4 ms·
I think we need fuzzers for more uses than file formats, like method fuzzing and in that case garbage data just doesn't work.
by planetis 4y ago
I think we need fuzzers for more uses than file formats, like method fuzzing and in that case garbage data just doesn't work.
- cjbprime 4y agoThis is also a testable claim! File formats and RPC do not seem that dissimilar to me, especially when using a fuzzer like aflplusplus, which will automatically build a symbol dictionary by pulling strings out of the binary, and perform some light symbolic transformation (laf-intel and cmplog), see https://lafintel.wordpress.com/2016/08/15/circumventing-fuzzing-roadblocks-with-compiler-transformations/ https://lafintel.wordpress.com/2016/08/15/circumventing-fuzz...
- planetis 4y agoIt's just sound weird to me because depending of who you ask, they will tell you generator fuzzers work the best. However defining what's a good benchmark and what to measure other than code coverage is even more complicated. But I guess we are talking about google they might have figured it out.
- cjbprime 4y agoYes, that's why I described the empirical results as surprising.