Ask HN: What is the emerging state of the art in fuzzing techniques?
I worked on the cyber reasoning system (CRS) at Trail of Bits for our entry into the Cyber Grand Challenge [1]. Some slides describing the system are here [2].<p>Specifically, I implemented our fuzzer. I created a dynamic binary translator [3]  that emulated the DECREE [4] operating system and x86 arhcitecture. It had the Radamsa [5] mutator built-in, along with a number of other simpler mutators.<p>I think our fuzzer out-performed our competitors, though I am biased ;-) The fuzzer was single-threaded, but could perform more than a million fuzz&#x2F;mutate-execute (with coverage) iterations every two hours. Before I optimized it, it beat the pants off PIN [6]. We ran many such fuzzer processes concurrently. They would saturate the CPUs, and actually performed no I&#x2F;O because I emulated all I&#x2F;O in memory ;-) This was key to us achieving such high-throughput.<p>Our fuzzer wasn&#x27;t super smart (though Radamsa is), but it benefited a lot from a feedback loop with our symbolic executors [7]. The symbolic executors would produce inputs that would then get fuzzed. These inputs could feed back into the symbolic executors, etc. That added more brains to our system.<p>All in all, we ran the CRS across something like 300 large EC2 nodes (across three availability zones). Per node, 8 or so fuzzers processes were running constantly for 24 hours. I&#x27;d ballpark that as 28.8 billion mutate+execute cycles.<p>In conclusion, the key for us was to make a production-quality, high-throughput fuzzer that did only one thing really well and really fast, then complement it with other more sophisticated tools like symbolic executors.<p>[1] <a href="https:&#x2F;&#x2F;blog.trailofbits.com&#x2F;2015&#x2F;07&#x2F;15&#x2F;how-we-fared-in-the-cyber-grand-challenge&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.trailofbits.com&#x2F;2015&#x2F;07&#x2F;15&#x2F;how-we-fared-in-the-...</a>
[2] <a href="http:&#x2F;&#x2F;infiltratecon.com&#x2F;archives&#x2F;Slides_Artem_Dinaburg.pdf" rel="nofollow">http:&#x2F;&#x2F;infiltratecon.com&#x2F;archives&#x2F;Slides_Artem_Dinaburg.pdf</a>
[3] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Binary_translation" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Binary_translation</a>
[4] <a href="https:&#x2F;&#x2F;github.com&#x2F;CyberGrandChallenge&#x2F;libcgc" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;CyberGrandChallenge&#x2F;libcgc</a>
[5] <a href="https:&#x2F;&#x2F;github.com&#x2F;aoh&#x2F;radamsa" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;aoh&#x2F;radamsa</a>
[6] <a href="https:&#x2F;&#x2F;software.intel.com&#x2F;en-us&#x2F;articles&#x2F;pin-a-dynamic-binary-instrumentation-tool" rel="nofollow">https:&#x2F;&#x2F;software.intel.com&#x2F;en-us&#x2F;articles&#x2F;pin-a-dynamic-bina...</a>
[7] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Symbolic_execution" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Symbolic_execution</a>