • 8. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TEST C4tscs FUZZER
  • 9. FUZZING - THE ART OF AUTOMATIC BUG FINDING 2 PROGRAM UNDER TEST C4tscs FUZZER
  • 10. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER
  • 11. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER
  • 12. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER
  • 13. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER C4tscs
  • 14. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER C4tscs
  • 15. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER
  • 16. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER X + 0
  • 17. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER X + 0
  • 18. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER X + 0
  • 19. PROGRAM UNDER TEST FUZZING - THE ART OF AUTOMATIC BUG FINDING 3 FUZZER X + 0 COMPLEX INPUT STRUCTURES NEED SYNTACTIC FUZZING
  • 20. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 21. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER & def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 22. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER & def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 23. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER & def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 24. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 25. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 26. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 27. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X @ def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 28. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X @ def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 29. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X @ def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 30. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X + def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 31. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X + def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 32. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X + 0 def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 33. PFUZZER - SURVIVING THE PARSING STAGE 4 PFUZZER X + 0 def parse_exp(i): c = input[i] if isDigit(c): parse_op(i + 1) elif isAlpha(c): parse_op(i + 1) def parse_op(i): c = input[i] if c == '-': parse_exp(i + 1) elif c == '+': parse_exp(i + 1) else: raise InvalidSyntax
  • 35. TOKENIZATION - COMPLEX PARSERS 5 X + 0
  • 36. TOKENIZATION - COMPLEX PARSERS 5 X + 0 TOKENIZER
  • 37. TOKENIZATION - COMPLEX PARSERS 5 X + 0 TOKENIZER T_ALPHA T_PLUS T_DIGIT
  • 38. TOKENIZATION - COMPLEX PARSERS 5 X + 0 TOKENIZER T_ALPHA T_PLUS T_DIGIT PARSER
  • 39. 6 TOKENIZATION - COMPLEX PARSERS X + 0 TOKENIZER T_ALPHA T_PLUS T_DIGIT PARSER
  • 40. 6 TOKENIZATION - COMPLEX PARSERS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax X + 0 TOKENIZER T_ALPHA T_PLUS T_DIGIT PARSER
  • 41. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 42. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 43. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 44. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 45. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 46. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 47. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 48. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 49. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 50. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA T_MINUS T_PLUS X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 51. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA T_MINUS T_PLUS X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 52. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA T_MINUS T_PLUS X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 53. DYNAMIC TAINTING - LOOKING INTO A PROGRAM 7 T_DIGIT T_ALPHA T_MINUS T_PLUS T_DIGIT X + 0 def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 54. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 55. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER & def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 56. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER & def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 57. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER & def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 58. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 59. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 60. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 61. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 62. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 63. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X 3 Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 64. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X 3 Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 65. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X 3 Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 66. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X + Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 67. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X + Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 68. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X + 0 Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 69. LFUZZER - SURVIVING THE TOKENIZATION AND PARSING STAGE 8 LFUZZER X + 0 Tokenmapping String Token A .. Z, a .. z T_ALPHA 0 .. 9 T_DIGIT - T_MINUS + T_PLUS def parse_exp(i): c = input[i] token = tokenize(c) if token == T_DIGIT: parse_op(i + 1) elif token == T_ALPHA: parse_op(i + 1) def parse_op(i): c = input[i] token = tokenize(c) if token == T_MINUS: parse_exp(i + 1) elif token == T_PLUS: parse_exp(i + 1) else: raise InvalidSyntax def tokenize(c): if isDigit(c): return T_DIGIT elif isAlpha(c): return T_ALPHA elif c == '-': return T_MINUS elif c == '+': return T_PLUS else: raise InvalidToken
  • 70. LFUZZER - BOOSTING FUZZERS 9
  • 71. LFUZZER - BOOSTING FUZZERS 9 0 .. 9 A .. Z a .. z + - TOKENS
  • 72. LFUZZER - BOOSTING FUZZERS 9 0 .. 9 A .. Z a .. z + - TOKENS 0 + 5
 a + 6 SAMPLE INPUTS
  • 73. LFUZZER - BOOSTING FUZZERS 9 0 .. 9 A .. Z a .. z + - TOKENS 0 + 5
 a + 6 SAMPLE INPUTS AFL
 MIMID*
 LIBFUZZER … YOURFAVORITEFUZZER FUZZER * In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
  • 74. LFUZZER - BOOSTING FUZZERS 9 0 .. 9 A .. Z a .. z + - TOKENS 0 + 5
 a + 6 SAMPLE INPUTS AFL
 MIMID*
 LIBFUZZER … YOURFAVORITEFUZZER FUZZER A - K 8 - I + P - q R + y - 6 + u … INPUTS * In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
  • 75. LFUZZER - BOOSTING FUZZERS 9 0 .. 9 A .. Z a .. z + - TOKENS 0 + 5
 a + 6 SAMPLE INPUTS AFL
 MIMID*
 LIBFUZZER … YOURFAVORITEFUZZER FUZZER A - K 8 - I + P - q R + y - 6 + u … INPUTS PROGRAM UNDER TEST * In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
  • 76. LFUZZER - BOOSTING FUZZERS 9 0 .. 9 A .. Z a .. z + - TOKENS 0 + 5
 a + 6 SAMPLE INPUTS AFL
 MIMID*
 LIBFUZZER … YOURFAVORITEFUZZER FUZZER A - K 8 - I + P - q R + y - 6 + u … INPUTS PROGRAM UNDER TEST * In: "Mining Input Grammars from Dynamic Control Flow" at FSE 2020
  • 77. EVALUATION - TOKENS AND COVERAGE 10
  • 78. EVALUATION - TOKENS AND COVERAGE 10 Fsv ini Fjson lisS tinyF mjs 6uEjeFt 0 20 40 60 80 TokensExtraFted 6tring ExtraFtion lFuzzer NUMBER OF VALID TOKENS EXTRACTED
  • 79. EVALUATION - TOKENS AND COVERAGE 10 Fsv ini Fjson lisS tinyF mjs 6uEjeFt 0 20 40 60 80 TokensExtraFted 6tring ExtraFtion lFuzzer NUMBER OF VALID TOKENS EXTRACTED Fsv ini Fjson lisS tinyF mjs SuEjeFt 0 25 50 75 100 125 150 175 200 7okensExtraFted String ExtraFtion lFuzzer NUMBER OF INVALID TOKENS EXTRACTED
  • 80. EVALUATION - TOKENS AND COVERAGE 10 Fsv ini Fjson lisS tinyF mjs 6uEjeFt 0 20 40 60 80 TokensExtraFted 6tring ExtraFtion lFuzzer NUMBER OF VALID TOKENS EXTRACTED Fsv ini Fjson lisS tinyF mjs SuEjeFt 0 25 50 75 100 125 150 175 200 7okensExtraFted String ExtraFtion lFuzzer NUMBER OF INVALID TOKENS EXTRACTED 0 4 8 12 16 20 24 TLme (h) 0 5 10 15 20 25 30 35 CoverDge(%) mjs A)L A)L_DLFt p)uzzer p)uzzer + A)L l)uzzer + A)L COVERAGE OVER TIME FOR MJS
  • 81. 11
  • 82. 11
  • 83. 11
  • 84. 11
  • 85. 11