5hadowblad3 / belieffuzz

Research artifact for TDSC'23 paper, "Balance Seed Scheduling via Monte Carlo Planning"

1. Introduction

BeliefFuzz is a bounded seed scheduling fuzzer based on AFL. This directory provides the prototype of compiler and fuzzer for artifacts evaluation in the paper "Balance Seed Scheduling via Monte Carlo Planning"[TDSC_23].

2. Compile

Binary recompilation is required as BeliefFuzz implements a precondition analysis and an instrumentation component based on LLVM for scheduling. You could find the BeliefFuzz compiler in the folder belieffuzz_bin. During the compilation, BeliefFuzz will collect the edge information into a specified file with the FLAG -res=$EDGE_POTENTIAL_PATH.

A nearly-universal approach to compile the target C program would be:

$ export BELIEFFUZZ_CFLAGS="-res=$EDGE_POTENTIAL_PATH"
$ CFLAGS="$BELIEFFUZZ_CFLAGS" CC=$BELIEFFUZZ_PATH/afl-clang-fast ./configure

3. Run

You could run BeliefFuzz in each project under the folder benchmark by the script ./start.sh, which contains the following command:

./afl-fuzz -r -p -c $EDGE_POTENTIAL_PATH/edge_potential.txt -i fuzz_in -o fuzz_out -- $PROG_PATH [...]

Here is the extra command line option for our scheduling method:

-r            - use MCTS model for seed selection
-p            - use Regret-based power scheduling
-c file       - load the edge weight file

4. Experimental Results

You can download the results of our experiments from Google Drive.

5. Publication

You can find more details in our TDSC_23 paper.

@ARTICLE{10149344,
  author={Huang, Heqing and Chiu, Hung-Chun and Shi, Qingkai and Yao, Peisen and Zhang, Charles},
  journal={IEEE Transactions on Dependable and Secure Computing}, 
  title={Balance Seed Scheduling via Monte Carlo Planning}, 
  year={2023},
  volume={},
  number={},
  pages={1-15},
  doi={10.1109/TDSC.2023.3285293}}

6. License

BeliefFuzz is under Apache License.

belieffuzz's Issues

Request for Source Code and Assistance with Reproduction

We are focusing on your recent work and have been attempting to reproduce the reported results. However, we have encountered challenges when using the provided binary program, and we need your help to obtain the corresponding source code.

We noticed that you compiled afl-clang-fast using clang-6.0, but the benchmark you provided was compiled under clang-10. Therefore, we attempted to compile using clang-6.0, but ultimately we were unable to perform fuzz testing with the afl-fuzz you provided. We will demonstrate the specific error messages and trigger situations using the code and screenshots below.

Therefore, we would appreciate it if you could provide detailed information about the compilation to assist us in conducting our experiments. If it's convenient, providing the source code for replication would be even better.

export EDGE_POTENTIAL_PATH="abs_path"
export BELIEFFUZZ_CFLAGS="-res=$EDGE_POTENTIAL_PATH"
export BELIEFFUZZ_PATH="abs_path"

git clone https://github.com/axiomatic-systems/Bento4.git
cd Bento4
cmake -S . -B ./Build -DCMAKE_C_FLAGS="$BELIEFFUZZ_CFLAGS" -DCMAKE_C_COMPILER="$BELIEFFUZZ_PATH/afl-clang-fast" -DCMAKE_CXX_FLAGS="$BELIEFFUZZ_CFLAGS" -DCMAKE_CXX_COMPILER="$BELIEFFUZZ_PATH/afl-clang-fast++"
cmake --build Build
cd ../
$BELIEFFUZZ_PATH/afl-fuzz -m none -p -r -d -c $EDGE_POTENTIAL_PATH/edge_potential.txt -i fuzz_in -o fuzz_out_$(date +%m%d%H%M) -- ./Bento4/Build/mp4info --show-layout --show-samples --show-sample-data @@