6 ms·
A team at Imperial is working on KLEE[http://klee.github.io/ http://klee.github.io/], using symbolic execution to find bugs, with some nice results. It would be
by xixixao 12y ago
A team at Imperial is working on KLEE[http://klee.github.io/ http://klee.github.io/], using symbolic execution to find bugs, with some nice results. It would be great to compare the two techniques on the same software and see the trade-off between speed and completeness.
- pascal_cuoq 12y ago“The fuzzing project” is not a fuzzing technique. It uses existing fuzzers out of the box. See “What fuzzing tools are there?”, the FIRST question in the FAQ at https://fuzzing-project.org/faq.html https://fuzzing-project.org/faq.html I am sure the project wouldn't have anything against using KLEE, as long as KLEE is able to pull its own weight and to justify the time it takes to set it up with unique bugs that simpler fuzzers do not find. Perhaps you mean to compare KLEE and afl. That suggestion would be more appropriate if the submitted article was http://lcamtuf.coredump.cx/afl/related_work.txt http://lcamtuf.coredump.cx/afl/related_work.txt (but even so, that URL in itself already explains a lot about the design goals of afl and what makes it different from the existing fuzzers, KLEE included).
- johnbender 12y agoI was wondering if concolic execution [1] isn't more popular for this type of thing due to the difficulty in setting up the tools or relative newness compared to randomly generating inputs? 1. http://en.wikipedia.org/wiki/Concolic_testing http://en.wikipedia.org/wiki/Concolic_testing